avoid fatal error

Co-authored-by: Your Name <brendan.ngo@okendo.io>
Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>

.github/package.json

@@ -1,7 +1,7 @@
 {
   "scripts": {
-    "format": "prettier --check .",
-    "format:fix": "prettier --write ."
+    "format": "prettier --cache --check .",
+    "format:fix": "prettier --cache --write --list-different ."
   },
   "devDependencies": {
     "prettier": "^3.7.4"

.github/workflows/check-openapi.yml

@@ -24,8 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Check for breaking API changes
-        # sha is pinning to a commit instead of a tag since the action does not tag versions
-        uses: oasdiff/oasdiff-action/breaking@ccb863950ce437a50f8f1a40d2a1112117e06ce4
+        uses: oasdiff/oasdiff-action/breaking@65fef71494258f00f911d7a71edb0482c5378899 # v0.0.30
         with:
           base: https://raw.githubusercontent.com/${{ github.repository }}/main/open-api/immich-openapi-specs.json
           revision: open-api/immich-openapi-specs.json

.github/workflows/codeql-analysis.yml

@@ -57,7 +57,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -70,7 +70,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/autobuild@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -83,6 +83,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
+        uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/docker.yml

@@ -131,7 +131,7 @@ jobs:
           - device: rocm
             suffixes: '-rocm'
             platforms: linux/amd64
-            runner-mapping: '{"linux/amd64": "pokedex-giant"}'
+            runner-mapping: '{"linux/amd64": "pokedex-large"}'
     uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@bd49ed7a5a6022149f79b6564df48177476a822b # multi-runner-build-workflow-v2.2.1
     permissions:
       contents: read

.github/workflows/release-pr.yml

@@ -1,170 +0,0 @@
-name: Manage release PR
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  bump:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
-        with:
-          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
-          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-          persist-credentials: true
-          ref: main
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
-
-      - name: Setup Node
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version-file: './server/.nvmrc'
-          cache: 'pnpm'
-          cache-dependency-path: '**/pnpm-lock.yaml'
-
-      - name: Determine release type
-        id: bump-type
-        uses: ietf-tools/semver-action@c90370b2958652d71c06a3484129a4d423a6d8a8 # v1.11.0
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-
-      - name: Bump versions
-        env:
-          TYPE: ${{ steps.bump-type.outputs.bump }}
-        run: |
-          if [ "$TYPE" == "none" ]; then
-            exit 1 # TODO: Is there a cleaner way to abort the workflow?
-          fi
-          misc/release/pump-version.sh -s $TYPE -m true
-
-      - name: Manage Outline release document
-        id: outline
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          OUTLINE_API_KEY: ${{ secrets.OUTLINE_API_KEY }}
-          NEXT_VERSION: ${{ steps.bump-type.outputs.next }}
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            const fs = require('fs');
-
-            const outlineKey = process.env.OUTLINE_API_KEY;
-            const parentDocumentId = 'da856355-0844-43df-bd71-f8edce5382d9'
-            const collectionId = 'e2910656-714c-4871-8721-447d9353bd73';
-            const baseUrl = 'https://outline.immich.cloud';
-
-            const listResponse = await fetch(`${baseUrl}/api/documents.list`, {
-              method: 'POST',
-              headers: {
-                'Authorization': `Bearer ${outlineKey}`,
-                'Content-Type': 'application/json'
-              },
-              body: JSON.stringify({ parentDocumentId })
-            });
-
-            if (!listResponse.ok) {
-              throw new Error(`Outline list failed: ${listResponse.statusText}`);
-            }
-
-            const listData = await listResponse.json();
-            const allDocuments = listData.data || [];
-
-            const document = allDocuments.find(doc => doc.title === 'next');
-
-            let documentId;
-            let documentUrl;
-            let documentText;
-
-            if (!document) {
-              // Create new document
-              console.log('No existing document found. Creating new one...');
-              const notesTmpl = fs.readFileSync('misc/release/notes.tmpl', 'utf8');
-              const createResponse = await fetch(`${baseUrl}/api/documents.create`, {
-                method: 'POST',
-                headers: {
-                  'Authorization': `Bearer ${outlineKey}`,
-                  'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({
-                  title: 'next',
-                  text: notesTmpl,
-                  collectionId: collectionId,
-                  parentDocumentId: parentDocumentId,
-                  publish: true
-                })
-              });
-
-              if (!createResponse.ok) {
-                throw new Error(`Failed to create document: ${createResponse.statusText}`);
-              }
-
-              const createData = await createResponse.json();
-              documentId = createData.data.id;
-              const urlId = createData.data.urlId;
-              documentUrl = `${baseUrl}/doc/next-${urlId}`;
-              documentText = createData.data.text || '';
-              console.log(`Created new document: ${documentUrl}`);
-            } else {
-              documentId = document.id;
-              const docPath = document.url;
-              documentUrl = `${baseUrl}${docPath}`;
-              documentText = document.text || '';
-              console.log(`Found existing document: ${documentUrl}`);
-            }
-
-            // Generate GitHub release notes
-            console.log('Generating GitHub release notes...');
-            const releaseNotesResponse = await github.rest.repos.generateReleaseNotes({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              tag_name: `${process.env.NEXT_VERSION}`,
-            });
-
-            // Combine the content
-            const changelog = `
-            # ${process.env.NEXT_VERSION}
-
-            ${documentText}
-
-            ${releaseNotesResponse.data.body}
-
-            ---
-
-            `
-
-            const existingChangelog = fs.existsSync('CHANGELOG.md') ? fs.readFileSync('CHANGELOG.md', 'utf8') : '';
-            fs.writeFileSync('CHANGELOG.md', changelog + existingChangelog, 'utf8');
-
-            core.setOutput('document_url', documentUrl);
-
-      - name: Create PR
-        id: create-pr
-        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-          commit-message: 'chore: release ${{ steps.bump-type.outputs.next }}'
-          title: 'chore: release ${{ steps.bump-type.outputs.next }}'
-          body: 'Release notes: ${{ steps.outline.outputs.document_url }}'
-          labels: 'changelog:skip'
-          branch: 'release/next'
-          draft: true

.vscode/extensions.json

@@ -5,6 +5,13 @@
     "dbaeumer.vscode-eslint",
     "dart-code.flutter",
     "dart-code.dart-code",
-    "dcmdev.dcm-vscode-extension"
+    "dcmdev.dcm-vscode-extension",
+    "bradlc.vscode-tailwindcss",
+    "ms-playwright.playwright",
+    "vitest.explorer",
+    "editorconfig.editorconfig",
+    "foxundermoon.shell-format",
+    "timonwong.shellcheck",
+    "bluebrown.yamlfmt"
   ]
 }

.vscode/settings.json

@@ -1,8 +1,7 @@
 {
   "[css]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
+    "editor.formatOnSave": true
   },
   "[dart]": {
     "editor.defaultFormatter": "Dart-Code.dart-code",
@@ -19,18 +18,15 @@
       "source.removeUnusedImports": "explicit"
     },
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
+    "editor.formatOnSave": true
   },
   "[json]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
+    "editor.formatOnSave": true
   },
   "[jsonc]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
+    "editor.formatOnSave": true
   },
   "[svelte]": {
     "editor.codeActionsOnSave": {
@@ -38,8 +34,7 @@
       "source.removeUnusedImports": "explicit"
     },
     "editor.defaultFormatter": "svelte.svelte-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
+    "editor.formatOnSave": true
   },
   "[typescript]": {
     "editor.codeActionsOnSave": {
@@ -47,18 +42,45 @@
       "source.removeUnusedImports": "explicit"
     },
     "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true,
-    "editor.tabSize": 2
+    "editor.formatOnSave": true
   },
   "cSpell.words": ["immich"],
+  "css.lint.unknownAtRules": "ignore",
+  "editor.bracketPairColorization.enabled": true,
   "editor.formatOnSave": true,
+  "eslint.useFlatConfig": true,
   "eslint.validate": ["javascript", "typescript", "svelte"],
+  "eslint.workingDirectories": [
+    { "directory": "cli", "changeProcessCWD": true },
+    { "directory": "e2e", "changeProcessCWD": true },
+    { "directory": "server", "changeProcessCWD": true },
+    { "directory": "web", "changeProcessCWD": true }
+  ],
+  "files.watcherExclude": {
+    "**/.jj/**": true,
+    "**/.git/**": true,
+    "**/node_modules/**": true,
+    "**/build/**": true,
+    "**/dist/**": true,
+    "**/.svelte-kit/**": true
+  },
   "explorer.fileNesting.enabled": true,
   "explorer.fileNesting.patterns": {
     "*.dart": "${capture}.g.dart,${capture}.gr.dart,${capture}.drift.dart",
     "*.ts": "${capture}.spec.ts,${capture}.mock.ts",
     "package.json": "package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb, bun.lock, pnpm-workspace.yaml, .pnpmfile.cjs"
   },
+  "search.exclude": {
+    "**/node_modules": true,
+    "**/build": true,
+    "**/dist": true,
+    "**/.svelte-kit": true,
+    "**/open-api/typescript-sdk/src": true
+  },
   "svelte.enable-ts-plugin": true,
-  "typescript.preferences.importModuleSpecifier": "non-relative"
+  "tailwindCSS.experimental.configFile": {
+    "web/src/app.css": "web/src/**"
+  },
+  "js/ts.preferences.importModuleSpecifier": "non-relative",
+  "vitest.maximumConfigs": 10
 }

CONTRIBUTING.md

@@ -15,6 +15,8 @@ Please try to keep pull requests as focused as possible. A PR should do exactly
 
 If you are looking for something to work on, there are discussions and issues with a `good-first-issue` label on them. These are always a good starting point. If none of them sound interesting or fit your skill set, feel free to reach out on our Discord. We're happy to help you find something to work on!
 
+We usually do not assign issues to new contributors, since it happens often that a PR is never even opened. Again, reach out on Discord if you fear putting a lot of time into fixing an issue, but ending up with a duplicate PR.
+
 ## Use of generative AI
 
 We ask you not to open PRs generated with an LLM. We find that code generated like this tends to need a large amount of back-and-forth, which is a very inefficient use of our time. If we want LLM-generated code, it's much faster for us to use an LLM ourselves than to go through an intermediary via a pull request.

cli/package.json

@@ -20,8 +20,8 @@
     "@types/lodash-es": "^4.17.12",
     "@types/micromatch": "^4.0.9",
     "@types/mock-fs": "^4.13.1",
-    "@types/node": "^24.10.13",
-    "@vitest/coverage-v8": "^3.0.0",
+    "@types/node": "^24.11.0",
+    "@vitest/coverage-v8": "^4.0.0",
     "byte-size": "^9.0.0",
     "cli-progress": "^3.12.0",
     "commander": "^12.0.0",
@@ -37,7 +37,7 @@
     "typescript-eslint": "^8.28.0",
     "vite": "^7.0.0",
     "vite-tsconfig-paths": "^6.0.0",
-    "vitest": "^3.0.0",
+    "vitest": "^4.0.0",
     "vitest-fetch-mock": "^0.4.0",
     "yaml": "^2.3.1"
   },
@@ -49,8 +49,8 @@
     "prepack": "pnpm run build",
     "test": "vitest",
     "test:cov": "vitest --coverage",
-    "format": "prettier --check .",
-    "format:fix": "prettier --write .",
+    "format": "prettier --cache --check .",
+    "format:fix": "prettier --cache --write --list-different .",
     "check": "tsc --noEmit"
   },
   "repository": {

cli/src/commands/asset.spec.ts

@@ -1,6 +1,6 @@
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { describe, expect, it, MockedFunction, vi } from 'vitest';
 
@@ -58,7 +58,7 @@ describe('uploadFiles', () => {
   });
 
   it('returns new assets when upload file is successful', async () => {
-    fetchMocker.doMockIf(new RegExp(`${baseUrl}/assets$`), () => {
+    fetchMocker.doMockIf(new RegExp(`${baseUrl}/assets$`), function () {
       return {
         status: 200,
         body: JSON.stringify({ id: 'fc5621b1-86f6-44a1-9905-403e607df9f5', status: 'created' }),
@@ -75,7 +75,7 @@ describe('uploadFiles', () => {
 
   it('returns new assets when upload file retry is successful', async () => {
     let counter = 0;
-    fetchMocker.doMockIf(new RegExp(`${baseUrl}/assets$`), () => {
+    fetchMocker.doMockIf(new RegExp(`${baseUrl}/assets$`), function () {
       counter++;
       if (counter < retry) {
         throw new Error('Network error');
@@ -96,7 +96,7 @@ describe('uploadFiles', () => {
   });
 
   it('returns new assets when upload file retry is failed', async () => {
-    fetchMocker.doMockIf(new RegExp(`${baseUrl}/assets$`), () => {
+    fetchMocker.doMockIf(new RegExp(`${baseUrl}/assets$`), function () {
       throw new Error('Network error');
     });
 
@@ -236,16 +236,19 @@ describe('startWatch', () => {
     await sleep(100); // to debounce the watcher from considering the test file as a existing file
     await fs.promises.writeFile(testFilePath, 'testjpg');
 
-    await vi.waitUntil(() => checkBulkUploadMocked.mock.calls.length > 0, 3000);
-    expect(checkBulkUpload).toHaveBeenCalledWith({
-      assetBulkUploadCheckDto: {
-        assets: [
-          expect.objectContaining({
-            id: testFilePath,
-          }),
-        ],
-      },
-    });
+    await vi.waitFor(
+      () =>
+        expect(checkBulkUpload).toHaveBeenCalledWith({
+          assetBulkUploadCheckDto: {
+            assets: [
+              expect.objectContaining({
+                id: testFilePath,
+              }),
+            ],
+          },
+        }),
+      { timeout: 5000 },
+    );
   });
 
   it('should filter out unsupported files', async () => {
@@ -257,16 +260,19 @@ describe('startWatch', () => {
     await fs.promises.writeFile(testFilePath, 'testjpg');
     await fs.promises.writeFile(unsupportedFilePath, 'testtxt');
 
-    await vi.waitUntil(() => checkBulkUploadMocked.mock.calls.length > 0, 3000);
-    expect(checkBulkUpload).toHaveBeenCalledWith({
-      assetBulkUploadCheckDto: {
-        assets: expect.arrayContaining([
-          expect.objectContaining({
-            id: testFilePath,
-          }),
-        ]),
-      },
-    });
+    await vi.waitFor(
+      () =>
+        expect(checkBulkUpload).toHaveBeenCalledWith({
+          assetBulkUploadCheckDto: {
+            assets: expect.arrayContaining([
+              expect.objectContaining({
+                id: testFilePath,
+              }),
+            ]),
+          },
+        }),
+      { timeout: 5000 },
+    );
 
     expect(checkBulkUpload).not.toHaveBeenCalledWith({
       assetBulkUploadCheckDto: {
@@ -291,16 +297,19 @@ describe('startWatch', () => {
     await fs.promises.writeFile(testFilePath, 'testjpg');
     await fs.promises.writeFile(ignoredFilePath, 'ignoredjpg');
 
-    await vi.waitUntil(() => checkBulkUploadMocked.mock.calls.length > 0, 3000);
-    expect(checkBulkUpload).toHaveBeenCalledWith({
-      assetBulkUploadCheckDto: {
-        assets: expect.arrayContaining([
-          expect.objectContaining({
-            id: testFilePath,
-          }),
-        ]),
-      },
-    });
+    await vi.waitFor(
+      () =>
+        expect(checkBulkUpload).toHaveBeenCalledWith({
+          assetBulkUploadCheckDto: {
+            assets: expect.arrayContaining([
+              expect.objectContaining({
+                id: testFilePath,
+              }),
+            ]),
+          },
+        }),
+      { timeout: 5000 },
+    );
 
     expect(checkBulkUpload).not.toHaveBeenCalledWith({
       assetBulkUploadCheckDto: {

cli/vite.config.ts

@@ -1,4 +1,4 @@
-import { defineConfig } from 'vite';
+import { defineConfig, UserConfig } from 'vite';
 import tsconfigPaths from 'vite-tsconfig-paths';
 
 export default defineConfig({
@@ -17,4 +17,8 @@ export default defineConfig({
     noExternal: /^(?!node:).*$/,
   },
   plugins: [tsconfigPaths()],
-});
+  test: {
+    name: 'cli:unit',
+    globals: true,
+  },
+} as UserConfig);

cli/vitest.config.ts

@@ -1,7 +0,0 @@
-import { defineConfig } from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    globals: true,
-  },
-});

deployment/mise.toml

@@ -1,6 +1,6 @@
 [tools]
-terragrunt = "0.98.0"
-opentofu = "1.11.4"
+terragrunt = "0.99.4"
+opentofu = "1.11.5"
 
 [tasks."tg:fmt"]
 run = "terragrunt hclfmt"

docker/docker-compose.dev.yml

@@ -155,7 +155,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:930b41430fb727f533c5982fe509b6f04233e26d0f7354e04de4b0d5c706e44e
+    image: docker.io/valkey/valkey:9@sha256:3eeb09785cd61ec8e3be35f8804c8892080f3ca21934d628abc24ee4ed1698f6
     healthcheck:
       test: redis-cli ping || exit 1
 

docker/docker-compose.prod.yml

@@ -56,7 +56,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:930b41430fb727f533c5982fe509b6f04233e26d0f7354e04de4b0d5c706e44e
+    image: docker.io/valkey/valkey:9@sha256:3eeb09785cd61ec8e3be35f8804c8892080f3ca21934d628abc24ee4ed1698f6
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
@@ -85,7 +85,7 @@ services:
     container_name: immich_prometheus
     ports:
       - 9090:9090
-    image: prom/prometheus@sha256:1f0f50f06acaceb0f5670d2c8a658a599affe7b0d8e78b898c1035653849a702
+    image: prom/prometheus@sha256:4a61322ac1103a0e3aea2a61ef1718422a48fa046441f299d71e660a3bc71ae9
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
       - prometheus-data:/prometheus

docker/docker-compose.rootless.yml

@@ -61,7 +61,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:930b41430fb727f533c5982fe509b6f04233e26d0f7354e04de4b0d5c706e44e
+    image: docker.io/valkey/valkey:9@sha256:3eeb09785cd61ec8e3be35f8804c8892080f3ca21934d628abc24ee4ed1698f6
     user: '1000:1000'
     security_opt:
       - no-new-privileges:true

docker/docker-compose.yml

@@ -49,7 +49,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:9@sha256:930b41430fb727f533c5982fe509b6f04233e26d0f7354e04de4b0d5c706e44e
+    image: docker.io/valkey/valkey:9@sha256:3eeb09785cd61ec8e3be35f8804c8892080f3ca21934d628abc24ee4ed1698f6
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always

