refactor(web): extract timeline selection logic into SelectableSegment and SelectableDay components

- Move asset selection, range selection, and keyboard interaction logic
  to SelectableSegment
  - Extract day group selection logic to SelectableDay component
  - Simplify Timeline component by removing selection-related state and
  handlers
  - Fix scroll compensation handling with dedicated while loop
  - Remove unused keyboard handlers from Scrubber component

.github/.nvmrc

@@ -1 +1 @@
-22.20.0
+22.21.0

.github/labeler.yml

@@ -31,7 +31,7 @@ documentation:
 🧠machine-learning:
   - changed-files:
       - any-glob-to-any-file:
-          - machine-learning/app/**
+          - machine-learning/**
 
 changelog:translation:
   - head-branch: ['^chore/translations$']

.github/workflows/build-mobile.yml

@@ -34,10 +34,17 @@ jobs:
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@5f91b52dfbb92b8d96ca411ab59c896cd59714ca # pre-job-action-v1.1.0
+        uses: immich-app/devtools/actions/pre-job@08bac802a312fc89808e0dd589271ca0974087b5 # pre-job-action-v2.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           filters: |
             mobile:
               - 'mobile/**'
@@ -51,14 +58,22 @@ jobs:
     permissions:
       contents: read
     # Skip when PR from a fork
-    if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && fromJSON(needs.pre-job.outputs.should_run).mobile == true }}
+    # if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' && fromJSON(needs.pre-job.outputs.should_run).mobile == true }}
+    if: ${{ false }}
     runs-on: mich
 
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.ref || github.sha }}
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       - name: Create the Keystore
         env:
@@ -140,3 +155,111 @@ jobs:
             mobile/android/.gradle
             mobile/.dart_tool
           key: ${{ steps.cache-gradle-restore.outputs.cache-primary-key }}
+
+  build-sign-ios:
+    name: Build and sign iOS
+    needs: pre-job
+    permissions:
+      contents: read
+    # Run on main branch or workflow_dispatch
+    if: ${{ !github.event.pull_request.head.repo.fork && fromJSON(needs.pre-job.outputs.should_run).mobile == true && github.ref == 'refs/heads/main' }}
+    runs-on: macos-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
+
+      - name: Setup Flutter SDK
+        uses: subosito/flutter-action@v2
+        with:
+          channel: 'stable'
+          flutter-version-file: ./mobile/pubspec.yaml
+          cache: true
+
+      - name: Install Flutter dependencies
+        working-directory: ./mobile
+        run: flutter pub get
+
+      - name: Generate translation files
+        run: dart run easy_localization:generate -S ../i18n && dart run bin/generate_keys.dart
+        working-directory: ./mobile
+
+      - name: Generate platform APIs
+        run: make pigeon
+        working-directory: ./mobile
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.2'
+          working-directory: ./mobile/ios
+
+      - name: Install Fastlane
+        run: |
+          cd mobile/ios
+          gem install bundler
+          bundle config set --local path 'vendor/bundle'
+          bundle install
+
+      - name: Create API Key JSON
+        env:
+          API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+          API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
+          API_KEY_CONTENT: ${{ secrets.APP_STORE_CONNECT_API_KEY }}
+        working-directory: ./mobile/ios
+        run: |
+          mkdir -p ~/.appstoreconnect/private_keys
+          echo "$API_KEY_CONTENT" | base64 --decode > ~/.appstoreconnect/private_keys/AuthKey_${API_KEY_ID}.p8
+          cat > api_key.json << EOF
+          {
+            "key_id": "${API_KEY_ID}",
+            "issuer_id": "${API_KEY_ISSUER_ID}",
+            "key": "$(cat ~/.appstoreconnect/private_keys/AuthKey_${API_KEY_ID}.p8)",
+            "duration": 1200,
+            "in_house": false
+          }
+          EOF
+
+      - name: Import Certificate and Provisioning Profile
+        env:
+          IOS_CERTIFICATE_P12: ${{ secrets.IOS_CERTIFICATE_P12 }}
+          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
+          IOS_PROVISIONING_PROFILE: ${{ secrets.IOS_PROVISIONING_PROFILE }}
+        working-directory: ./mobile/ios
+        run: |
+          echo "$IOS_CERTIFICATE_P12" | base64 --decode > certificate.p12
+          echo "$IOS_PROVISIONING_PROFILE" | base64 --decode > profile.mobileprovision
+
+      - name: Create keychain
+        env:
+          KEYCHAIN_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
+        run: |
+          security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security default-keychain -s build.keychain
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
+          security set-keychain-settings -t 3600 -u build.keychain
+
+      - name: Build and deploy to TestFlight
+        env:
+          FASTLANE_TEAM_ID: ${{ secrets.FASTLANE_TEAM_ID }}
+          IOS_CERTIFICATE_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_NAME: build.keychain
+          KEYCHAIN_PASSWORD: ${{ secrets.IOS_CERTIFICATE_PASSWORD }}
+          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+          APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
+        working-directory: ./mobile/ios
+        run: bundle exec fastlane release_ci
+
+      - name: Clean up keychain
+        if: always()
+        run: |
+          security delete-keychain build.keychain || true
+
+      - name: Upload IPA artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ios-release-ipa
+          path: mobile/ios/Runner.ipa

.github/workflows/cache-cleanup.yml

@@ -18,14 +18,21 @@ jobs:
       contents: read
       actions: write
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Check out code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       - name: Cleanup
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.token.outputs.token }}
           REF: ${{ github.ref }}
         run: |
           gh extension install actions/gh-actions-cache

.github/workflows/cli.yml

@@ -29,15 +29,22 @@ jobs:
         working-directory: ./cli
 
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
 
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './cli/.nvmrc'
           registry-url: 'https://registry.npmjs.org'
@@ -64,10 +71,17 @@ jobs:
     needs: publish
 
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
@@ -81,7 +95,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ steps.token.outputs.token }}
 
       - name: Get package version
         id: package-version
@@ -111,3 +125,4 @@ jobs:
           cache-to: type=gha,mode=max
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
+          github-token: ${{ steps.token.outputs.token }}

.github/workflows/close-duplicates.yml

@@ -35,7 +35,7 @@ jobs:
     needs: [get_body, should_run]
     if: ${{ needs.should_run.outputs.should_run == 'true' }}
     container:
-      image: ghcr.io/immich-app/mdq:main@sha256:d8ae47cf2e6cf4e2559bd57a60b73674fe44f897cba2c2bddff2987a05be10a4
+      image: ghcr.io/immich-app/mdq:main@sha256:6b8450bfc06770af1af66bce9bf2ced7d1d9b90df1a59fc4c83a17777a9f6723
     outputs:
       checked: ${{ steps.get_checkbox.outputs.checked }}
     steps:

.github/workflows/codeql-analysis.yml

@@ -43,14 +43,21 @@ jobs:
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
 
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
+        uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -63,7 +70,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
+        uses: github/codeql-action/autobuild@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -76,6 +83,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
+        uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/docker.yml

@@ -22,10 +22,17 @@ jobs:
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@5f91b52dfbb92b8d96ca411ab59c896cd59714ca # pre-job-action-v1.1.0
+        uses: immich-app/devtools/actions/pre-job@08bac802a312fc89808e0dd589271ca0974087b5 # pre-job-action-v2.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           filters: |
             server:
               - 'server/**'
@@ -58,6 +65,7 @@ jobs:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Re-tag image
         env:
           REGISTRY_NAME: 'ghcr.io'
@@ -87,6 +95,7 @@ jobs:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Re-tag image
         env:
           REGISTRY_NAME: 'ghcr.io'
@@ -107,24 +116,23 @@ jobs:
       matrix:
         include:
           - device: cpu
-            tag-suffix: ''
           - device: cuda
-            tag-suffix: '-cuda'
+            suffixes: '-cuda'
             platforms: linux/amd64
           - device: openvino
-            tag-suffix: '-openvino'
+            suffixes: '-openvino'
             platforms: linux/amd64
           - device: armnn
-            tag-suffix: '-armnn'
+            suffixes: '-armnn'
             platforms: linux/arm64
           - device: rknn
-            tag-suffix: '-rknn'
+            suffixes: '-rknn'
             platforms: linux/arm64
           - device: rocm
-            tag-suffix: '-rocm'
+            suffixes: '-rocm'
             platforms: linux/amd64
             runner-mapping: '{"linux/amd64": "mich"}'
-    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@946acac326940f8badf09ccf591d9cb345d6a689 # multi-runner-build-workflow-v0.2.1
+    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@47a2ee86898ccff51592d6572391fb1abcd7f782 # multi-runner-build-workflow-v2.0.1
     permissions:
       contents: read
       actions: read
@@ -138,7 +146,7 @@ jobs:
       dockerfile: machine-learning/Dockerfile
       platforms: ${{ matrix.platforms }}
       runner-mapping: ${{ matrix.runner-mapping }}
-      tag-suffix: ${{ matrix.tag-suffix }}
+      suffixes: ${{ matrix.suffixes }}
       dockerhub-push: ${{ github.event_name == 'release' }}
       build-args: |
         DEVICE=${{ matrix.device }}
@@ -147,7 +155,7 @@ jobs:
     name: Build and Push Server
     needs: pre-job
     if: ${{ fromJSON(needs.pre-job.outputs.should_run).server == true }}
-    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@946acac326940f8badf09ccf591d9cb345d6a689 # multi-runner-build-workflow-v0.2.1
+    uses: immich-app/devtools/.github/workflows/multi-runner-build.yml@47a2ee86898ccff51592d6572391fb1abcd7f782 # multi-runner-build-workflow-v2.0.1
     permissions:
       contents: read
       actions: read

.github/workflows/docs-build.yml

@@ -20,10 +20,17 @@ jobs:
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@5f91b52dfbb92b8d96ca411ab59c896cd59714ca # pre-job-action-v1.1.0
+        uses: immich-app/devtools/actions/pre-job@08bac802a312fc89808e0dd589271ca0974087b5 # pre-job-action-v2.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           filters: |
             docs:
               - 'docs/**'
@@ -46,16 +53,23 @@ jobs:
         working-directory: ./docs
 
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
 
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './docs/.nvmrc'
           cache: 'pnpm'

.github/workflows/docs-deploy.yml

@@ -5,6 +5,9 @@ on:
     types:
       - completed
 
+env:
+  TG_NON_INTERACTIVE: 'true'
+
 jobs:
   checks:
     name: Docs Deploy Checks
@@ -16,12 +19,19 @@ jobs:
       parameters: ${{ steps.parameters.outputs.result }}
       artifact: ${{ steps.get-artifact.outputs.result }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - if: ${{ github.event.workflow_run.conclusion != 'success' }}
         run: echo 'The triggering workflow did not succeed' && exit 1
       - name: Get artifact
         id: get-artifact
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           script: |
             let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
                owner: context.repo.owner,
@@ -42,6 +52,7 @@ jobs:
         env:
           HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
         with:
+          github-token: ${{ steps.token.outputs.token }}
           script: |
             const eventType = context.payload.workflow_run.event;
             const isFork = context.payload.workflow_run.repository.fork;
@@ -107,10 +118,20 @@ jobs:
       pull-requests: write
     if: ${{ fromJson(needs.checks.outputs.artifact).found && fromJson(needs.checks.outputs.parameters).shouldDeploy }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@cd24790a7f5f6439ac32cc94f5523cb2de8bfa8c # use-mise-action-v1.1.0
 
       - name: Load parameters
         id: parameters
@@ -118,6 +139,7 @@ jobs:
         env:
           PARAM_JSON: ${{ needs.checks.outputs.parameters }}
         with:
+          github-token: ${{ steps.token.outputs.token }}
           script: |
             const parameters = JSON.parse(process.env.PARAM_JSON);
             core.setOutput("event", parameters.event);
@@ -129,6 +151,7 @@ jobs:
         env:
           ARTIFACT_JSON: ${{ needs.checks.outputs.artifact }}
         with:
+          github-token: ${{ steps.token.outputs.token }}
           script: |
             let artifact = JSON.parse(process.env.ARTIFACT_JSON);
             let download = await github.rest.actions.downloadArtifact({
@@ -150,12 +173,8 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
-        with:
-          tg_version: '0.58.12'
-          tofu_version: '1.7.1'
-          tg_dir: 'deployment/modules/cloudflare/docs'
-          tg_command: 'apply'
+        working-directory: 'deployment/modules/cloudflare/docs'
+        run: 'mise run tf apply'
 
       - name: Deploy Docs Subdomain Output
         id: docs-output
@@ -165,20 +184,12 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
-        with:
-          tg_version: '0.58.12'
-          tofu_version: '1.7.1'
-          tg_dir: 'deployment/modules/cloudflare/docs'
-          tg_command: 'output -json'
-
-      - name: Output Cleaning
-        id: clean
-        env:
-          TG_OUTPUT: ${{ steps.docs-output.outputs.tg_action_output }}
+        working-directory: 'deployment/modules/cloudflare/docs'
         run: |
-          CLEANED=$(echo "$TG_OUTPUT" | sed 's|%0A|\n|g ; s|%3C|<|g' | jq -c .)
-          echo "output=$CLEANED" >> $GITHUB_OUTPUT
+          mise run tf output -- -json | jq -r '
+            "projectName=\(.pages_project_name.value)",
+            "subdomain=\(.immich_app_branch_subdomain.value)"
+          ' >> $GITHUB_OUTPUT
 
       - name: Publish to Cloudflare Pages
         # TODO: Action is deprecated
@@ -186,7 +197,7 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN_PAGES_UPLOAD }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          projectName: ${{ fromJson(steps.clean.outputs.output).pages_project_name.value }}
+          projectName: ${{ steps.docs-output.outputs.projectName }}
           workingDirectory: 'docs'
           directory: 'build'
           branch: ${{ steps.parameters.outputs.name }}
@@ -199,19 +210,16 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
-        with:
-          tg_version: '0.58.12'
-          tofu_version: '1.7.1'
-          tg_dir: 'deployment/modules/cloudflare/docs-release'
-          tg_command: 'apply'
+        working-directory: 'deployment/modules/cloudflare/docs-release'
+        run: 'mise run tf apply'
 
       - name: Comment
         uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3.2.0
         if: ${{ steps.parameters.outputs.event == 'pr' }}
         with:
+          token: ${{ steps.token.outputs.token }}
           number: ${{ fromJson(needs.checks.outputs.parameters).pr_number }}
           body: |
-            📖 Documentation deployed to [${{ fromJson(steps.clean.outputs.output).immich_app_branch_subdomain.value }}](https://${{ fromJson(steps.clean.outputs.output).immich_app_branch_subdomain.value }})
+            📖 Documentation deployed to [${{ steps.docs-output.outputs.subdomain }}](https://${{ steps.docs-output.outputs.subdomain }})
           emojis: 'rocket'
           body-include: '<!-- Docs PR URL -->'

.github/workflows/docs-destroy.yml

@@ -5,6 +5,9 @@ on:
 
 permissions: {}
 
+env:
+  TG_NON_INTERACTIVE: 'true'
+
 jobs:
   deploy:
     name: Docs Destroy
@@ -13,10 +16,20 @@ jobs:
       contents: read
       pull-requests: write
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
+
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@cd24790a7f5f6439ac32cc94f5523cb2de8bfa8c # use-mise-action-v1.1.0
 
       - name: Destroy Docs Subdomain
         env:
@@ -25,16 +38,13 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
-        uses: gruntwork-io/terragrunt-action@aee21a7df999be8b471c2a8564c6cd853cb674e1 # v2.1.8
-        with:
-          tg_version: '0.58.12'
-          tofu_version: '1.7.1'
-          tg_dir: 'deployment/modules/cloudflare/docs'
-          tg_command: 'destroy -refresh=false'
+        working-directory: 'deployment/modules/cloudflare/docs'
+        run: 'mise run tf destroy -- -refresh=false'
 
       - name: Comment
         uses: actions-cool/maintain-one-comment@4b2dbf086015f892dcb5e8c1106f5fccd6c1476b # v3.2.0
         with:
+          token: ${{ steps.token.outputs.token }}
           number: ${{ github.event.number }}
           delete: true
           body-include: '<!-- Docs PR URL -->'

.github/workflows/fix-format.yml

@@ -29,10 +29,10 @@ jobs:
           persist-credentials: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
 
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './server/.nvmrc'
           cache: 'pnpm'
@@ -51,6 +51,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         if: always()
         with:
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             github.rest.issues.removeLabel({
               issue_number: context.payload.pull_request.number,

.github/workflows/merge-translations.yml

@@ -28,11 +28,19 @@ jobs:
     permissions:
       pull-requests: write
     steps:
+      - name: Generate a token
+        id: generate_token
+        if: ${{ inputs.skip != true }}
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Find translation PR
         id: find_pr
         if: ${{ inputs.skip != true }}
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
         run: |
           set -euo pipefail
 
@@ -55,14 +63,6 @@ jobs:
             exit 1
           fi
 
-      - name: Generate a token
-        id: generate_token
-        if: ${{ inputs.skip != true }}
-        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
-        with:
-          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
-          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
-
       - name: Lock weblate
         if: ${{ inputs.skip != true }}
         env:

.github/workflows/pr-label-validation.yml

@@ -13,9 +13,16 @@ jobs:
       issues: write
       pull-requests: write
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Require PR to have a changelog label
         uses: mheap/github-action-required-labels@8afbe8ae6ab7647d0c9f0cfa7c2f939650d22509 # v5.5.1
         with:
+          token: ${{ steps.token.outputs.token }}
           mode: exactly
           count: 1
           use_regex: true

.github/workflows/pr-labeler.yml

@@ -11,4 +11,12 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        with:
+          repo-token: ${{ steps.token.outputs.token }}

.github/workflows/prepare-release.yml

@@ -62,13 +62,13 @@ jobs:
           ref: main
 
       - name: Install uv
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+        uses: astral-sh/setup-uv@2ddd2b9cb38ad8efd50337e8ab201519a34c9f24 # v7.1.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
 
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './server/.nvmrc'
           cache: 'pnpm'
@@ -126,9 +126,10 @@ jobs:
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: release-apk-signed
+          github-token: ${{ steps.generate-token.outputs.token }}
 
       - name: Create draft release
-        uses: softprops/action-gh-release@aec2ec56f94eb8180ceec724245f64ef008b89f5 # v2.4.0
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
         with:
           draft: true
           tag_name: ${{ env.IMMICH_VERSION }}

.github/workflows/preview-label.yaml

@@ -13,10 +13,17 @@ jobs:
     permissions:
       pull-requests: write
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         with:
+          github-token: ${{ steps.token.outputs.token }}
           message-id: 'preview-status'
-          message: 'Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.cloud/'
+          message: 'Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.build/'
 
   remove-label:
     runs-on: ubuntu-latest
@@ -24,8 +31,15 @@ jobs:
     permissions:
       pull-requests: write
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           script: |
             github.rest.issues.removeLabel({
               issue_number: context.payload.pull_request.number,
@@ -37,11 +51,13 @@ jobs:
       - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         if: ${{ github.event.pull_request.head.repo.fork }}
         with:
+          github-token: ${{ steps.token.outputs.token }}
           message-id: 'preview-status'
           message: 'PRs from forks cannot have preview environments.'
 
       - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         if: ${{ !github.event.pull_request.head.repo.fork }}
         with:
+          github-token: ${{ steps.token.outputs.token }}
           message-id: 'preview-status'
           message: 'Preview environment has been removed.'

.github/workflows/sdk.yml

@@ -16,15 +16,22 @@ jobs:
       run:
         working-directory: ./open-api/typescript-sdk
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
 
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './open-api/typescript-sdk/.nvmrc'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/static_analysis.yml

@@ -19,10 +19,17 @@ jobs:
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@5f91b52dfbb92b8d96ca411ab59c896cd59714ca # pre-job-action-v1.1.0
+        uses: immich-app/devtools/actions/pre-job@08bac802a312fc89808e0dd589271ca0974087b5 # pre-job-action-v2.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           filters: |
             mobile:
               - 'mobile/**'
@@ -41,10 +48,17 @@ jobs:
       run:
         working-directory: ./mobile
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
 
       - name: Setup Flutter SDK
         uses: subosito/flutter-action@fd55f4c5af5b953cc57a2be44cb082c8f6635e8e # v2.21.0
@@ -58,7 +72,7 @@ jobs:
       - name: Install DCM
         uses: CQLabs/setup-dcm@8697ae0790c0852e964a6ef1d768d62a6675481a # v2.0.1
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.token.outputs.token }}
           version: auto
           working-directory: ./mobile
 

.github/workflows/test.yml

@@ -16,10 +16,17 @@ jobs:
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@5f91b52dfbb92b8d96ca411ab59c896cd59714ca # pre-job-action-v1.1.0
+        uses: immich-app/devtools/actions/pre-job@08bac802a312fc89808e0dd589271ca0974087b5 # pre-job-action-v2.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           filters: |
             i18n:
               - 'i18n/**'
@@ -55,14 +62,22 @@ jobs:
       run:
         working-directory: ./server
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
+
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './server/.nvmrc'
           cache: 'pnpm'
@@ -92,14 +107,21 @@ jobs:
       run:
         working-directory: ./cli
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './cli/.nvmrc'
           cache: 'pnpm'
@@ -132,14 +154,21 @@ jobs:
       run:
         working-directory: ./cli
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './cli/.nvmrc'
           cache: 'pnpm'
@@ -167,14 +196,21 @@ jobs:
       run:
         working-directory: ./web
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './web/.nvmrc'
           cache: 'pnpm'
@@ -204,14 +240,21 @@ jobs:
       run:
         working-directory: ./web
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './web/.nvmrc'
           cache: 'pnpm'
@@ -235,14 +278,21 @@ jobs:
     permissions:
       contents: read
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './web/.nvmrc'
           cache: 'pnpm'
@@ -276,14 +326,21 @@ jobs:
       run:
         working-directory: ./e2e
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './e2e/.nvmrc'
           cache: 'pnpm'
@@ -315,14 +372,21 @@ jobs:
       run:
         working-directory: ./server
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './server/.nvmrc'
           cache: 'pnpm'
@@ -346,15 +410,22 @@ jobs:
       matrix:
         runner: [ubuntu-latest, ubuntu-24.04-arm]
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
           submodules: 'recursive'
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './e2e/.nvmrc'
           cache: 'pnpm'
@@ -394,15 +465,22 @@ jobs:
       matrix:
         runner: [ubuntu-latest, ubuntu-24.04-arm]
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
           submodules: 'recursive'
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './e2e/.nvmrc'
           cache: 'pnpm'
@@ -441,9 +519,16 @@ jobs:
     permissions:
       contents: read
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup Flutter SDK
         uses: subosito/flutter-action@fd55f4c5af5b953cc57a2be44cb082c8f6635e8e # v2.21.0
         with:
@@ -466,11 +551,18 @@ jobs:
       run:
         working-directory: ./machine-learning
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Install uv
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
+        uses: astral-sh/setup-uv@2ddd2b9cb38ad8efd50337e8ab201519a34c9f24 # v7.1.1
       - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         # TODO: add caching when supported (https://github.com/actions/setup-python/pull/818)
         # with:
@@ -502,14 +594,21 @@ jobs:
       run:
         working-directory: ./.github
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './.github/.nvmrc'
           cache: 'pnpm'
@@ -525,9 +624,16 @@ jobs:
     permissions:
       contents: read
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Run ShellCheck
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
         with:
@@ -539,14 +645,21 @@ jobs:
     permissions:
       contents: read
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './server/.nvmrc'
           cache: 'pnpm'
@@ -594,14 +707,21 @@ jobs:
       run:
         working-directory: ./server
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Checkout code
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
+          token: ${{ steps.token.outputs.token }}
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
           node-version-file: './server/.nvmrc'
           cache: 'pnpm'

.github/workflows/weblate-lock.yml

@@ -23,10 +23,17 @@ jobs:
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Check what should run
         id: check
-        uses: immich-app/devtools/actions/pre-job@5f91b52dfbb92b8d96ca411ab59c896cd59714ca # pre-job-action-v1.1.0
+        uses: immich-app/devtools/actions/pre-job@08bac802a312fc89808e0dd589271ca0974087b5 # pre-job-action-v2.0.0
         with:
+          github-token: ${{ steps.token.outputs.token }}
           filters: |
             i18n:
               - 'i18n/!(en)**\.json'
@@ -40,10 +47,16 @@ jobs:
     permissions: {}
     if: ${{ fromJSON(needs.pre-job.outputs.should_run).i18n == true }}
     steps:
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@da177fa133657503ddb7503f8ba53dccefec5da1 # create-workflow-token-action-v1.0.0
+        with:
+          app-id: ${{ secrets.PUSH_O_MATIC_APP_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Bot review status
         env:
           PR_NUMBER: ${{ github.event.pull_request.number || github.event.pull_request_review.pull_request.number }}
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.token.outputs.token }}
         run: |
           # Then check for APPROVED by the bot, if absent fail
           gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json reviews | jq -e '.reviews | map(select(.author.login == env.BOT_NAME and .state == "APPROVED")) | length > 0' \

cli/.nvmrc

@@ -1 +1 @@
-22.20.0
+22.21.0

cli/package.json

@@ -20,7 +20,7 @@
     "@types/lodash-es": "^4.17.12",
     "@types/micromatch": "^4.0.9",
     "@types/mock-fs": "^4.13.1",
-    "@types/node": "^22.18.8",
+    "@types/node": "^22.18.12",
     "@vitest/coverage-v8": "^3.0.0",
     "byte-size": "^9.0.0",
     "cli-progress": "^3.12.0",
@@ -69,6 +69,6 @@
     "micromatch": "^4.0.8"
   },
   "volta": {
-    "node": "22.20.0"
+    "node": "22.21.0"
   }
 }

cli/src/commands/asset.spec.ts

@@ -271,7 +271,7 @@ describe('startWatch', () => {
     });
   });
 
-  it('should filger out ignored patterns', async () => {
+  it('should filter out ignored patterns', async () => {
     const testFilePath = path.join(testFolder, 'test.jpg');
     const ignoredPattern = 'ignored';
     const ignoredFolder = path.join(testFolder, ignoredPattern);

cli/src/commands/asset.ts

@@ -37,6 +37,7 @@ export interface UploadOptionsDto {
   dryRun?: boolean;
   skipHash?: boolean;
   delete?: boolean;
+  deleteDuplicates?: boolean;
   album?: boolean;
   albumName?: string;
   includeHidden?: boolean;
@@ -70,10 +71,8 @@ const uploadBatch = async (files: string[], options: UploadOptionsDto) => {
     console.log(JSON.stringify({ newFiles, duplicates, newAssets }, undefined, 4));
   }
   await updateAlbums([...newAssets, ...duplicates], options);
-  await deleteFiles(
-    newAssets.map(({ filepath }) => filepath),
-    options,
-  );
+
+  await deleteFiles(newAssets, duplicates, options);
 };
 
 export const startWatch = async (
@@ -406,28 +405,46 @@ const uploadFile = async (input: string, stats: Stats): Promise<AssetMediaRespon
   return response.json();
 };
 