docs/docs/administration/jobs-workers.md

@@ -67,7 +67,8 @@ graph TD
     C --> D["Thumbnail Generation (Large, small, blurred and person)"]
     D --> E[Smart Search]
     D --> F[Face Detection]
-    D --> G[Video Transcoding]
-    E --> H[Duplicate Detection]
-    F --> I[Facial Recognition]
+    D --> G[OCR]
+    D --> H[Video Transcoding]
+    E --> I[Duplicate Detection]
+    F --> J[Facial Recognition]
 ```

docs/docs/administration/system-settings.md

@@ -230,7 +230,7 @@ The default value is `ultrafast`.
 
 ### Audio codec (`ffmpeg.targetAudioCodec`) {#ffmpeg.targetAudioCodec}
 
-Which audio codec to use when the audio stream is being transcoded. Can be one of `mp3`, `aac`, `libopus`.
+Which audio codec to use when the audio stream is being transcoded. Can be one of `mp3`, `aac`, `opus`.
 
 The default value is `aac`.
 

docs/docs/install/config-file.md

@@ -27,7 +27,7 @@ The default configuration looks like this:
   "ffmpeg": {
     "accel": "disabled",
     "accelDecode": false,
-    "acceptedAudioCodecs": ["aac", "mp3", "libopus"],
+    "acceptedAudioCodecs": ["aac", "mp3", "opus"],
     "acceptedContainers": ["mov", "ogg", "webm"],
     "acceptedVideoCodecs": ["h264"],
     "bframes": -1,

docs/docs/install/environment-variables.md

@@ -166,6 +166,8 @@ Redis (Sentinel) URL example JSON before encoding:
 | `MACHINE_LEARNING_PRELOAD__CLIP__VISUAL`                    | Comma-separated list of (visual) CLIP model(s) to preload and cache                                                                                          |                                 | machine learning |
 | `MACHINE_LEARNING_PRELOAD__FACIAL_RECOGNITION__RECOGNITION` | Comma-separated list of (recognition) facial recognition model(s) to preload and cache                                                                       |                                 | machine learning |
 | `MACHINE_LEARNING_PRELOAD__FACIAL_RECOGNITION__DETECTION`   | Comma-separated list of (detection) facial recognition model(s) to preload and cache                                                                         |                                 | machine learning |
+| `MACHINE_LEARNING_PRELOAD__OCR__RECOGNITION`                | Comma-separated list of (recognition) OCR model(s) to preload and cache                                                                                      |                                 | machine learning |
+| `MACHINE_LEARNING_PRELOAD__OCR__DETECTION`                  | Comma-separated list of (detection) OCR model(s) to preload and cache                                                                                        |                                 | machine learning |
 | `MACHINE_LEARNING_ANN`                                      | Enable ARM-NN hardware acceleration if supported                                                                                                             |             `True`              | machine learning |
 | `MACHINE_LEARNING_ANN_FP16_TURBO`                           | Execute operations in FP16 precision: increasing speed, reducing precision (applies only to ARM-NN)                                                          |             `False`             | machine learning |
 | `MACHINE_LEARNING_ANN_TUNING_LEVEL`                         | ARM-NN GPU tuning level (1: rapid, 2: normal, 3: exhaustive)                                                                                                 |               `2`               | machine learning |

docs/package.json

@@ -4,8 +4,8 @@
   "private": true,
   "scripts": {
     "docusaurus": "docusaurus",
-    "format": "prettier --check .",
-    "format:fix": "prettier --write .",
+    "format": "prettier --cache --check .",
+    "format:fix": "prettier --cache --write --list-different .",
     "start": "docusaurus start --port 3005",
     "copy:openapi": "jq -c < ../open-api/immich-openapi-specs.json > ./static/openapi.json || exit 0",
     "build": "pnpm run copy:openapi && docusaurus build",

e2e/docker-compose.yml

@@ -44,7 +44,7 @@ services:
 
   redis:
     container_name: immich-e2e-redis
-    image: docker.io/valkey/valkey:9@sha256:930b41430fb727f533c5982fe509b6f04233e26d0f7354e04de4b0d5c706e44e
+    image: docker.io/valkey/valkey:9@sha256:3eeb09785cd61ec8e3be35f8804c8892080f3ca21934d628abc24ee4ed1698f6
     healthcheck:
       test: redis-cli ping || exit 1
 

e2e/package.json

@@ -14,8 +14,8 @@
     "start:web": "pnpm exec playwright test --ui --project=web",
     "start:web:maintenance": "pnpm exec playwright test --ui --project=maintenance",
     "start:web:ui": "pnpm exec playwright test --ui --project=ui",
-    "format": "prettier --check .",
-    "format:fix": "prettier --write .",
+    "format": "prettier --cache --check .",
+    "format:fix": "prettier --cache --write --list-different .",
     "lint": "eslint \"src/**/*.ts\" --max-warnings 0",
     "lint:fix": "pnpm run lint --fix",
     "check": "tsc --noEmit"
@@ -27,12 +27,12 @@
     "@eslint/js": "^10.0.0",
     "@faker-js/faker": "^10.1.0",
     "@immich/cli": "workspace:*",
-    "@immich/e2e-auth-server":  "workspace:*",
+    "@immich/e2e-auth-server": "workspace:*",
     "@immich/sdk": "workspace:*",
     "@playwright/test": "^1.44.1",
     "@socket.io/component-emitter": "^3.1.2",
     "@types/luxon": "^3.4.2",
-    "@types/node": "^24.10.13",
+    "@types/node": "^24.11.0",
     "@types/pg": "^8.15.1",
     "@types/pngjs": "^6.0.4",
     "@types/supertest": "^6.0.2",
@@ -54,7 +54,8 @@
     "typescript": "^5.3.3",
     "typescript-eslint": "^8.28.0",
     "utimes": "^5.2.1",
-    "vitest": "^3.0.0"
+    "vite-tsconfig-paths": "^6.1.1",
+    "vitest": "^4.0.0"
   },
   "volta": {
     "node": "24.13.1"

e2e/src/specs/web/asset-viewer/stack.e2e-spec.ts

@@ -1,66 +0,0 @@
-import { AssetMediaResponseDto, LoginResponseDto } from '@immich/sdk';
-import { expect, Page, test } from '@playwright/test';
-import { utils } from 'src/utils';
-
-async function ensureDetailPanelVisible(page: Page) {
-  await page.waitForSelector('#immich-asset-viewer');
-
-  const isVisible = await page.locator('#detail-panel').isVisible();
-  if (!isVisible) {
-    await page.keyboard.press('i');
-    await page.waitForSelector('#detail-panel');
-  }
-}
-
-test.describe('Asset Viewer stack', () => {
-  let admin: LoginResponseDto;
-  let assetOne: AssetMediaResponseDto;
-  let assetTwo: AssetMediaResponseDto;
-
-  test.beforeAll(async () => {
-    utils.initSdk();
-    await utils.resetDatabase();
-    admin = await utils.adminSetup();
-    await utils.updateMyPreferences(admin.accessToken, { tags: { enabled: true } });
-
-    assetOne = await utils.createAsset(admin.accessToken);
-    assetTwo = await utils.createAsset(admin.accessToken);
-    await utils.createStack(admin.accessToken, [assetOne.id, assetTwo.id]);
-
-    const tags = await utils.upsertTags(admin.accessToken, ['test/1', 'test/2']);
-    const tagOne = tags.find((tag) => tag.value === 'test/1')!;
-    const tagTwo = tags.find((tag) => tag.value === 'test/2')!;
-    await utils.tagAssets(admin.accessToken, tagOne.id, [assetOne.id]);
-    await utils.tagAssets(admin.accessToken, tagTwo.id, [assetTwo.id]);
-  });
-
-  test('stack slideshow is visible', async ({ page, context }) => {
-    await utils.setAuthCookies(context, admin.accessToken);
-    await page.goto(`/photos/${assetOne.id}`);
-
-    const stackAssets = page.locator('#stack-slideshow [data-asset]');
-    await expect(stackAssets.first()).toBeVisible();
-    await expect(stackAssets.nth(1)).toBeVisible();
-  });
-
-  test('tags of primary asset are visible', async ({ page, context }) => {
-    await utils.setAuthCookies(context, admin.accessToken);
-    await page.goto(`/photos/${assetOne.id}`);
-    await ensureDetailPanelVisible(page);
-
-    const tags = page.getByTestId('detail-panel-tags').getByRole('link');
-    await expect(tags.first()).toHaveText('test/1');
-  });
-
-  test('tags of second asset are visible', async ({ page, context }) => {
-    await utils.setAuthCookies(context, admin.accessToken);
-    await page.goto(`/photos/${assetOne.id}`);
-    await ensureDetailPanelVisible(page);
-
-    const stackAssets = page.locator('#stack-slideshow [data-asset]');
-    await stackAssets.nth(1).click();
-
-    const tags = page.getByTestId('detail-panel-tags').getByRole('link');
-    await expect(tags.first()).toHaveText('test/2');
-  });
-});

e2e/src/specs/web/photo-viewer.e2e-spec.ts

@@ -1,14 +1,13 @@
 import { AssetMediaResponseDto, LoginResponseDto } from '@immich/sdk';
-import { Page, expect, test } from '@playwright/test';
+import { expect, test } from '@playwright/test';
+import type { Socket } from 'socket.io-client';
 import { utils } from 'src/utils';
 
-function imageLocator(page: Page) {
-  return page.getByAltText('Image taken').locator('visible=true');
-}
 test.describe('Photo Viewer', () => {
   let admin: LoginResponseDto;
   let asset: AssetMediaResponseDto;
   let rawAsset: AssetMediaResponseDto;
+  let websocket: Socket;
 
   test.beforeAll(async () => {
     utils.initSdk();
@@ -16,6 +15,11 @@ test.describe('Photo Viewer', () => {
     admin = await utils.adminSetup();
     asset = await utils.createAsset(admin.accessToken);
     rawAsset = await utils.createAsset(admin.accessToken, { assetData: { filename: 'test.arw' } });
+    websocket = await utils.connectWebsocket(admin.accessToken);
+  });
+
+  test.afterAll(() => {
+    utils.disconnectWebsocket(websocket);
   });
 
   test.beforeEach(async ({ context, page }) => {
@@ -26,31 +30,51 @@ test.describe('Photo Viewer', () => {
 
   test('loads original photo when zoomed', async ({ page }) => {
     await page.goto(`/photos/${asset.id}`);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
-    const box = await imageLocator(page).boundingBox();
-    expect(box).toBeTruthy();
-    const { x, y, width, height } = box!;
-    await page.mouse.move(x + width / 2, y + height / 2);
+
+    const preview = page.getByTestId('preview').filter({ visible: true });
+    await expect(preview).toHaveAttribute('src', /.+/);
+
+    const originalResponse = page.waitForResponse((response) => response.url().includes('/original'));
+
+    const { width, height } = page.viewportSize()!;
+    await page.mouse.move(width / 2, height / 2);
     await page.mouse.wheel(0, -1);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('original');
+
+    await originalResponse;
+
+    const original = page.getByTestId('original').filter({ visible: true });
+    await expect(original).toHaveAttribute('src', /original/);
   });
 
   test('loads fullsize image when zoomed and original is web-incompatible', async ({ page }) => {
     await page.goto(`/photos/${rawAsset.id}`);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
-    const box = await imageLocator(page).boundingBox();
-    expect(box).toBeTruthy();
-    const { x, y, width, height } = box!;
-    await page.mouse.move(x + width / 2, y + height / 2);
+
+    const preview = page.getByTestId('preview').filter({ visible: true });
+    await expect(preview).toHaveAttribute('src', /.+/);
+
+    const fullsizeResponse = page.waitForResponse((response) => response.url().includes('fullsize'));
+
+    const { width, height } = page.viewportSize()!;
+    await page.mouse.move(width / 2, height / 2);
     await page.mouse.wheel(0, -1);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('fullsize');
+
+    await fullsizeResponse;
+
+    const original = page.getByTestId('original').filter({ visible: true });
+    await expect(original).toHaveAttribute('src', /fullsize/);
   });
 
   test('reloads photo when checksum changes', async ({ page }) => {
     await page.goto(`/photos/${asset.id}`);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).toContain('thumbnail');
-    const initialSrc = await imageLocator(page).getAttribute('src');
+
+    const preview = page.getByTestId('preview').filter({ visible: true });
+    await expect(preview).toHaveAttribute('src', /.+/);
+    const initialSrc = await preview.getAttribute('src');
+
+    const websocketEvent = utils.waitForWebsocketEvent({ event: 'assetUpdate', id: asset.id });
     await utils.replaceAsset(admin.accessToken, asset.id);
-    await expect.poll(async () => await imageLocator(page).getAttribute('src')).not.toBe(initialSrc);
+    await websocketEvent;
+
+    await expect(preview).not.toHaveAttribute('src', initialSrc!);
   });
 });

e2e/src/ui/mock-network/broken-asset-network.ts

@@ -0,0 +1,167 @@
+import { faker } from '@faker-js/faker';
+import { AssetTypeEnum, AssetVisibility, type AssetResponseDto, type StackResponseDto } from '@immich/sdk';
+import { BrowserContext } from '@playwright/test';
+import { randomPreview, randomThumbnail } from 'src/ui/generators/timeline';
+
+export type MockStack = {
+  id: string;
+  primaryAssetId: string;
+  assets: AssetResponseDto[];
+  brokenAssetIds: Set<string>;
+  assetMap: Map<string, AssetResponseDto>;
+};
+
+export const createMockStackAsset = (ownerId: string): AssetResponseDto => {
+  const assetId = faker.string.uuid();
+  const now = new Date().toISOString();
+  return {
+    id: assetId,
+    deviceAssetId: `device-${assetId}`,
+    ownerId,
+    owner: {
+      id: ownerId,
+      email: 'admin@immich.cloud',
+      name: 'Admin',
+      profileImagePath: '',
+      profileChangedAt: now,
+      avatarColor: 'blue' as never,
+    },
+    libraryId: `library-${ownerId}`,
+    deviceId: `device-${ownerId}`,
+    type: AssetTypeEnum.Image,
+    originalPath: `/original/${assetId}.jpg`,
+    originalFileName: `${assetId}.jpg`,
+    originalMimeType: 'image/jpeg',
+    thumbhash: null,
+    fileCreatedAt: now,
+    fileModifiedAt: now,
+    localDateTime: now,
+    updatedAt: now,
+    createdAt: now,
+    isFavorite: false,
+    isArchived: false,
+    isTrashed: false,
+    visibility: AssetVisibility.Timeline,
+    duration: '0:00:00.00000',
+    exifInfo: {
+      make: null,
+      model: null,
+      exifImageWidth: 3000,
+      exifImageHeight: 4000,
+      fileSizeInByte: null,
+      orientation: null,
+      dateTimeOriginal: now,
+      modifyDate: null,
+      timeZone: null,
+      lensModel: null,
+      fNumber: null,
+      focalLength: null,
+      iso: null,
+      exposureTime: null,
+      latitude: null,
+      longitude: null,
+      city: null,
+      country: null,
+      state: null,
+      description: null,
+    },
+    livePhotoVideoId: null,
+    tags: [],
+    people: [],
+    unassignedFaces: [],
+    stack: null,
+    isOffline: false,
+    hasMetadata: true,
+    duplicateId: null,
+    resized: true,
+    checksum: faker.string.alphanumeric({ length: 28 }),
+    width: 3000,
+    height: 4000,
+    isEdited: false,
+  };
+};
+
+export const createMockStack = (
+  primaryAssetDto: AssetResponseDto,
+  additionalAssets: AssetResponseDto[],
+  brokenAssetIds?: Set<string>,
+): MockStack => {
+  const stackId = faker.string.uuid();
+  const allAssets = [primaryAssetDto, ...additionalAssets];
+  const resolvedBrokenIds = brokenAssetIds ?? new Set(additionalAssets.map((a) => a.id));
+  const assetMap = new Map(allAssets.map((a) => [a.id, a]));
+
+  primaryAssetDto.stack = {
+    id: stackId,
+    assetCount: allAssets.length,
+    primaryAssetId: primaryAssetDto.id,
+  };
+
+  return {
+    id: stackId,
+    primaryAssetId: primaryAssetDto.id,
+    assets: allAssets,
+    brokenAssetIds: resolvedBrokenIds,
+    assetMap,
+  };
+};
+
+export const setupBrokenAssetMockApiRoutes = async (context: BrowserContext, mockStack: MockStack) => {
+  await context.route('**/api/stacks/*', async (route, request) => {
+    if (request.method() !== 'GET') {
+      return route.fallback();
+    }
+    const stackResponse: StackResponseDto = {
+      id: mockStack.id,
+      primaryAssetId: mockStack.primaryAssetId,
+      assets: mockStack.assets,
+    };
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      json: stackResponse,
+    });
+  });
+
+  await context.route('**/api/assets/*', async (route, request) => {
+    if (request.method() !== 'GET') {
+      return route.fallback();
+    }
+    const url = new URL(request.url());
+    const segments = url.pathname.split('/');
+    const assetId = segments.at(-1);
+    if (assetId && mockStack.assetMap.has(assetId)) {
+      return route.fulfill({
+        status: 200,
+        contentType: 'application/json',
+        json: mockStack.assetMap.get(assetId),
+      });
+    }
+    return route.fallback();
+  });
+
+  await context.route('**/api/assets/*/thumbnail?size=*', async (route, request) => {
+    if (!route.request().serviceWorker()) {
+      return route.continue();
+    }
+    const pattern = /\/api\/assets\/(?<assetId>[^/]+)\/thumbnail\?size=(?<size>preview|thumbnail)/;
+    const match = request.url().match(pattern);
+    if (!match?.groups || !mockStack.assetMap.has(match.groups.assetId)) {
+      return route.fallback();
+    }
+    if (mockStack.brokenAssetIds.has(match.groups.assetId)) {
+      return route.fulfill({ status: 404 });
+    }
+    const asset = mockStack.assetMap.get(match.groups.assetId)!;
+    const ratio = (asset.exifInfo?.exifImageWidth ?? 3000) / (asset.exifInfo?.exifImageHeight ?? 4000);
+    const body =
+      match.groups.size === 'preview'
+        ? await randomPreview(match.groups.assetId, ratio)
+        : await randomThumbnail(match.groups.assetId, ratio);
+    return route.fulfill({
+      status: 200,
+      headers: { 'content-type': 'image/jpeg' },
+      body,
+    });
+  });
+};

e2e/src/ui/mock-network/face-editor-network.ts

@@ -0,0 +1,127 @@
+import { BrowserContext } from '@playwright/test';
+import { randomThumbnail } from 'src/ui/generators/timeline';
+
+// Minimal valid H.264 MP4 (8x8px, 1 frame) that browsers can decode to get videoWidth/videoHeight
+const MINIMAL_MP4_BASE64 =
+  'AAAAIGZ0eXBpc29tAAACAGlzb21pc28yYXZjMW1wNDEAAAAIZnJlZQAAAr9tZGF0AAACoAYF//+c' +
+  '3EXpvebZSLeWLNgg2SPu73gyNjQgLSBjb3JlIDEyNSAtIEguMjY0L01QRUctNCBBVkMgY29kZWMg' +
+  'LSBDb3B5bGVmdCAyMDAzLTIwMTIgLSBodHRwOi8vd3d3LnZpZGVvbGFuLm9yZy94MjY0Lmh0bWwg' +
+  'LSBvcHRpb25zOiBjYWJhYz0xIHJlZj0zIGRlYmxvY2s9MTowOjAgYW5hbHlzZT0weDM6MHgxMTMg' +
+  'bWU9aGV4IHN1Ym1lPTcgcHN5PTEgcHN5X3JkPTEuMDA6MC4wMCBtaXhlZF9yZWY9MSBtZV9yYW5n' +
+  'ZT0xNiBjaHJvbWFfbWU9MSB0cmVsbGlzPTEgOHg4ZGN0PTEgY3FtPTAgZGVhZHpvbmU9MjEsMTEg' +
+  'ZmFzdF9wc2tpcD0xIGNocm9tYV9xcF9vZmZzZXQ9LTIgdGhyZWFkcz02IGxvb2thaGVhZF90aHJl' +
+  'YWRzPTEgc2xpY2VkX3RocmVhZHM9MCBucj0wIGRlY2ltYXRlPTEgaW50ZXJsYWNlZD0wIGJsdXJh' +
+  'eV9jb21wYXQ9MCBjb25zdHJhaW5lZF9pbnRyYT0wIGJmcmFtZXM9MyBiX3B5cmFtaWQ9MiBiX2Fk' +
+  'YXB0PTEgYl9iaWFzPTAgZGlyZWN0PTEgd2VpZ2h0Yj0xIG9wZW5fZ29wPTAgd2VpZ2h0cD0yIGtl' +
+  'eWludD0yNTAga2V5aW50X21pbj0yNCBzY2VuZWN1dD00MCBpbnRyYV9yZWZyZXNoPTAgcmNfbG9v' +
+  'a2FoZWFkPTQwIHJjPWNyZiBtYnRyZWU9MSBjcmY9MjMuMCBxY29tcD0wLjYwIHFwbWluPTAgcXBt' +
+  'YXg9NjkgcXBzdGVwPTQgaXBfcmF0aW89MS40MCBhcT0xOjEuMDAAgAAAAA9liIQAV/0TAAYdeBTX' +
+  'zg8AAALvbW9vdgAAAGxtdmhkAAAAAAAAAAAAAAAAAAAD6AAAACoAAQAAAQAAAAAAAAAAAAAAAAEAAAAA' +
+  'AAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA' +
+  'Ahl0cmFrAAAAXHRraGQAAAAPAAAAAAAAAAAAAAABAAAAAAAAACoAAAAAAAAAAAAAAAAAAAAAAAEAAAAA' +
+  'AAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAABAAAAAAAgAAAAIAAAAAAAkZWR0cwAAABxlbHN0AAAAAAAA' +
+  'AAEAAAAqAAAAAAABAAAAAAGRbWRpYQAAACBtZGhkAAAAAAAAAAAAAAAAAAAwAAAAAgBVxAAAAAAA' +
+  'LWhkbHIAAAAAAAAAAHZpZGUAAAAAAAAAAAAAAABWaWRlb0hhbmRsZXIAAAABPG1pbmYAAAAUdm1oZAAA' +
+  'AAEAAAAAAAAAAAAAACRkaW5mAAAAHGRyZWYAAAAAAAAAAQAAAAx1cmwgAAAAAQAAAPxzdGJsAAAAmHN0' +
+  'c2QAAAAAAAAAAQAAAIhhdmMxAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAgACABIAAAASAAAAAAAAAAB' +
+  'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGP//AAAAMmF2Y0MBZAAK/+EAGWdkAAqs' +
+  '2V+WXAWyAAADAAIAAAMAYB4kSywBAAZo6+PLIsAAAAAYc3R0cwAAAAAAAAABAAAAAQAAAgAAAAAcc3Rz' +
+  'YwAAAAAAAAABAAAAAQAAAAEAAAABAAAAFHN0c3oAAAAAAAACtwAAAAEAAAAUc3RjbwAAAAAAAAABAAAA' +
+  'MAAAAGJ1ZHRhAAAAWm1ldGEAAAAAAAAAIWhkbHIAAAAAAAAAAG1kaXJhcHBsAAAAAAAAAAAAAAAALWls' +
+  'c3QAAAAlqXRvbwAAAB1kYXRhAAAAAQAAAABMYXZmNTQuNjMuMTA0';
+
+export const MINIMAL_MP4_BUFFER = Buffer.from(MINIMAL_MP4_BASE64, 'base64');
+
+export type MockPerson = {
+  id: string;
+  name: string;
+  birthDate: string | null;
+  isHidden: boolean;
+  thumbnailPath: string;
+  updatedAt: string;
+};
+
+export const createMockPeople = (count: number): MockPerson[] => {
+  const names = [
+    'Alice Johnson',
+    'Bob Smith',
+    'Charlie Brown',
+    'Diana Prince',
+    'Eve Adams',
+    'Frank Castle',
+    'Grace Lee',
+    'Hank Pym',
+    'Iris West',
+    'Jack Ryan',
+  ];
+  return Array.from({ length: count }, (_, index) => ({
+    id: `person-${index}`,
+    name: names[index % names.length],
+    birthDate: null,
+    isHidden: false,
+    thumbnailPath: `/upload/thumbs/person-${index}.jpeg`,
+    updatedAt: '2025-01-01T00:00:00.000Z',
+  }));
+};
+
+export type FaceCreateCapture = {
+  requests: Array<{
+    assetId: string;
+    personId: string;
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+    imageWidth: number;
+    imageHeight: number;
+  }>;
+};
+
+export const setupFaceEditorMockApiRoutes = async (
+  context: BrowserContext,
+  mockPeople: MockPerson[],
+  faceCreateCapture: FaceCreateCapture,
+) => {
+  await context.route('**/api/people?*', async (route, request) => {
+    if (request.method() !== 'GET') {
+      return route.fallback();
+    }
+
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      json: {
+        hasNextPage: false,
+        hidden: 0,
+        people: mockPeople,
+        total: mockPeople.length,
+      },
+    });
+  });
+
+  await context.route('**/api/faces', async (route, request) => {
+    if (request.method() !== 'POST') {
+      return route.fallback();
+    }
+
+    const body = request.postDataJSON();
+    faceCreateCapture.requests.push(body);
+
+    return route.fulfill({
+      status: 201,
+      contentType: 'text/plain',
+      body: 'OK',
+    });
+  });
+
+  await context.route('**/api/people/*/thumbnail', async (route) => {
+    if (!route.request().serviceWorker()) {
+      return route.continue();
+    }
+    return route.fulfill({
+      status: 200,
+      headers: { 'content-type': 'image/jpeg' },
+      body: await randomThumbnail('person-thumb', 1),
+    });
+  });
+};

e2e/src/ui/mock-network/timeline-network.ts

@@ -12,6 +12,7 @@ import {
   TimelineData,
 } from 'src/ui/generators/timeline';
 import { sleep } from 'src/ui/specs/timeline/utils';
+import { MINIMAL_MP4_BUFFER } from './face-editor-network';
 
 export class TimelineTestContext {
   slowBucket = false;
@@ -135,6 +136,14 @@ export const setupTimelineMockApiRoutes = async (
     return route.continue();
   });
 
+  await context.route('**/api/assets/*/video/playback*', async (route) => {
+    return route.fulfill({
+      status: 200,
+      headers: { 'content-type': 'video/mp4' },
+      body: MINIMAL_MP4_BUFFER,
+    });
+  });
+
   await context.route('**/api/albums/**', async (route, request) => {
     const albumsMatch = request.url().match(/\/api\/albums\/(?<albumId>[^/?]+)/);
     if (albumsMatch) {

e2e/src/ui/specs/asset-viewer/broken-asset.e2e-spec.ts

@@ -0,0 +1,86 @@
+import { expect, test } from '@playwright/test';
+import { toAssetResponseDto } from 'src/ui/generators/timeline';
+import {
+  createMockStack,
+  createMockStackAsset,
+  MockStack,
+  setupBrokenAssetMockApiRoutes,
+} from 'src/ui/mock-network/broken-asset-network';
+import { assetViewerUtils } from '../timeline/utils';
+import { setupAssetViewerFixture } from './utils';
+
+test.describe.configure({ mode: 'parallel' });
+test.describe('broken-asset responsiveness', () => {
+  const fixture = setupAssetViewerFixture(889);
+  let mockStack: MockStack;
+
+  test.beforeAll(async () => {
+    const primaryAssetDto = toAssetResponseDto(fixture.primaryAsset);
+
+    const brokenAssets = [
+      createMockStackAsset(fixture.adminUserId),
+      createMockStackAsset(fixture.adminUserId),
+      createMockStackAsset(fixture.adminUserId),
+    ];
+
+    mockStack = createMockStack(primaryAssetDto, brokenAssets);
+  });
+
+  test.beforeEach(async ({ context }) => {
+    await setupBrokenAssetMockApiRoutes(context, mockStack);
+  });
+
+  test('broken asset in stack strip hides icon at small size', async ({ page }) => {
+    await page.goto(`/photos/${fixture.primaryAsset.id}`);
+    await assetViewerUtils.waitForViewerLoad(page, fixture.primaryAsset);
+
+    const stackSlideshow = page.locator('#stack-slideshow');
+    await expect(stackSlideshow).toBeVisible();
+
+    const brokenAssets = stackSlideshow.locator('[data-broken-asset]');
+    await expect(brokenAssets.first()).toBeVisible();
+    await expect(brokenAssets).toHaveCount(mockStack.brokenAssetIds.size);
+
+    for (const brokenAsset of await brokenAssets.all()) {
+      await expect(brokenAsset.locator('svg')).not.toBeVisible();
+    }
+  });
+
+  test('broken asset in stack strip uses text-xs class', async ({ page }) => {
+    await page.goto(`/photos/${fixture.primaryAsset.id}`);
+    await assetViewerUtils.waitForViewerLoad(page, fixture.primaryAsset);
+
+    const stackSlideshow = page.locator('#stack-slideshow');
+    await expect(stackSlideshow).toBeVisible();
+
+    const brokenAssets = stackSlideshow.locator('[data-broken-asset]');
+    await expect(brokenAssets.first()).toBeVisible();
+
+    for (const brokenAsset of await brokenAssets.all()) {
+      const messageSpan = brokenAsset.locator('span');
+      await expect(messageSpan).toHaveClass(/text-xs/);
+    }
+  });
+
+  test('broken asset in main viewer shows icon and uses text-base', async ({ context, page }) => {
+    await context.route(
+      (url) =>
+        url.pathname.includes(`/api/assets/${fixture.primaryAsset.id}/thumbnail`) ||
+        url.pathname.includes(`/api/assets/${fixture.primaryAsset.id}/original`),
+      async (route) => {
+        return route.fulfill({ status: 404 });
+      },
+    );
+
+    await page.goto(`/photos/${fixture.primaryAsset.id}`);
+    await page.waitForSelector('#immich-asset-viewer');
+
+    const viewerBrokenAsset = page.locator('[data-viewer-content] [data-broken-asset]').first();
+    await expect(viewerBrokenAsset).toBeVisible();
+
+    await expect(viewerBrokenAsset.locator('svg')).toBeVisible();
+
+    const messageSpan = viewerBrokenAsset.locator('span');
+    await expect(messageSpan).toHaveClass(/text-base/);
+  });
+});

e2e/src/ui/specs/asset-viewer/face-editor.e2e-spec.ts

@@ -0,0 +1,285 @@
+import { expect, Page, test } from '@playwright/test';
+import { SeededRandom, selectRandom, TimelineAssetConfig } from 'src/ui/generators/timeline';
+import {
+  createMockPeople,
+  FaceCreateCapture,
+  MockPerson,
+  setupFaceEditorMockApiRoutes,
+} from 'src/ui/mock-network/face-editor-network';
+import { assetViewerUtils } from '../timeline/utils';
+import { setupAssetViewerFixture } from './utils';
+
+const waitForSelectorTransition = async (page: Page) => {
+  await page.waitForFunction(
+    () => {
+      const selector = document.querySelector('#face-selector') as HTMLElement | null;
+      if (!selector) {
+        return false;
+      }
+      return selector.getAnimations({ subtree: false }).every((animation) => animation.playState === 'finished');
+    },
+    undefined,
+    { timeout: 1000, polling: 50 },
+  );
+};
+
+const openFaceEditor = async (page: Page, asset: TimelineAssetConfig) => {
+  await page.goto(`/photos/${asset.id}`);
+  await assetViewerUtils.waitForViewerLoad(page, asset);
+  await page.keyboard.press('i');
+  await page.locator('#detail-panel').waitFor({ state: 'visible' });
+  await page.getByLabel('Tag people').click();
+  await page.locator('#face-selector').waitFor({ state: 'visible' });
+  await waitForSelectorTransition(page);
+};
+
+test.describe.configure({ mode: 'parallel' });
+test.describe('face-editor', () => {
+  const fixture = setupAssetViewerFixture(777);
+  const rng = new SeededRandom(777);
+  let mockPeople: MockPerson[];
+  let faceCreateCapture: FaceCreateCapture;
+
+  test.beforeAll(async () => {
+    mockPeople = createMockPeople(8);
+  });
+
+  test.beforeEach(async ({ context }) => {
+    faceCreateCapture = { requests: [] };
+    await setupFaceEditorMockApiRoutes(context, mockPeople, faceCreateCapture);
+  });
+
+  type ScreenRect = { top: number; left: number; width: number; height: number };
+
+  const getFaceBoxRect = async (page: Page): Promise<ScreenRect> => {
+    const dataEl = page.locator('#face-editor-data');
+    await expect(dataEl).toHaveAttribute('data-face-left', /^-?\d+/);
+    await expect(dataEl).toHaveAttribute('data-face-top', /^-?\d+/);
+    await expect(dataEl).toHaveAttribute('data-face-width', /^[1-9]/);
+    await expect(dataEl).toHaveAttribute('data-face-height', /^[1-9]/);
+    const canvasBox = await page.locator('#face-editor').boundingBox();
+    if (!canvasBox) {
+      throw new Error('Canvas element not found');
+    }
+    const left = Number(await dataEl.getAttribute('data-face-left'));
+    const top = Number(await dataEl.getAttribute('data-face-top'));
+    const width = Number(await dataEl.getAttribute('data-face-width'));
+    const height = Number(await dataEl.getAttribute('data-face-height'));
+    return {
+      top: canvasBox.y + top,
+      left: canvasBox.x + left,
+      width,
+      height,
+    };
+  };
+
+  const getSelectorRect = async (page: Page): Promise<ScreenRect> => {
+    const box = await page.locator('#face-selector').boundingBox();
+    if (!box) {
+      throw new Error('Face selector element not found');
+    }
+    return { top: box.y, left: box.x, width: box.width, height: box.height };
+  };
+
+  const computeOverlapArea = (a: ScreenRect, b: ScreenRect): number => {
+    const overlapX = Math.max(0, Math.min(a.left + a.width, b.left + b.width) - Math.max(a.left, b.left));
+    const overlapY = Math.max(0, Math.min(a.top + a.height, b.top + b.height) - Math.max(a.top, b.top));
+    return overlapX * overlapY;
+  };
+
+  const dragFaceBox = async (page: Page, deltaX: number, deltaY: number) => {
+    const faceBox = await getFaceBoxRect(page);
+    const centerX = faceBox.left + faceBox.width / 2;
+    const centerY = faceBox.top + faceBox.height / 2;
+    await page.mouse.move(centerX, centerY);
+    await page.mouse.down();
+    await page.mouse.move(centerX + deltaX, centerY + deltaY, { steps: 5 });
+    await page.mouse.up();
+    await page.waitForTimeout(300);
+  };
+
+  test('Face editor opens with person list', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    await expect(page.locator('#face-selector')).toBeVisible();
+    await expect(page.locator('#face-editor')).toBeVisible();
+
+    for (const person of mockPeople) {
+      await expect(page.locator('#face-selector').getByText(person.name)).toBeVisible();
+    }
+  });
+
+  test('Search filters people by name', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    const searchInput = page.locator('#face-selector input');
+    await searchInput.fill('Alice');
+
+    await expect(page.locator('#face-selector').getByText('Alice Johnson')).toBeVisible();
+    await expect(page.locator('#face-selector').getByText('Bob Smith')).toBeHidden();
+
+    await searchInput.clear();
+
+    for (const person of mockPeople) {
+      await expect(page.locator('#face-selector').getByText(person.name)).toBeVisible();
+    }
+  });
+
+  test('Search with no results shows empty message', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    const searchInput = page.locator('#face-selector input');
+    await searchInput.fill('Nonexistent Person XYZ');
+
+    for (const person of mockPeople) {
+      await expect(page.locator('#face-selector').getByText(person.name)).toBeHidden();
+    }
+  });
+
+  test('Selecting a person shows confirmation dialog', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    const personToTag = mockPeople[0];
+    await page.locator('#face-selector').getByText(personToTag.name).click();
+
+    await expect(page.getByRole('dialog')).toBeVisible();
+  });
+
+  test('Confirming tag calls createFace API and closes editor', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    const personToTag = mockPeople[0];
+    await page.locator('#face-selector').getByText(personToTag.name).click();
+
+    await expect(page.getByRole('dialog')).toBeVisible();
+    await page.getByRole('button', { name: /confirm/i }).click();
+
+    await expect(page.locator('#face-selector')).toBeHidden();
+    await expect(page.locator('#face-editor')).toBeHidden();
+
+    expect(faceCreateCapture.requests).toHaveLength(1);
+    expect(faceCreateCapture.requests[0].assetId).toBe(asset.id);
+    expect(faceCreateCapture.requests[0].personId).toBe(personToTag.id);
+  });
+
+  test('Cancel button closes face editor', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    await expect(page.locator('#face-selector')).toBeVisible();
+    await expect(page.locator('#face-editor')).toBeVisible();
+
+    await page.getByRole('button', { name: /cancel/i }).click();
+
+    await expect(page.locator('#face-selector')).toBeHidden();
+    await expect(page.locator('#face-editor')).toBeHidden();
+  });
+
+  test('Selector does not overlap face box on initial open', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    const faceBox = await getFaceBoxRect(page);
+    const selectorBox = await getSelectorRect(page);
+    const overlap = computeOverlapArea(faceBox, selectorBox);
+
+    expect(overlap).toBe(0);
+  });
+
+  test('Selector repositions without overlap after dragging face box down', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    await dragFaceBox(page, 0, 150);
+
+    const faceBox = await getFaceBoxRect(page);
+    const selectorBox = await getSelectorRect(page);
+    const overlap = computeOverlapArea(faceBox, selectorBox);
+
+    expect(overlap).toBe(0);
+  });
+
+  test('Selector repositions without overlap after dragging face box right', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    await dragFaceBox(page, 200, 0);
+
+    const faceBox = await getFaceBoxRect(page);
+    const selectorBox = await getSelectorRect(page);
+    const overlap = computeOverlapArea(faceBox, selectorBox);
+
+    expect(overlap).toBe(0);
+  });
+
+  test('Selector repositions without overlap after dragging face box to top-left corner', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    await dragFaceBox(page, -300, -300);
+
+    const faceBox = await getFaceBoxRect(page);
+    const selectorBox = await getSelectorRect(page);
+    const overlap = computeOverlapArea(faceBox, selectorBox);
+
+    expect(overlap).toBe(0);
+  });
+
+  test('Selector repositions without overlap after dragging face box to bottom-right', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    await dragFaceBox(page, 300, 300);
+
+    const faceBox = await getFaceBoxRect(page);
+    const selectorBox = await getSelectorRect(page);
+    const overlap = computeOverlapArea(faceBox, selectorBox);
+
+    expect(overlap).toBe(0);
+  });
+
+  test('Selector stays within viewport bounds', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    const viewportSize = page.viewportSize()!;
+    const selectorBox = await getSelectorRect(page);
+
+    expect(selectorBox.top).toBeGreaterThanOrEqual(0);
+    expect(selectorBox.left).toBeGreaterThanOrEqual(0);
+    expect(selectorBox.top + selectorBox.height).toBeLessThanOrEqual(viewportSize.height);
+    expect(selectorBox.left + selectorBox.width).toBeLessThanOrEqual(viewportSize.width);
+  });
+
+  test('Selector stays within viewport after dragging to edge', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    await dragFaceBox(page, -400, -400);
+
+    const viewportSize = page.viewportSize()!;
+    const selectorBox = await getSelectorRect(page);
+
+    expect(selectorBox.top).toBeGreaterThanOrEqual(0);
+    expect(selectorBox.left).toBeGreaterThanOrEqual(0);
+    expect(selectorBox.top + selectorBox.height).toBeLessThanOrEqual(viewportSize.height);
+    expect(selectorBox.left + selectorBox.width).toBeLessThanOrEqual(viewportSize.width);
+  });
+
+  test('Face box is draggable on the canvas', async ({ page }) => {
+    const asset = selectRandom(fixture.assets, rng);
+    await openFaceEditor(page, asset);
+
+    const beforeDrag = await getFaceBoxRect(page);
+    await dragFaceBox(page, 100, 50);
+    const afterDrag = await getFaceBoxRect(page);
+
+    expect(afterDrag.left).toBeGreaterThan(beforeDrag.left + 50);
+    expect(afterDrag.top).toBeGreaterThan(beforeDrag.top + 20);
+  });
+});

e2e/src/ui/specs/asset-viewer/stack.e2e-spec.ts

@@ -0,0 +1,84 @@
+import { faker } from '@faker-js/faker';
+import type { AssetResponseDto } from '@immich/sdk';
+import { expect, test } from '@playwright/test';
+import { toAssetResponseDto } from 'src/ui/generators/timeline';
+import {
+  createMockStack,
+  createMockStackAsset,
+  MockStack,
+  setupBrokenAssetMockApiRoutes,
+} from 'src/ui/mock-network/broken-asset-network';
+import { assetViewerUtils } from '../timeline/utils';
+import { enableTagsPreference, ensureDetailPanelVisible, setupAssetViewerFixture } from './utils';
+
+test.describe.configure({ mode: 'parallel' });
+test.describe('asset-viewer stack', () => {
+  const fixture = setupAssetViewerFixture(888);
+  let mockStack: MockStack;
+  let primaryAssetDto: AssetResponseDto;
+  let secondAssetDto: AssetResponseDto;
+
+  test.beforeAll(async () => {
+    primaryAssetDto = toAssetResponseDto(fixture.primaryAsset);
+    primaryAssetDto.tags = [
+      {
+        id: faker.string.uuid(),
+        name: '1',
+        value: 'test/1',
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+      },
+    ];
+
+    secondAssetDto = createMockStackAsset(fixture.adminUserId);
+    secondAssetDto.tags = [
+      {
+        id: faker.string.uuid(),
+        name: '2',
+        value: 'test/2',
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+      },
+    ];
+
+    mockStack = createMockStack(primaryAssetDto, [secondAssetDto], new Set());
+  });
+
+  test.beforeEach(async ({ context }) => {
+    await setupBrokenAssetMockApiRoutes(context, mockStack);
+  });
+
+  test('stack slideshow is visible', async ({ page }) => {
+    await page.goto(`/photos/${fixture.primaryAsset.id}`);
+    await assetViewerUtils.waitForViewerLoad(page, fixture.primaryAsset);
+
+    const stackSlideshow = page.locator('#stack-slideshow');
+    await expect(stackSlideshow).toBeVisible();
+
+    const stackAssets = stackSlideshow.locator('[data-asset]');
+    await expect(stackAssets).toHaveCount(mockStack.assets.length);
+  });
+
+  test('tags of primary asset are visible', async ({ context, page }) => {
+    await enableTagsPreference(context);
+
+    await page.goto(`/photos/${fixture.primaryAsset.id}`);
+    await ensureDetailPanelVisible(page);
+
+    const tags = page.getByTestId('detail-panel-tags').getByRole('link');
+    await expect(tags.first()).toHaveText('test/1');
+  });
+
+  test('tags of second asset are visible', async ({ context, page }) => {
+    await enableTagsPreference(context);
+
+    await page.goto(`/photos/${fixture.primaryAsset.id}`);
+    await ensureDetailPanelVisible(page);
+
+    const stackAssets = page.locator('#stack-slideshow [data-asset]');
+    await stackAssets.nth(1).click();
+
+    const tags = page.getByTestId('detail-panel-tags').getByRole('link');
+    await expect(tags.first()).toHaveText('test/2');
+  });
+});

e2e/src/ui/specs/asset-viewer/utils.ts

@@ -0,0 +1,116 @@
+import { faker } from '@faker-js/faker';
+import type { AssetResponseDto } from '@immich/sdk';
+import { BrowserContext, Page, test } from '@playwright/test';
+import {
+  Changes,
+  createDefaultTimelineConfig,
+  generateTimelineData,
+  SeededRandom,
+  selectRandom,
+  TimelineAssetConfig,
+  TimelineData,
+  toAssetResponseDto,
+} from 'src/ui/generators/timeline';
+import { setupBaseMockApiRoutes } from 'src/ui/mock-network/base-network';
+import { setupTimelineMockApiRoutes, TimelineTestContext } from 'src/ui/mock-network/timeline-network';
+import { utils } from 'src/utils';
+
+export type AssetViewerTestFixture = {
+  adminUserId: string;
+  timelineRestData: TimelineData;
+  assets: TimelineAssetConfig[];
+  testContext: TimelineTestContext;
+  changes: Changes;
+  primaryAsset: TimelineAssetConfig;
+  primaryAssetDto: AssetResponseDto;
+};
+
+export function setupAssetViewerFixture(seed: number): AssetViewerTestFixture {
+  const rng = new SeededRandom(seed);
+  const testContext = new TimelineTestContext();
+
+  const fixture: AssetViewerTestFixture = {
+    adminUserId: undefined!,
+    timelineRestData: undefined!,
+    assets: [],
+    testContext,
+    changes: {
+      albumAdditions: [],
+      assetDeletions: [],
+      assetArchivals: [],
+      assetFavorites: [],
+    },
+    primaryAsset: undefined!,
+    primaryAssetDto: undefined!,
+  };
+
+  test.beforeAll(async () => {
+    test.fail(
+      process.env.PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS !== '1',
+      'This test requires env var: PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1',
+    );
+    utils.initSdk();
+    fixture.adminUserId = faker.string.uuid();
+    testContext.adminId = fixture.adminUserId;
+    fixture.timelineRestData = generateTimelineData({
+      ...createDefaultTimelineConfig(),
+      ownerId: fixture.adminUserId,
+    });
+    for (const timeBucket of fixture.timelineRestData.buckets.values()) {
+      fixture.assets.push(...timeBucket);
+    }
+
+    fixture.primaryAsset = selectRandom(
+      fixture.assets.filter((a) => a.isImage),
+      rng,
+    );
+    fixture.primaryAssetDto = toAssetResponseDto(fixture.primaryAsset);
+  });
+
+  test.beforeEach(async ({ context }) => {
+    await setupBaseMockApiRoutes(context, fixture.adminUserId);
+    await setupTimelineMockApiRoutes(context, fixture.timelineRestData, fixture.changes, fixture.testContext);
+  });
+
+  test.afterEach(() => {
+    fixture.testContext.slowBucket = false;
+    fixture.changes.albumAdditions = [];
+    fixture.changes.assetDeletions = [];
+    fixture.changes.assetArchivals = [];
+    fixture.changes.assetFavorites = [];
+  });
+
+  return fixture;
+}
+
+export async function ensureDetailPanelVisible(page: Page) {
+  await page.waitForSelector('#immich-asset-viewer');
+
+  const isVisible = await page.locator('#detail-panel').isVisible();
+  if (!isVisible) {
+    await page.keyboard.press('i');
+    await page.waitForSelector('#detail-panel');
+  }
+}
+
+export async function enableTagsPreference(context: BrowserContext) {
+  await context.route('**/users/me/preferences', async (route) => {
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      json: {
+        albums: { defaultAssetOrder: 'desc' },
+        folders: { enabled: false, sidebarWeb: false },
+        memories: { enabled: true, duration: 5 },
+        people: { enabled: true, sidebarWeb: false },
+        sharedLinks: { enabled: true, sidebarWeb: false },
+        ratings: { enabled: false },
+        tags: { enabled: true, sidebarWeb: false },
+        emailNotifications: { enabled: true, albumInvite: true, albumUpdate: true },
+        download: { archiveSize: 4_294_967_296, includeEmbeddedVideos: false },
+        purchase: { showSupportBadge: true, hideBuyButtonUntil: '2100-02-12T00:00:00.000Z' },
+        cast: { gCastEnabled: false },
+      },
+    });
+  });
+}

e2e/src/ui/specs/timeline/utils.ts

@@ -215,8 +215,9 @@ export const pageUtils = {
     await page.getByText('Confirm').click();
   },
   async selectDay(page: Page, day: string) {
-    await page.getByTitle(day).hover();
-    await page.locator('[data-group] .w-8').click();
+    const section = page.getByTitle(day).locator('xpath=ancestor::section[@data-group]');
+    await section.hover();
+    await section.locator('.w-8').click();
   },
   async pauseTestDebug() {
     console.log('NOTE: pausing test indefinately for debug');

e2e/src/utils.ts

@@ -177,40 +177,51 @@ export const utils = {
   },
 
   resetDatabase: async (tables?: string[]) => {
-    try {
-      client = await utils.connectDatabase();
+    client = await utils.connectDatabase();
 
-      tables = tables || [
-        // TODO e2e test for deleting a stack, since it is quite complex
-        'stack',
-        'library',
-        'shared_link',
-        'person',
-        'album',
-        'asset',
-        'asset_face',
-        'activity',
-        'api_key',
-        'session',
-        'user',
-        'system_metadata',
-        'tag',
-      ];
+    tables = tables || [
+      // TODO e2e test for deleting a stack, since it is quite complex
+      'stack',
+      'library',
+      'shared_link',
+      'person',
+      'album',
+      'asset',
+      'asset_face',
+      'activity',
+      'api_key',
+      'session',
+      'user',
+      'system_metadata',
+      'tag',
+    ];
 
-      const sql: string[] = [];
+    const truncateTables = tables.filter((table) => table !== 'system_metadata');
+    const sql: string[] = [];
 
-      for (const table of tables) {
-        if (table === 'system_metadata') {
-          sql.push(`DELETE FROM "system_metadata" where "key" NOT IN ('reverse-geocoding-state', 'system-flags');`);
-        } else {
-          sql.push(`DELETE FROM "${table}" CASCADE;`);
+    if (truncateTables.length > 0) {
+      sql.push(`TRUNCATE "${truncateTables.join('", "')}" CASCADE;`);
+    }
+
+    if (tables.includes('system_metadata')) {
+      sql.push(`DELETE FROM "system_metadata" where "key" NOT IN ('reverse-geocoding-state', 'system-flags');`);
+    }
+
+    const query = sql.join('\n');
+    const maxRetries = 3;
+
+    for (let attempt = 1; attempt <= maxRetries; attempt++) {
+      try {
+        await client.query(query);
+        return;
+      } catch (error: any) {
+        if (error?.code === '40P01' && attempt < maxRetries) {
+          await new Promise((resolve) => setTimeout(resolve, 250 * attempt));
+          continue;
         }
+        console.error('Failed to reset database', error);
+        throw error;
       }
-
-      await client.query(sql.join('\n'));
-    } catch (error) {
-      console.error('Failed to reset database', error);
-      throw error;
     }
   },
 

e2e/tsconfig.json

@@ -17,6 +17,6 @@
     "esModuleInterop": true,
     "baseUrl": "./"
   },
-  "include": ["src/**/*.ts"],
+  "include": ["src/**/*.ts", "vitest*.config.ts"],
   "exclude": ["dist", "node_modules"]
 }

e2e/vitest.config.ts

@@ -1,3 +1,4 @@
+import tsconfigPaths from 'vite-tsconfig-paths';
 import { defineConfig } from 'vitest/config';
 
 const skipDockerSetup = process.env.VITEST_DISABLE_DOCKER_SETUP === 'true';
@@ -14,15 +15,14 @@ if (!skipDockerSetup) {
 
 export default defineConfig({
   test: {
+    name: 'e2e:server',
     retry: process.env.CI ? 4 : 0,
     include: ['src/specs/server/**/*.e2e-spec.ts'],
     globalSetup,
     testTimeout: 15_000,
     pool: 'threads',
-    poolOptions: {
-      threads: {
-        singleThread: true,
-      },
-    },
+    maxWorkers: 1,
+    isolate: false,
   },
+  plugins: [tsconfigPaths()],
 });

e2e/vitest.maintenance.config.ts

@@ -1,3 +1,4 @@
+import tsconfigPaths from 'vite-tsconfig-paths';
 import { defineConfig } from 'vitest/config';
 
 const skipDockerSetup = process.env.VITEST_DISABLE_DOCKER_SETUP === 'true';
@@ -14,15 +15,14 @@ if (!skipDockerSetup) {
 
 export default defineConfig({
   test: {
+    name: 'e2e:maintenance',
     retry: process.env.CI ? 4 : 0,
     include: ['src/specs/maintenance/server/**/*.e2e-spec.ts'],
     globalSetup,
     testTimeout: 15_000,
     pool: 'threads',
-    poolOptions: {
-      threads: {
-        singleThread: true,
-      },
-    },
+    maxWorkers: 1,
+    isolate: false,
   },
+  plugins: [tsconfigPaths()],
 });

i18n/en.json

@@ -411,7 +411,7 @@
     "transcoding_tone_mapping": "Tone-mapping",
     "transcoding_tone_mapping_description": "Attempts to preserve the appearance of HDR videos when converted to SDR. Each algorithm makes different tradeoffs for color, detail and brightness. Hable preserves detail, Mobius preserves color, and Reinhard preserves brightness.",
     "transcoding_transcode_policy": "Transcode policy",
-    "transcoding_transcode_policy_description": "Policy for when a video should be transcoded. HDR videos will always be transcoded (except if transcoding is disabled).",
+    "transcoding_transcode_policy_description": "Policy for when a video should be transcoded. HDR videos and videos with a pixel format other than YUV 4:2:0 will always be transcoded (except if transcoding is disabled).",
     "transcoding_two_pass_encoding": "Two-pass encoding",
     "transcoding_two_pass_encoding_setting_description": "Transcode in two passes to produce better encoded videos. When max bitrate is enabled (required for it to work with H.264 and HEVC), this mode uses a bitrate range based on the max bitrate and ignores CRF. For VP9, CRF can be used if max bitrate is disabled.",
     "transcoding_video_codec": "Video codec",
@@ -871,8 +871,8 @@
   "current_pin_code": "Current PIN code",
   "current_server_address": "Current server address",
   "custom_date": "Custom date",
-  "custom_locale": "Custom Locale",
-  "custom_locale_description": "Format dates and numbers based on the language and the region",
+  "custom_locale": "Custom locale",
+  "custom_locale_description": "Format dates, times, and numbers based on the selected language and region",
   "custom_url": "Custom URL",
   "cutoff_date_description": "Keep photos from the last…",
   "cutoff_day": "{count, plural, one {day} other {days}}",
@@ -895,8 +895,6 @@
   "deduplication_criteria_2": "Count of EXIF data",
   "deduplication_info": "Deduplication Info",
   "deduplication_info_description": "To automatically preselect assets and remove duplicates in bulk, we look at:",
-  "default_locale": "Default Locale",
-  "default_locale_description": "Format dates and numbers based on your browser locale",
   "delete": "Delete",
   "delete_action_confirmation_message": "Are you sure you want to delete this asset? This action will move the asset to the server's trash and will prompt if you want to delete it locally",
   "delete_action_prompt": "{count} deleted",
@@ -1074,7 +1072,7 @@
     "failed_to_update_notification_status": "Failed to update notification status",
     "incorrect_email_or_password": "Incorrect email or password",
     "library_folder_already_exists": "This import path already exists.",
-    "page_not_found": "Page not found :/",
+    "page_not_found": "Page not found",
     "paths_validation_failed": "{paths, plural, one {# path} other {# paths}} failed validation",
     "profile_picture_transparent_pixels": "Profile pictures cannot have transparent pixels. Please zoom in and/or move the image.",
     "quota_higher_than_disk_size": "You set a quota higher than the disk size",
@@ -2338,6 +2336,8 @@
   "url": "URL",
   "usage": "Usage",
   "use_biometric": "Use biometric",
+  "use_browser_locale": "Use browser locale",
+  "use_browser_locale_description": "Format dates, times, and numbers based on your browser locale",
   "use_current_connection": "Use current connection",
   "use_custom_date_range": "Use custom date range instead",
   "user": "User",

i18n/package.json

@@ -3,8 +3,8 @@
   "version": "2.5.6",
   "private": true,
   "scripts": {
-    "format": "prettier --check .",
-    "format:fix": "prettier --write ."
+    "format": "prettier --cache --check .",
+    "format:fix": "prettier --cache --write --list-different ."
   },
   "devDependencies": {
     "prettier": "^3.7.4",

machine-learning/.python-version

@@ -0,0 +1 @@
+3.13

machine-learning/Dockerfile

@@ -48,14 +48,14 @@ FROM python:3.13-slim-trixie@sha256:3de9a8d7aedbb7984dc18f2dff178a7850f16c1ae7c3
 
 RUN apt-get update && \
     apt-get install --no-install-recommends -yqq ocl-icd-libopencl1 wget && \
-    wget -nv https://github.com/intel/intel-graphics-compiler/releases/download/v2.27.10/intel-igc-core-2_2.27.10+20617_amd64.deb && \
-    wget -nv https://github.com/intel/intel-graphics-compiler/releases/download/v2.27.10/intel-igc-opencl-2_2.27.10+20617_amd64.deb && \
-    wget -nv https://github.com/intel/compute-runtime/releases/download/26.01.36711.4/intel-opencl-icd_26.01.36711.4-0_amd64.deb &&  \
+    wget -nv https://github.com/intel/intel-graphics-compiler/releases/download/v2.28.4/intel-igc-core-2_2.28.4+20760_amd64.deb && \
+    wget -nv https://github.com/intel/intel-graphics-compiler/releases/download/v2.28.4/intel-igc-opencl-2_2.28.4+20760_amd64.deb && \
+    wget -nv https://github.com/intel/compute-runtime/releases/download/26.05.37020.3/intel-opencl-icd_26.05.37020.3-0_amd64.deb &&  \
     wget -nv https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-core_1.0.17537.24_amd64.deb && \
     wget -nv https://github.com/intel/intel-graphics-compiler/releases/download/igc-1.0.17537.24/intel-igc-opencl_1.0.17537.24_amd64.deb && \
     wget -nv https://github.com/intel/compute-runtime/releases/download/24.35.30872.36/intel-opencl-icd-legacy1_24.35.30872.36_amd64.deb && \
     # TODO: Figure out how to get renovate to manage this differently versioned libigdgmm file
-    wget -nv https://github.com/intel/compute-runtime/releases/download/26.01.36711.4/libigdgmm12_22.9.0_amd64.deb && \
+    wget -nv https://github.com/intel/compute-runtime/releases/download/26.05.37020.3/libigdgmm12_22.9.0_amd64.deb && \
     dpkg -i *.deb && \
     rm *.deb && \
     apt-get remove wget -yqq && \

machine-learning/immich_ml/config.py

@@ -48,8 +48,11 @@ class PreloadModelData(BaseModel):
 
 
 class MaxBatchSize(BaseModel):
+    ocr_fallback: str | None = os.getenv("MACHINE_LEARNING_MAX_BATCH_SIZE__TEXT_RECOGNITION", None)
+    if ocr_fallback is not None:
+        os.environ["MACHINE_LEARNING_MAX_BATCH_SIZE__OCR"] = ocr_fallback
     facial_recognition: int | None = None
-    text_recognition: int | None = None
+    ocr: int | None = None
 
 
 class Settings(BaseSettings):

machine-learning/immich_ml/models/facial_recognition/recognition.py

@@ -29,7 +29,7 @@ class FaceRecognizer(InferenceModel):
 
     def __init__(self, model_name: str, **model_kwargs: Any) -> None:
         super().__init__(model_name, **model_kwargs)
-        max_batch_size = settings.max_batch_size.facial_recognition if settings.max_batch_size else None
+        max_batch_size = settings.max_batch_size and settings.max_batch_size.facial_recognition
         self.batch_size = max_batch_size if max_batch_size else self._batch_size_default
 
     def _load(self) -> ModelSession:

machine-learning/immich_ml/models/ocr/detection.py

@@ -22,7 +22,7 @@ class TextDetector(InferenceModel):
     depends = []
     identity = (ModelType.DETECTION, ModelTask.OCR)
 
-    def __init__(self, model_name: str, **model_kwargs: Any) -> None:
+    def __init__(self, model_name: str, min_score: float = 0.5, **model_kwargs: Any) -> None:
         super().__init__(model_name.split("__")[-1], **model_kwargs, model_format=ModelFormat.ONNX)
         self.max_resolution = 736
         self.mean = np.array([0.5, 0.5, 0.5], dtype=np.float32)
@@ -33,7 +33,7 @@ class TextDetector(InferenceModel):
         }
         self.postprocess = DBPostProcess(
             thresh=0.3,
-            box_thresh=model_kwargs.get("minScore", 0.5),
+            box_thresh=model_kwargs.get("minScore", min_score),
             max_candidates=1000,
             unclip_ratio=1.6,
             use_dilation=True,

machine-learning/immich_ml/models/ocr/recognition.py

@@ -24,9 +24,9 @@ class TextRecognizer(InferenceModel):
     depends = [(ModelType.DETECTION, ModelTask.OCR)]
     identity = (ModelType.RECOGNITION, ModelTask.OCR)
 
-    def __init__(self, model_name: str, **model_kwargs: Any) -> None:
+    def __init__(self, model_name: str, min_score: float = 0.9, **model_kwargs: Any) -> None:
         self.language = LangRec[model_name.split("__")[0]] if "__" in model_name else LangRec.CH
-        self.min_score = model_kwargs.get("minScore", 0.9)
+        self.min_score = model_kwargs.get("minScore", min_score)
         self._empty: TextRecognitionOutput = {
             "box": np.empty(0, dtype=np.float32),
             "boxScore": np.empty(0, dtype=np.float32),
@@ -57,10 +57,11 @@ class TextRecognizer(InferenceModel):
     def _load(self) -> ModelSession:
         # TODO: support other runtimes
         session = OrtSession(self.model_path)
+        max_batch_size = settings.max_batch_size and settings.max_batch_size.ocr
         self.model = RapidTextRecognizer(
             OcrOptions(
                 session=session.session,
-                rec_batch_num=settings.max_batch_size.text_recognition if settings.max_batch_size is not None else 6,
+                rec_batch_num=max_batch_size if max_batch_size else 6,
                 rec_img_shape=(3, 48, 320),
                 lang_type=self.language,
             )

machine-learning/immich_ml/sessions/ort.py

@@ -64,14 +64,6 @@ class OrtSession:
     def _providers_default(self) -> list[str]:
         available_providers = set(ort.get_available_providers())
         log.debug(f"Available ORT providers: {available_providers}")
-        if (openvino := "OpenVINOExecutionProvider") in available_providers:
-            device_ids: list[str] = ort.capi._pybind_state.get_available_openvino_device_ids()
-            log.debug(f"Available OpenVINO devices: {device_ids}")
-
-            gpu_devices = [device_id for device_id in device_ids if device_id.startswith("GPU")]
-            if not gpu_devices:
-                log.warning("No GPU device found in OpenVINO. Falling back to CPU.")
-                available_providers.remove(openvino)
         return [provider for provider in SUPPORTED_PROVIDERS if provider in available_providers]
 
     @property
@@ -102,12 +94,19 @@ class OrtSession:
                         "migraphx_fp16_enable": "1" if settings.rocm_precision == ModelPrecision.FP16 else "0",
                     }
                 case "OpenVINOExecutionProvider":
-                    openvino_dir = self.model_path.parent / "openvino"
-                    device = f"GPU.{settings.device_id}"
+                    device_ids: list[str] = ort.capi._pybind_state.get_available_openvino_device_ids()
+                    # Check for available devices, preferring GPU over CPU
+                    gpu_devices = [d for d in device_ids if d.startswith("GPU")]
+                    if gpu_devices:
+                        device_type = f"GPU.{settings.device_id}"
+                        log.debug(f"OpenVINO: Using GPU device {device_type}")
+                    else:
+                        device_type = "CPU"
+                        log.debug("OpenVINO: No GPU found, using CPU")
                     options = {
-                        "device_type": device,
+                        "device_type": device_type,
                         "precision": settings.openvino_precision.value,
-                        "cache_dir": openvino_dir.as_posix(),
+                        "cache_dir": (self.model_path.parent / "openvino").as_posix(),
                     }
                 case "CoreMLExecutionProvider":
                     options = {
@@ -139,12 +138,14 @@ class OrtSession:
         sess_options.enable_cpu_mem_arena = settings.model_arena
 
         # avoid thread contention between models
+        # Set inter_op threads
         if settings.model_inter_op_threads > 0:
             sess_options.inter_op_num_threads = settings.model_inter_op_threads
         # these defaults work well for CPU, but bottleneck GPU
         elif settings.model_inter_op_threads == 0 and self.providers == ["CPUExecutionProvider"]:
             sess_options.inter_op_num_threads = 1
 
+        # Set intra_op threads
         if settings.model_intra_op_threads > 0:
             sess_options.intra_op_num_threads = settings.model_intra_op_threads
         elif settings.model_intra_op_threads == 0 and self.providers == ["CPUExecutionProvider"]:

machine-learning/pyproject.toml

@@ -49,7 +49,7 @@ dev = ["locust>=2.15.1", { include-group = "test" }, { include-group = "lint" }]
 [project.optional-dependencies]
 cpu = ["onnxruntime>=1.23.2,<2"]
 cuda = ["onnxruntime-gpu>=1.23.2,<2"]
-openvino = ["onnxruntime-openvino>=1.23.0,<2"]
+openvino = ["onnxruntime-openvino>=1.24.1,<2"]
 armnn = ["onnxruntime>=1.23.2,<2"]
 rknn = ["onnxruntime>=1.23.2,<2", "rknn-toolkit-lite2>=2.3.0,<3"]
 rocm = ["onnxruntime-migraphx>=1.23.2,<2"]

machine-learning/test_main.py

@@ -18,7 +18,7 @@ from PIL import Image
 from pytest import MonkeyPatch
 from pytest_mock import MockerFixture
 
-from immich_ml.config import Settings, settings
+from immich_ml.config import MaxBatchSize, Settings, settings
 from immich_ml.main import load, preload_models
 from immich_ml.models.base import InferenceModel
 from immich_ml.models.cache import ModelCache
@@ -26,6 +26,9 @@ from immich_ml.models.clip.textual import MClipTextualEncoder, OpenClipTextualEn
 from immich_ml.models.clip.visual import OpenClipVisualEncoder
 from immich_ml.models.facial_recognition.detection import FaceDetector
 from immich_ml.models.facial_recognition.recognition import FaceRecognizer
+from immich_ml.models.ocr.detection import TextDetector
+from immich_ml.models.ocr.recognition import TextRecognizer
+from immich_ml.models.ocr.schemas import OcrOptions
 from immich_ml.schemas import ModelFormat, ModelPrecision, ModelTask, ModelType
 from immich_ml.sessions.ann import AnnSession
 from immich_ml.sessions.ort import OrtSession
@@ -201,13 +204,6 @@ class TestOrtSession:
 
         assert session.providers == self.OV_EP
 
-    @pytest.mark.ov_device_ids(["CPU"])
-    @pytest.mark.providers(OV_EP)
-    def test_avoids_openvino_if_gpu_not_available(self, providers: list[str], ov_device_ids: list[str]) -> None:
-        session = OrtSession("ViT-B-32__openai")
-
-        assert session.providers == self.CPU_EP
-
     @pytest.mark.providers(CUDA_EP_OUT_OF_ORDER)