-const deleteFiles = async (files: string[], options: UploadOptionsDto): Promise<void> => {
-  if (!options.delete) {
-    return;
+const deleteFiles = async (uploaded: Asset[], duplicates: Asset[], options: UploadOptionsDto): Promise<void> => {
+  let fileCount = 0;
+  if (options.delete) {
+    fileCount += uploaded.length;
+  }
+
+  if (options.deleteDuplicates) {
+    fileCount += duplicates.length;
   }
 
   if (options.dryRun) {
-    console.log(`Would have deleted ${files.length} local asset${s(files.length)}`);
+    console.log(`Would have deleted ${fileCount} local asset${s(fileCount)}`);
+    return;
+  }
+
+  if (fileCount === 0) {
     return;
   }
 
   console.log('Deleting assets that have been uploaded...');
-
   const deletionProgress = new SingleBar(
     { format: 'Deleting local assets | {bar} | {percentage}% | ETA: {eta}s | {value}/{total} assets' },
     Presets.shades_classic,
   );
-  deletionProgress.start(files.length, 0);
+  deletionProgress.start(fileCount, 0);
+
+  const chunkDelete = async (files: Asset[]) => {
+    for (const assetBatch of chunk(files, options.concurrency)) {
+      await Promise.all(assetBatch.map((input: Asset) => unlink(input.filepath)));
+      deletionProgress.update(assetBatch.length);
+    }
+  };
 
   try {
-    for (const assetBatch of chunk(files, options.concurrency)) {
-      await Promise.all(assetBatch.map((input: string) => unlink(input)));
-      deletionProgress.update(assetBatch.length);
+    if (options.delete) {
+      await chunkDelete(uploaded);
+    }
+
+    if (options.deleteDuplicates) {
+      await chunkDelete(duplicates);
     }
   } finally {
     deletionProgress.stop();

cli/src/index.ts

@@ -8,6 +8,7 @@ import { serverInfo } from 'src/commands/server-info';
 import { version } from '../package.json';
 
 const defaultConfigDirectory = path.join(os.homedir(), '.config/immich/');
+const defaultConcurrency = Math.max(1, os.cpus().length - 1);
 
 const program = new Command()
   .name('immich')
@@ -66,7 +67,7 @@ program
   .addOption(
     new Option('-c, --concurrency <number>', 'Number of assets to upload at the same time')
       .env('IMMICH_UPLOAD_CONCURRENCY')
-      .default(4),
+      .default(defaultConcurrency),
   )
   .addOption(
     new Option('-j, --json-output', 'Output detailed information in json format')
@@ -74,6 +75,11 @@ program
       .default(false),
   )
   .addOption(new Option('--delete', 'Delete local assets after upload').env('IMMICH_DELETE_ASSETS'))
+  .addOption(
+    new Option('--delete-duplicates', 'Delete local assets that are duplicates (already exist on server)').env(
+      'IMMICH_DELETE_DUPLICATES',
+    ),
+  )
   .addOption(new Option('--no-progress', 'Hide progress bars').env('IMMICH_PROGRESS_BAR').default(true))
   .addOption(
     new Option('--watch', 'Watch for changes and upload automatically')

docker/docker-compose.dev.yml

@@ -122,7 +122,7 @@ services:
     ports:
       - 3003:3003
     volumes:
-      - ../machine-learning:/usr/src/app
+      - ../machine-learning/immich_ml:/usr/src/immich_ml
       - model-cache:/cache
     env_file:
       - .env
@@ -134,7 +134,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
+    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
     healthcheck:
       test: redis-cli ping || exit 1
 

docker/docker-compose.prod.yml

@@ -56,7 +56,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
+    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always
@@ -83,7 +83,7 @@ services:
     container_name: immich_prometheus
     ports:
       - 9090:9090
-    image: prom/prometheus@sha256:63805ebb8d2b3920190daf1cb14a60871b16fd38bed42b857a3182bc621f4996
+    image: prom/prometheus@sha256:23031bfe0e74a13004252caaa74eccd0d62b6c6e7a04711d5b8bf5b7e113adc7
     volumes:
       - ./prometheus.yml:/etc/prometheus/prometheus.yml
       - prometheus-data:/prometheus
@@ -95,7 +95,7 @@ services:
     command: ['./run.sh', '-disable-reporting']
     ports:
       - 3000:3000
-    image: grafana/grafana:12.1.1-ubuntu@sha256:d1da838234ff2de93e0065ee1bf0e66d38f948dcc5d718c25fa6237e14b4424a
+    image: grafana/grafana:12.2.1-ubuntu@sha256:797530c642f7b41ba7848c44cfda5e361ef1f3391a98bed1e5d448c472b6826a
     volumes:
       - grafana-data:/var/lib/grafana
 

docker/docker-compose.yml

@@ -49,7 +49,7 @@ services:
 
   redis:
     container_name: immich_redis
-    image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
+    image: docker.io/valkey/valkey:8@sha256:81db6d39e1bba3b3ff32bd3a1b19a6d69690f94a3954ec131277b9a26b95b3aa
     healthcheck:
       test: redis-cli ping || exit 1
     restart: always

docker/example.env

@@ -9,8 +9,8 @@ DB_DATA_LOCATION=./postgres
 # To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
 # TZ=Etc/UTC
 
-# The Immich version to use. You can pin this to a specific version like "v1.71.0"
-IMMICH_VERSION=release
+# The Immich version to use. You can pin this to a specific version like "v2.1.0"
+IMMICH_VERSION=v2
 
 # Connection secret for postgres. You should change it to a random password
 # Please use only the characters `A-Za-z0-9`, without special characters or spaces

docs/.nvmrc

@@ -1 +1 @@
-22.20.0
+22.21.0

docs/docs/administration/backup-and-restore.md

@@ -57,6 +57,7 @@ Then please follow the steps in the following section for restoring the database
   <TabItem value="Linux system" label="Linux system" default>
 
 ```bash title='Backup'
+# Replace <DB_USERNAME> with the database username - usually postgres unless you have changed it.
 docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=<DB_USERNAME> | gzip > "/path/to/backup/dump.sql.gz"
 ```
 
@@ -69,16 +70,18 @@ docker compose create           # Create Docker containers for Immich apps witho
 docker start immich_postgres    # Start Postgres server
 sleep 10                        # Wait for Postgres server to start up
 # Check the database user if you deviated from the default
+# Replace <DB_USERNAME> with the database username - usually postgres unless you have changed it.
 gunzip --stdout "/path/to/backup/dump.sql.gz" \
 | sed "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g" \
 | docker exec -i immich_postgres psql --dbname=postgres --username=<DB_USERNAME>  # Restore Backup
 docker compose up -d            # Start remainder of Immich apps
 ```
 
-</TabItem>
+  </TabItem>
   <TabItem value="Windows system (PowerShell)" label="Windows system (PowerShell)">
 
 ```powershell title='Backup'
+# Replace <DB_USERNAME> with the database username - usually postgres unless you have changed it.
 [System.IO.File]::WriteAllLines("C:\absolute\path\to\backup\dump.sql", (docker exec -t immich_postgres pg_dumpall --clean --if-exists --username=<DB_USERNAME>))
 ```
 
@@ -92,13 +95,15 @@ docker compose create                             # Create Docker containers for
 docker start immich_postgres                      # Start Postgres server
 sleep 10                                          # Wait for Postgres server to start up
 docker exec -it immich_postgres bash              # Enter the Docker shell and run the following command
-# Check the database user if you deviated from the default. If your backup ends in `.gz`, replace `cat` with `gunzip --stdout`
+# If your backup ends in `.gz`, replace `cat` with `gunzip --stdout`
+# Replace <DB_USERNAME> with the database username - usually postgres unless you have changed it.
+
 cat "/dump.sql" | sed "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g" | psql --dbname=postgres --username=<DB_USERNAME>
 exit                                              # Exit the Docker shell
 docker compose up -d                              # Start remainder of Immich apps
 ```
 
-</TabItem>
+  </TabItem>
 </Tabs>
 
 Note that for the database restore to proceed properly, it requires a completely fresh install (i.e. the Immich server has never run since creating the Docker containers). If the Immich app has run, Postgres conflicts may be encountered upon database restoration (relation already exists, violated foreign key constraints, multiple primary keys, etc.), in which case you need to delete the `DB_DATA_LOCATION` folder to reset the database.

docs/docs/administration/reverse-proxy.md

@@ -6,6 +6,10 @@ Users can deploy a custom reverse proxy that forwards requests to Immich. This w
 Immich does not support being served on a sub-path such as `location /immich {`. It has to be served on the root path of a (sub)domain.
 :::
 
+:::info
+If your reverse proxy uses the [Let's Encrypt](https://letsencrypt.org/) [http-01 challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge), you may want to verify that the Immich well-known endpoint (`/.well-known/immich`) gets correctly routed to Immich, otherwise it will likely be routed elsewhere and the mobile app may run into connection issues.
+:::
+
 ### Nginx example config
 