     def test_sets_providers_in_correct_order(self, providers: list[str]) -> None:
         session = OrtSession("ViT-B-32__openai")
@@ -253,7 +249,8 @@ class TestOrtSession:
             {"arena_extend_strategy": "kSameAsRequested"},
         ]
 
-    def test_sets_provider_options_for_openvino(self) -> None:
+    @pytest.mark.ov_device_ids(["GPU.0", "GPU.1", "CPU"])
+    def test_sets_provider_options_for_openvino(self, ov_device_ids: list[str]) -> None:
         model_path = "/cache/ViT-B-32__openai/textual/model.onnx"
         os.environ["MACHINE_LEARNING_DEVICE_ID"] = "1"
 
@@ -267,7 +264,8 @@ class TestOrtSession:
             }
         ]
 
-    def test_sets_openvino_to_fp16_if_enabled(self, mocker: MockerFixture) -> None:
+    @pytest.mark.ov_device_ids(["GPU.0", "GPU.1", "CPU"])
+    def test_sets_openvino_to_fp16_if_enabled(self, ov_device_ids: list[str], mocker: MockerFixture) -> None:
         model_path = "/cache/ViT-B-32__openai/textual/model.onnx"
         os.environ["MACHINE_LEARNING_DEVICE_ID"] = "1"
         mocker.patch.object(settings, "openvino_precision", ModelPrecision.FP16)
@@ -282,6 +280,19 @@ class TestOrtSession:
             }
         ]
 
+    @pytest.mark.ov_device_ids(["CPU"])
+    def test_sets_provider_options_for_openvino_cpu(self, ov_device_ids: list[str]) -> None:
+        model_path = "/cache/ViT-B-32__openai/model.onnx"
+        session = OrtSession(model_path, providers=["OpenVINOExecutionProvider"])
+
+        assert session.provider_options == [
+            {
+                "device_type": "CPU",
+                "precision": "FP32",
+                "cache_dir": "/cache/ViT-B-32__openai/openvino",
+            }
+        ]
+
     def test_sets_provider_options_for_cuda(self) -> None:
         os.environ["MACHINE_LEARNING_DEVICE_ID"] = "1"
 
@@ -338,6 +349,23 @@ class TestOrtSession:
         assert session.sess_options.inter_op_num_threads == 1
         assert session.sess_options.intra_op_num_threads == 2
 
+    @pytest.mark.ov_device_ids(["CPU"])
+    def test_sets_default_sess_options_if_openvino_cpu(self, ov_device_ids: list[str]) -> None:
+        model_path = "/cache/ViT-B-32__openai/model.onnx"
+        session = OrtSession(model_path, providers=["OpenVINOExecutionProvider"])
+
+        assert session.sess_options.execution_mode == ort.ExecutionMode.ORT_SEQUENTIAL
+        assert session.sess_options.inter_op_num_threads == 0
+        assert session.sess_options.intra_op_num_threads == 0
+
+    @pytest.mark.ov_device_ids(["GPU.0", "CPU"])
+    def test_sets_default_sess_options_if_openvino_gpu(self, ov_device_ids: list[str]) -> None:
+        model_path = "/cache/ViT-B-32__openai/model.onnx"
+        session = OrtSession(model_path, providers=["OpenVINOExecutionProvider"])
+
+        assert session.sess_options.inter_op_num_threads == 0
+        assert session.sess_options.intra_op_num_threads == 0
+
     def test_sets_default_sess_options_does_not_set_threads_if_non_cpu_and_default_threads(self) -> None:
         session = OrtSession("ViT-B-32__openai", providers=["CUDAExecutionProvider", "CPUExecutionProvider"])
 
@@ -855,6 +883,78 @@ class TestFaceRecognition:
         onnx.load.assert_not_called()
         onnx.save.assert_not_called()
 
+    def test_set_custom_max_batch_size(self, mocker: MockerFixture) -> None:
+        mocker.patch.object(settings, "max_batch_size", MaxBatchSize(facial_recognition=2))
+
+        recognizer = FaceRecognizer("buffalo_l", cache_dir="test_cache")
+
+        assert recognizer.batch_size == 2
+
+    def test_ignore_other_custom_max_batch_size(self, mocker: MockerFixture) -> None:
+        mocker.patch.object(settings, "max_batch_size", MaxBatchSize(ocr=2))
+
+        recognizer = FaceRecognizer("buffalo_l", cache_dir="test_cache")
+
+        assert recognizer.batch_size is None
+
+
+class TestOcr:
+    def test_set_det_min_score(self, path: mock.Mock) -> None:
+        path.return_value.__truediv__.return_value.__truediv__.return_value.suffix = ".onnx"
+
+        text_detector = TextDetector("PP-OCRv5_mobile", min_score=0.8, cache_dir="test_cache")
+
+        assert text_detector.postprocess.box_thresh == 0.8
+
+    def test_set_rec_min_score(self, path: mock.Mock) -> None:
+        path.return_value.__truediv__.return_value.__truediv__.return_value.suffix = ".onnx"
+
+        text_recognizer = TextRecognizer("PP-OCRv5_mobile", min_score=0.8, cache_dir="test_cache")
+
+        assert text_recognizer.min_score == 0.8
+
+    def test_set_rec_set_default_max_batch_size(
+        self, ort_session: mock.Mock, path: mock.Mock, mocker: MockerFixture
+    ) -> None:
+        path.return_value.__truediv__.return_value.__truediv__.return_value.suffix = ".onnx"
+        mocker.patch("immich_ml.models.base.InferenceModel.download")
+        rapid_recognizer = mocker.patch("immich_ml.models.ocr.recognition.RapidTextRecognizer")
+
+        text_recognizer = TextRecognizer("PP-OCRv5_mobile", cache_dir="test_cache")
+        text_recognizer.load()
+
+        rapid_recognizer.assert_called_once_with(
+            OcrOptions(session=ort_session.return_value, rec_batch_num=6, rec_img_shape=(3, 48, 320))
+        )
+
+    def test_set_custom_max_batch_size(self, ort_session: mock.Mock, path: mock.Mock, mocker: MockerFixture) -> None:
+        path.return_value.__truediv__.return_value.__truediv__.return_value.suffix = ".onnx"
+        mocker.patch("immich_ml.models.base.InferenceModel.download")
+        rapid_recognizer = mocker.patch("immich_ml.models.ocr.recognition.RapidTextRecognizer")
+        mocker.patch.object(settings, "max_batch_size", MaxBatchSize(ocr=4))
+
+        text_recognizer = TextRecognizer("PP-OCRv5_mobile", cache_dir="test_cache")
+        text_recognizer.load()
+
+        rapid_recognizer.assert_called_once_with(
+            OcrOptions(session=ort_session.return_value, rec_batch_num=4, rec_img_shape=(3, 48, 320))
+        )
+
+    def test_ignore_other_custom_max_batch_size(
+        self, ort_session: mock.Mock, path: mock.Mock, mocker: MockerFixture
+    ) -> None:
+        path.return_value.__truediv__.return_value.__truediv__.return_value.suffix = ".onnx"
+        mocker.patch("immich_ml.models.base.InferenceModel.download")
+        rapid_recognizer = mocker.patch("immich_ml.models.ocr.recognition.RapidTextRecognizer")
+        mocker.patch.object(settings, "max_batch_size", MaxBatchSize(facial_recognition=3))
+
+        text_recognizer = TextRecognizer("PP-OCRv5_mobile", cache_dir="test_cache")
+        text_recognizer.load()
+
+        rapid_recognizer.assert_called_once_with(
+            OcrOptions(session=ort_session.return_value, rec_batch_num=6, rec_img_shape=(3, 48, 320))
+        )
+
 
 @pytest.mark.asyncio
 class TestCache:

machine-learning/uv.lock

@@ -262,18 +262,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
 ]
 
-[[package]]
-name = "coloredlogs"
-version = "15.0.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "humanfriendly" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/cc/c7/eed8f27100517e8c0e6b923d5f0845d0cb99763da6fdee00478f91db7325/coloredlogs-15.0.1.tar.gz", hash = "sha256:7c991aa71a4577af2f82600d8f8f3a89f936baeaf9b50a9c197da014e5bf16b0", size = 278520, upload-time = "2021-06-11T10:22:45.202Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/a7/06/3d6badcf13db419e25b07041d9c7b4a2c331d3f4e7134445ec5df57714cd/coloredlogs-15.0.1-py2.py3-none-any.whl", hash = "sha256:612ee75c546f53e92e70049c9dbfcc18c935a2b9a53b66085ce9ef6a6e5c0934", size = 46018, upload-time = "2021-06-11T10:22:42.561Z" },
-]
-
 [[package]]
 name = "colorlog"
 version = "6.9.0"
@@ -886,18 +874,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a8/af/48ac8483240de756d2438c380746e7130d1c6f75802ef22f3c6d49982787/huggingface_hub-0.36.2-py3-none-any.whl", hash = "sha256:48f0c8eac16145dfce371e9d2d7772854a4f591bcb56c9cf548accf531d54270", size = 566395, upload-time = "2026-02-06T09:24:11.133Z" },
 ]
 
-[[package]]
-name = "humanfriendly"
-version = "10.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "pyreadline3", marker = "sys_platform == 'win32'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/cc/3f/2c29224acb2e2df4d2046e4c73ee2662023c58ff5b113c4c1adac0886c43/humanfriendly-10.0.tar.gz", hash = "sha256:6b0b831ce8f15f7300721aa49829fc4e83921a9a301cc7f606be6686a2288ddc", size = 360702, upload-time = "2021-09-17T21:40:43.31Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f0/0f/310fb31e39e2d734ccaa2c0fb981ee41f7bd5056ce9bc29b2248bd569169/humanfriendly-10.0-py2.py3-none-any.whl", hash = "sha256:1697e1a8a8f550fd43c2865cd84542fc175a61dcb779b6fee18cf6b6ccba1477", size = 86794, upload-time = "2021-09-17T21:40:39.897Z" },
-]
-
 [[package]]
 name = "idna"
 version = "3.11"
@@ -1017,7 +993,7 @@ requires-dist = [
     { name = "onnxruntime", marker = "extra == 'rknn'", specifier = ">=1.23.2,<2" },
     { name = "onnxruntime-gpu", marker = "extra == 'cuda'", specifier = ">=1.23.2,<2" },
     { name = "onnxruntime-migraphx", marker = "extra == 'rocm'", specifier = ">=1.23.2,<2" },
-    { name = "onnxruntime-openvino", marker = "extra == 'openvino'", specifier = ">=1.23.0,<2" },
+    { name = "onnxruntime-openvino", marker = "extra == 'openvino'", specifier = ">=1.24.1,<2" },
     { name = "opencv-python-headless", specifier = ">=4.7.0.72,<5.0" },
     { name = "orjson", specifier = ">=3.9.5" },
     { name = "pillow", specifier = ">=12.1.1,<12.2" },
@@ -1748,10 +1724,9 @@ wheels = [
 
 [[package]]
 name = "onnxruntime-openvino"
-version = "1.23.0"
+version = "1.24.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "coloredlogs" },
     { name = "flatbuffers" },
     { name = "numpy" },
     { name = "packaging" },
@@ -1759,12 +1734,12 @@ dependencies = [
     { name = "sympy" },
 ]
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5a/10/adcd4ac68ffc8dee003553125ef5c091be822e2d7c1077d0bb85690baa9c/onnxruntime_openvino-1.23.0-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:91938837e6e92e30c63d12fad68a8a4959c40d2eade2bd60f38bdd5b6392f8d3", size = 70481480, upload-time = "2025-10-14T15:19:45.882Z" },
-    { url = "https://files.pythonhosted.org/packages/97/95/25f28d6fecf300aa0af393e96af9e00cc676e5dab650ab84f2122610df50/onnxruntime_openvino-1.23.0-cp311-cp311-win_amd64.whl", hash = "sha256:8f05d2d6a804fb70d3f4329d777ac62439773dcc2df827dd5f42644b10bf1fea", size = 13117353, upload-time = "2025-10-14T15:19:49.014Z" },
-    { url = "https://files.pythonhosted.org/packages/42/0c/8d97419dfeedf419c5fe5293f3dbc59284855a63ad22e71f46c0010c9dc4/onnxruntime_openvino-1.23.0-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:b963ea19bf9856f3d6b2f719d451f2eeae482a8f69c729906465aa4f27f4d39c", size = 70483359, upload-time = "2025-10-14T15:19:52.88Z" },
-    { url = "https://files.pythonhosted.org/packages/29/30/ff6111b16ffb4187c462824aa4e95acc20fdd90f856d44a339d56c6dacd6/onnxruntime_openvino-1.23.0-cp312-cp312-win_amd64.whl", hash = "sha256:937e52657f94c56990a6e5bd4c3705bd6e970834c7c94e23d300dde6848f2889", size = 13117933, upload-time = "2025-10-14T15:19:58.319Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/48/e42f618a8ec5fcf825fed4fdc8125f7105256cc6020b84567ecb88d5e2b7/onnxruntime_openvino-1.23.0-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:2e93b9a8323e196b7433866054a59260f2206ab6fb0e7223dda91da71f1db8c5", size = 70483088, upload-time = "2025-10-14T15:20:02.425Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/f9/a531dc497dc113dc14df9a9de5aacb1676cadebc3ec6cc7cd3ca65cb3db0/onnxruntime_openvino-1.23.0-cp313-cp313-win_amd64.whl", hash = "sha256:0ebbf70929de4ce269371cb255536bbedef588932d744da0b40e66c38a620f35", size = 13118206, upload-time = "2025-10-14T15:20:05.587Z" },
+    { url = "https://files.pythonhosted.org/packages/99/16/69ca742f0b65c40d4de3ff44bb6abc23c47b23e932bc901116176ae69922/onnxruntime_openvino-1.24.1-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:3007c803634cc69c6d52af1dea7ce729d9bb62b9a11070fd2f959119199007a8", size = 84430935, upload-time = "2026-02-26T13:44:32.193Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/73/619bb416bbfc40aebdd493fd6800d2637359294fe683d8a6bae3ff8d869a/onnxruntime_openvino-1.24.1-cp311-cp311-win_amd64.whl", hash = "sha256:8042698232bf67f1f6b219c2b07728d7ae7ddff17d8524588de3675480609aef", size = 13655357, upload-time = "2026-02-26T13:44:35.555Z" },
+    { url = "https://files.pythonhosted.org/packages/50/cf/17ba72de2df0fcba349937d2788f154397bbc2d1a2d67772a97e26f6bc5f/onnxruntime_openvino-1.24.1-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:d617fac2f59a6ab5ea59a788c3e1592240a129642519aaeaa774761dfe35150e", size = 84433207, upload-time = "2026-02-26T13:44:41.395Z" },
+    { url = "https://files.pythonhosted.org/packages/59/37/d301f2c68b19a9485ed5db3047e0fb52478f3e73eb08c7d2a7c61be7cc1c/onnxruntime_openvino-1.24.1-cp312-cp312-win_amd64.whl", hash = "sha256:f186335a9c9b255633275290da7521d3d4d14c7773fee3127bfa040234d3fa5a", size = 13658075, upload-time = "2026-02-26T13:44:44.905Z" },
+    { url = "https://files.pythonhosted.org/packages/08/07/f225999919f56506b603aaa3ff837ad563ab26f86906ed7fa7e5abcd849e/onnxruntime_openvino-1.24.1-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:2c3bb73e68ac27f4891af8a595c1faf574ec68b772e6583c90a0b997a1822782", size = 84433183, upload-time = "2026-02-26T13:44:50.254Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/92/46ae2cd565961a89189900f385bb2f13a9fa731ea4674001d23720fbb1e0/onnxruntime_openvino-1.24.1-cp313-cp313-win_amd64.whl", hash = "sha256:434bf49aa71393c577a456c9d76c98e6d6958a833fa0876793e3d5437b5a511a", size = 13658485, upload-time = "2026-02-26T13:44:53.889Z" },
 ]
 
 [[package]]
@@ -2204,15 +2179,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/39/92/8486ede85fcc088f1b3dba4ce92dd29d126fd96b0008ea213167940a2475/pyparsing-3.1.1-py3-none-any.whl", hash = "sha256:32c7c0b711493c72ff18a981d24f28aaf9c1fb7ed5e9667c9e84e3db623bdbfb", size = 103139, upload-time = "2023-07-30T15:06:59.829Z" },
 ]
 
-[[package]]
-name = "pyreadline3"
-version = "3.4.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/d7/86/3d61a61f36a0067874a00cb4dceb9028d34b6060e47828f7fc86fb9f7ee9/pyreadline3-3.4.1.tar.gz", hash = "sha256:6f3d1f7b8a31ba32b73917cefc1f28cc660562f39aea8646d30bd6eff21f7bae", size = 86465, upload-time = "2022-01-24T20:05:11.66Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/56/fc/a3c13ded7b3057680c8ae95a9b6cc83e63657c38e0005c400a5d018a33a7/pyreadline3-3.4.1-py3-none-any.whl", hash = "sha256:b0efb6516fd4fb07b45949053826a62fa4cb353db5be2bbb4a7aa1fdd1e345fb", size = 95203, upload-time = "2022-01-24T20:05:10.442Z" },
-]
-
 [[package]]
 name = "pytest"
 version = "9.0.2"

mise.toml

@@ -16,9 +16,9 @@ config_roots = [
 [tools]
 node = "24.13.1"
 flutter = "3.35.7"
-pnpm = "10.30.0"
-terragrunt = "0.98.0"
-opentofu = "1.11.4"
+pnpm = "10.30.3"
+terragrunt = "0.99.4"
+opentofu = "1.11.5"
 java = "21.0.2"
 
 [tools."github:CQLabs/homebrew-dcm"]

mobile/analysis_options.yaml

@@ -9,7 +9,7 @@
 # packages, and plugins designed to encourage good coding practices.
 include: package:flutter_lints/flutter.yaml
 
-formatter:  
+formatter:
   page_width: 120
 
 linter:
@@ -33,6 +33,7 @@ linter:
     require_trailing_commas: true
     unrelated_type_equality_checks: true
     prefer_const_constructors: true
+    always_use_package_imports: true
 
 # Additional information about this file can be found at
 # https://dart.dev/guides/language/analysis-options

mobile/android/app/build.gradle

@@ -3,6 +3,7 @@ plugins {
   id "kotlin-android"
   id "dev.flutter.flutter-gradle-plugin"
   id 'com.google.devtools.ksp'
+  id 'org.jetbrains.kotlin.plugin.serialization'
   id 'org.jetbrains.kotlin.plugin.compose' version '2.0.20' // this version matches your Kotlin version
 
 }
@@ -81,6 +82,7 @@ android {
 
     release {
       signingConfig signingConfigs.release
+      proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
     }
   }
   namespace 'app.alextran.immich'

mobile/android/app/proguard-rules.pro

@@ -36,4 +36,12 @@
 ##---------------End: proguard configuration for Gson  ----------
 
 # Keep all widget model classes and their fields for Gson
--keep class app.alextran.immich.widget.model.** { *; }
+-keep class app.alextran.immich.widget.model.** { *; }
+
+##---------------Begin: proguard configuration for ok_http JNI ----------
+# The ok_http Dart plugin accesses OkHttp and Okio classes via JNI
+# string-based reflection (JClass.forName), which R8 cannot trace.
+-keep class okhttp3.** { *; }
+-keep class okio.** { *; }
+-keep class com.example.ok_http.** { *; }
+##---------------End: proguard configuration for ok_http JNI ----------

mobile/android/app/src/main/cpp/native_buffer.c

@@ -36,3 +36,17 @@ Java_app_alextran_immich_NativeBuffer_copy(
         memcpy((void *) destAddress, (char *) src + offset, length);
     }
 }
+
+/**
+ * Creates a JNI global reference to the given object and returns its address.
+ * The caller is responsible for deleting the global reference when it's no longer needed.
+ */
+JNIEXPORT jlong JNICALL
+Java_app_alextran_immich_NativeBuffer_createGlobalRef(JNIEnv *env, jobject clazz, jobject obj) {
+    if (obj == NULL) {
+        return 0;
+    }
+
+    jobject globalRef = (*env)->NewGlobalRef(env, obj);
+    return (jlong) globalRef;
+}

mobile/android/app/src/main/kotlin/app/alextran/immich/NativeBuffer.kt

@@ -23,6 +23,9 @@ object NativeBuffer {
 
   @JvmStatic
   external fun copy(buffer: ByteBuffer, destAddress: Long, offset: Int, length: Int)
+
+  @JvmStatic
+  external fun createGlobalRef(obj: Any): Long
 }
 
 class NativeByteBuffer(initialCapacity: Int) {

mobile/android/app/src/main/kotlin/app/alextran/immich/core/HttpClientManager.kt

@@ -1,11 +1,23 @@
 package app.alextran.immich.core
 
 import android.content.Context
+import android.content.SharedPreferences
+import android.security.KeyChain
+import androidx.core.content.edit
 import app.alextran.immich.BuildConfig
+import app.alextran.immich.NativeBuffer
 import okhttp3.Cache
 import okhttp3.ConnectionPool
+import okhttp3.Cookie
+import okhttp3.CookieJar
+import okhttp3.Credentials
 import okhttp3.Dispatcher
+import okhttp3.Headers
+import okhttp3.HttpUrl
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.OkHttpClient
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
 import java.io.ByteArrayInputStream
 import java.io.File
 import java.net.Socket
@@ -20,8 +32,24 @@ import javax.net.ssl.TrustManagerFactory
 import javax.net.ssl.X509KeyManager
 import javax.net.ssl.X509TrustManager
 
-const val CERT_ALIAS = "client_cert"
 const val USER_AGENT = "Immich_Android_${BuildConfig.VERSION_NAME}"
+private const val CERT_ALIAS = "client_cert"
+private const val PREFS_NAME = "immich.ssl"
+private const val PREFS_CERT_ALIAS = "immich.client_cert"
+private const val PREFS_HEADERS = "immich.request_headers"
+private const val PREFS_SERVER_URLS = "immich.server_urls"
+private const val PREFS_COOKIES = "immich.cookies"
+private const val COOKIE_EXPIRY_DAYS = 400L
+
+private enum class AuthCookie(val cookieName: String, val httpOnly: Boolean) {
+  ACCESS_TOKEN("immich_access_token", httpOnly = true),
+  IS_AUTHENTICATED("immich_is_authenticated", httpOnly = false),
+  AUTH_TYPE("immich_auth_type", httpOnly = true);
+
+  companion object {
+    val names = entries.map { it.cookieName }.toSet()
+  }
+}
 
 /**
  * Manages a shared OkHttpClient with SSL configuration support.
@@ -35,23 +63,71 @@ object HttpClientManager {
   private var initialized = false
   private val clientChangedListeners = mutableListOf<() -> Unit>()
 
-  private lateinit var client: OkHttpClient
+  @JvmStatic
+  lateinit var client: OkHttpClient
+    private set
+  private lateinit var appContext: Context
+  private lateinit var prefs: SharedPreferences
 
   private val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
 
-  val isMtls: Boolean get() = keyStore.containsAlias(CERT_ALIAS)
+  var keyChainAlias: String? = null
+    private set
+
+  var headers: Headers = Headers.headersOf()
+    private set
+
+  private val cookieJar = PersistentCookieJar()
+
+  val isMtls: Boolean get() = keyChainAlias != null || keyStore.containsAlias(CERT_ALIAS)
+
+  val serverUrl: String? get() = if (initialized) prefs.getString(PREFS_SERVER_URLS, null)
+    ?.let { Json.decodeFromString<List<String>>(it).firstOrNull() } else null
 
   fun initialize(context: Context) {
     if (initialized) return
     synchronized(this) {
       if (initialized) return
 
+      appContext = context.applicationContext
+      prefs = appContext.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+      keyChainAlias = prefs.getString(PREFS_CERT_ALIAS, null)
+
+      cookieJar.init(prefs)
+
+      val savedHeaders = prefs.getString(PREFS_HEADERS, null)
+      if (savedHeaders != null) {
+        val map = Json.decodeFromString<Map<String, String>>(savedHeaders)
+        val builder = Headers.Builder()
+        for ((key, value) in map) {
+          builder.add(key, value)
+        }
+        headers = builder.build()
+      }
+
+      val serverUrlsJson = prefs.getString(PREFS_SERVER_URLS, null)
+      if (serverUrlsJson != null) {
+        cookieJar.setServerUrls(Json.decodeFromString<List<String>>(serverUrlsJson))
+      }
+
       val cacheDir = File(File(context.cacheDir, "okhttp"), "api")
       client = build(cacheDir)
       initialized = true
     }
   }
 
+  fun setKeyChainAlias(alias: String) {
+    synchronized(this) {
+      val wasMtls = isMtls
+      keyChainAlias = alias
+      prefs.edit { putString(PREFS_CERT_ALIAS, alias) }
+
+      if (wasMtls != isMtls) {
+        clientChangedListeners.forEach { it() }
+      }
+    }
+  }
+
   fun setKeyEntry(clientData: ByteArray, password: CharArray) {
     synchronized(this) {
       val wasMtls = isMtls
@@ -63,7 +139,7 @@ object HttpClientManager {
       val key = tmpKeyStore.getKey(tmpAlias, password)
       val chain = tmpKeyStore.getCertificateChain(tmpAlias)
 
-      if (wasMtls) {
+      if (keyStore.containsAlias(CERT_ALIAS)) {
         keyStore.deleteEntry(CERT_ALIAS)
       }
       keyStore.setKeyEntry(CERT_ALIAS, key, null, chain)
@@ -75,24 +151,78 @@ object HttpClientManager {
 
   fun deleteKeyEntry() {
     synchronized(this) {
-      if (!isMtls) {
-        return
+      val wasMtls = isMtls
+
+      if (keyChainAlias != null) {
+        keyChainAlias = null
+        prefs.edit { remove(PREFS_CERT_ALIAS) }
       }
 
       keyStore.deleteEntry(CERT_ALIAS)
-      clientChangedListeners.forEach { it() }
+
+      if (wasMtls) {
+        clientChangedListeners.forEach { it() }
+      }
     }
   }
 
-  @JvmStatic
-  fun getClient(): OkHttpClient {
-    return client
+  private var clientGlobalRef: Long = 0L
+
+  fun getClientPointer(): Long {
+    if (clientGlobalRef == 0L) {
+      clientGlobalRef = NativeBuffer.createGlobalRef(client)
+    }
+    return clientGlobalRef
   }
 
   fun addClientChangedListener(listener: () -> Unit) {
     synchronized(this) { clientChangedListeners.add(listener) }
   }
 
+  fun setRequestHeaders(headerMap: Map<String, String>, serverUrls: List<String>, token: String?) {
+    synchronized(this) {
+      val builder = Headers.Builder()
+      headerMap.forEach { (key, value) -> builder[key] = value }
+      val newHeaders = builder.build()
+
+      val headersChanged = headers != newHeaders
+      val urlsChanged = Json.encodeToString(serverUrls) != prefs.getString(PREFS_SERVER_URLS, null)
+
+      headers = newHeaders
+      cookieJar.setServerUrls(serverUrls)
+
+      if (headersChanged || urlsChanged) {
+        prefs.edit {
+          putString(PREFS_HEADERS, Json.encodeToString(headerMap))
+          putString(PREFS_SERVER_URLS, Json.encodeToString(serverUrls))
+        }
+      }
+
+      if (token != null) {
+        val url = serverUrls.firstNotNullOfOrNull { it.toHttpUrlOrNull() } ?: return
+        val expiry = System.currentTimeMillis() + COOKIE_EXPIRY_DAYS * 24 * 60 * 60 * 1000
+        val values = mapOf(
+          AuthCookie.ACCESS_TOKEN to token,
+          AuthCookie.IS_AUTHENTICATED to "true",
+          AuthCookie.AUTH_TYPE to "password",
+        )
+        cookieJar.saveFromResponse(url, values.map { (cookie, value) ->
+          Cookie.Builder().name(cookie.cookieName).value(value).domain(url.host).path("/").expiresAt(expiry)
+            .apply {
+              if (url.isHttps) secure()
+              if (cookie.httpOnly) httpOnly()
+            }.build()
+        })
+      }
+    }
+  }
+
+  fun loadCookieHeader(url: String): String? {
+    val httpUrl = url.toHttpUrlOrNull() ?: return null
+    return cookieJar.loadForRequest(httpUrl).takeIf { it.isNotEmpty() }
+      ?.joinToString("; ") { "${it.name}=${it.value}" }
+  }
+
   private fun build(cacheDir: File): OkHttpClient {
     val connectionPool = ConnectionPool(
       maxIdleConnections = KEEP_ALIVE_CONNECTIONS,
@@ -109,8 +239,17 @@ object HttpClientManager {
     HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.socketFactory)
 
     return OkHttpClient.Builder()
-      .addInterceptor { chain ->
-        chain.proceed(chain.request().newBuilder().header("User-Agent", USER_AGENT).build())
+      .cookieJar(cookieJar)
+      .addInterceptor {
+        val request = it.request()
+        val builder = request.newBuilder()
+        builder.header("User-Agent", USER_AGENT)
+        headers.forEach { (key, value) -> builder.header(key, value) }
+        val url = request.url
+        if (url.username.isNotEmpty()) {
+          builder.header("Authorization", Credentials.basic(url.username, url.password))
+        }
+        it.proceed(builder.build())
       }
       .connectionPool(connectionPool)
       .dispatcher(Dispatcher().apply { maxRequestsPerHost = MAX_REQUESTS_PER_HOST })
@@ -119,23 +258,39 @@ object HttpClientManager {
       .build()
   }
 
-  // Reads from the key store rather than taking a snapshot at initialization time
+  /**
+   * Resolves client certificates dynamically at TLS handshake time.
+   * Checks the system KeyChain alias first, then falls back to the app's private KeyStore.
+   */
   private class DynamicKeyManager : X509KeyManager {
-    override fun getClientAliases(keyType: String, issuers: Array<Principal>?): Array<String>? =
-      if (isMtls) arrayOf(CERT_ALIAS) else null
+    override fun getClientAliases(keyType: String, issuers: Array<Principal>?): Array<String>? {
+      val alias = chooseClientAlias(arrayOf(keyType), issuers, null) ?: return null
+      return arrayOf(alias)
+    }
 
     override fun chooseClientAlias(
       keyTypes: Array<String>,
       issuers: Array<Principal>?,
       socket: Socket?
-    ): String? =
-      if (isMtls) CERT_ALIAS else null
+    ): String? {
+      keyChainAlias?.let { return it }
+      if (keyStore.containsAlias(CERT_ALIAS)) return CERT_ALIAS
+      return null
+    }
 
-    override fun getCertificateChain(alias: String): Array<X509Certificate>? =
-      keyStore.getCertificateChain(alias)?.map { it as X509Certificate }?.toTypedArray()
+    override fun getCertificateChain(alias: String): Array<X509Certificate>? {
+      if (alias == keyChainAlias) {
+        return KeyChain.getCertificateChain(appContext, alias)
+      }
+      return keyStore.getCertificateChain(alias)?.map { it as X509Certificate }?.toTypedArray()
+    }
 
-    override fun getPrivateKey(alias: String): PrivateKey? =
-      keyStore.getKey(alias, null) as? PrivateKey
+    override fun getPrivateKey(alias: String): PrivateKey? {
+      if (alias == keyChainAlias) {
+        return KeyChain.getPrivateKey(appContext, alias)
+      }
+      return keyStore.getKey(alias, null) as? PrivateKey
+    }
 
     override fun getServerAliases(keyType: String, issuers: Array<Principal>?): Array<String>? =
       null
@@ -146,4 +301,131 @@ object HttpClientManager {
       socket: Socket?
     ): String? = null
   }
+
+  /**
+   * Persistent CookieJar that duplicates auth cookies across equivalent server URLs.
+   * When the server sets cookies for one domain, copies are created for all other known
+   * server domains (for URL switching between local/remote endpoints of the same server).
+   */
+  private class PersistentCookieJar : CookieJar {
+    private val store = mutableListOf<Cookie>()
+    private var serverUrls = listOf<HttpUrl>()
+    private var prefs: SharedPreferences? = null
+
+
+    fun init(prefs: SharedPreferences) {
+      this.prefs = prefs
+      restore()
+    }
+
+    @Synchronized
+    fun setServerUrls(urls: List<String>) {
+      val parsed = urls.mapNotNull { it.toHttpUrlOrNull() }
+      if (parsed.map { it.host } == serverUrls.map { it.host }) return
+      serverUrls = parsed
+      if (syncAuthCookies()) persist()
+    }
+
+    @Synchronized
+    override fun saveFromResponse(url: HttpUrl, cookies: List<Cookie>) {
+      val changed = cookies.any { new ->
+        store.none { it.name == new.name && it.domain == new.domain && it.path == new.path && it.value == new.value }
+      }
+      store.removeAll { existing ->
+        cookies.any { it.name == existing.name && it.domain == existing.domain && it.path == existing.path }
+      }
+      store.addAll(cookies)
+      val synced = serverUrls.any { it.host == url.host } && syncAuthCookies()
+      if (changed || synced) persist()
+    }
+
+    @Synchronized
+    override fun loadForRequest(url: HttpUrl): List<Cookie> {
+      val now = System.currentTimeMillis()
+      if (store.removeAll { it.expiresAt < now }) {
+        syncAuthCookies()
+        persist()
+      }
+      return store.filter { it.matches(url) }
+    }
+
+    private fun syncAuthCookies(): Boolean {
+      val serverHosts = serverUrls.map { it.host }.toSet()
+      val now = System.currentTimeMillis()
+      val sourceCookies = store
+        .filter { it.name in AuthCookie.names && it.domain in serverHosts && it.expiresAt > now }
+        .associateBy { it.name }
+
+      if (sourceCookies.isEmpty()) {
+        return store.removeAll { it.name in AuthCookie.names && it.domain in serverHosts }
+      }
+
+      var changed = false
+      for (url in serverUrls) {
+        for ((_, source) in sourceCookies) {
+          if (store.any { it.name == source.name && it.domain == url.host && it.value == source.value }) continue
+          store.removeAll { it.name == source.name && it.domain == url.host }
+          store.add(rebuildCookie(source, url))
+          changed = true
+        }
+      }
+      return changed
+    }
+
+    private fun rebuildCookie(source: Cookie, url: HttpUrl): Cookie {
+      return Cookie.Builder()
+        .name(source.name).value(source.value)
+        .domain(url.host).path("/")
+        .expiresAt(source.expiresAt)
+        .apply {
+          if (url.isHttps) secure()
+          if (source.httpOnly) httpOnly()
+        }
+        .build()
+    }
+
+    private fun persist() {
+      val p = prefs ?: return
+      p.edit { putString(PREFS_COOKIES, Json.encodeToString(store.map { SerializedCookie.from(it) })) }
+    }
+
+    private fun restore() {
+      val p = prefs ?: return
+      val jsonStr = p.getString(PREFS_COOKIES, null) ?: return
+      try {
+        store.addAll(Json.decodeFromString<List<SerializedCookie>>(jsonStr).map { it.toCookie() })
+      } catch (_: Exception) {
+        store.clear()
+      }
+    }
+  }
+
+  @Serializable
+  private data class SerializedCookie(
+    val name: String,
+    val value: String,
+    val domain: String,
+    val path: String,
+    val expiresAt: Long,
+    val secure: Boolean,
+    val httpOnly: Boolean,
+    val hostOnly: Boolean,
+  ) {
+    fun toCookie(): Cookie = Cookie.Builder()
+      .name(name).value(value).path(path).expiresAt(expiresAt)
+      .apply {
+        if (hostOnly) hostOnlyDomain(domain) else domain(domain)
+        if (secure) secure()
+        if (httpOnly) httpOnly()
+      }
+      .build()
+
+    companion object {
+      fun from(cookie: Cookie) = SerializedCookie(
+        name = cookie.name, value = cookie.value, domain = cookie.domain,
+        path = cookie.path, expiresAt = cookie.expiresAt, secure = cookie.secure,
+        httpOnly = cookie.httpOnly, hostOnly = cookie.hostOnly,
+      )
+    }
+  }
 }

mobile/android/app/src/main/kotlin/app/alextran/immich/core/Network.g.kt

@@ -180,8 +180,11 @@ private open class NetworkPigeonCodec : StandardMessageCodec() {
 /** Generated interface from Pigeon that represents a handler of messages from Flutter. */
 interface NetworkApi {
   fun addCertificate(clientData: ClientCertData, callback: (Result<Unit>) -> Unit)
-  fun selectCertificate(promptText: ClientCertPrompt, callback: (Result<ClientCertData>) -> Unit)
+  fun selectCertificate(promptText: ClientCertPrompt, callback: (Result<Unit>) -> Unit)
   fun removeCertificate(callback: (Result<Unit>) -> Unit)
+  fun hasCertificate(): Boolean
+  fun getClientPointer(): Long
+  fun setRequestHeaders(headers: Map<String, String>, serverUrls: List<String>, token: String?)
 
   companion object {
     /** The codec used by NetworkApi. */
@@ -217,13 +220,12 @@ interface NetworkApi {
           channel.setMessageHandler { message, reply ->
             val args = message as List<Any?>
             val promptTextArg = args[0] as ClientCertPrompt
-            api.selectCertificate(promptTextArg) { result: Result<ClientCertData> ->
+            api.selectCertificate(promptTextArg) { result: Result<Unit> ->
               val error = result.exceptionOrNull()
               if (error != null) {
                 reply.reply(NetworkPigeonUtils.wrapError(error))
               } else {
-                val data = result.getOrNull()
-                reply.reply(NetworkPigeonUtils.wrapResult(data))
+                reply.reply(NetworkPigeonUtils.wrapResult(null))
               }
             }
           }
@@ -248,6 +250,56 @@ interface NetworkApi {
           channel.setMessageHandler(null)
         }
       }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.hasCertificate$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            val wrapped: List<Any?> = try {
+              listOf(api.hasCertificate())
+            } catch (exception: Throwable) {
+              NetworkPigeonUtils.wrapError(exception)
+            }
+            reply.reply(wrapped)
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.getClientPointer$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            val wrapped: List<Any?> = try {
+              listOf(api.getClientPointer())
+            } catch (exception: Throwable) {
+              NetworkPigeonUtils.wrapError(exception)
+            }
+            reply.reply(wrapped)
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.setRequestHeaders$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val headersArg = args[0] as Map<String, String>
+            val serverUrlsArg = args[1] as List<String>
+            val tokenArg = args[2] as String?
+            val wrapped: List<Any?> = try {
+              api.setRequestHeaders(headersArg, serverUrlsArg, tokenArg)
+              listOf(null)
+            } catch (exception: Throwable) {
+              NetworkPigeonUtils.wrapError(exception)
+            }
+            reply.reply(wrapped)
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
     }
   }
 }

mobile/android/app/src/main/kotlin/app/alextran/immich/core/NetworkApiPlugin.kt

@@ -2,20 +2,9 @@ package app.alextran.immich.core
 
 import android.app.Activity
 import android.content.Context
-import android.net.Uri
 import android.os.OperationCanceledException
-import android.text.InputType
-import android.view.ContextThemeWrapper
-import android.view.ViewGroup.LayoutParams.MATCH_PARENT
-import android.view.ViewGroup.LayoutParams.WRAP_CONTENT
-import android.widget.FrameLayout
-import android.widget.LinearLayout
-import androidx.activity.ComponentActivity
-import androidx.activity.result.ActivityResultLauncher
-import androidx.activity.result.contract.ActivityResultContracts
-import com.google.android.material.dialog.MaterialAlertDialogBuilder
-import com.google.android.material.textfield.TextInputEditText
-import com.google.android.material.textfield.TextInputLayout
+import android.security.KeyChain
+import app.alextran.immich.NativeBuffer
 import io.flutter.embedding.engine.plugins.FlutterPlugin
 import io.flutter.embedding.engine.plugins.activity.ActivityAware
 import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
@@ -24,7 +13,7 @@ class NetworkApiPlugin : FlutterPlugin, ActivityAware {
   private var networkApi: NetworkApiImpl? = null
 
   override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
-    networkApi = NetworkApiImpl(binding.applicationContext)
+    networkApi = NetworkApiImpl()
     NetworkApi.setUp(binding.binaryMessenger, networkApi)
   }
 
@@ -34,48 +23,24 @@ class NetworkApiPlugin : FlutterPlugin, ActivityAware {
   }
 
   override fun onAttachedToActivity(binding: ActivityPluginBinding) {
-    networkApi?.onAttachedToActivity(binding)
+    networkApi?.activity = binding.activity
   }
 
   override fun onDetachedFromActivityForConfigChanges() {
-    networkApi?.onDetachedFromActivityForConfigChanges()
+    networkApi?.activity = null
   }
 
   override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
-    networkApi?.onReattachedToActivityForConfigChanges(binding)
+    networkApi?.activity = binding.activity
   }
 
   override fun onDetachedFromActivity() {
-    networkApi?.onDetachedFromActivity()
+    networkApi?.activity = null
   }
 }
 
-private class NetworkApiImpl(private val context: Context) : NetworkApi {
-  private var activity: Activity? = null
-  private var pendingCallback: ((Result<ClientCertData>) -> Unit)? = null
-  private var filePicker: ActivityResultLauncher<Array<String>>? = null
-  private var promptText: ClientCertPrompt? = null
-
-  fun onAttachedToActivity(binding: ActivityPluginBinding) {
-    activity = binding.activity
-    (binding.activity as? ComponentActivity)?.let { componentActivity ->
-      filePicker = componentActivity.registerForActivityResult(
-        ActivityResultContracts.OpenDocument()
-      ) { uri -> uri?.let { handlePickedFile(it) } ?: pendingCallback?.invoke(Result.failure(OperationCanceledException())) }
-    }
-  }
-
-  fun onDetachedFromActivityForConfigChanges() {
-    activity = null
-  }
-
-  fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
-    activity = binding.activity
-  }
-
-  fun onDetachedFromActivity() {
-    activity = null
-  }
+private class NetworkApiImpl : NetworkApi {
+  var activity: Activity? = null
 
   override fun addCertificate(clientData: ClientCertData, callback: (Result<Unit>) -> Unit) {
     try {
@@ -86,11 +51,19 @@ private class NetworkApiImpl(private val context: Context) : NetworkApi {
     }
   }
 
-  override fun selectCertificate(promptText: ClientCertPrompt, callback: (Result<ClientCertData>) -> Unit) {
-    val picker = filePicker ?: return callback(Result.failure(IllegalStateException("No activity")))
-    pendingCallback = callback
-    this.promptText = promptText
-    picker.launch(arrayOf("application/x-pkcs12", "application/x-pem-file"))
+  override fun selectCertificate(promptText: ClientCertPrompt, callback: (Result<Unit>) -> Unit) {
+    val currentActivity = activity
+      ?: return callback(Result.failure(IllegalStateException("No activity")))
+
+    val onAlias = { alias: String? ->
+      if (alias != null) {
+        HttpClientManager.setKeyChainAlias(alias)
+        callback(Result.success(Unit))
+      } else {
+        callback(Result.failure(OperationCanceledException()))
+      }
+    }
+    KeyChain.choosePrivateKeyAlias(currentActivity, onAlias, null, null, null, null)
   }
 
   override fun removeCertificate(callback: (Result<Unit>) -> Unit) {
@@ -98,62 +71,15 @@ private class NetworkApiImpl(private val context: Context) : NetworkApi {
     callback(Result.success(Unit))
   }
 
-  private fun handlePickedFile(uri: Uri) {
-    val callback = pendingCallback ?: return
-    pendingCallback = null
-
-    try {
-      val data = context.contentResolver.openInputStream(uri)?.use { it.readBytes() }
-        ?: throw IllegalStateException("Could not read file")
-
-      val activity = activity ?: throw IllegalStateException("No activity")
-      promptForPassword(activity) { password ->
-        promptText = null
-        if (password == null) {
-          callback(Result.failure(OperationCanceledException()))
-          return@promptForPassword
-        }
-        try {
-          HttpClientManager.setKeyEntry(data, password.toCharArray())
-          callback(Result.success(ClientCertData(data, password)))
-        } catch (e: Exception) {
-          callback(Result.failure(e))
-        }
-      }
-    } catch (e: Exception) {
-      callback(Result.failure(e))
-    }
+  override fun hasCertificate(): Boolean {
+    return HttpClientManager.isMtls
   }
 
-  private fun promptForPassword(activity: Activity, callback: (String?) -> Unit) {
-    val themedContext = ContextThemeWrapper(activity, com.google.android.material.R.style.Theme_Material3_DayNight_Dialog)
-    val density = activity.resources.displayMetrics.density
-    val horizontalPadding = (24 * density).toInt()
+  override fun getClientPointer(): Long {
+    return HttpClientManager.getClientPointer()
+  }
 
-    val textInputLayout = TextInputLayout(themedContext).apply {
-      hint = "Password"
-      endIconMode = TextInputLayout.END_ICON_PASSWORD_TOGGLE
-      layoutParams = FrameLayout.LayoutParams(MATCH_PARENT, WRAP_CONTENT).apply {
-        setMargins(horizontalPadding, 0, horizontalPadding, 0)
-      }
-    }
-
-    val editText = TextInputEditText(textInputLayout.context).apply {
-      inputType = InputType.TYPE_CLASS_TEXT or InputType.TYPE_TEXT_VARIATION_PASSWORD
-      layoutParams = LinearLayout.LayoutParams(MATCH_PARENT, WRAP_CONTENT)
-    }
-    textInputLayout.addView(editText)
-
-    val container = FrameLayout(themedContext).apply { addView(textInputLayout) }
-
-    val text = promptText!!
-    MaterialAlertDialogBuilder(themedContext)
-      .setTitle(text.title)
-      .setMessage(text.message)
-      .setView(container)
-      .setPositiveButton(text.confirm) { _, _ -> callback(editText.text.toString()) }
-      .setNegativeButton(text.cancel) { _, _ -> callback(null) }
-      .setOnCancelListener { callback(null) }
-      .show()
+  override fun setRequestHeaders(headers: Map<String, String>, serverUrls: List<String>, token: String?) {
+    HttpClientManager.setRequestHeaders(headers, serverUrls, token)
   }
 }

mobile/android/app/src/main/kotlin/app/alextran/immich/images/LocalImages.g.kt

@@ -59,7 +59,7 @@ private open class LocalImagesPigeonCodec : StandardMessageCodec() {
 
 /** Generated interface from Pigeon that represents a handler of messages from Flutter. */
 interface LocalImageApi {
-  fun requestImage(assetId: String, requestId: Long, width: Long, height: Long, isVideo: Boolean, callback: (Result<Map<String, Long>?>) -> Unit)
+  fun requestImage(assetId: String, requestId: Long, width: Long, height: Long, isVideo: Boolean, preferEncoded: Boolean, callback: (Result<Map<String, Long>?>) -> Unit)
   fun cancelRequest(requestId: Long)
   fun getThumbhash(thumbhash: String, callback: (Result<Map<String, Long>>) -> Unit)
 
@@ -82,7 +82,8 @@ interface LocalImageApi {
             val widthArg = args[2] as Long
             val heightArg = args[3] as Long
             val isVideoArg = args[4] as Boolean
-            api.requestImage(assetIdArg, requestIdArg, widthArg, heightArg, isVideoArg) { result: Result<Map<String, Long>?> ->
+            val preferEncodedArg = args[5] as Boolean
+            api.requestImage(assetIdArg, requestIdArg, widthArg, heightArg, isVideoArg, preferEncodedArg) { result: Result<Map<String, Long>?> ->
               val error = result.exceptionOrNull()
               if (error != null) {
                 reply.reply(LocalImagesPigeonUtils.wrapError(error))

mobile/android/app/src/main/kotlin/app/alextran/immich/images/LocalImagesImpl.kt

@@ -14,6 +14,7 @@ import android.util.Size
 import androidx.annotation.RequiresApi
 import app.alextran.immich.NativeBuffer
 import kotlin.math.*
+import java.io.IOException
 import java.util.concurrent.Executors
 import com.bumptech.glide.Glide
 import com.bumptech.glide.Priority
@@ -31,14 +32,18 @@ data class Request(
 )
 
 @RequiresApi(Build.VERSION_CODES.Q)
-inline fun ImageDecoder.Source.decodeBitmap(target: Size = Size(0, 0)): Bitmap {
+fun ImageDecoder.Source.decodeBitmap(
+  target: Size = Size(0, 0),
+  allocator: Int = ImageDecoder.ALLOCATOR_DEFAULT,
+  colorspace: ColorSpace? = null
+): Bitmap {
   return ImageDecoder.decodeBitmap(this) { decoder, info, _ ->
     if (target.width > 0 && target.height > 0) {
       val sample = max(1, min(info.size.width / target.width, info.size.height / target.height))
       decoder.setTargetSampleSize(sample)
     }
-    decoder.allocator = ImageDecoder.ALLOCATOR_SOFTWARE
-    decoder.setTargetColorSpace(ColorSpace.get(ColorSpace.Named.SRGB))
+    decoder.allocator = allocator
+    decoder.setTargetColorSpace(colorspace)
   }
 }
 
@@ -99,12 +104,17 @@ class LocalImagesImpl(context: Context) : LocalImageApi {
     width: Long,
     height: Long,
     isVideo: Boolean,
+    preferEncoded: Boolean,
     callback: (Result<Map<String, Long>?>) -> Unit
   ) {
     val signal = CancellationSignal()
     val task = threadPool.submit {
       try {
-        getThumbnailBufferInternal(assetId, width, height, isVideo, callback, signal)
+        if (preferEncoded) {
+          getEncodedImageInternal(assetId, callback, signal)
+        } else {
+          getThumbnailBufferInternal(assetId, width, height, isVideo, callback, signal)
+        }
       } catch (e: Exception) {
         when (e) {
           is OperationCanceledException -> callback(CANCELLED)
@@ -133,6 +143,35 @@ class LocalImagesImpl(context: Context) : LocalImageApi {
     }
   }
 
+  private fun getEncodedImageInternal(
+    assetId: String,
+    callback: (Result<Map<String, Long>?>) -> Unit,
+    signal: CancellationSignal
+  ) {
+    signal.throwIfCanceled()
+    val id = assetId.toLong()
+    val uri = ContentUris.withAppendedId(Images.Media.EXTERNAL_CONTENT_URI, id)
+
+    signal.throwIfCanceled()
+    val bytes = resolver.openInputStream(uri)?.use { it.readBytes() }
+      ?: throw IOException("Could not read image data for $assetId")
+
+    signal.throwIfCanceled()
+    val pointer = NativeBuffer.allocate(bytes.size)
+    try {
+      val buffer = NativeBuffer.wrap(pointer, bytes.size)
+      buffer.put(bytes)
+      signal.throwIfCanceled()
+      callback(Result.success(mapOf(
+        "pointer" to pointer,
+        "length" to bytes.size.toLong()
+      )))
+    } catch (e: Exception) {
+      NativeBuffer.free(pointer)
+      throw e
+    }
+  }
+
   private fun getThumbnailBufferInternal(
     assetId: String,
     width: Long,
@@ -193,7 +232,11 @@ class LocalImagesImpl(context: Context) : LocalImageApi {
   private fun decodeSource(uri: Uri, target: Size, signal: CancellationSignal): Bitmap {
     signal.throwIfCanceled()
     return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-      ImageDecoder.createSource(resolver, uri).decodeBitmap(target)
+      ImageDecoder.createSource(resolver, uri).decodeBitmap(
+        target,
+        ImageDecoder.ALLOCATOR_SOFTWARE,
+        ColorSpace.get(ColorSpace.Named.SRGB)
+      )
     } else {
       val ref =
         Glide.with(ctx).asBitmap().priority(Priority.IMMEDIATE).load(uri).disallowHardwareConfig()

mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImages.g.kt

@@ -47,7 +47,7 @@ private open class RemoteImagesPigeonCodec : StandardMessageCodec() {
 
 /** Generated interface from Pigeon that represents a handler of messages from Flutter. */
 interface RemoteImageApi {
-  fun requestImage(url: String, headers: Map<String, String>, requestId: Long, callback: (Result<Map<String, Long>?>) -> Unit)
+  fun requestImage(url: String, requestId: Long, preferEncoded: Boolean, callback: (Result<Map<String, Long>?>) -> Unit)
   fun cancelRequest(requestId: Long)
   fun clearCache(callback: (Result<Long>) -> Unit)
 
@@ -66,9 +66,9 @@ interface RemoteImageApi {
           channel.setMessageHandler { message, reply ->
             val args = message as List<Any?>
             val urlArg = args[0] as String
-            val headersArg = args[1] as Map<String, String>
-            val requestIdArg = args[2] as Long
-            api.requestImage(urlArg, headersArg, requestIdArg) { result: Result<Map<String, Long>?> ->
+            val requestIdArg = args[1] as Long
+            val preferEncodedArg = args[2] as Boolean
+            api.requestImage(urlArg, requestIdArg, preferEncodedArg) { result: Result<Map<String, Long>?> ->
               val error = result.exceptionOrNull()
               if (error != null) {
                 reply.reply(RemoteImagesPigeonUtils.wrapError(error))

mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImagesImpl.kt

@@ -1,6 +1,10 @@
 package app.alextran.immich.images
 
 import android.content.Context
+import android.graphics.Bitmap
+import android.graphics.BitmapFactory
+import android.graphics.ImageDecoder
+import android.os.Build
 import android.os.CancellationSignal
 import android.os.OperationCanceledException
 import app.alextran.immich.INITIAL_BUFFER_SIZE
@@ -12,6 +16,8 @@ import kotlinx.coroutines.*
 import okhttp3.Cache
 import okhttp3.Call
 import okhttp3.Callback
+import okhttp3.Credentials
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.Response
@@ -31,6 +37,21 @@ import java.nio.file.attribute.BasicFileAttributes
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.Executors
 
+fun NativeByteBuffer.decodeBitmap(target: android.util.Size = android.util.Size(0, 0)): Bitmap {
+  try {
+    val byteBuffer = NativeBuffer.wrap(pointer, offset)
+    return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+      ImageDecoder.createSource(byteBuffer).decodeBitmap(target = target)
+    } else {
+      val bytes = ByteArray(offset)
+      byteBuffer.get(bytes)
+      BitmapFactory.decodeByteArray(bytes, 0, bytes.size)
+        ?: throw IOException("Failed to decode image")
+    }
+  } finally {
+    free()
+  }
+}
 
 private const val CACHE_SIZE_BYTES = 1024L * 1024 * 1024
 
@@ -49,8 +70,8 @@ class RemoteImagesImpl(context: Context) : RemoteImageApi {
 
   override fun requestImage(
     url: String,
-    headers: Map<String, String>,
     requestId: Long,
+    preferEncoded: Boolean, // always returns encoded; setting has no effect on Android
     callback: (Result<Map<String, Long>?>) -> Unit
   ) {
     val signal = CancellationSignal()
@@ -58,7 +79,6 @@ class RemoteImagesImpl(context: Context) : RemoteImageApi {
 
     ImageFetcherManager.fetch(
       url,
-      headers,
       signal,
       onSuccess = { buffer ->
         requestMap.remove(requestId)
@@ -99,7 +119,7 @@ class RemoteImagesImpl(context: Context) : RemoteImageApi {
   }
 }
 
-private object ImageFetcherManager {
+object ImageFetcherManager {
   private lateinit var appContext: Context
   private lateinit var cacheDir: File
   private lateinit var fetcher: ImageFetcher
@@ -119,12 +139,11 @@ private object ImageFetcherManager {
 
   fun fetch(
     url: String,
-    headers: Map<String, String>,
     signal: CancellationSignal,
     onSuccess: (NativeByteBuffer) -> Unit,
     onFailure: (Exception) -> Unit,
   ) {
-    fetcher.fetch(url, headers, signal, onSuccess, onFailure)
+    fetcher.fetch(url, signal, onSuccess, onFailure)
   }
 
   fun clearCache(onCleared: (Result<Long>) -> Unit) {
@@ -148,10 +167,9 @@ private object ImageFetcherManager {
   }
 }
 
-private sealed interface ImageFetcher {
+internal sealed interface ImageFetcher {
   fun fetch(
     url: String,
-    headers: Map<String, String>,
     signal: CancellationSignal,
     onSuccess: (NativeByteBuffer) -> Unit,
     onFailure: (Exception) -> Unit,
@@ -162,7 +180,7 @@ private sealed interface ImageFetcher {
   fun clearCache(onCleared: (Result<Long>) -> Unit)
 }
 
-private class CronetImageFetcher(context: Context, cacheDir: File) : ImageFetcher {
+internal class CronetImageFetcher(context: Context, cacheDir: File) : ImageFetcher {
   private val ctx = context
   private var engine: CronetEngine
   private val executor = Executors.newFixedThreadPool(4)
@@ -178,7 +196,6 @@ private class CronetImageFetcher(context: Context, cacheDir: File) : ImageFetche
 
   override fun fetch(
     url: String,
-    headers: Map<String, String>,
     signal: CancellationSignal,
     onSuccess: (NativeByteBuffer) -> Unit,
     onFailure: (Exception) -> Unit,
@@ -193,7 +210,13 @@ private class CronetImageFetcher(context: Context, cacheDir: File) : ImageFetche
 
     val callback = FetchCallback(onSuccess, onFailure, ::onComplete)
     val requestBuilder = engine.newUrlRequestBuilder(url, callback, executor)
-    headers.forEach { (key, value) -> requestBuilder.addHeader(key, value) }
+    HttpClientManager.headers.forEach { (key, value) -> requestBuilder.addHeader(key, value) }
+    HttpClientManager.loadCookieHeader(url)?.let { requestBuilder.addHeader("Cookie", it) }
+    url.toHttpUrlOrNull()?.let { httpUrl ->
+      if (httpUrl.username.isNotEmpty()) {
+        requestBuilder.addHeader("Authorization", Credentials.basic(httpUrl.username, httpUrl.password))
+      }
+    }
     val request = requestBuilder.build()
     signal.setOnCancelListener(request::cancel)
     request.start()
@@ -337,7 +360,7 @@ private class CronetImageFetcher(context: Context, cacheDir: File) : ImageFetche
     }
   }
 
-  suspend fun deleteFolderAndGetSize(root: Path): Long = withContext(Dispatchers.IO) {
+  private suspend fun deleteFolderAndGetSize(root: Path): Long = withContext(Dispatchers.IO) {
     var totalSize = 0L
 
     Files.walkFileTree(root, object : SimpleFileVisitor<Path>() {
@@ -359,7 +382,7 @@ private class CronetImageFetcher(context: Context, cacheDir: File) : ImageFetche
   }
 }
 
-private class OkHttpImageFetcher private constructor(
+internal class OkHttpImageFetcher private constructor(
   private val client: OkHttpClient,
 ) : ImageFetcher {
   private val stateLock = Any()
@@ -370,7 +393,7 @@ private class OkHttpImageFetcher private constructor(
     fun create(cacheDir: File): OkHttpImageFetcher {
       val dir = File(cacheDir, "okhttp")
 
-      val client = HttpClientManager.getClient().newBuilder()
+      val client = HttpClientManager.client.newBuilder()
         .cache(Cache(File(dir, "thumbnails"), CACHE_SIZE_BYTES))
         .build()
 
@@ -390,7 +413,6 @@ private class OkHttpImageFetcher private constructor(
 
   override fun fetch(
     url: String,
-    headers: Map<String, String>,
     signal: CancellationSignal,
     onSuccess: (NativeByteBuffer) -> Unit,
     onFailure: (Exception) -> Unit,
@@ -403,7 +425,6 @@ private class OkHttpImageFetcher private constructor(
     }
 
     val requestBuilder = Request.Builder().url(url)
-    headers.forEach { (key, value) -> requestBuilder.addHeader(key, value) }
     val call = client.newCall(requestBuilder.build())
     signal.setOnCancelListener(call::cancel)
 

mobile/android/app/src/main/kotlin/app/alextran/immich/sync/Messages.g.kt

@@ -78,6 +78,21 @@ class FlutterError (
   val details: Any? = null
 ) : Throwable()
 
+enum class PlatformAssetPlaybackStyle(val raw: Int) {
+  UNKNOWN(0),
+  IMAGE(1),
+  VIDEO(2),
+  IMAGE_ANIMATED(3),
+  LIVE_PHOTO(4),
+  VIDEO_LOOPING(5);
+
+  companion object {
+    fun ofRaw(raw: Int): PlatformAssetPlaybackStyle? {
+      return values().firstOrNull { it.raw == raw }
+    }
+  }
+}
+
 /** Generated class from Pigeon that represents data sent in messages. */
 data class PlatformAsset (
   val id: String,
@@ -92,7 +107,8 @@ data class PlatformAsset (
   val isFavorite: Boolean,
   val adjustmentTime: Long? = null,
   val latitude: Double? = null,
-  val longitude: Double? = null
+  val longitude: Double? = null,
+  val playbackStyle: PlatformAssetPlaybackStyle
 )
  {
   companion object {
@@ -110,7 +126,8 @@ data class PlatformAsset (
       val adjustmentTime = pigeonVar_list[10] as Long?
       val latitude = pigeonVar_list[11] as Double?
       val longitude = pigeonVar_list[12] as Double?
-      return PlatformAsset(id, name, type, createdAt, updatedAt, width, height, durationInSeconds, orientation, isFavorite, adjustmentTime, latitude, longitude)
+      val playbackStyle = pigeonVar_list[13] as PlatformAssetPlaybackStyle
+      return PlatformAsset(id, name, type, createdAt, updatedAt, width, height, durationInSeconds, orientation, isFavorite, adjustmentTime, latitude, longitude, playbackStyle)
     }
   }
   fun toList(): List<Any?> {
@@ -128,6 +145,7 @@ data class PlatformAsset (
       adjustmentTime,
       latitude,
       longitude,
+      playbackStyle,
     )
   }
   override fun equals(other: Any?): Boolean {
@@ -290,26 +308,31 @@ private open class MessagesPigeonCodec : StandardMessageCodec() {
   override fun readValueOfType(type: Byte, buffer: ByteBuffer): Any? {
     return when (type) {
       129.toByte() -> {
-        return (readValue(buffer) as? List<Any?>)?.let {
-          PlatformAsset.fromList(it)
+        return (readValue(buffer) as Long?)?.let {
+          PlatformAssetPlaybackStyle.ofRaw(it.toInt())
         }
       }
       130.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
-          PlatformAlbum.fromList(it)
+          PlatformAsset.fromList(it)
         }
       }
       131.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
-          SyncDelta.fromList(it)
+          PlatformAlbum.fromList(it)
         }
       }
       132.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
-          HashResult.fromList(it)
+          SyncDelta.fromList(it)
         }
       }
       133.toByte() -> {
+        return (readValue(buffer) as? List<Any?>)?.let {
+          HashResult.fromList(it)
+        }
+      }
+      134.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
           CloudIdResult.fromList(it)
         }
@@ -319,26 +342,30 @@ private open class MessagesPigeonCodec : StandardMessageCodec() {
   }
   override fun writeValue(stream: ByteArrayOutputStream, value: Any?)   {
     when (value) {
-      is PlatformAsset -> {
+      is PlatformAssetPlaybackStyle -> {
         stream.write(129)
-        writeValue(stream, value.toList())
+        writeValue(stream, value.raw)
       }
-      is PlatformAlbum -> {
+      is PlatformAsset -> {
         stream.write(130)
         writeValue(stream, value.toList())
       }
-      is SyncDelta -> {
+      is PlatformAlbum -> {
         stream.write(131)
         writeValue(stream, value.toList())
       }
-      is HashResult -> {
+      is SyncDelta -> {
         stream.write(132)
         writeValue(stream, value.toList())
       }
-      is CloudIdResult -> {
+      is HashResult -> {
         stream.write(133)
         writeValue(stream, value.toList())
       }
+      is CloudIdResult -> {
+        stream.write(134)
+        writeValue(stream, value.toList())
+      }
       else -> super.writeValue(stream, value)
     }
   }

mobile/android/app/src/main/kotlin/app/alextran/immich/sync/MessagesImplBase.kt

@@ -4,11 +4,19 @@ import android.annotation.SuppressLint
 import android.content.ContentUris
 import android.content.Context
 import android.database.Cursor
+import androidx.exifinterface.media.ExifInterface
+import android.os.Build
 import android.os.Bundle
+import android.os.ext.SdkExtensions
 import android.provider.MediaStore
 import android.util.Base64
+import android.util.Log
 import androidx.core.database.getStringOrNull
 import app.alextran.immich.core.ImmichPlugin
+import com.bumptech.glide.Glide
+import com.bumptech.glide.load.ImageHeaderParser
+import com.bumptech.glide.load.ImageHeaderParserUtils
+import com.bumptech.glide.load.resource.bitmap.DefaultImageHeaderParser
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
@@ -28,6 +36,8 @@ sealed class AssetResult {
   data class InvalidAsset(val assetId: String) : AssetResult()
 }
 
+private const val TAG = "NativeSyncApiImplBase"
+
 @SuppressLint("InlinedApi")
 open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
   private val ctx: Context = context.applicationContext
@@ -39,6 +49,13 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
     private val hashSemaphore = Semaphore(MAX_CONCURRENT_HASH_OPERATIONS)
     private const val HASHING_CANCELLED_CODE = "HASH_CANCELLED"
 
+    // MediaStore.Files.FileColumns.SPECIAL_FORMAT — S Extensions 21+
+    // https://developer.android.com/reference/android/provider/MediaStore.Files.FileColumns#SPECIAL_FORMAT
+    private const val SPECIAL_FORMAT_COLUMN = "_special_format"
+    private const val SPECIAL_FORMAT_GIF = 1
+    private const val SPECIAL_FORMAT_MOTION_PHOTO = 2
+    private const val SPECIAL_FORMAT_ANIMATED_WEBP = 3
+
     const val MEDIA_SELECTION =
       "(${MediaStore.Files.FileColumns.MEDIA_TYPE} = ? OR ${MediaStore.Files.FileColumns.MEDIA_TYPE} = ?)"
     val MEDIA_SELECTION_ARGS = arrayOf(
@@ -60,12 +77,28 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
       add(MediaStore.MediaColumns.DURATION)
       add(MediaStore.MediaColumns.ORIENTATION)
       // IS_FAVORITE is only available on Android 11 and above
-      if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.R) {
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
         add(MediaStore.MediaColumns.IS_FAVORITE)
       }
+      if (hasSpecialFormatColumn()) {
+        add(SPECIAL_FORMAT_COLUMN)
+      } else {
+        // fallback to mimetype and xmp for playback style detection on older Android versions
+        // both only needed if special format column is not available
+        add(MediaStore.MediaColumns.MIME_TYPE)
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+          add(MediaStore.MediaColumns.XMP)
+        }
+      }
     }.toTypedArray()
 
     const val HASH_BUFFER_SIZE = 2 * 1024 * 1024
+
+    // _special_format requires S Extensions 21+