 Below is an example config for nginx. Make sure to set `public_url` to the front-facing URL of your instance, and `backend_url` to the path of the Immich server.
@@ -37,29 +41,14 @@ server {
     location / {
         proxy_pass http://<backend_url>:2283;
     }
+
+    # useful when using Let's Encrypt http-01 challenge
+    # location = /.well-known/immich {
+    #     proxy_pass http://<backend_url>:2283;
+    # }
 }
 ```
 
-#### Compatibility with Let's Encrypt
-
-In the event that your nginx configuration includes a section for Let's Encrypt, it's likely that you have a segment similar to the following:
-
-```nginx
-location ~ /.well-known {
-    ...
-}
-```
-
-This particular `location` directive can inadvertently prevent mobile clients from reaching the `/.well-known/immich` path, which is crucial for discovery. Usual error message for this case is: "Your app major version is not compatible with the server". To remedy this, you should introduce an additional location block specifically for this path, ensuring that requests are correctly proxied to the Immich server:
-
-```nginx
-location = /.well-known/immich {
-    proxy_pass http://<backend_url>:2283;
-}
-```
-
-By doing so, you'll maintain the functionality of Let's Encrypt while allowing mobile clients to access the necessary Immich path without obstruction.
-
 ### Caddy example config
 
 As an alternative to nginx, you can also use [Caddy](https://caddyserver.com/) as a reverse proxy (with automatic HTTPS configuration). Below is an example config.

docs/docs/community-guides.mdx

@@ -1,12 +0,0 @@
-# Community Guides
-
-This page lists community guides that are written around Immich, but not officially supported by the development team.
-
-:::warning
-This list comes with no guarantees about security, performance, reliability, or accuracy. Use at your own risk.
-:::
-
-import CommunityGuides from '../src/components/community-guides.tsx';
-import React from 'react';
-
-<CommunityGuides />

docs/docs/community-projects.mdx

@@ -1,12 +0,0 @@
-# Community Projects
-
-This page lists community projects that are built around Immich, but not officially supported by the development team.
-
-:::warning
-This list comes with no guarantees about security, performance, reliability, or accuracy. Use at your own risk.
-:::
-
-import CommunityProjects from '../src/components/community-projects.tsx';
-import React from 'react';
-
-<CommunityProjects />

docs/docs/features/command-line-interface.md

@@ -103,6 +103,7 @@ Options:
   -c, --concurrency <number>  Number of assets to upload at the same time (default: 4, env: IMMICH_UPLOAD_CONCURRENCY)
   -j, --json-output           Output detailed information in json format (default: false, env: IMMICH_JSON_OUTPUT)
   --delete                    Delete local assets after upload (env: IMMICH_DELETE_ASSETS)
+  --delete-duplicates         Delete local assets that are duplicates (already exist on server) (env: IMMICH_DELETE_DUPLICATES)
   --no-progress               Hide progress bars (env: IMMICH_PROGRESS_BAR)
   --watch                     Watch for changes and upload automatically (default: false, env: IMMICH_WATCH_CHANGES)
   --help                      display help for command
@@ -182,7 +183,7 @@ For example to get a list of files that would be uploaded for further
 processing:
 
 ```bash
-immich upload --dry-run . | tail -n +4 | jq .newFiles[]
+immich upload --dry-run . | tail -n +6 | jq .newFiles[]
 ```
 
 ### Obtain the API Key

docs/docs/features/ml-hardware-acceleration.md

@@ -54,9 +54,25 @@ You do not need to redo any machine learning jobs after enabling hardware accele
 #### OpenVINO
 
 - Integrated GPUs are more likely to experience issues than discrete GPUs, especially for older processors or servers with low RAM.
-- Ensure the server's kernel version is new enough to use the device for hardware accceleration.
+- Ensure the server's kernel version is new enough to use the device for hardware acceleration.
 - Expect higher RAM usage when using OpenVINO compared to CPU processing.
 
+#### OpenVINO-WSL
+
+- Ensure your container can access the /dev/dri directory, you can verify this by doing `docker exec -t immich_machine_learning ls -la /dev/dri`. If this is not the case execute `getent group render` and `getent group video` on the WSL host, then add those groups to hwaccel.ml.yaml
+  ```yaml
+  openvino-wsl:
+    devices:
+      - /dev/dri:/dev/dri
+      - /dev/dxg:/dev/dxg
+    volumes:
+      - /dev/bus/usb:/dev/bus/usb
+      - /usr/lib/wsl:/usr/lib/wsl
+    group_add:
+      - 44 # Replace this number with the number you found with getent group video
+      - 992 # Replace this number with the number you found with getent group render
+  ```
+
 #### RKNN
 
 - You must have a supported Rockchip SoC: only RK3566, RK3568, RK3576 and RK3588 are supported at this moment.

docs/docs/features/mobile-app.mdx

@@ -3,7 +3,6 @@ import { mdiCloudOffOutline, mdiCloudCheckOutline } from '@mdi/js';
 import MobileAppDownload from '/docs/partials/_mobile-app-download.md';
 import MobileAppLogin from '/docs/partials/_mobile-app-login.md';
 import MobileAppBackup from '/docs/partials/_mobile-app-backup.md';
-import { cloudDonePath, cloudOffPath } from '@site/src/components/svg-paths';
 
 # Mobile App
 

docs/docs/features/sharing.md

@@ -28,7 +28,7 @@ You can read this guide to learn more about [partner sharing](/features/partner-
 
 ## Public sharing
 
-You can create a public link to share a group of photos or videos, or an album, with anyone. The public link can be shared via email, social media, or any other method. There are a varierity of options to customize the public link, such as setting an expiration date, password protection, and more. Public shared link is handy when you want to share a group of photos or videos with someone who doesn't have an Immich account and allow the shared user to upload their photos or videos to your account.
+You can create a public link to share a group of photos or videos, or an album, with anyone. The public link can be shared via email, social media, or any other method. There are a variety of options to customize the public link, such as setting an expiration date, password protection, and more. Public shared link is handy when you want to share a group of photos or videos with someone who doesn't have an Immich account and allow the shared user to upload their photos or videos to your account.
 
 The public shared link is generated with a random URL, which acts as as a secret to avoid the link being guessed by unwanted parties, for instance.
 

docs/docs/guides/external-library.md

@@ -37,7 +37,7 @@ In the Immich web UI:
   <img src={require('./img/create-external-library.webp').default} width="50%" title="Create Library button" />
 
 - In the dialog, select which user should own the new library
-  <img src={require('./img/library-owner.webp').default} width="50%" title="Library owner diaglog" />
+  <img src={require('./img/library-owner.webp').default} width="50%" title="Library owner dialog" />
 
 - Click the three-dots menu and select **Edit Import Paths**
   <img src={require('./img/edit-import-paths.webp').default} width="50%" title="Edit Import Paths menu option" />

docs/docs/install/environment-variables.md

@@ -171,6 +171,7 @@ Redis (Sentinel) URL example JSON before encoding:
 | `MACHINE_LEARNING_MAX_BATCH_SIZE__FACIAL_RECOGNITION`       | Set the maximum number of faces that will be processed at once by the facial recognition model      |  None (`1` if using OpenVINO)   | machine learning |
 | `MACHINE_LEARNING_RKNN`                                     | Enable RKNN hardware acceleration if supported                                                      |             `True`              | machine learning |
 | `MACHINE_LEARNING_RKNN_THREADS`                             | How many threads of RKNN runtime should be spinned up while inferencing.                            |               `1`               | machine learning |
+| `MACHINE_LEARNING_MODEL_ARENA`                              | Pre-allocates CPU memory to avoid memory fragmentation                                              |              true               | machine learning |
 
 \*1: It is recommended to begin with this parameter when changing the concurrency levels of the machine learning service and then tune the other ones.
 

docs/docs/install/synology.md

@@ -40,7 +40,7 @@ In the settings of your new project, set "**Project name**" to a name you'll rem
 
 ![Set path](../../static/img/synology-container-manager-set-path.png)
 
-The following screen will give you the option to further customize your `docker-compose.yml` file. Take note of `DB_STORAGE_TYPE: 'HDD'`and uncomment if applicable for your Synology setup.
+The following screen will give you the option to further customize your `docker-compose.yml` file. Take note of `DB_STORAGE_TYPE: 'HDD'` and uncomment if applicable for your Synology setup.
 
 ![DB storage](../../static/img/synology-container-manager-customize-docker-compose.png)
 

docs/docs/install/upgrading.md

@@ -87,7 +87,7 @@ After making a backup, please modify your `docker-compose.yml` file with the fol
 If you deviated from the defaults of pg14 or pgvectors0.2.0, you must adjust the pg major version and pgvecto.rs version. If you are still using the default `docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0` image, you can just follow the changes above. For example, if the previous image is `docker.io/tensorchord/pgvecto-rs:pg16-v0.3.0`, the new image should be `ghcr.io/immich-app/postgres:16-vectorchord0.3.0-pgvectors0.3.0` instead of the image specified in the diff.
 :::
 
-After making these changes, you can start Immich as normal. Immich will make some changes to the DB during startup, which can take seconds to minutes to finish, depending on hardware and library size. In particular, it’s normal for the server logs to be seemingly stuck at `Reindexing clip_index` and `Reindexing face_index`for some time if you have over 100k assets in Immich and/or Immich is on a relatively weak server. If you see these logs and there are no errors, just give it time.
+After making these changes, you can start Immich as normal. Immich will make some changes to the DB during startup, which can take seconds to minutes to finish, depending on hardware and library size. In particular, it’s normal for the server logs to be seemingly stuck at `Reindexing clip_index` and `Reindexing face_index` for some time if you have over 100k assets in Immich and/or Immich is on a relatively weak server. If you see these logs and there are no errors, just give it time.
 
 :::danger
 After switching to VectorChord, you should not downgrade Immich below 1.133.0.

docs/docs/partials/_mobile-app-download.md

@@ -1,5 +1,6 @@
 The mobile app can be downloaded from the following places:
 
+- Obtainium: You can get your Obtainium config link from the [Utilities page of your Immich server](https://my.immich.app/utilities).
 - [Google Play Store](https://play.google.com/store/apps/details?id=app.alextran.immich)
 - [Apple App Store](https://apps.apple.com/us/app/immich/id1613945652)
 - [F-Droid](https://f-droid.org/packages/app.alextran.immich)

docs/package.json

@@ -57,6 +57,6 @@
     "node": ">=20"
   },
   "volta": {
-    "node": "22.20.0"
+    "node": "22.21.0"
   }
 }

docs/src/components/community-guides.tsx

@@ -1,108 +0,0 @@
-import Link from '@docusaurus/Link';
-import React from 'react';
-
-interface CommunityGuidesProps {
-  title: string;
-  description: string;
-  url: string;
-}
-
-const guides: CommunityGuidesProps[] = [
-  {
-    title: 'Cloudflare Tunnels with SSO/OAuth',
-    description: `Setting up Cloudflare Tunnels and a SaaS App for Immich.`,
-    url: 'https://github.com/immich-app/immich/discussions/8299',
-  },
-  {
-    title: 'Database backup in TrueNAS',
-    description: `Create a database backup with pgAdmin in TrueNAS.`,
-    url: 'https://github.com/immich-app/immich/discussions/8809',
-  },
-  {
-    title: 'Unraid backup scripts',
-    description: `Back up your assets in Unraid with a pre-prepared script.`,
-    url: 'https://github.com/immich-app/immich/discussions/8416',
-  },
-  {
-    title: 'Sync folders with albums',
-    description: `synchronize folders in imported library with albums having the folders name.`,
-    url: 'https://github.com/immich-app/immich/discussions/3382',
-  },
-  {
-    title: 'Immich Podman Quadlets Handbook',
-    description:
-      'A rewrite of the original Immich Docker Compose file using Podman Quadlets, with a set of extra guides in the repository’s wiki.',
-    url: 'https://github.com/linux-universe/immich-podman-quadlets/blob/main/README.md',
-  },
-  {
-    title: 'Podman/Quadlets Install',
-    description: 'Documentation for simple podman setup using quadlets.',
-    url: 'https://github.com/tbelway/immich-podman-quadlets/blob/main/docs/install/podman-quadlet.md',
-  },
-  {
-    title: 'Google Photos import + albums',
-    description: 'Import your Google Photos files into Immich and add your albums.',
-    url: 'https://github.com/immich-app/immich/discussions/1340',
-  },
-  {
-    title: 'Access Immich with custom domain',
-    description: 'Access your local Immich installation over the internet using your own domain.',
-    url: 'https://github.com/ppr88/immich-guides/blob/main/open-immich-custom-domain.md',
-  },
-  {
-    title: 'Nginx caching map server',
-    description: 'Increase privacy by using nginx as a caching proxy in front of a map tile server.',
-    url: 'https://github.com/pcouy/pcouy.github.io/blob/main/_posts/2024-08-30-proxying-a-map-tile-server-for-increased-privacy.md',
-  },
-  {
-    title: 'fail2ban setup instructions',
-    description: 'How to configure an existing fail2ban installation to block incorrect login attempts.',
-    url: 'https://github.com/immich-app/immich/discussions/3243#discussioncomment-6681948',
-  },
-  {
-    title: 'Immich remote access with NordVPN Meshnet',