+    // https://developer.android.com/reference/android/provider/MediaStore.Files.FileColumns#SPECIAL_FORMAT
+    private fun hasSpecialFormatColumn(): Boolean =
+      Build.VERSION.SDK_INT >= Build.VERSION_CODES.S &&
+        SdkExtensions.getExtensionVersion(Build.VERSION_CODES.S) >= 21
   }
 
   protected fun getCursor(
@@ -102,6 +135,7 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
         val dateAddedColumn = c.getColumnIndexOrThrow(MediaStore.MediaColumns.DATE_ADDED)
         val dateModifiedColumn = c.getColumnIndexOrThrow(MediaStore.MediaColumns.DATE_MODIFIED)
         val mediaTypeColumn = c.getColumnIndexOrThrow(MediaStore.Files.FileColumns.MEDIA_TYPE)
+        val mimeTypeColumn = c.getColumnIndex(MediaStore.MediaColumns.MIME_TYPE)
         val bucketIdColumn = c.getColumnIndexOrThrow(MediaStore.MediaColumns.BUCKET_ID)
         val widthColumn = c.getColumnIndexOrThrow(MediaStore.MediaColumns.WIDTH)
         val heightColumn = c.getColumnIndexOrThrow(MediaStore.MediaColumns.HEIGHT)
@@ -109,9 +143,12 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
         val orientationColumn =
           c.getColumnIndexOrThrow(MediaStore.MediaColumns.ORIENTATION)
         val favoriteColumn = c.getColumnIndex(MediaStore.MediaColumns.IS_FAVORITE)
+        val specialFormatColumn = c.getColumnIndex(SPECIAL_FORMAT_COLUMN)
+        val xmpColumn = c.getColumnIndex(MediaStore.MediaColumns.XMP)
 
         while (c.moveToNext()) {
-          val id = c.getLong(idColumn).toString()
+          val numericId = c.getLong(idColumn)
+          val id = numericId.toString()
           val name = c.getStringOrNull(nameColumn)
           val bucketId = c.getStringOrNull(bucketIdColumn)
           val path = c.getStringOrNull(dataColumn)
@@ -125,10 +162,11 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
             continue
           }
 
-          val mediaType = when (c.getInt(mediaTypeColumn)) {
-            MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE -> 1
-            MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO -> 2
-            else -> 0
+          val rawMediaType = c.getInt(mediaTypeColumn)
+          val assetType: Long = when (rawMediaType) {
+            MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE -> 1L
+            MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO -> 2L
+            else -> 0L
           }
           // Date taken is milliseconds since epoch, Date added is seconds since epoch
           val createdAt = (c.getLong(dateTakenColumn).takeIf { it > 0 }?.div(1000))
@@ -138,22 +176,28 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
           val width = c.getInt(widthColumn).toLong()
           val height = c.getInt(heightColumn).toLong()
           // Duration is milliseconds
-          val duration = if (mediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE) 0
+          val duration = if (rawMediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE) 0L
           else c.getLong(durationColumn) / 1000
           val orientation = c.getInt(orientationColumn)
           val isFavorite = if (favoriteColumn == -1) false else c.getInt(favoriteColumn) != 0
 
+          val playbackStyle = detectPlaybackStyle(
+            numericId, rawMediaType, mimeTypeColumn, specialFormatColumn, xmpColumn, c
+          )
+
+          val isFlipped = orientation == 90 || orientation == 270
           val asset = PlatformAsset(
             id,
             name,
-            mediaType.toLong(),
+            assetType,
             createdAt,
             modifiedAt,
-            width,
-            height,
+            if (isFlipped) height else width,
+            if (isFlipped) width else height,
             duration,
-            orientation.toLong(),
+            0L,
             isFavorite,
+            playbackStyle = playbackStyle,
           )
           yield(AssetResult.ValidAsset(asset, bucketId))
         }
@@ -161,6 +205,92 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
     }
   }
 
+  /**
+   * Detects the playback style for an asset using _special_format (SDK Extension 21+)
+   * or XMP / MIME / RIFF header fallbacks.
+   */
+  @SuppressLint("NewApi")
+  private fun detectPlaybackStyle(
+    assetId: Long,
+    rawMediaType: Int,
+    mimeTypeColumn: Int,
+    specialFormatColumn: Int,
+    xmpColumn: Int,
+    cursor: Cursor
+  ): PlatformAssetPlaybackStyle {
+    // video currently has no special formats, so we can short circuit and avoid unnecessary work
+    if (rawMediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO) {
+      return PlatformAssetPlaybackStyle.VIDEO
+    }
+
+    // API 33+: use _special_format from cursor
+    if (specialFormatColumn != -1) {
+      val specialFormat = cursor.getInt(specialFormatColumn)
+      return when {
+        specialFormat == SPECIAL_FORMAT_MOTION_PHOTO -> PlatformAssetPlaybackStyle.LIVE_PHOTO
+        specialFormat == SPECIAL_FORMAT_GIF || specialFormat == SPECIAL_FORMAT_ANIMATED_WEBP -> PlatformAssetPlaybackStyle.IMAGE_ANIMATED
+        rawMediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE -> PlatformAssetPlaybackStyle.IMAGE
+        else -> PlatformAssetPlaybackStyle.UNKNOWN
+      }
+    }
+
+    if (rawMediaType != MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE) {
+      return PlatformAssetPlaybackStyle.UNKNOWN
+    }
+
+    val mimeType = if (mimeTypeColumn != -1) cursor.getString(mimeTypeColumn) else null
+
+    // GIFs are always animated and cannot be motion photos; no I/O needed
+    if (mimeType == "image/gif") {
+      return PlatformAssetPlaybackStyle.IMAGE_ANIMATED
+    }
+
+    val uri = ContentUris.withAppendedId(
+      MediaStore.Files.getContentUri(MediaStore.VOLUME_EXTERNAL),
+      assetId
+    )
+
+    // Only WebP needs a stream check to distinguish static vs animated;
+    // WebP files are not used as motion photos, so skip XMP detection
+    if (mimeType == "image/webp") {
+      try {
+        val glide = Glide.get(ctx)
+        ctx.contentResolver.openInputStream(uri)?.use { stream ->
+          val type = ImageHeaderParserUtils.getType(
+            listOf(DefaultImageHeaderParser()),
+            stream,
+            glide.arrayPool
+          )
+          // Also check for GIF just in case MIME type is incorrect; Doesn't hurt performance
+          if (type == ImageHeaderParser.ImageType.ANIMATED_WEBP || type == ImageHeaderParser.ImageType.GIF) {
+            return PlatformAssetPlaybackStyle.IMAGE_ANIMATED
+          }
+        }
+      } catch (e: Exception) {
+        Log.w(TAG, "Failed to parse image header for asset $assetId", e)
+      }
+      // if mimeType is webp but not animated, its just an image.
+      return PlatformAssetPlaybackStyle.IMAGE
+    }
+
+
+    // Read XMP from cursor (API 30+)
+    val xmp: String? = if (xmpColumn != -1) {
+      cursor.getBlob(xmpColumn)?.toString(Charsets.UTF_8)
+    } else {
+      // if xmp column is not available, we are on API 29 or below
+      // theoretically there were motion photos but the Camera:MotionPhoto xmp tag
+      // was only added in Android 11, so we should not have to worry about parsing XMP on older versions
+      null
+    }
+
+    if (xmp != null && "Camera:MotionPhoto" in xmp) {
+      return PlatformAssetPlaybackStyle.LIVE_PHOTO
+    }
+
+    return PlatformAssetPlaybackStyle.IMAGE
+  }
+
   fun getAlbums(): List<PlatformAlbum> {
     val albums = mutableListOf<PlatformAlbum>()
     val albumsCount = mutableMapOf<String, Int>()

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/BitmapUtils.kt

@@ -1,33 +0,0 @@
-package app.alextran.immich.widget
-
-import android.graphics.Bitmap
-import android.graphics.BitmapFactory
-import java.io.File
-
-fun loadScaledBitmap(file: File, reqWidth: Int, reqHeight: Int): Bitmap? {
-  val options = BitmapFactory.Options().apply {
-    inJustDecodeBounds = true
-  }
-  BitmapFactory.decodeFile(file.absolutePath, options)
-
-  options.inSampleSize = calculateInSampleSize(options, reqWidth, reqHeight)
-  options.inJustDecodeBounds = false
-
-  return BitmapFactory.decodeFile(file.absolutePath, options)
-}
-
-fun calculateInSampleSize(options: BitmapFactory.Options, reqWidth: Int, reqHeight: Int): Int {
-  val (height: Int, width: Int) = options.run { outHeight to outWidth }
-  var inSampleSize = 1
-
-  if (height > reqHeight || width > reqWidth) {
-    val halfHeight: Int = height / 2
-    val halfWidth: Int = width / 2
-
-    while ((halfHeight / inSampleSize) >= reqHeight && (halfWidth / inSampleSize) >= reqWidth) {
-      inSampleSize *= 2
-    }
-  }
-
-  return inSampleSize
-}

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/ImageDownloadWorker.kt

@@ -1,18 +1,12 @@
 package app.alextran.immich.widget
 
 import android.content.Context
-import android.graphics.Bitmap
 import android.util.Log
 import androidx.datastore.preferences.core.Preferences
 import androidx.glance.*
 import androidx.glance.appwidget.GlanceAppWidgetManager
 import androidx.glance.appwidget.state.updateAppWidgetState
 import androidx.work.*
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
-import java.io.File
-import java.io.FileOutputStream
-import java.util.UUID
 import java.util.concurrent.TimeUnit
 import androidx.glance.appwidget.state.getAppWidgetState
 import androidx.glance.state.PreferencesGlanceStateDefinition
@@ -75,18 +69,8 @@ class ImageDownloadWorker(
       )
     }
 
-    suspend fun cancel(context: Context, appWidgetId: Int) {
+    fun cancel(context: Context, appWidgetId: Int) {
       WorkManager.getInstance(context).cancelAllWorkByTag("$uniqueWorkName-$appWidgetId")
-
-      // delete cached image
-      val glanceId = GlanceAppWidgetManager(context).getGlanceIdBy(appWidgetId)
-      val widgetConfig = getAppWidgetState(context, PreferencesGlanceStateDefinition, glanceId)
-      val currentImgUUID = widgetConfig[kImageUUID]
-
-      if (!currentImgUUID.isNullOrEmpty()) {
-        val file = File(context.cacheDir, imageFilename(currentImgUUID))
-        file.delete()
-      }
     }
   }
 
@@ -96,43 +80,22 @@ class ImageDownloadWorker(
       val widgetId = inputData.getInt(kWorkerWidgetID, -1)
       val glanceId = GlanceAppWidgetManager(context).getGlanceIdBy(widgetId)
       val widgetConfig = getAppWidgetState(context, PreferencesGlanceStateDefinition, glanceId)
-      val currentImgUUID = widgetConfig[kImageUUID]
-
-      val serverConfig = ImmichAPI.getServerConfig(context)
-
-      // clear any image caches and go to "login" state if no credentials
-      if (serverConfig == null) {
-        if (!currentImgUUID.isNullOrEmpty()) {
-          deleteImage(currentImgUUID)
-          updateWidget(
-            glanceId,
-            "",
-            "",
-            "immich://",
-            WidgetState.LOG_IN
-          )
+      // clear state and go to "login" if no credentials
+      if (!ImmichAPI.isLoggedIn(context)) {
+        val currentAssetId = widgetConfig[kAssetId]
+        if (!currentAssetId.isNullOrEmpty()) {
+          updateWidget(glanceId, "", "", "immich://", WidgetState.LOG_IN)
         }
 
         return Result.success()
       }
 
-      // fetch new image
       val entry = when (widgetType) {
-        WidgetType.RANDOM -> fetchRandom(serverConfig, widgetConfig)
-        WidgetType.MEMORIES -> fetchMemory(serverConfig)
+        WidgetType.RANDOM -> fetchRandom(widgetConfig)
+        WidgetType.MEMORIES -> fetchMemory()
       }
 
-      // clear current image if it exists
-      if (!currentImgUUID.isNullOrEmpty()) {
-        deleteImage(currentImgUUID)
-      }
-
-      // save a new image
-      val imgUUID = UUID.randomUUID().toString()
-      saveImage(entry.image, imgUUID)
-
-      // trigger the update routine with new image uuid
-      updateWidget(glanceId, imgUUID, entry.subtitle, entry.deeplink)
+      updateWidget(glanceId, entry.assetId, entry.subtitle, entry.deeplink)
 
       Result.success()
     } catch (e: Exception) {
@@ -147,28 +110,25 @@ class ImageDownloadWorker(
 
   private suspend fun updateWidget(
     glanceId: GlanceId,
-    imageUUID: String,
+    assetId: String,
     subtitle: String?,
     deeplink: String?,
     widgetState: WidgetState = WidgetState.SUCCESS
   ) {
     updateAppWidgetState(context, glanceId) { prefs ->
       prefs[kNow] = System.currentTimeMillis()
-      prefs[kImageUUID] = imageUUID
+      prefs[kAssetId] = assetId
       prefs[kWidgetState] = widgetState.toString()
       prefs[kSubtitleText] = subtitle ?: ""
       prefs[kDeeplinkURL] = deeplink ?: ""
     }
 
-    PhotoWidget().update(context,glanceId)
+    PhotoWidget().update(context, glanceId)
   }
 
   private suspend fun fetchRandom(
-    serverConfig: ServerConfig,
     widgetConfig: Preferences
   ): WidgetEntry {
-    val api = ImmichAPI(serverConfig)
-
     val filters = SearchFilters()
     val albumId = widgetConfig[kSelectedAlbum]
     val showSubtitle = widgetConfig[kShowAlbumName]
@@ -182,31 +142,27 @@ class ImageDownloadWorker(
       filters.albumIds = listOf(albumId)
     }
 
-    var randomSearch = api.fetchSearchResults(filters)
+    var randomSearch = ImmichAPI.fetchSearchResults(filters)
 
     // handle an empty album, fallback to random
     if (randomSearch.isEmpty() && albumId != null) {
-      randomSearch = api.fetchSearchResults(SearchFilters())
+      randomSearch = ImmichAPI.fetchSearchResults(SearchFilters())
       subtitle = ""
     }
 
     val random = randomSearch.first()
-    val image = api.fetchImage(random)
+    ImmichAPI.fetchImage(random).free() // warm the HTTP disk cache
 
     return WidgetEntry(
-      image,
+      random.id,
       subtitle,
       assetDeeplink(random)
     )
   }
 
-  private suspend fun fetchMemory(
-    serverConfig: ServerConfig
-  ): WidgetEntry {
-    val api = ImmichAPI(serverConfig)
-
+  private suspend fun fetchMemory(): WidgetEntry {
     val today = LocalDate.now()
-    val memories = api.fetchMemory(today)
+    val memories = ImmichAPI.fetchMemory(today)
     val asset: Asset
     var subtitle: String? = null
 
@@ -219,26 +175,15 @@ class ImageDownloadWorker(
       subtitle = "$yearDiff ${if (yearDiff == 1) "year" else "years"} ago"
     } else {
       val filters = SearchFilters(size=1)
-      asset = api.fetchSearchResults(filters).first()
+      asset = ImmichAPI.fetchSearchResults(filters).first()
     }
 
-    val image = api.fetchImage(asset)
+    ImmichAPI.fetchImage(asset).free() // warm the HTTP disk cache
     return WidgetEntry(
-      image,
+      asset.id,
       subtitle,
       assetDeeplink(asset)
     )
   }
 
-  private suspend fun deleteImage(uuid: String) = withContext(Dispatchers.IO) {
-    val file = File(context.cacheDir, imageFilename(uuid))
-    file.delete()
-  }
-
-  private suspend fun saveImage(bitmap: Bitmap, uuid: String) = withContext(Dispatchers.IO) {
-    val file = File(context.cacheDir, imageFilename(uuid))
-    FileOutputStream(file).use { out ->
-      bitmap.compress(Bitmap.CompressFormat.JPEG, 90, out)
-    }
-  }
 }

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/ImmichAPI.kt

@@ -1,122 +1,97 @@
 package app.alextran.immich.widget
 
 import android.content.Context
-import android.graphics.Bitmap
-import android.graphics.BitmapFactory
+import android.os.CancellationSignal
+import app.alextran.immich.NativeByteBuffer
+import app.alextran.immich.core.HttpClientManager
+import app.alextran.immich.images.ImageFetcherManager
 import app.alextran.immich.widget.model.*
 import com.google.gson.Gson
 import com.google.gson.reflect.TypeToken
-import es.antonborri.home_widget.HomeWidgetPlugin
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.suspendCancellableCoroutine
 import kotlinx.coroutines.withContext
-import java.io.OutputStreamWriter
-import java.net.HttpURLConnection
-import java.net.URL
-import java.net.URLEncoder
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
 import java.time.LocalDate
 import java.time.format.DateTimeFormatter
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
 
-class ImmichAPI(cfg: ServerConfig) {
-
-  companion object {
-    fun getServerConfig(context: Context): ServerConfig? {
-      val prefs = HomeWidgetPlugin.getData(context)
-
-      val serverURL = prefs.getString("widget_server_url", "") ?: ""
-      val sessionKey = prefs.getString("widget_auth_token", "") ?: ""
-      val customHeadersJSON = prefs.getString("widget_custom_headers", "") ?: ""
-
-      if (serverURL.isBlank() || sessionKey.isBlank()) {
-        return null
-      }
-
-      var customHeaders: Map<String, String> = HashMap<String, String>()
-
-      if (customHeadersJSON.isNotBlank()) {
-        val stringMapType = object : TypeToken<Map<String, String>>() {}.type
-        customHeaders = Gson().fromJson(customHeadersJSON, stringMapType)
-      }
-
-      return ServerConfig(
-        serverURL,
-        sessionKey,
-        customHeaders
-      )
-    }
-  }
-
-
+object ImmichAPI {
   private val gson = Gson()
-  private val serverConfig = cfg
+  private val serverEndpoint: String
+    get() = HttpClientManager.serverUrl ?: throw IllegalStateException("Not logged in")
 
-  private fun buildRequestURL(endpoint: String, params: List<Pair<String, String>> = emptyList()): URL {
-    val urlString = StringBuilder("${serverConfig.serverEndpoint}$endpoint?sessionKey=${serverConfig.sessionKey}")
-
-    for ((key, value) in params) {
-      urlString.append("&${URLEncoder.encode(key, "UTF-8")}=${URLEncoder.encode(value, "UTF-8")}")
-    }
-
-    return URL(urlString.toString())
+  private fun initialize(context: Context) {
+    HttpClientManager.initialize(context)
+    ImageFetcherManager.initialize(context)
   }
 
-  private fun HttpURLConnection.applyCustomHeaders() {
-    serverConfig.customHeaders.forEach { (key, value) ->
-      setRequestProperty(key, value)
+  fun isLoggedIn(context: Context): Boolean {
+    initialize(context)
+    return HttpClientManager.serverUrl != null
+  }
+
+  private fun buildRequestURL(endpoint: String, params: List<Pair<String, String>> = emptyList()): String {
+    val url = StringBuilder("$serverEndpoint$endpoint")
+
+    if (params.isNotEmpty()) {
+      url.append("?")
+      url.append(params.joinToString("&") { (key, value) ->
+        "${java.net.URLEncoder.encode(key, "UTF-8")}=${java.net.URLEncoder.encode(value, "UTF-8")}"
+      })
     }
+
+    return url.toString()
   }
 
   suspend fun fetchSearchResults(filters: SearchFilters): List<Asset> = withContext(Dispatchers.IO) {
     val url = buildRequestURL("/search/random")
-    val connection = (url.openConnection() as HttpURLConnection).apply {
-      requestMethod = "POST"
-      setRequestProperty("Content-Type", "application/json")
-      applyCustomHeaders()
+    val body = gson.toJson(filters).toRequestBody("application/json".toMediaType())
+    val request = Request.Builder().url(url).post(body).build()
 
-      doOutput = true
+    HttpClientManager.client.newCall(request).execute().use { response ->
+      val responseBody = response.body?.string() ?: throw Exception("Empty response")
+      val type = object : TypeToken<List<Asset>>() {}.type
+      gson.fromJson(responseBody, type)
     }
-
-    connection.outputStream.use {
-      OutputStreamWriter(it).use { writer ->
-        writer.write(gson.toJson(filters))
-        writer.flush()
-      }
-    }
-
-    val response = connection.inputStream.bufferedReader().readText()
-    val type = object : TypeToken<List<Asset>>() {}.type
-    gson.fromJson(response, type)
   }
 
   suspend fun fetchMemory(date: LocalDate): List<MemoryResult> = withContext(Dispatchers.IO) {
     val iso8601 = date.format(DateTimeFormatter.ISO_LOCAL_DATE)
     val url = buildRequestURL("/memories", listOf("for" to iso8601))
-    val connection = (url.openConnection() as HttpURLConnection).apply {
-      requestMethod = "GET"
-      applyCustomHeaders()
-    }
+    val request = Request.Builder().url(url).get().build()
 
-    val response = connection.inputStream.bufferedReader().readText()
-    val type = object : TypeToken<List<MemoryResult>>() {}.type
-    gson.fromJson(response, type)
+    HttpClientManager.client.newCall(request).execute().use { response ->
+      val responseBody = response.body?.string() ?: throw Exception("Empty response")
+      val type = object : TypeToken<List<MemoryResult>>() {}.type
+      gson.fromJson(responseBody, type)
+    }
   }
 
-  suspend fun fetchImage(asset: Asset): Bitmap = withContext(Dispatchers.IO) {
+  suspend fun fetchImage(asset: Asset): NativeByteBuffer = suspendCancellableCoroutine { cont ->
     val url = buildRequestURL("/assets/${asset.id}/thumbnail", listOf("size" to "preview", "edited" to "true"))
-    val connection = url.openConnection()
-    val data = connection.getInputStream().readBytes()
-    BitmapFactory.decodeByteArray(data, 0, data.size)
-      ?: throw Exception("Invalid image data")
+    val signal = CancellationSignal()
+    cont.invokeOnCancellation { signal.cancel() }
+
+    ImageFetcherManager.fetch(
+      url,
+      signal,
+      onSuccess = { buffer -> cont.resume(buffer) },
+      onFailure = { e -> cont.resumeWithException(e) }
+    )
   }
 
   suspend fun fetchAlbums(): List<Album> = withContext(Dispatchers.IO) {
     val url = buildRequestURL("/albums")
-    val connection = (url.openConnection() as HttpURLConnection).apply {
-      requestMethod = "GET"
-      applyCustomHeaders()
-    }
+    val request = Request.Builder().url(url).get().build()
 
-    val response = connection.inputStream.bufferedReader().readText()
-    val type = object : TypeToken<List<Album>>() {}.type
-    gson.fromJson(response, type)
+    HttpClientManager.client.newCall(request).execute().use { response ->
+      val responseBody = response.body?.string() ?: throw Exception("Empty response")
+      val type = object : TypeToken<List<Album>>() {}.type
+      gson.fromJson(responseBody, type)
+    }
   }
 }

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/MemoryReceiver.kt

@@ -1,58 +0,0 @@
-package app.alextran.immich.widget
-
-import android.appwidget.AppWidgetManager
-import android.content.ComponentName
-import android.content.Context
-import android.content.Intent
-import androidx.glance.appwidget.GlanceAppWidgetReceiver
-import app.alextran.immich.widget.model.*
-import es.antonborri.home_widget.HomeWidgetPlugin
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
-
-class MemoryReceiver : GlanceAppWidgetReceiver() {
-  override val glanceAppWidget = PhotoWidget()
-
-  override fun onUpdate(
-    context: Context,
-    appWidgetManager: AppWidgetManager,
-    appWidgetIds: IntArray
-  ) {
-    super.onUpdate(context, appWidgetManager, appWidgetIds)
-
-    appWidgetIds.forEach { widgetID ->
-      ImageDownloadWorker.enqueuePeriodic(context, widgetID, WidgetType.MEMORIES)
-    }
-  }
-
-  override fun onReceive(context: Context, intent: Intent) {
-    val fromMainApp = intent.getBooleanExtra(HomeWidgetPlugin.TRIGGERED_FROM_HOME_WIDGET, false)
-    val provider = ComponentName(context, MemoryReceiver::class.java)
-    val glanceIds = AppWidgetManager.getInstance(context).getAppWidgetIds(provider)
-
-    // Launch coroutine to setup a single shot if the app requested the update
-    if (fromMainApp) {
-      glanceIds.forEach { widgetID ->
-        ImageDownloadWorker.singleShot(context, widgetID, WidgetType.MEMORIES)
-      }
-    }
-
-    // make sure the periodic jobs are running
-    glanceIds.forEach { widgetID ->
-      ImageDownloadWorker.enqueuePeriodic(context, widgetID, WidgetType.MEMORIES)
-    }
-
-    super.onReceive(context, intent)
-  }
-
-  override fun onDeleted(context: Context, appWidgetIds: IntArray) {
-    super.onDeleted(context, appWidgetIds)
-    CoroutineScope(Dispatchers.Default).launch {
-      appWidgetIds.forEach { id ->
-        ImageDownloadWorker.cancel(context, id)
-      }
-    }
-  }
-}
-

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/PhotoWidget.kt

@@ -2,12 +2,12 @@ package app.alextran.immich.widget
 
 import android.content.Context
 import android.content.Intent
-import android.graphics.Bitmap
+import android.util.Size
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.unit.*
 import androidx.core.net.toUri
-import androidx.datastore.preferences.core.MutablePreferences
 import androidx.glance.appwidget.*
+import androidx.glance.appwidget.state.getAppWidgetState
 import androidx.glance.*
 import androidx.glance.action.clickable
 import androidx.glance.layout.*
@@ -18,30 +18,28 @@ import androidx.glance.text.TextAlign
 import androidx.glance.text.TextStyle
 import androidx.glance.unit.ColorProvider
 import app.alextran.immich.R
+import app.alextran.immich.images.decodeBitmap
 import app.alextran.immich.widget.model.*
-import java.io.File
 
 class PhotoWidget : GlanceAppWidget() {
   override var stateDefinition: GlanceStateDefinition<*> = PreferencesGlanceStateDefinition
 
   override suspend fun provideGlance(context: Context, id: GlanceId) {
-    provideContent {
-      val prefs = currentState<MutablePreferences>()
+    val state = getAppWidgetState(context, PreferencesGlanceStateDefinition, id)
+    val assetId = state[kAssetId]
+    val subtitle = state[kSubtitleText]
+    val deeplinkURL = state[kDeeplinkURL]?.toUri()
+    val widgetState = state[kWidgetState]
 
-      val imageUUID = prefs[kImageUUID]
-      val subtitle = prefs[kSubtitleText]
-      val deeplinkURL = prefs[kDeeplinkURL]?.toUri()
-      val widgetState = prefs[kWidgetState]
-      var bitmap: Bitmap? = null
-
-      if (imageUUID != null) {
-        // fetch a random photo from server
-        val file = File(context.cacheDir, imageFilename(imageUUID))
-
-        if (file.exists()) {
-          bitmap = loadScaledBitmap(file, 500, 500)
-        }
+    val bitmap = if (!assetId.isNullOrEmpty() && ImmichAPI.isLoggedIn(context)) {
+      try {
+        ImmichAPI.fetchImage(Asset(assetId, AssetType.IMAGE)).decodeBitmap(Size(500, 500))
+      } catch (e: Exception) {
+        null
       }
+    } else null
+
+    provideContent {
 
       // WIDGET CONTENT
       Box(

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/WidgetReceiver.kt

@@ -4,14 +4,11 @@ import android.appwidget.AppWidgetManager
 import android.content.ComponentName
 import android.content.Context
 import android.content.Intent
-import es.antonborri.home_widget.HomeWidgetPlugin
 import androidx.glance.appwidget.GlanceAppWidgetReceiver
 import app.alextran.immich.widget.model.*
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.launch
+import es.antonborri.home_widget.HomeWidgetPlugin
 
-class RandomReceiver : GlanceAppWidgetReceiver() {
+abstract class WidgetReceiver(private val widgetType: WidgetType) : GlanceAppWidgetReceiver() {
   override val glanceAppWidget = PhotoWidget()
 
   override fun onUpdate(
@@ -22,25 +19,25 @@ class RandomReceiver : GlanceAppWidgetReceiver() {
     super.onUpdate(context, appWidgetManager, appWidgetIds)
 
     appWidgetIds.forEach { widgetID ->
-      ImageDownloadWorker.enqueuePeriodic(context, widgetID, WidgetType.RANDOM)
+      ImageDownloadWorker.enqueuePeriodic(context, widgetID, widgetType)
     }
   }
 
   override fun onReceive(context: Context, intent: Intent) {
     val fromMainApp = intent.getBooleanExtra(HomeWidgetPlugin.TRIGGERED_FROM_HOME_WIDGET, false)
-    val provider = ComponentName(context, RandomReceiver::class.java)
+    val provider = ComponentName(context, this::class.java)
     val glanceIds = AppWidgetManager.getInstance(context).getAppWidgetIds(provider)
 
     // Launch coroutine to setup a single shot if the app requested the update
     if (fromMainApp) {
       glanceIds.forEach { widgetID ->
-        ImageDownloadWorker.singleShot(context, widgetID, WidgetType.RANDOM)
+        ImageDownloadWorker.singleShot(context, widgetID, widgetType)
       }
     }
 
     // make sure the periodic jobs are running
     glanceIds.forEach { widgetID ->
-      ImageDownloadWorker.enqueuePeriodic(context, widgetID, WidgetType.RANDOM)
+      ImageDownloadWorker.enqueuePeriodic(context, widgetID, widgetType)
     }
 
     super.onReceive(context, intent)
@@ -48,10 +45,12 @@ class RandomReceiver : GlanceAppWidgetReceiver() {
 
   override fun onDeleted(context: Context, appWidgetIds: IntArray) {
     super.onDeleted(context, appWidgetIds)
-    CoroutineScope(Dispatchers.Default).launch {
-      appWidgetIds.forEach { id ->
-        ImageDownloadWorker.cancel(context, id)
-      }
+    appWidgetIds.forEach { id ->
+      ImageDownloadWorker.cancel(context, id)
     }
   }
 }
+
+class MemoryReceiver : WidgetReceiver(WidgetType.MEMORIES)
+
+class RandomReceiver : WidgetReceiver(WidgetType.RANDOM)

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/configure/RandomConfigure.kt

@@ -71,22 +71,18 @@ fun RandomConfiguration(context: Context, appWidgetId: Int, glanceId: GlanceId,
 
   LaunchedEffect(Unit) {
     // get albums from server
-    val serverCfg = ImmichAPI.getServerConfig(context)
-
-    if (serverCfg == null) {
+    if (!ImmichAPI.isLoggedIn(context)) {
       state = WidgetConfigState.LOG_IN
       return@LaunchedEffect
     }
 
-    val api = ImmichAPI(serverCfg)
-
     val currentState = getAppWidgetState(context, PreferencesGlanceStateDefinition, glanceId)
     val currentAlbumId = currentState[kSelectedAlbum] ?: "NONE"
     val currentAlbumName = currentState[kSelectedAlbumName] ?: "None"
     var albumItems: List<DropdownItem>
 
     try {
-      albumItems = api.fetchAlbums().map {
+      albumItems = ImmichAPI.fetchAlbums().map {
         DropdownItem(it.albumName, it.id)
       }
 

mobile/android/app/src/main/kotlin/app/alextran/immich/widget/model/Model.kt

@@ -1,6 +1,5 @@
 package app.alextran.immich.widget.model
 
-import android.graphics.Bitmap
 import androidx.datastore.preferences.core.*
 
 // MARK: Immich Entities
@@ -50,19 +49,13 @@ enum class WidgetConfigState {
 }
 
 data class WidgetEntry (
-  val image: Bitmap,
+  val assetId: String,
   val subtitle: String?,
   val deeplink: String?
 )
 
-data class ServerConfig(
-  val serverEndpoint: String,
-  val sessionKey: String,
-  val customHeaders: Map<String, String>
-)
-
 // MARK: Widget State Keys
-val kImageUUID = stringPreferencesKey("uuid")
+val kAssetId = stringPreferencesKey("assetId")
 val kSubtitleText = stringPreferencesKey("subtitle")
 val kNow = longPreferencesKey("now")
 val kWidgetState = stringPreferencesKey("state")
@@ -75,10 +68,6 @@ const val kWorkerWidgetType = "widgetType"
 const val kWorkerWidgetID = "widgetId"
 const val kTriggeredFromApp = "triggeredFromApp"
 
-fun imageFilename(id: String): String {
-  return "widget_image_$id.jpg"
-}
-
 fun assetDeeplink(asset: Asset): String {
   return "immich://asset?id=${asset.id}"
 }

mobile/ios/Runner.xcodeproj/project.pbxproj

@@ -140,6 +140,13 @@
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
+		A872EC0CA71550E4AB04E049 /* Shared */ = {
+			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+			);
+			path = Shared;
+			sourceTree = "<group>";