-    description: 'Access Immich with an end-to-end encrypted connection.',
-    url: 'https://meshnet.nordvpn.com/how-to/remote-files-media-access/immich-remote-access',
-  },
-  {
-    title: 'Trust Self Signed Certificates with Immich - OAuth Setup',
-    description:
-      'Set up Certificate Authority trust with Immich, and your private OAuth2/OpenID service, while using a private CA for HTTPS commication.',
-    url: 'https://github.com/immich-app/immich/discussions/18614',
-  },
-];
-
-function CommunityGuide({ title, description, url }: CommunityGuidesProps): JSX.Element {
-  return (
-    <section className="flex flex-col gap-4 justify-between dark:bg-immich-dark-gray bg-immich-gray dark:border-0 border-gray-200 border border-solid rounded-2xl px-4 py-6">
-      <div className="flex flex-col gap-2">
-        <p className="m-0 items-start flex gap-2 text-2xl font-bold text-immich-primary dark:text-immich-dark-primary">
-          <span>{title}</span>
-        </p>
-
-        <p className="m-0 text-sm text-gray-600 dark:text-gray-300">{description}</p>
-        <p className="m-0 text-sm text-gray-600 dark:text-gray-300 my-4">
-          <a href={url}>{url}</a>
-        </p>
-      </div>
-      <div className="flex">
-        <Link
-          className="px-4 py-2 bg-immich-primary/10 dark:bg-gray-300 rounded-xl text-sm hover:no-underline text-immich-primary dark:text-immich-dark-bg font-semibold"
-          to={url}
-        >
-          View Guide
-        </Link>
-      </div>
-    </section>
-  );
-}
-
-export default function CommunityGuides(): JSX.Element {
-  return (
-    <div className="grid grid-cols-1 xl:grid-cols-2 gap-4">
-      {guides.map((guides) => (
-        <CommunityGuide {...guides} />
-      ))}
-    </div>
-  );
-}

docs/src/components/community-projects.tsx

@@ -1,158 +0,0 @@
-import Link from '@docusaurus/Link';
-import React from 'react';
-
-interface CommunityProjectProps {
-  title: string;
-  description: string;
-  url: string;
-}
-
-const projects: CommunityProjectProps[] = [
-  {
-    title: 'immich-go',
-    description: `An alternative to the immich-CLI that doesn't depend on nodejs. It specializes in importing Google Photos Takeout archives.`,
-    url: 'https://github.com/simulot/immich-go',
-  },
-  {
-    title: 'ImmichFrame',
-    description: 'Run an Immich slideshow in a photo frame.',
-    url: 'https://github.com/3rob3/ImmichFrame',
-  },
-  {
-    title: 'API Album Sync',
-    description: 'A Python script to sync folders as albums.',
-    url: 'https://git.orenit.solutions/open/immichalbumpull',
-  },
-  {
-    title: 'Immich-Tools',
-    description: 'Provides scripts for handling problems on the repair page.',
-    url: 'https://github.com/clumsyCoder00/Immich-Tools',
-  },
-  {
-    title: 'Lightroom Publisher: mi.Immich.Publisher',
-    description: 'Lightroom plugin to publish photos from Lightroom collections to Immich albums.',
-    url: 'https://github.com/midzelis/mi.Immich.Publisher',
-  },
-  {
-    title: 'Lightroom Immich Plugin: lrc-immich-plugin',
-    description:
-      'Lightroom plugin to publish, export photos from Lightroom to Immich. Import from Immich to Lightroom is also supported.',
-    url: 'https://blog.fokuspunk.de/lrc-immich-plugin/',
-  },
-  {
-    title: 'Immich-Tiktok-Remover',
-    description: 'Script to search for and remove TikTok videos from your Immich library.',
-    url: 'https://github.com/mxc2/immich-tiktok-remover',
-  },
-  {
-    title: 'Immich Android TV',
-    description: 'Unofficial Immich Android TV app.',
-    url: 'https://github.com/giejay/Immich-Android-TV',
-  },
-  {
-    title: 'Create albums from folders',
-    description: 'A Python script to create albums based on the folder structure of an external library.',
-    url: 'https://github.com/Salvoxia/immich-folder-album-creator',
-  },
-  {
-    title: 'Powershell Module PSImmich',
-    description: 'Powershell Module for the Immich API',
-    url: 'https://github.com/hanpq/PSImmich',
-  },
-  {
-    title: 'Immich Distribution',
-    description: 'Snap package for easy install and zero-care auto updates of Immich. Self-hosted photo management.',
-    url: 'https://immich-distribution.nsg.cc',
-  },
-  {
-    title: 'Immich Kiosk',
-    description: 'Lightweight slideshow to run on kiosk devices and browsers.',
-    url: 'https://github.com/damongolding/immich-kiosk',
-  },
-  {
-    title: 'Immich Power Tools',
-    description: 'Power tools for organizing your immich library.',
-    url: 'https://github.com/varun-raj/immich-power-tools',
-  },
-  {
-    title: 'Immich Public Proxy',
-    description:
-      'Share your Immich photos and albums in a safe way without exposing your Immich instance to the public.',
-    url: 'https://github.com/alangrainger/immich-public-proxy',
-  },
-  {
-    title: 'Immich Kodi',
-    description: 'Unofficial Kodi plugin for Immich.',
-    url: 'https://github.com/vladd11/immich-kodi',
-  },
-  {
-    title: 'Immich Downloader',
-    description: 'Downloads a configurable number of random photos based on people or album ID.',
-    url: 'https://github.com/jon6fingrs/immich-dl',
-  },
-  {
-    title: 'Immich Upload Optimizer',
-    description: 'Automatically optimize files uploaded to Immich in order to save storage space',
-    url: 'https://github.com/miguelangel-nubla/immich-upload-optimizer',
-  },
-  {
-    title: 'Immich Machine Learning Load Balancer',
-    description: 'Speed up your machine learning by load balancing your requests to multiple computers',
-    url: 'https://github.com/apetersson/immich_ml_balancer',
-  },
-  {
-    title: 'Immich Drop Uploader',
-    description: 'A tiny, zero-login web app for collecting photos/videos from anyone into your Immich server.',
-    url: 'https://github.com/Nasogaa/immich-drop',
-  },
-  {
-    title: 'Immich Birthday Sync',
-    description: 'Bulk-upload and -download birthdays, with CardDAV sync support',
-    url: 'https://github.com/sid3windr/immich-birthday',
-  },
-  {
-    title: 'Immich Stack',
-    description: 'Auto-stack photos with identical filenames and differing extensions (i.e. JPG+RAW)',
-    url: 'https://github.com/sid3windr/immich-stack',
-  },
-  {
-    title: 'Immich Stack',
-    description: 'Automatically groups similar photos into stacks within the Immich photo management system.',
-    url: 'https://github.com/Majorfi/immich-stack/',
-  },
-];
-
-function CommunityProject({ title, description, url }: CommunityProjectProps): JSX.Element {
-  return (
-    <section className="flex flex-col gap-4 justify-between dark:bg-immich-dark-gray bg-immich-gray dark:border-0 border-gray-200 border border-solid rounded-2xl px-4 py-6">
-      <div className="flex flex-col gap-2">
-        <p className="m-0 items-start flex gap-2 text-2xl font-bold text-immich-primary dark:text-immich-dark-primary">
-          <span>{title}</span>
-        </p>
-
-        <p className="m-0 text-sm text-gray-600 dark:text-gray-300">{description}</p>
-        <p className="m-0 text-sm text-gray-600 dark:text-gray-300 my-4">
-          <a href={url}>{url}</a>
-        </p>
-      </div>
-      <div className="flex">
-        <Link
-          className="px-4 py-2 bg-immich-primary/10 dark:bg-gray-300 rounded-xl text-sm hover:no-underline text-immich-primary dark:text-immich-dark-bg font-semibold"
-          to={url}
-        >
-          View Link
-        </Link>
-      </div>
-    </section>
-  );
-}
-
-export default function CommunityProjects(): JSX.Element {
-  return (
-    <div className="grid grid-cols-1 xl:grid-cols-2 gap-4">
-      {projects.map((project) => (
-        <CommunityProject {...project} />
-      ))}
-    </div>
-  );
-}

docs/src/components/svg-paths.ts

@@ -1,3 +0,0 @@
-export const discordPath =
-  'M81.15,0c-1.2376,2.1973-2.3489,4.4704-3.3591,6.794-9.5975-1.4396-19.3718-1.4396-28.9945,0-.985-2.3236-2.1216-4.5967-3.3591-6.794-9.0166,1.5407-17.8059,4.2431-26.1405,8.0568C2.779,32.5304-1.6914,56.3725.5312,79.8863c9.6732,7.1476,20.5083,12.603,32.0505,16.0884,2.6014-3.4854,4.8998-7.1981,6.8698-11.0623-3.738-1.3891-7.3497-3.1318-10.8098-5.1523.9092-.6567,1.7932-1.3386,2.6519-1.9953,20.281,9.547,43.7696,9.547,64.0758,0,.8587.7072,1.7427,1.3891,2.6519,1.9953-3.4601,2.0457-7.0718,3.7632-10.835,5.1776,1.97,3.8642,4.2683,7.5769,6.8698,11.0623,11.5419-3.4854,22.3769-8.9156,32.0509-16.0631,2.626-27.2771-4.496-50.9172-18.817-71.8548C98.9811,4.2684,90.1918,1.5659,81.1752.0505l-.0252-.0505ZM42.2802,65.4144c-6.2383,0-11.4159-5.6575-11.4159-12.6535s4.9755-12.6788,11.3907-12.6788,11.5169,5.708,11.4159,12.6788c-.101,6.9708-5.026,12.6535-11.3907,12.6535ZM84.3576,65.4144c-6.2637,0-11.3907-5.6575-11.3907-12.6535s4.9755-12.6788,11.3907-12.6788,11.4917,5.708,11.3906,12.6788c-.101,6.9708-5.026,12.6535-11.3906,12.6535Z';
-export const discordViewBox = '0 0 126.644 96';

docs/static/_redirects

@@ -27,8 +27,10 @@
 /administration/password-login /administration/system-settings 307
 /features/search /features/searching 307
 /features/smart-search /features/searching 307
-/guides/api-album-sync /community-projects 307
-/guides/remove-offline-files /community-projects 307
+/guides/api-album-sync https://awesome.immich.app/ 307
+/guides/remove-offline-files https://awesome.immich.app/ 307
+/community-guides https://awesome.immich.app/ 307
+/community-projects https://awesome.immich.app/ 307
 /overview/introduction /overview/quick-start 307
 /overview/welcome /overview/quick-start 307
 /docs/* /:splat 307

e2e/.nvmrc

@@ -1 +1 @@
-22.20.0
+22.21.0

e2e/package.json

@@ -25,7 +25,7 @@
     "@playwright/test": "^1.44.1",
     "@socket.io/component-emitter": "^3.1.2",
     "@types/luxon": "^3.4.2",
-    "@types/node": "^22.18.8",
+    "@types/node": "^22.18.12",
     "@types/oidc-provider": "^9.0.0",
     "@types/pg": "^8.15.1",
     "@types/pngjs": "^6.0.4",
@@ -34,7 +34,7 @@
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.1.3",
     "eslint-plugin-unicorn": "^60.0.0",
-    "exiftool-vendored": "^28.3.1",
+    "exiftool-vendored": "^31.1.0",
     "globals": "^16.0.0",
     "jose": "^5.6.3",
     "luxon": "^3.4.4",
@@ -52,6 +52,6 @@
     "vitest": "^3.0.0"
   },
   "volta": {
-    "node": "22.20.0"
+    "node": "22.21.0"
   }
 }

e2e/src/api/specs/album.e2e-spec.ts

@@ -136,6 +136,7 @@ describe('/albums', () => {
       expect(body).toEqual({
         ...user1Albums[0],
         assets: [expect.objectContaining({ isFavorite: false })],
+        contributorCounts: [{ userId: user1.userId, assetCount: 1 }],
         lastModifiedAssetTimestamp: expect.any(String),
         startDate: expect.any(String),
         endDate: expect.any(String),
@@ -310,6 +311,7 @@ describe('/albums', () => {
       expect(body).toEqual({
         ...user1Albums[0],