+		};
 		B231F52D2E93A44A00BC45D1 /* Core */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
 			exceptions = (
@@ -257,6 +264,7 @@
 				97C146EF1CF9000F007C117D /* Products */,
 				0FB772A5B9601143383626CA /* Pods */,
 				1754452DD81DA6620E279E51 /* Frameworks */,
+				A872EC0CA71550E4AB04E049 /* Shared */,
 			);
 			sourceTree = "<group>";
 		};
@@ -362,6 +370,7 @@
 				F0B57D482DF764BE00DC5BCC /* PBXTargetDependency */,
 			);
 			fileSystemSynchronizedGroups = (
+				A872EC0CA71550E4AB04E049 /* Shared */,
 				B231F52D2E93A44A00BC45D1 /* Core */,
 				B2CF7F8C2DDE4EBB00744BF6 /* Sync */,
 				FEE084F22EC172080045228E /* Schemas */,
@@ -384,6 +393,7 @@
 			dependencies = (
 			);
 			fileSystemSynchronizedGroups = (
+				A872EC0CA71550E4AB04E049 /* Shared */,
 				F0B57D3D2DF764BD00DC5BCC /* WidgetExtension */,
 			);
 			name = WidgetExtension;

mobile/ios/Runner/Core/Network.g.swift

@@ -221,8 +221,11 @@ class NetworkPigeonCodec: FlutterStandardMessageCodec, @unchecked Sendable {
 /// Generated protocol from Pigeon that represents a handler of messages from Flutter.
 protocol NetworkApi {
   func addCertificate(clientData: ClientCertData, completion: @escaping (Result<Void, Error>) -> Void)
-  func selectCertificate(promptText: ClientCertPrompt, completion: @escaping (Result<ClientCertData, Error>) -> Void)
+  func selectCertificate(promptText: ClientCertPrompt, completion: @escaping (Result<Void, Error>) -> Void)
   func removeCertificate(completion: @escaping (Result<Void, Error>) -> Void)
+  func hasCertificate() throws -> Bool
+  func getClientPointer() throws -> Int64
+  func setRequestHeaders(headers: [String: String], serverUrls: [String], token: String?) throws
 }
 
 /// Generated setup class from Pigeon to handle messages through the `binaryMessenger`.
@@ -255,8 +258,8 @@ class NetworkApiSetup {
         let promptTextArg = args[0] as! ClientCertPrompt
         api.selectCertificate(promptText: promptTextArg) { result in
           switch result {
-          case .success(let res):
-            reply(wrapResult(res))
+          case .success:
+            reply(wrapResult(nil))
           case .failure(let error):
             reply(wrapError(error))
           }
@@ -280,5 +283,48 @@ class NetworkApiSetup {
     } else {
       removeCertificateChannel.setMessageHandler(nil)
     }
+    let hasCertificateChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.hasCertificate\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      hasCertificateChannel.setMessageHandler { _, reply in
+        do {
+          let result = try api.hasCertificate()
+          reply(wrapResult(result))
+        } catch {
+          reply(wrapError(error))
+        }
+      }
+    } else {
+      hasCertificateChannel.setMessageHandler(nil)
+    }
+    let getClientPointerChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.getClientPointer\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      getClientPointerChannel.setMessageHandler { _, reply in
+        do {
+          let result = try api.getClientPointer()
+          reply(wrapResult(result))
+        } catch {
+          reply(wrapError(error))
+        }
+      }
+    } else {
+      getClientPointerChannel.setMessageHandler(nil)
+    }
+    let setRequestHeadersChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.setRequestHeaders\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      setRequestHeadersChannel.setMessageHandler { message, reply in
+        let args = message as! [Any?]
+        let headersArg = args[0] as! [String: String]
+        let serverUrlsArg = args[1] as! [String]
+        let tokenArg: String? = nilOrValue(args[2])
+        do {
+          try api.setRequestHeaders(headers: headersArg, serverUrls: serverUrlsArg, token: tokenArg)
+          reply(wrapResult(nil))
+        } catch {
+          reply(wrapError(error))
+        }
+      }
+    } else {
+      setRequestHeadersChannel.setMessageHandler(nil)
+    }
   }
 }

mobile/ios/Runner/Core/NetworkApiImpl.swift

@@ -1,5 +1,6 @@
 import Foundation
 import UniformTypeIdentifiers
+import native_video_player
 
 enum ImportError: Error {
   case noFile
@@ -16,14 +17,25 @@ class NetworkApiImpl: NetworkApi {
     self.viewController = viewController
   }
   
-  func selectCertificate(promptText: ClientCertPrompt, completion: @escaping (Result<ClientCertData, any Error>) -> Void) {
+  func selectCertificate(promptText: ClientCertPrompt, completion: @escaping (Result<Void, any Error>) -> Void) {
     let importer = CertImporter(promptText: promptText, completion: { [weak self] result in
       self?.activeImporter = nil
-      completion(result.map { ClientCertData(data: FlutterStandardTypedData(bytes: $0.0), password: $0.1) })
+      completion(result)
     }, viewController: viewController)
     activeImporter = importer
     importer.load()
   }
+
+  func hasCertificate() throws -> Bool {
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassIdentity,
+      kSecAttrLabel as String: CLIENT_CERT_LABEL,
+      kSecReturnRef as String: true,
+    ]
+    var item: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &item)
+    return status == errSecSuccess
+  }
   
   func removeCertificate(completion: @escaping (Result<Void, any Error>) -> Void) {
     let status = clearCerts()
@@ -40,14 +52,55 @@ class NetworkApiImpl: NetworkApi {
     }
     completion(.failure(ImportError.keychainError(status)))
   }
+  
+  func getClientPointer() throws -> Int64 {
+    let pointer = URLSessionManager.shared.sessionPointer
+    return Int64(Int(bitPattern: pointer))
+  }
+  
+  func setRequestHeaders(headers: [String : String], serverUrls: [String], token: String?) throws {
+    URLSessionManager.setServerUrls(serverUrls)
+
+    if let token = token {
+      let expiry = Date().addingTimeInterval(COOKIE_EXPIRY_DAYS * 24 * 60 * 60)
+      for serverUrl in serverUrls {
+        guard let url = URL(string: serverUrl), let domain = url.host else { continue }
+        let isSecure = serverUrl.hasPrefix("https")
+        let values: [AuthCookie: String] = [
+          .accessToken: token,
+          .isAuthenticated: "true",
+          .authType: "password",
+        ]
+        for (cookie, value) in values {
+          var properties: [HTTPCookiePropertyKey: Any] = [
+            .name: cookie.name,
+            .value: value,
+            .domain: domain,
+            .path: "/",
+            .expires: expiry,
+          ]
+          if isSecure { properties[.secure] = "TRUE" }
+          if cookie.httpOnly { properties[.init("HttpOnly")] = "TRUE" }
+          if let httpCookie = HTTPCookie(properties: properties) {
+            URLSessionManager.cookieStorage.setCookie(httpCookie)
+          }
+        }
+      }
+    }
+
+    if headers != UserDefaults.group.dictionary(forKey: HEADERS_KEY) as? [String: String] {
+      UserDefaults.group.set(headers, forKey: HEADERS_KEY)
+      URLSessionManager.shared.recreateSession()
+    }
+  }
 }
 
 private class CertImporter: NSObject, UIDocumentPickerDelegate {
   private let promptText: ClientCertPrompt
-  private var completion: ((Result<(Data, String), Error>) -> Void)
+  private var completion: ((Result<Void, Error>) -> Void)
   private weak var viewController: UIViewController?
-  
-  init(promptText: ClientCertPrompt, completion: (@escaping (Result<(Data, String), Error>) -> Void), viewController: UIViewController?) {
+
+  init(promptText: ClientCertPrompt, completion: (@escaping (Result<Void, Error>) -> Void), viewController: UIViewController?) {
     self.promptText = promptText
     self.completion = completion
     self.viewController = viewController
@@ -81,7 +134,7 @@ private class CertImporter: NSObject, UIDocumentPickerDelegate {
         }
         
         await URLSessionManager.shared.session.flush()
-        self.completion(.success((data, password)))
+        self.completion(.success(()))
       } catch {
         completion(.failure(error))
       }

mobile/ios/Runner/Core/URLSessionManager.swift

@@ -1,87 +0,0 @@
-import Foundation
-
-let CLIENT_CERT_LABEL = "app.alextran.immich.client_identity"
-
-/// Manages a shared URLSession with SSL configuration support.
-class URLSessionManager: NSObject {
-  static let shared = URLSessionManager()
-  
-  let session: URLSession
-  private let configuration = {
-    let config = URLSessionConfiguration.default
-    
-    let cacheDir = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)
-      .first!
-      .appendingPathComponent("api", isDirectory: true)
-    try! FileManager.default.createDirectory(at: cacheDir, withIntermediateDirectories: true)
-    
-    config.urlCache = URLCache(
-      memoryCapacity: 0,
-      diskCapacity: 1024 * 1024 * 1024,
-      directory: cacheDir
-    )
-    
-    config.httpMaximumConnectionsPerHost = 64
-    config.timeoutIntervalForRequest = 60
-    config.timeoutIntervalForResource = 300
-    
-    let version = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
-    config.httpAdditionalHeaders = ["User-Agent": "Immich_iOS_\(version)"]
-    
-    return config
-  }()
-  
-  private override init() {
-    session = URLSession(configuration: configuration, delegate: URLSessionManagerDelegate(), delegateQueue: nil)
-    super.init()
-  }
-}
-
-class URLSessionManagerDelegate: NSObject, URLSessionTaskDelegate {
-  func urlSession(
-    _ session: URLSession,
-    didReceive challenge: URLAuthenticationChallenge,
-    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    handleChallenge(challenge, completionHandler: completionHandler)
-  }
-  
-  func urlSession(
-    _ session: URLSession,
-    task: URLSessionTask,
-    didReceive challenge: URLAuthenticationChallenge,
-    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    handleChallenge(challenge, completionHandler: completionHandler)
-  }
-  
-  func handleChallenge(
-    _ challenge: URLAuthenticationChallenge,
-    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    switch challenge.protectionSpace.authenticationMethod {
-    case NSURLAuthenticationMethodClientCertificate: handleClientCertificate(completion: completionHandler)
-    default: completionHandler(.performDefaultHandling, nil)
-    }
-  }
-  
-  private func handleClientCertificate(
-    completion: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
-  ) {
-    let query: [String: Any] = [
-      kSecClass as String: kSecClassIdentity,
-      kSecAttrLabel as String: CLIENT_CERT_LABEL,
-      kSecReturnRef as String: true,
-    ]
-    
-    var item: CFTypeRef?
-    let status = SecItemCopyMatching(query as CFDictionary, &item)
-    if status == errSecSuccess, let identity = item {
-      let credential = URLCredential(identity: identity as! SecIdentity,
-                                     certificates: nil,
-                                     persistence: .forSession)
-      return completion(.useCredential, credential)
-    }
-    completion(.performDefaultHandling, nil)
-  }
-}

mobile/ios/Runner/Images/LocalImages.g.swift

@@ -70,7 +70,7 @@ class LocalImagesPigeonCodec: FlutterStandardMessageCodec, @unchecked Sendable {
 
 /// Generated protocol from Pigeon that represents a handler of messages from Flutter.
 protocol LocalImageApi {
-  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
+  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, preferEncoded: Bool, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
   func cancelRequest(requestId: Int64) throws
   func getThumbhash(thumbhash: String, completion: @escaping (Result<[String: Int64], Error>) -> Void)
 }
@@ -90,7 +90,8 @@ class LocalImageApiSetup {
         let widthArg = args[2] as! Int64
         let heightArg = args[3] as! Int64
         let isVideoArg = args[4] as! Bool
-        api.requestImage(assetId: assetIdArg, requestId: requestIdArg, width: widthArg, height: heightArg, isVideo: isVideoArg) { result in
+        let preferEncodedArg = args[5] as! Bool
+        api.requestImage(assetId: assetIdArg, requestId: requestIdArg, width: widthArg, height: heightArg, isVideo: isVideoArg, preferEncoded: preferEncodedArg) { result in
           switch result {
           case .success(let res):
             reply(wrapResult(res))

mobile/ios/Runner/Images/LocalImagesImpl.swift

@@ -7,7 +7,7 @@ class LocalImageRequest {
   weak var workItem: DispatchWorkItem?
   var isCancelled = false
   let callback: (Result<[String: Int64]?, any Error>) -> Void
-  
+
   init(callback: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
     self.callback = callback
   }
@@ -30,11 +30,11 @@ class LocalImageApiImpl: LocalImageApi {
     requestOptions.version = .current
     return requestOptions
   }()
-  
+
   private static let assetQueue = DispatchQueue(label: "thumbnail.assets", qos: .userInitiated)
   private static let requestQueue = DispatchQueue(label: "thumbnail.requests", qos: .userInitiated)
   private static let cancelQueue = DispatchQueue(label: "thumbnail.cancellation", qos: .default)
-  
+
   private static var rgbaFormat = vImage_CGImageFormat(
     bitsPerComponent: 8,
     bitsPerPixel: 32,
@@ -48,12 +48,12 @@ class LocalImageApiImpl: LocalImageApi {
     assetCache.countLimit = 10000
     return assetCache
   }()
-  
+
   func getThumbhash(thumbhash: String, completion: @escaping (Result<[String : Int64], any Error>) -> Void) {
     ImageProcessing.queue.async {
       guard let data = Data(base64Encoded: thumbhash)
       else { return completion(.failure(PigeonError(code: "", message: "Invalid base64 string: \(thumbhash)", details: nil)))}
-      
+
       let (width, height, pointer) = thumbHashToRGBA(hash: data)
       completion(.success([
         "pointer": Int64(Int(bitPattern: pointer.baseAddress)),
@@ -63,34 +63,77 @@ class LocalImageApiImpl: LocalImageApi {
       ]))
     }
   }
-  
-  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, completion: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
+
+  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, preferEncoded: Bool, completion: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
     let request = LocalImageRequest(callback: completion)
     let item = DispatchWorkItem {
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       ImageProcessing.semaphore.wait()
       defer {
         ImageProcessing.semaphore.signal()
       }
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       guard let asset = Self.requestAsset(assetId: assetId)
       else {
         Self.remove(requestId: requestId)
         completion(.failure(PigeonError(code: "", message: "Could not get asset data for \(assetId)", details: nil)))
         return
       }
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
+      if preferEncoded {
+        let dataOptions = PHImageRequestOptions()
+        dataOptions.isNetworkAccessAllowed = true
+        dataOptions.isSynchronous = true
+        dataOptions.version = .current
+
+        var imageData: Data?
+        Self.imageManager.requestImageDataAndOrientation(
+          for: asset,
+          options: dataOptions,
+          resultHandler: { (data, _, _, _) in
+            imageData = data
+          }
+        )
+
+        if request.isCancelled {
+          Self.remove(requestId: requestId)
+          return completion(ImageProcessing.cancelledResult)
+        }
+
+        guard let data = imageData else {
+          Self.remove(requestId: requestId)
+          return completion(.failure(PigeonError(code: "", message: "Could not get image data for \(assetId)", details: nil)))
+        }
+
+        let length = data.count
+        let pointer = malloc(length)!
+        data.copyBytes(to: pointer.assumingMemoryBound(to: UInt8.self), count: length)
+
+        if request.isCancelled {
+          free(pointer)
+          Self.remove(requestId: requestId)
+          return completion(ImageProcessing.cancelledResult)
+        }
+
+        request.callback(.success([
+          "pointer": Int64(Int(bitPattern: pointer)),
+          "length": Int64(length),
+        ]))
+        Self.remove(requestId: requestId)
+        return
+      }
+
       var image: UIImage?
       Self.imageManager.requestImage(
         for: asset,
@@ -101,29 +144,29 @@ class LocalImageApiImpl: LocalImageApi {
           image = _image
         }
       )
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       guard let image = image,
             let cgImage = image.cgImage else {
         Self.remove(requestId: requestId)
         return completion(.failure(PigeonError(code: "", message: "Could not get pixel data for \(assetId)", details: nil)))
       }
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       do {
         let buffer = try vImage_Buffer(cgImage: cgImage, format: Self.rgbaFormat)
-        
+
         if request.isCancelled {
           buffer.free()
           return completion(ImageProcessing.cancelledResult)
         }
-        
+
         request.callback(.success([
           "pointer": Int64(Int(bitPattern: buffer.data)),
           "width": Int64(buffer.width),
@@ -136,24 +179,24 @@ class LocalImageApiImpl: LocalImageApi {
         return completion(.failure(PigeonError(code: "", message: "Failed to convert image for \(assetId): \(error)", details: nil)))
       }
     }
-    
+
     request.workItem = item
     Self.add(requestId: requestId, request: request)
     ImageProcessing.queue.async(execute: item)
   }
-  
+
   func cancelRequest(requestId: Int64) {
     Self.cancel(requestId: requestId)
   }
-  
+
   private static func add(requestId: Int64, request: LocalImageRequest) -> Void {
     requestQueue.sync { requests[requestId] = request }
   }
-  
+
   private static func remove(requestId: Int64) -> Void {
     requestQueue.sync { requests[requestId] = nil }
   }
-  
+
   private static func cancel(requestId: Int64) -> Void {
     requestQueue.async {
       guard let request = requests.removeValue(forKey: requestId) else { return }
@@ -164,12 +207,12 @@ class LocalImageApiImpl: LocalImageApi {
       }
     }
   }
-  
+
   private static func requestAsset(assetId: String) -> PHAsset? {
     var asset: PHAsset?
     assetQueue.sync { asset = assetCache.object(forKey: assetId as NSString) }
     if asset != nil { return asset }
-    
+
     guard let asset = PHAsset.fetchAssets(withLocalIdentifiers: [assetId], options: Self.fetchOptions).firstObject
     else { return nil }
     assetQueue.async { assetCache.setObject(asset, forKey: assetId as NSString) }

mobile/ios/Runner/Images/RemoteImages.g.swift

@@ -70,7 +70,7 @@ class RemoteImagesPigeonCodec: FlutterStandardMessageCodec, @unchecked Sendable
 
 /// Generated protocol from Pigeon that represents a handler of messages from Flutter.
 protocol RemoteImageApi {
-  func requestImage(url: String, headers: [String: String], requestId: Int64, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
+  func requestImage(url: String, requestId: Int64, preferEncoded: Bool, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
   func cancelRequest(requestId: Int64) throws
   func clearCache(completion: @escaping (Result<Int64, Error>) -> Void)
 }
@@ -86,9 +86,9 @@ class RemoteImageApiSetup {
       requestImageChannel.setMessageHandler { message, reply in
         let args = message as! [Any?]
         let urlArg = args[0] as! String
-        let headersArg = args[1] as! [String: String]
-        let requestIdArg = args[2] as! Int64
-        api.requestImage(url: urlArg, headers: headersArg, requestId: requestIdArg) { result in
+        let requestIdArg = args[1] as! Int64
+        let preferEncodedArg = args[2] as! Bool
+        api.requestImage(url: urlArg, requestId: requestIdArg, preferEncoded: preferEncodedArg) { result in
           switch result {
           case .success(let res):
             reply(wrapResult(res))

mobile/ios/Runner/Images/RemoteImagesImpl.swift

@@ -8,7 +8,7 @@ class RemoteImageRequest {
   let id: Int64
   var isCancelled = false
   let completion: (Result<[String: Int64]?, any Error>) -> Void
-  
+
   init(id: Int64, task: URLSessionDataTask, completion: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
     self.id = id
     self.task = task
@@ -32,75 +32,90 @@ class RemoteImageApiImpl: NSObject, RemoteImageApi {
     kCGImageSourceCreateThumbnailWithTransform: true,
     kCGImageSourceCreateThumbnailFromImageAlways: true
   ] as CFDictionary
-  
-  func requestImage(url: String, headers: [String : String], requestId: Int64, completion: @escaping (Result<[String : Int64]?, any Error>) -> Void) {
+
+  func requestImage(url: String, requestId: Int64, preferEncoded: Bool, completion: @escaping (Result<[String : Int64]?, any Error>) -> Void) {
     var urlRequest = URLRequest(url: URL(string: url)!)
     urlRequest.cachePolicy = .returnCacheDataElseLoad
-    for (key, value) in headers {
-      urlRequest.setValue(value, forHTTPHeaderField: key)
-    }
-    
+
     let task = URLSessionManager.shared.session.dataTask(with: urlRequest) { data, response, error in
-      Self.handleCompletion(requestId: requestId, data: data, response: response, error: error)
+      Self.handleCompletion(requestId: requestId, encoded: preferEncoded, data: data, response: response, error: error)
     }
-    
+
     let request = RemoteImageRequest(id: requestId, task: task, completion: completion)
-    
+
     os_unfair_lock_lock(&Self.lock)
     Self.requests[requestId] = request
     os_unfair_lock_unlock(&Self.lock)
-    
+
     task.resume()
   }
-  
-  private static func handleCompletion(requestId: Int64, data: Data?, response: URLResponse?, error: Error?) {
+
+  private static func handleCompletion(requestId: Int64, encoded: Bool, data: Data?, response: URLResponse?, error: Error?) {
     os_unfair_lock_lock(&Self.lock)
     guard let request = requests[requestId] else {
       return os_unfair_lock_unlock(&Self.lock)
     }
     requests[requestId] = nil
     os_unfair_lock_unlock(&Self.lock)
-    
+
     if let error = error {
       if request.isCancelled || (error as NSError).code == NSURLErrorCancelled {
         return request.completion(ImageProcessing.cancelledResult)
       }
       return request.completion(.failure(error))
     }
-    
+
     if request.isCancelled {
       return request.completion(ImageProcessing.cancelledResult)
     }
-    
+
     guard let data = data else {
       return request.completion(.failure(PigeonError(code: "", message: "No data received", details: nil)))
     }
-    
+
     ImageProcessing.queue.async {
       ImageProcessing.semaphore.wait()
       defer { ImageProcessing.semaphore.signal() }
-      
+
       if request.isCancelled {
         return request.completion(ImageProcessing.cancelledResult)
       }
-      
+
+      // Return raw encoded bytes when requested (for animated images)
+      if encoded {
+        let length = data.count
+        let pointer = malloc(length)!
+        data.copyBytes(to: pointer.assumingMemoryBound(to: UInt8.self), count: length)
+
+        if request.isCancelled {
+          free(pointer)
+          return request.completion(ImageProcessing.cancelledResult)
+        }
+
+        return request.completion(
+          .success([
+            "pointer": Int64(Int(bitPattern: pointer)),
+            "length": Int64(length),
+          ]))
+      }
+
       guard let imageSource = CGImageSourceCreateWithData(data as CFData, nil),
             let cgImage = CGImageSourceCreateThumbnailAtIndex(imageSource, 0, decodeOptions) else {
         return request.completion(.failure(PigeonError(code: "", message: "Failed to decode image for request", details: nil)))
       }
-      
+
       if request.isCancelled {
         return request.completion(ImageProcessing.cancelledResult)
       }
-      
+
       do {
         let buffer = try vImage_Buffer(cgImage: cgImage, format: rgbaFormat)
-        
+
         if request.isCancelled {
           buffer.free()
           return request.completion(ImageProcessing.cancelledResult)
         }
-        
+
         request.completion(
           .success([
             "pointer": Int64(Int(bitPattern: buffer.data)),
@@ -113,17 +128,17 @@ class RemoteImageApiImpl: NSObject, RemoteImageApi {
       }
     }
   }
-  
+
   func cancelRequest(requestId: Int64) {
     os_unfair_lock_lock(&Self.lock)
     let request = Self.requests[requestId]
     os_unfair_lock_unlock(&Self.lock)
-    
+
     guard let request = request else { return }
     request.isCancelled = true
     request.task?.cancel()
   }
-  
+
   func clearCache(completion: @escaping (Result<Int64, any Error>) -> Void) {
     Task {
       let cache = URLSessionManager.shared.session.configuration.urlCache!

mobile/ios/Runner/Sync/Messages.g.swift

@@ -128,6 +128,15 @@ func deepHashMessages(value: Any?, hasher: inout Hasher) {
 
     
 
+enum PlatformAssetPlaybackStyle: Int {
+  case unknown = 0
+  case image = 1
+  case video = 2
+  case imageAnimated = 3
+  case livePhoto = 4
+  case videoLooping = 5
+}
+
 /// Generated class from Pigeon that represents data sent in messages.
 struct PlatformAsset: Hashable {
   var id: String
@@ -143,6 +152,7 @@ struct PlatformAsset: Hashable {
   var adjustmentTime: Int64? = nil
   var latitude: Double? = nil
   var longitude: Double? = nil
+  var playbackStyle: PlatformAssetPlaybackStyle
 
 
   // swift-format-ignore: AlwaysUseLowerCamelCase
@@ -160,6 +170,7 @@ struct PlatformAsset: Hashable {
     let adjustmentTime: Int64? = nilOrValue(pigeonVar_list[10])
     let latitude: Double? = nilOrValue(pigeonVar_list[11])
     let longitude: Double? = nilOrValue(pigeonVar_list[12])
+    let playbackStyle = pigeonVar_list[13] as! PlatformAssetPlaybackStyle
 
     return PlatformAsset(
       id: id,
@@ -174,7 +185,8 @@ struct PlatformAsset: Hashable {
       isFavorite: isFavorite,
       adjustmentTime: adjustmentTime,
       latitude: latitude,
-      longitude: longitude
+      longitude: longitude,
+      playbackStyle: playbackStyle
     )
   }
   func toList() -> [Any?] {
@@ -192,6 +204,7 @@ struct PlatformAsset: Hashable {
       adjustmentTime,
       latitude,
       longitude,
+      playbackStyle,
     ]
   }
   static func == (lhs: PlatformAsset, rhs: PlatformAsset) -> Bool {
@@ -349,14 +362,20 @@ private class MessagesPigeonCodecReader: FlutterStandardReader {
   override func readValue(ofType type: UInt8) -> Any? {
     switch type {
     case 129:
-      return PlatformAsset.fromList(self.readValue() as! [Any?])
+      let enumResultAsInt: Int? = nilOrValue(self.readValue() as! Int?)
+      if let enumResultAsInt = enumResultAsInt {
+        return PlatformAssetPlaybackStyle(rawValue: enumResultAsInt)
+      }
+      return nil
     case 130:
-      return PlatformAlbum.fromList(self.readValue() as! [Any?])
+      return PlatformAsset.fromList(self.readValue() as! [Any?])
     case 131:
-      return SyncDelta.fromList(self.readValue() as! [Any?])
+      return PlatformAlbum.fromList(self.readValue() as! [Any?])
     case 132:
-      return HashResult.fromList(self.readValue() as! [Any?])
+      return SyncDelta.fromList(self.readValue() as! [Any?])
     case 133:
+      return HashResult.fromList(self.readValue() as! [Any?])
+    case 134:
       return CloudIdResult.fromList(self.readValue() as! [Any?])
     default:
       return super.readValue(ofType: type)
@@ -366,21 +385,24 @@ private class MessagesPigeonCodecReader: FlutterStandardReader {
 
 private class MessagesPigeonCodecWriter: FlutterStandardWriter {
   override func writeValue(_ value: Any) {
-    if let value = value as? PlatformAsset {
+    if let value = value as? PlatformAssetPlaybackStyle {
       super.writeByte(129)
-      super.writeValue(value.toList())
-    } else if let value = value as? PlatformAlbum {
+      super.writeValue(value.rawValue)
+    } else if let value = value as? PlatformAsset {
       super.writeByte(130)
       super.writeValue(value.toList())
-    } else if let value = value as? SyncDelta {
+    } else if let value = value as? PlatformAlbum {
       super.writeByte(131)
       super.writeValue(value.toList())
-    } else if let value = value as? HashResult {
+    } else if let value = value as? SyncDelta {
       super.writeByte(132)
       super.writeValue(value.toList())
-    } else if let value = value as? CloudIdResult {
+    } else if let value = value as? HashResult {
       super.writeByte(133)
       super.writeValue(value.toList())
+    } else if let value = value as? CloudIdResult {
+      super.writeByte(134)
+      super.writeValue(value.toList())
     } else {
       super.writeValue(value)
     }

mobile/ios/Runner/Sync/MessagesImpl.swift

@@ -173,7 +173,8 @@ class NativeSyncApiImpl: ImmichPlugin, NativeSyncApi, FlutterPlugin {
             type: 0,
             durationInSeconds: 0,
             orientation: 0,
-            isFavorite: false
+            isFavorite: false,
+            playbackStyle: .unknown
           )
           if (updatedAssets.contains(AssetWrapper(with: predicate))) {
             continue

mobile/ios/Runner/Sync/PHAssetExtensions.swift

@@ -1,6 +1,17 @@
 import Photos
 
 extension PHAsset {
+  var platformPlaybackStyle: PlatformAssetPlaybackStyle {
+    switch playbackStyle {
+    case .image: return .image
+    case .imageAnimated: return .imageAnimated
+    case .livePhoto: return .livePhoto
+    case .video: return .video
+    case .videoLooping: return .videoLooping
+    @unknown default: return .unknown
+    }
+  }
+
   func toPlatformAsset() -> PlatformAsset {
     return PlatformAsset(
       id: localIdentifier,
@@ -15,7 +26,8 @@ extension PHAsset {
       isFavorite: isFavorite,
       adjustmentTime: adjustmentTimestamp,
       latitude: location?.coordinate.latitude,
-      longitude: location?.coordinate.longitude
+      longitude: location?.coordinate.longitude,
+      playbackStyle: platformPlaybackStyle
     )
   }
 
@@ -26,7 +38,7 @@ extension PHAsset {
   var filename: String? {
     return value(forKey: "filename") as? String
   }
-  
+
   var adjustmentTimestamp: Int64? {
     if let date = value(forKey: "adjustmentTimestamp") as? Date {
       return Int64(date.timeIntervalSince1970)

mobile/ios/Shared/URLSessionManager.swift

@@ -0,0 +1,241 @@
+import Foundation
+#if canImport(native_video_player)
+import native_video_player
+#endif
+
+let CLIENT_CERT_LABEL = "app.alextran.immich.client_identity"
+let HEADERS_KEY = "immich.request_headers"
+let SERVER_URLS_KEY = "immich.server_urls"
+let APP_GROUP = "group.app.immich.share"
+let COOKIE_EXPIRY_DAYS: TimeInterval = 400
+
+enum AuthCookie: CaseIterable {
+  case accessToken, isAuthenticated, authType
+
+  var name: String {
+    switch self {
+    case .accessToken: return "immich_access_token"
+    case .isAuthenticated: return "immich_is_authenticated"
+    case .authType: return "immich_auth_type"
+    }
+  }
+
+  var httpOnly: Bool {
+    switch self {
+    case .accessToken, .authType: return true
+    case .isAuthenticated: return false
+    }
+  }
+
+  static let names: Set<String> = Set(allCases.map(\.name))
+}
+
+extension UserDefaults {
+  static let group = UserDefaults(suiteName: APP_GROUP)!
+}
+
+/// Manages a shared URLSession with SSL configuration support.
+/// Old sessions are kept alive by Dart's FFI retain until all isolates release them.
+class URLSessionManager: NSObject {
+  static let shared = URLSessionManager()
+
+  private(set) var session: URLSession
+  let delegate: URLSessionManagerDelegate
+  private static let cacheDir: URL = {
+    let dir = FileManager.default.urls(for: .cachesDirectory, in: .userDomainMask)
+      .first!
+      .appendingPathComponent("api", isDirectory: true)
+    try! FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+    return dir
+  }()
+  private static let urlCache = URLCache(
+    memoryCapacity: 0,
+    diskCapacity: 1024 * 1024 * 1024,
+    directory: cacheDir
+  )
+  private static let userAgent: String = {
+    let version = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
+    return "Immich_iOS_\(version)"
+  }()
+  static let cookieStorage = HTTPCookieStorage.sharedCookieStorage(forGroupContainerIdentifier: APP_GROUP)
+  private static var serverUrls: [String] = []
+  private static var isSyncing = false
+
+  var sessionPointer: UnsafeMutableRawPointer {
+    Unmanaged.passUnretained(session).toOpaque()
+  }
+
+  private override init() {
+    delegate = URLSessionManagerDelegate()
+    session = Self.buildSession(delegate: delegate)
+    super.init()
+    Self.serverUrls = UserDefaults.group.stringArray(forKey: SERVER_URLS_KEY) ?? []
+    NotificationCenter.default.addObserver(
+      Self.self,
+      selector: #selector(Self.cookiesDidChange),
+      name: NSNotification.Name.NSHTTPCookieManagerCookiesChanged,
+      object: Self.cookieStorage
+    )
+  }
+
+  func recreateSession() {
+    session = Self.buildSession(delegate: delegate)
+  }
+
+  static func setServerUrls(_ urls: [String]) {
+    guard urls != serverUrls else { return }
+    serverUrls = urls
+    UserDefaults.group.set(urls, forKey: SERVER_URLS_KEY)
+    syncAuthCookies()
+  }
+
+  @objc private static func cookiesDidChange(_ notification: Notification) {
+    guard !isSyncing, !serverUrls.isEmpty else { return }
+    syncAuthCookies()
+  }
+
+  private static func syncAuthCookies() {
+    let serverHosts = Set(serverUrls.compactMap { URL(string: $0)?.host })
+    let allCookies = cookieStorage.cookies ?? []
+    let now = Date()
+
+    let serverAuthCookies = allCookies.filter {
+      AuthCookie.names.contains($0.name) && serverHosts.contains($0.domain)
+    }
+
+    var sourceCookies: [String: HTTPCookie] = [:]
+    for cookie in serverAuthCookies {
+      if cookie.expiresDate.map({ $0 > now }) ?? true {
+        sourceCookies[cookie.name] = cookie
+      }
+    }
+
+    isSyncing = true
+    defer { isSyncing = false }
+
+    if sourceCookies.isEmpty {
+      for cookie in serverAuthCookies {
+        cookieStorage.deleteCookie(cookie)
+      }
+      return
+    }
+
+    for serverUrl in serverUrls {
+      guard let url = URL(string: serverUrl), let domain = url.host else { continue }
+      let isSecure = serverUrl.hasPrefix("https")
+
+      for (_, source) in sourceCookies {
+        if allCookies.contains(where: { $0.name == source.name && $0.domain == domain && $0.value == source.value }) {
+          continue
+        }
+
+        var properties: [HTTPCookiePropertyKey: Any] = [
+          .name: source.name,
+          .value: source.value,
+          .domain: domain,
+          .path: "/",
+          .expires: source.expiresDate ?? Date().addingTimeInterval(COOKIE_EXPIRY_DAYS * 24 * 60 * 60),
+        ]
+        if isSecure { properties[.secure] = "TRUE" }
+        if source.isHTTPOnly { properties[.init("HttpOnly")] = "TRUE" }
+
+        if let cookie = HTTPCookie(properties: properties) {
+          cookieStorage.setCookie(cookie)
+        }
+      }
+    }
+  }
+
+  private static func buildSession(delegate: URLSessionDelegate) -> URLSession {
+    let config = URLSessionConfiguration.default
+    config.urlCache = urlCache
+    config.httpCookieStorage = cookieStorage
+    config.httpMaximumConnectionsPerHost = 64
+    config.timeoutIntervalForRequest = 60
+    config.timeoutIntervalForResource = 300
+
+    var headers = UserDefaults.group.dictionary(forKey: HEADERS_KEY) as? [String: String] ?? [:]
+    headers["User-Agent"] = headers["User-Agent"] ?? userAgent
+    config.httpAdditionalHeaders = headers
+
+    return URLSession(configuration: config, delegate: delegate, delegateQueue: nil)
+  }
+}
+
+class URLSessionManagerDelegate: NSObject, URLSessionTaskDelegate, URLSessionWebSocketDelegate {
+  func urlSession(
+    _ session: URLSession,
+    didReceive challenge: URLAuthenticationChallenge,
+    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+  ) {
+    handleChallenge(session, challenge, completionHandler)
+  }
+
+  func urlSession(
+    _ session: URLSession,
+    task: URLSessionTask,
+    didReceive challenge: URLAuthenticationChallenge,
+    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+  ) {
+    handleChallenge(session, challenge, completionHandler, task: task)
+  }
+
+  func handleChallenge(
+    _ session: URLSession,
+    _ challenge: URLAuthenticationChallenge,
+    _ completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void,
+    task: URLSessionTask? = nil
+  ) {
+    switch challenge.protectionSpace.authenticationMethod {
+    case NSURLAuthenticationMethodClientCertificate: handleClientCertificate(session, completion: completionHandler)
+    case NSURLAuthenticationMethodHTTPBasic: handleBasicAuth(session, task: task, completion: completionHandler)
+    default: completionHandler(.performDefaultHandling, nil)
+    }
+  }
+
+  private func handleClientCertificate(
+    _ session: URLSession,
+    completion: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+  ) {
+    let query: [String: Any] = [
+      kSecClass as String: kSecClassIdentity,
+      kSecAttrLabel as String: CLIENT_CERT_LABEL,
+      kSecReturnRef as String: true,
+    ]
+
+    var item: CFTypeRef?
+    let status = SecItemCopyMatching(query as CFDictionary, &item)
+    if status == errSecSuccess, let identity = item {
+      let credential = URLCredential(identity: identity as! SecIdentity,
+                                     certificates: nil,
+                                     persistence: .forSession)
+      #if canImport(native_video_player)
+      if #available(iOS 15, *) {
+        VideoProxyServer.shared.session = session
+      }
+      #endif
+      return completion(.useCredential, credential)
+    }
+    completion(.performDefaultHandling, nil)
+  }
+
+  private func handleBasicAuth(
+    _ session: URLSession,
+    task: URLSessionTask?,
+    completion: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+  ) {
+    guard let url = task?.originalRequest?.url,
+      let user = url.user,
+      let password = url.password
+    else {
+      return completion(.performDefaultHandling, nil)
+    }
+    #if canImport(native_video_player)
+    if #available(iOS 15, *) {
+      VideoProxyServer.shared.session = session
+    }
+    #endif
+    let credential = URLCredential(user: user, password: password, persistence: .forSession)
+    completion(.useCredential, credential)
+  }
+}

mobile/ios/WidgetExtension/ImageEntry.swift

@@ -9,6 +9,7 @@ struct ImageEntry: TimelineEntry {
   var metadata: Metadata = Metadata()
 
   struct Metadata: Codable {
+    var assetId: String? = nil
     var subtitle: String? = nil
     var error: WidgetError? = nil
     var deepLink: URL? = nil
@@ -33,80 +34,39 @@ struct ImageEntry: TimelineEntry {
       date: entryDate,
       image: image,
       metadata: EntryMetadata(
+        assetId: asset.id,
         subtitle: subtitle,
         deepLink: asset.deepLink
       )
     )
   }
 
-  func cache(for key: String) throws {
-    if let containerURL = FileManager.default.containerURL(
-      forSecurityApplicationGroupIdentifier: IMMICH_SHARE_GROUP
-    ) {
-      let imageURL = containerURL.appendingPathComponent("\(key)_image.png")
-      let metadataURL = containerURL.appendingPathComponent(
-        "\(key)_metadata.json"
-      )
-
-      // build metadata JSON
-      let entryMetadata = try JSONEncoder().encode(self.metadata)
-
-      // write to disk
-      try self.image?.pngData()?.write(to: imageURL, options: .atomic)
-      try entryMetadata.write(to: metadataURL, options: .atomic)
+  static func saveLast(for key: String, metadata: Metadata) {
+    if let data = try? JSONEncoder().encode(metadata) {
+      UserDefaults.group.set(data, forKey: "widget_last_\(key)")
     }
   }
 
-  static func loadCached(for key: String, at date: Date = Date.now)
-    -> ImageEntry?
-  {
-    if let containerURL = FileManager.default.containerURL(
-      forSecurityApplicationGroupIdentifier: IMMICH_SHARE_GROUP
-    ) {
-      let imageURL = containerURL.appendingPathComponent("\(key)_image.png")
-      let metadataURL = containerURL.appendingPathComponent(
-        "\(key)_metadata.json"
-      )
-
-      guard let imageData = try? Data(contentsOf: imageURL),
-        let metadataJSON = try? Data(contentsOf: metadataURL),
-        let decodedMetadata = try? JSONDecoder().decode(
-          Metadata.self,
-          from: metadataJSON
-        )
-      else {
-        return nil
-      }
-
-      return ImageEntry(
-        date: date,
-        image: UIImage(data: imageData),
-        metadata: decodedMetadata
-      )
-    }
-
-    return nil
-  }
-
   static func handleError(
     for key: String,
+    api: ImmichAPI? = nil,
     error: WidgetError = .fetchFailed
-  ) -> Timeline<ImageEntry> {
-    var timelineEntry = ImageEntry(
-      date: Date.now,
-      image: nil,
-      metadata: EntryMetadata(error: error)
-    )
-
-    // use cache if generic failed error
-    // we want to show the other errors to the user since without intervention,
-    // it will never succeed
-    if error == .fetchFailed, let cachedEntry = ImageEntry.loadCached(for: key)
+  ) async -> Timeline<ImageEntry> {
+    // Try to show the last image from the URL cache for transient failures
+    if error == .fetchFailed, let api = api,
+       let data = UserDefaults.group.data(forKey: "widget_last_\(key)"),
+       let cached = try? JSONDecoder().decode(Metadata.self, from: data),
+       let assetId = cached.assetId,
+       let image = try? await api.fetchImage(asset: Asset(id: assetId, type: .image))
     {
-      timelineEntry = cachedEntry
+      let entry = ImageEntry(date: Date.now, image: image, metadata: cached)
+      return Timeline(entries: [entry], policy: .atEnd)
     }
 
-    return Timeline(entries: [timelineEntry], policy: .atEnd)
+    return Timeline(
+      entries: [ImageEntry(date: Date.now, metadata: Metadata(error: error))],
+      policy: .atEnd
+    )
   }
 
 }

mobile/ios/WidgetExtension/ImmichAPI.swift

@@ -2,7 +2,7 @@ import Foundation
 import SwiftUI
 import WidgetKit
 
-let IMMICH_SHARE_GROUP = "group.app.immich.share"
+// Constants and session configuration are in Shared/SharedURLSession.swift
 
 enum WidgetError: Error, Codable {
   case noLogin
@@ -104,87 +104,48 @@ struct Album: Codable, Equatable {
 // MARK: API
 
 class ImmichAPI {
-  typealias CustomHeaders = [String:String]
-  struct ServerConfig {
-    let serverEndpoint: String
-    let sessionKey: String
-    let customHeaders: CustomHeaders
-  }
-  
-  let serverConfig: ServerConfig
+  let serverEndpoint: String
 
   init() async throws {
-    // fetch the credentials from the UserDefaults store that dart placed here
-    guard let defaults = UserDefaults(suiteName: IMMICH_SHARE_GROUP),
-      let serverURL = defaults.string(forKey: "widget_server_url"),
-      let sessionKey = defaults.string(forKey: "widget_auth_token")
+    guard let serverURLs = UserDefaults.group.stringArray(forKey: SERVER_URLS_KEY),
+      let serverURL = serverURLs.first,
+      !serverURL.isEmpty
     else {
       throw WidgetError.noLogin
     }
 
-    if serverURL == "" || sessionKey == "" {
-      throw WidgetError.noLogin
-    }
-    
-    // custom headers come in the form of KV pairs in JSON
-    var customHeadersJSON = (defaults.string(forKey: "widget_custom_headers") ?? "")
-    var customHeaders: CustomHeaders = [:]
-    
-    if customHeadersJSON != "",
-       let parsedHeaders = try? JSONDecoder().decode(CustomHeaders.self, from: customHeadersJSON.data(using: .utf8)!) {
-      customHeaders = parsedHeaders
-    }
-
-    serverConfig = ServerConfig(
-      serverEndpoint: serverURL,
-      sessionKey: sessionKey,
-      customHeaders: customHeaders
-    )
+    serverEndpoint = serverURL
   }
 
   private func buildRequestURL(
-    serverConfig: ServerConfig,
     endpoint: String,
     params: [URLQueryItem] = []
-  ) -> URL? {
-    guard let baseURL = URL(string: serverConfig.serverEndpoint) else {
-      fatalError("Invalid base URL")
+  ) throws(FetchError) -> URL? {
+    guard let baseURL = URL(string: serverEndpoint) else {
+      throw FetchError.invalidURL
     }
 
-    // Combine the base URL and API path
     let fullPath = baseURL.appendingPathComponent(
       endpoint.trimmingCharacters(in: CharacterSet(charactersIn: "/"))
     )
 
-    // Add the session key as a query parameter
     var components = URLComponents(
       url: fullPath,
       resolvingAgainstBaseURL: false
     )
-    components?.queryItems = [
-      URLQueryItem(name: "sessionKey", value: serverConfig.sessionKey)
-    ]
-    components?.queryItems?.append(contentsOf: params)
+    if !params.isEmpty {
+      components?.queryItems = params
+    }
 
     return components?.url
   }
-  
-  func applyCustomHeaders(for request: inout URLRequest) {
-    for (header, value) in serverConfig.customHeaders {
-      request.addValue(value, forHTTPHeaderField: header)
-    }
-  }
 
   func fetchSearchResults(with filters: SearchFilter = Album.NONE.filter)
     async throws
     -> [Asset]
   {
-    // get URL
     guard
-      let searchURL = buildRequestURL(
-        serverConfig: serverConfig,
-        endpoint: "/search/random"
-      )
+      let searchURL = try buildRequestURL(endpoint: "/search/random")
     else {
       throw URLError(.badURL)
     }
@@ -193,20 +154,15 @@ class ImmichAPI {
     request.httpMethod = "POST"
     request.httpBody = try JSONEncoder().encode(filters)
     request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-    applyCustomHeaders(for: &request)
-    
-    let (data, _) = try await URLSession.shared.data(for: request)
 
-    // decode data
+    let (data, _) = try await URLSessionManager.shared.session.data(for: request)
     return try JSONDecoder().decode([Asset].self, from: data)
   }
 
   func fetchMemory(for date: Date) async throws -> [MemoryResult] {
-    // get URL
     let memoryParams = [URLQueryItem(name: "for", value: date.ISO8601Format())]
     guard
-      let searchURL = buildRequestURL(
-        serverConfig: serverConfig,
+      let searchURL = try buildRequestURL(
         endpoint: "/memories",
         params: memoryParams
       )
@@ -216,11 +172,8 @@ class ImmichAPI {
 
     var request = URLRequest(url: searchURL)
     request.httpMethod = "GET"
-    applyCustomHeaders(for: &request)
 
-    let (data, _) = try await URLSession.shared.data(for: request)
-
-    // decode data
+    let (data, _) = try await URLSessionManager.shared.session.data(for: request)
     return try JSONDecoder().decode([MemoryResult].self, from: data)
   }
 
@@ -229,8 +182,7 @@ class ImmichAPI {
     let assetEndpoint = "/assets/" + asset.id + "/thumbnail"
 
     guard
-      let fetchURL = buildRequestURL(
-        serverConfig: serverConfig,
+      let fetchURL = try buildRequestURL(
         endpoint: assetEndpoint,
         params: thumbnailParams
       )
@@ -238,9 +190,13 @@ class ImmichAPI {
       throw .invalidURL
     }
 
-    guard let imageSource = CGImageSourceCreateWithURL(fetchURL as CFURL, nil)
-    else {
-      throw .invalidURL
+    let request = URLRequest(url: fetchURL)
+    guard let (data, _) = try? await URLSessionManager.shared.session.data(for: request) else {
+      throw .fetchFailed
+    }
+
+    guard let imageSource = CGImageSourceCreateWithData(data as CFData, nil) else {
+      throw .invalidImage
     }
 
     let decodeOptions: [NSString: Any] = [
@@ -263,23 +219,16 @@ class ImmichAPI {
   }
 
   func fetchAlbums() async throws -> [Album] {
-    // get URL
     guard
-      let searchURL = buildRequestURL(
-        serverConfig: serverConfig,
-        endpoint: "/albums"
-      )
+      let searchURL = try buildRequestURL(endpoint: "/albums")
     else {
       throw URLError(.badURL)
     }
 
     var request = URLRequest(url: searchURL)
     request.httpMethod = "GET"
-    applyCustomHeaders(for: &request)
-    
-    let (data, _) = try await URLSession.shared.data(for: request)
 
-    // decode data
+    let (data, _) = try await URLSessionManager.shared.session.data(for: request)
     return try JSONDecoder().decode([Album].self, from: data)
   }
 }

mobile/ios/WidgetExtension/UIImage+Resize.swift

@@ -1,23 +0,0 @@
-//
-//  Utils.swift
-//  Runner
-//
-//  Created by Alex Tran and Brandon Wees on 6/16/25.
-//
-import UIKit
-
-extension UIImage {
-  /// Crops the image to ensure width and height do not exceed maxSize.
-  /// Keeps original aspect ratio and crops excess equally from edges (center crop).
-  func resized(toWidth width: CGFloat, isOpaque: Bool = true) -> UIImage? {
-    let canvas = CGSize(
-      width: width,
-      height: CGFloat(ceil(width / size.width * size.height))
-    )
-    let format = imageRendererFormat
-    format.opaque = isOpaque
-    return UIGraphicsImageRenderer(size: canvas, format: format).image {
-      _ in draw(in: CGRect(origin: .zero, size: canvas))
-    }
-  }
-}

mobile/ios/WidgetExtension/widgets/MemoryWidget.swift

@@ -24,14 +24,14 @@ struct ImmichMemoryProvider: TimelineProvider {
     Task {
       guard let api = try? await ImmichAPI() else {
         completion(
-          ImageEntry.handleError(for: cacheKey, error: .noLogin).entries.first!
+          await ImageEntry.handleError(for: cacheKey, error: .noLogin).entries.first!
         )
         return
       }
 
       guard let memories = try? await api.fetchMemory(for: Date.now)
       else {
-        completion(ImageEntry.handleError(for: cacheKey).entries.first!)
+        completion(await ImageEntry.handleError(for: cacheKey, api: api).entries.first!)
         return
       }
 
@@ -58,7 +58,7 @@ struct ImmichMemoryProvider: TimelineProvider {
           dateOffset: 0
         )
       else {
-        completion(ImageEntry.handleError(for: cacheKey).entries.first!)
+        completion(await ImageEntry.handleError(for: cacheKey, api: api).entries.first!)
         return
       }
 
@@ -78,7 +78,7 @@ struct ImmichMemoryProvider: TimelineProvider {
 
       guard let api = try? await ImmichAPI() else {
         completion(
-          ImageEntry.handleError(for: cacheKey, error: .noLogin)
+          await ImageEntry.handleError(for: cacheKey, error: .noLogin)
         )
         return
       }
@@ -129,20 +129,20 @@ struct ImmichMemoryProvider: TimelineProvider {
           // Load or save a cached asset for when network conditions are bad
           if search.count == 0 {
             completion(
-              ImageEntry.handleError(for: cacheKey, error: .noAssetsAvailable)
+              await ImageEntry.handleError(for: cacheKey, error: .noAssetsAvailable)
             )
             return
           }
 
           entries.append(contentsOf: search)
         } catch {
-          completion(ImageEntry.handleError(for: cacheKey))
+          completion(await ImageEntry.handleError(for: cacheKey, api: api))
           return
         }
       }
 
-      // cache the last image
-      try? entries.last!.cache(for: cacheKey)
+      // save the last asset for fallback
+      ImageEntry.saveLast(for: cacheKey, metadata: entries.last!.metadata)
 
       completion(Timeline(entries: entries, policy: .atEnd))
     }

mobile/ios/WidgetExtension/widgets/RandomWidget.swift

@@ -65,7 +65,7 @@ struct ImmichRandomProvider: AppIntentTimelineProvider {
     let cacheKey = "random_none_\(context.family.rawValue)"
 
     guard let api = try? await ImmichAPI() else {
-      return ImageEntry.handleError(for: cacheKey, error: .noLogin).entries
+      return await ImageEntry.handleError(for: cacheKey, error: .noLogin).entries
         .first!
     }
 
@@ -79,7 +79,7 @@ struct ImmichRandomProvider: AppIntentTimelineProvider {
         dateOffset: 0
       )
     else {
-      return ImageEntry.handleError(for: cacheKey).entries.first!
+      return await ImageEntry.handleError(for: cacheKey, api: api).entries.first!
     }
 
     return entry
@@ -102,7 +102,7 @@ struct ImmichRandomProvider: AppIntentTimelineProvider {
 
     // If we don't have a server config, return an entry with an error
     guard let api = try? await ImmichAPI() else {
-      return ImageEntry.handleError(for: cacheKey, error: .noLogin)
+      return await ImageEntry.handleError(for: cacheKey, error: .noLogin)
     }
 
     // build entries
@@ -119,16 +119,16 @@ struct ImmichRandomProvider: AppIntentTimelineProvider {
 
       // Load or save a cached asset for when network conditions are bad
       if search.count == 0 {
-        return ImageEntry.handleError(for: cacheKey, error: .noAssetsAvailable)
+        return await ImageEntry.handleError(for: cacheKey, error: .noAssetsAvailable)
       }
 
       entries.append(contentsOf: search)
     } catch {
-      return ImageEntry.handleError(for: cacheKey)
+      return await ImageEntry.handleError(for: cacheKey, api: api)
     }
 
-    // cache the last image
-    try? entries.last!.cache(for: cacheKey)
+    // save the last asset for fallback
+    ImageEntry.saveLast(for: cacheKey, metadata: entries.last!.metadata)
 
     return Timeline(entries: entries, policy: .atEnd)
   }

mobile/lib/constants/colors.dart

@@ -7,6 +7,6 @@ const String defaultColorPresetName = "indigo";
 
 const Color immichBrandColorLight = Color(0xFF4150AF);
 const Color immichBrandColorDark = Color(0xFFACCBFA);
-const Color whiteOpacity75 = Color.fromARGB((0.75 * 255) ~/ 1, 255, 255, 255);
+const Color whiteOpacity75 = Color.fromRGBO(255, 255, 255, 0.75);
 const Color red400 = Color(0xFFEF5350);
 const Color grey200 = Color(0xFFEEEEEE);

mobile/lib/constants/constants.dart

@@ -33,12 +33,6 @@ const int kTimelineNoneSegmentSize = 120;
 const int kTimelineAssetLoadBatchSize = 1024;
 const int kTimelineAssetLoadOppositeSize = 64;
 
-// Widget keys
-const String appShareGroupId = "group.app.immich.share";
-const String kWidgetAuthToken = "widget_auth_token";
-const String kWidgetServerEndpoint = "widget_server_url";
-const String kWidgetCustomHeaders = "widget_custom_headers";
-
 // add widget identifiers here for new widgets
 // these are used to force a widget refresh
 // (iOSName, androidFQDN)

mobile/lib/domain/models/asset/base_asset.model.dart

@@ -11,6 +11,10 @@ enum AssetType {
 
 enum AssetState { local, remote, merged }
 
+// do not change!
+// keep in sync with PlatformAssetPlaybackStyle
+enum AssetPlaybackStyle { unknown, image, video, imageAnimated, livePhoto, videoLooping }
+
 sealed class BaseAsset {
   final String name;
   final String? checksum;
@@ -42,6 +46,15 @@ sealed class BaseAsset {
   bool get isVideo => type == AssetType.video;
 
   bool get isMotionPhoto => livePhotoVideoId != null;
+  bool get isAnimatedImage => playbackStyle == AssetPlaybackStyle.imageAnimated;
+
+  AssetPlaybackStyle get playbackStyle {
+    if (isVideo) return AssetPlaybackStyle.video;
+    if (isMotionPhoto) return AssetPlaybackStyle.livePhoto;
+    if (isImage && durationInSeconds != null && durationInSeconds! > 0) return AssetPlaybackStyle.imageAnimated;
+    if (isImage) return AssetPlaybackStyle.image;
+    return AssetPlaybackStyle.unknown;
+  }
 
   Duration get duration {
     final durationInSeconds = this.durationInSeconds;

mobile/lib/domain/models/asset/local_asset.model.dart

@@ -5,6 +5,8 @@ class LocalAsset extends BaseAsset {
   final String? remoteAssetId;
   final String? cloudId;
   final int orientation;
+  @override
+  final AssetPlaybackStyle playbackStyle;
 
   final DateTime? adjustmentTime;
   final double? latitude;
@@ -25,6 +27,7 @@ class LocalAsset extends BaseAsset {
     super.isFavorite = false,
     super.livePhotoVideoId,
     this.orientation = 0,
+    required this.playbackStyle,
     this.adjustmentTime,
     this.latitude,
     this.longitude,
@@ -56,6 +59,7 @@ class LocalAsset extends BaseAsset {
    width: ${width ?? "<NA>"},
    height: ${height ?? "<NA>"},
    durationInSeconds: ${durationInSeconds ?? "<NA>"},
+   playbackStyle: $playbackStyle,
    remoteId: ${remoteId ?? "<NA>"},
    cloudId: ${cloudId ?? "<NA>"},
    checksum: ${checksum ?? "<NA>"},
@@ -76,6 +80,7 @@ class LocalAsset extends BaseAsset {
         id == other.id &&
         cloudId == other.cloudId &&
         orientation == other.orientation &&
+        playbackStyle == other.playbackStyle &&
         adjustmentTime == other.adjustmentTime &&
         latitude == other.latitude &&
         longitude == other.longitude;
@@ -87,6 +92,7 @@ class LocalAsset extends BaseAsset {
       id.hashCode ^
       remoteId.hashCode ^
       orientation.hashCode ^
+      playbackStyle.hashCode ^
       adjustmentTime.hashCode ^
       latitude.hashCode ^
       longitude.hashCode;
@@ -105,6 +111,7 @@ class LocalAsset extends BaseAsset {
     int? durationInSeconds,
     bool? isFavorite,
     int? orientation,
+    AssetPlaybackStyle? playbackStyle,
     DateTime? adjustmentTime,
     double? latitude,
     double? longitude,
@@ -124,6 +131,7 @@ class LocalAsset extends BaseAsset {
       durationInSeconds: durationInSeconds ?? this.durationInSeconds,
       isFavorite: isFavorite ?? this.isFavorite,
       orientation: orientation ?? this.orientation,
+      playbackStyle: playbackStyle ?? this.playbackStyle,
       adjustmentTime: adjustmentTime ?? this.adjustmentTime,
       latitude: latitude ?? this.latitude,
       longitude: longitude ?? this.longitude,

mobile/lib/domain/models/asset_edit.model.dart

@@ -0,0 +1,21 @@
+import "package:openapi/api.dart" as api show AssetEditAction;
+
+enum AssetEditAction { rotate, crop, mirror, other }
+
+extension AssetEditActionExtension on AssetEditAction {
+  api.AssetEditAction? toDto() {
+    return switch (this) {
+      AssetEditAction.rotate => api.AssetEditAction.rotate,
+      AssetEditAction.crop => api.AssetEditAction.crop,
+      AssetEditAction.mirror => api.AssetEditAction.mirror,
+      AssetEditAction.other => null,
+    };
+  }
+}
+
+class AssetEdit {
+  final AssetEditAction action;
+  final Map<String, dynamic> parameters;
+
+  const AssetEdit({required this.action, required this.parameters});
+}

mobile/lib/domain/models/search_result.model.dart

@@ -3,30 +3,21 @@ import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 
 class SearchResult {
   final List<BaseAsset> assets;
-  final double scrollOffset;
   final int? nextPage;
 
-  const SearchResult({required this.assets, this.scrollOffset = 0.0, this.nextPage});
-
-  SearchResult copyWith({List<BaseAsset>? assets, int? nextPage, double? scrollOffset}) {
-    return SearchResult(
-      assets: assets ?? this.assets,
-      nextPage: nextPage ?? this.nextPage,
-      scrollOffset: scrollOffset ?? this.scrollOffset,
-    );
-  }
+  const SearchResult({required this.assets, this.nextPage});
 
   @override
-  String toString() => 'SearchResult(assets: ${assets.length}, nextPage: $nextPage, scrollOffset: $scrollOffset)';
+  String toString() => 'SearchResult(assets: ${assets.length}, nextPage: $nextPage)';
 
   @override
   bool operator ==(covariant SearchResult other) {
     if (identical(this, other)) return true;
     final listEquals = const DeepCollectionEquality().equals;
 
-    return listEquals(other.assets, assets) && other.nextPage == nextPage && other.scrollOffset == scrollOffset;
+    return listEquals(other.assets, assets) && other.nextPage == nextPage;
   }
 
   @override
-  int get hashCode => assets.hashCode ^ nextPage.hashCode ^ scrollOffset.hashCode;
+  int get hashCode => assets.hashCode ^ nextPage.hashCode;
 }

mobile/lib/domain/services/background_worker.service.dart

@@ -3,7 +3,6 @@ import 'dart:io';
 import 'dart:ui';
 
 import 'package:background_downloader/background_downloader.dart';
-import 'package:cancellation_token_http/http.dart';
 import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/constants/constants.dart';
@@ -28,7 +27,6 @@ import 'package:immich_mobile/services/localization.service.dart';
 import 'package:immich_mobile/services/foreground_upload.service.dart';
 import 'package:immich_mobile/utils/bootstrap.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
-import 'package:immich_mobile/utils/http_ssl_options.dart';
 import 'package:immich_mobile/wm_executor.dart';
 import 'package:isar/isar.dart';
 import 'package:logging/logging.dart';
@@ -64,7 +62,7 @@ class BackgroundWorkerBgService extends BackgroundWorkerFlutterApi {
   final Drift _drift;
   final DriftLogger _driftLogger;
   final BackgroundWorkerBgHostApi _backgroundHostApi;
-  final CancellationToken _cancellationToken = CancellationToken();
+  final _cancellationToken = Completer<void>();
   final Logger _logger = Logger('BackgroundWorkerBgService');
 
   bool _isCleanedUp = false;
@@ -88,8 +86,6 @@ class BackgroundWorkerBgService extends BackgroundWorkerFlutterApi {
 
   Future<void> init() async {
     try {
-      HttpSSLOptions.apply();
-
       await Future.wait(
         [
           loadTranslations(),
@@ -198,7 +194,7 @@ class BackgroundWorkerBgService extends BackgroundWorkerFlutterApi {
       _ref?.dispose();
       _ref = null;
 
-      _cancellationToken.cancel();
+      _cancellationToken.complete();
       _logger.info("Cleaning up background worker");
 
       final cleanupFutures = [

mobile/lib/domain/services/local_sync.service.dart

@@ -435,9 +435,19 @@ extension PlatformToLocalAsset on PlatformAsset {
     durationInSeconds: durationInSeconds,
     isFavorite: isFavorite,
     orientation: orientation,
+    playbackStyle: _toPlaybackStyle(playbackStyle),
     adjustmentTime: tryFromSecondsSinceEpoch(adjustmentTime, isUtc: true),
     latitude: latitude,
     longitude: longitude,
     isEdited: false,
   );
 }
+
+AssetPlaybackStyle _toPlaybackStyle(PlatformAssetPlaybackStyle style) => switch (style) {
+  PlatformAssetPlaybackStyle.unknown => AssetPlaybackStyle.unknown,
+  PlatformAssetPlaybackStyle.image => AssetPlaybackStyle.image,
+  PlatformAssetPlaybackStyle.video => AssetPlaybackStyle.video,
+  PlatformAssetPlaybackStyle.imageAnimated => AssetPlaybackStyle.imageAnimated,
+  PlatformAssetPlaybackStyle.livePhoto => AssetPlaybackStyle.livePhoto,
+  PlatformAssetPlaybackStyle.videoLooping => AssetPlaybackStyle.videoLooping,
+};