         assets: [expect.objectContaining({ id: user1Albums[0].assets[0].id })],
+        contributorCounts: [{ userId: user1.userId, assetCount: 1 }],
         lastModifiedAssetTimestamp: expect.any(String),
         startDate: expect.any(String),
         endDate: expect.any(String),
@@ -345,6 +347,7 @@ describe('/albums', () => {
       expect(body).toEqual({
         ...user1Albums[0],
         assets: [expect.objectContaining({ id: user1Albums[0].assets[0].id })],
+        contributorCounts: [{ userId: user1.userId, assetCount: 1 }],
         lastModifiedAssetTimestamp: expect.any(String),
         startDate: expect.any(String),
         endDate: expect.any(String),
@@ -362,6 +365,7 @@ describe('/albums', () => {
       expect(body).toEqual({
         ...user1Albums[0],
         assets: [],
+        contributorCounts: [{ userId: user1.userId, assetCount: 1 }],
         assetCount: 1,
         lastModifiedAssetTimestamp: expect.any(String),
         endDate: expect.any(String),
@@ -382,6 +386,7 @@ describe('/albums', () => {
       expect(body).toEqual({
         ...user2Albums[0],
         assets: [],
+        contributorCounts: [{ userId: user1.userId, assetCount: 1 }],
         assetCount: 1,
         lastModifiedAssetTimestamp: expect.any(String),
         endDate: expect.any(String),

e2e/src/api/specs/server.e2e-spec.ts

@@ -113,6 +113,7 @@ describe('/server', () => {
         importFaces: false,
         oauth: false,
         oauthAutoLaunch: false,
+        ocr: false,
         passwordLogin: true,
         search: true,
         sidecar: true,

e2e/src/api/specs/tag.e2e-spec.ts

@@ -582,7 +582,7 @@ describe('/tags', () => {
       expect(body).toEqual([expect.objectContaining({ id: userAsset.id, success: true })]);
     });
 
-    it('should remove duplicate assets only once', async () => {
+    it.skip('should remove duplicate assets only once', async () => {
       const tagA = await create(user.accessToken, { name: 'TagA' });
       await tagAssets(
         { id: tagA.id, bulkIdsDto: { ids: [userAsset.id] } },

e2e/src/api/specs/user-admin.e2e-spec.ts

@@ -1,4 +1,5 @@
 import {
+  JobName,
   LoginResponseDto,
   createStack,
   deleteUserAdmin,
@@ -327,6 +328,8 @@ describe('/admin/users', () => {
         { headers: asBearerAuth(user.accessToken) },
       );
 
+      await utils.waitForQueueFinish(admin.accessToken, JobName.BackgroundTask);
+
       const { status, body } = await request(app)
         .delete(`/admin/users/${user.userId}`)
         .send({ force: true })

e2e/src/cli/specs/upload.e2e-spec.ts

@@ -442,6 +442,176 @@ describe(`immich upload`, () => {
     });
   });
 
+  describe('immich upload --delete-duplicates', () => {
+    it('should delete local duplicate files', async () => {
+      const {
+        stderr: firstStderr,
+        stdout: firstStdout,
+        exitCode: firstExitCode,
+      } = await immichCli(['upload', `${testAssetDir}/albums/nature/silver_fir.jpg`]);
+      expect(firstStderr).toContain('{message}');
+      expect(firstStdout.split('\n')).toEqual(
+        expect.arrayContaining([expect.stringContaining('Successfully uploaded 1 new asset')]),
+      );
+      expect(firstExitCode).toBe(0);
+
+      await mkdir(`/tmp/albums/nature`, { recursive: true });
+      await symlink(`${testAssetDir}/albums/nature/silver_fir.jpg`, `/tmp/albums/nature/silver_fir.jpg`);
+
+      // Upload with --delete-duplicates flag
+      const { stderr, stdout, exitCode } = await immichCli([
+        'upload',
+        `/tmp/albums/nature/silver_fir.jpg`,
+        '--delete-duplicates',
+      ]);
+
+      // Check that the duplicate file was deleted
+      const files = await readdir(`/tmp/albums/nature`);
+      await rm(`/tmp/albums/nature`, { recursive: true });
+      expect(files.length).toBe(0);
+
+      expect(stdout.split('\n')).toEqual(
+        expect.arrayContaining([
+          expect.stringContaining('Found 0 new files and 1 duplicate'),
+          expect.stringContaining('All assets were already uploaded, nothing to do'),
+        ]),
+      );
+      expect(stderr).toContain('{message}');
+      expect(exitCode).toBe(0);
+
+      // Verify no new assets were uploaded
+      const assets = await getAssetStatistics({}, { headers: asKeyAuth(key) });
+      expect(assets.total).toBe(1);
+    });
+
+    it('should have accurate dry run with --delete-duplicates', async () => {
+      const {
+        stderr: firstStderr,
+        stdout: firstStdout,
+        exitCode: firstExitCode,
+      } = await immichCli(['upload', `${testAssetDir}/albums/nature/silver_fir.jpg`]);
+      expect(firstStderr).toContain('{message}');
+      expect(firstStdout.split('\n')).toEqual(
+        expect.arrayContaining([expect.stringContaining('Successfully uploaded 1 new asset')]),
+      );
+      expect(firstExitCode).toBe(0);
+
+      await mkdir(`/tmp/albums/nature`, { recursive: true });
+      await symlink(`${testAssetDir}/albums/nature/silver_fir.jpg`, `/tmp/albums/nature/silver_fir.jpg`);
+
+      // Upload with --delete-duplicates and --dry-run flags
+      const { stderr, stdout, exitCode } = await immichCli([
+        'upload',
+        `/tmp/albums/nature/silver_fir.jpg`,
+        '--delete-duplicates',
+        '--dry-run',
+      ]);
+
+      // Check that the duplicate file was NOT deleted in dry run mode
+      const files = await readdir(`/tmp/albums/nature`);
+      await rm(`/tmp/albums/nature`, { recursive: true });
+      expect(files.length).toBe(1);
+
+      expect(stdout.split('\n')).toEqual(
+        expect.arrayContaining([
+          expect.stringContaining('Found 0 new files and 1 duplicate'),
+          expect.stringContaining('Would have deleted 1 local asset'),
+        ]),
+      );
+      expect(stderr).toContain('{message}');
+      expect(exitCode).toBe(0);
+
+      // Verify no new assets were uploaded
+      const assets = await getAssetStatistics({}, { headers: asKeyAuth(key) });
+      expect(assets.total).toBe(1);
+    });
+
+    it('should work with both --delete and --delete-duplicates flags', async () => {
+      // First, upload a file to create a duplicate on the server
+      const {
+        stderr: firstStderr,
+        stdout: firstStdout,
+        exitCode: firstExitCode,
+      } = await immichCli(['upload', `${testAssetDir}/albums/nature/silver_fir.jpg`]);
+      expect(firstStderr).toContain('{message}');
+      expect(firstStdout.split('\n')).toEqual(
+        expect.arrayContaining([expect.stringContaining('Successfully uploaded 1 new asset')]),
+      );
+      expect(firstExitCode).toBe(0);
+
+      // Both new and duplicate files
+      await mkdir(`/tmp/albums/nature`, { recursive: true });
+      await symlink(`${testAssetDir}/albums/nature/silver_fir.jpg`, `/tmp/albums/nature/silver_fir.jpg`); // duplicate
+      await symlink(`${testAssetDir}/albums/nature/el_torcal_rocks.jpg`, `/tmp/albums/nature/el_torcal_rocks.jpg`); // new
+
+      // Upload with both --delete and --delete-duplicates flags
+      const { stderr, stdout, exitCode } = await immichCli([
+        'upload',
+        `/tmp/albums/nature`,
+        '--delete',
+        '--delete-duplicates',
+      ]);
+
+      // Check that both files were deleted (new file due to --delete, duplicate due to --delete-duplicates)
+      const files = await readdir(`/tmp/albums/nature`);
+      await rm(`/tmp/albums/nature`, { recursive: true });
+      expect(files.length).toBe(0);
+
+      expect(stdout.split('\n')).toEqual(
+        expect.arrayContaining([
+          expect.stringContaining('Found 1 new files and 1 duplicate'),
+          expect.stringContaining('Successfully uploaded 1 new asset'),
+          expect.stringContaining('Deleting assets that have been uploaded'),
+        ]),
+      );
+      expect(stderr).toContain('{message}');
+      expect(exitCode).toBe(0);
+
+      // Verify one new asset was uploaded (total should be 2 now)
+      const assets = await getAssetStatistics({}, { headers: asKeyAuth(key) });
+      expect(assets.total).toBe(2);
+    });
+
+    it('should only delete duplicates when --delete-duplicates is used without --delete', async () => {
+      const {
+        stderr: firstStderr,
+        stdout: firstStdout,
+        exitCode: firstExitCode,
+      } = await immichCli(['upload', `${testAssetDir}/albums/nature/silver_fir.jpg`]);
+      expect(firstStderr).toContain('{message}');
+      expect(firstStdout.split('\n')).toEqual(
+        expect.arrayContaining([expect.stringContaining('Successfully uploaded 1 new asset')]),
+      );
+      expect(firstExitCode).toBe(0);
+
+      // Both new and duplicate files
+      await mkdir(`/tmp/albums/nature`, { recursive: true });
+      await symlink(`${testAssetDir}/albums/nature/silver_fir.jpg`, `/tmp/albums/nature/silver_fir.jpg`); // duplicate
+      await symlink(`${testAssetDir}/albums/nature/el_torcal_rocks.jpg`, `/tmp/albums/nature/el_torcal_rocks.jpg`); // new
+
+      // Upload with only --delete-duplicates flag
+      const { stderr, stdout, exitCode } = await immichCli(['upload', `/tmp/albums/nature`, '--delete-duplicates']);
+
+      // Check that only the duplicate was deleted, new file should remain
+      const files = await readdir(`/tmp/albums/nature`);
+      await rm(`/tmp/albums/nature`, { recursive: true });
+      expect(files).toEqual(['el_torcal_rocks.jpg']);
+
+      expect(stdout.split('\n')).toEqual(
+        expect.arrayContaining([
+          expect.stringContaining('Found 1 new files and 1 duplicate'),
+          expect.stringContaining('Successfully uploaded 1 new asset'),
+        ]),
+      );
+      expect(stderr).toContain('{message}');
+      expect(exitCode).toBe(0);
+
+      // Verify one new asset was uploaded (total should be 2 now)
+      const assets = await getAssetStatistics({}, { headers: asKeyAuth(key) });
+      expect(assets.total).toBe(2);
+    });
+  });
+
   describe('immich upload --skip-hash', () => {
     it('should skip hashing', async () => {
       const filename = `albums/nature/silver_fir.jpg`;

e2e/src/responses.ts

@@ -119,5 +119,6 @@ export const deviceDto = {
     isPendingSyncReset: false,
     deviceOS: '',
     deviceType: '',
+    appVersion: null,
   },
 };

e2e/src/web/specs/asset-viewer/navbar.e2e-spec.ts

@@ -59,7 +59,7 @@ test.describe('Asset Viewer Navbar', () => {
       await page.goto(`/photos/${asset.id}`);
       await page.waitForSelector('#immich-asset-viewer');
       await page.keyboard.press('f');
-      await expect(page.locator('#notification-list').getByTestId('message')).toHaveText('Added to favorites');
+      await expect(page.getByText('Added to favorites')).toBeVisible();
     });
   });
 });

e2e/src/web/specs/asset-viewer/slideshow.e2e-spec.ts

@@ -51,6 +51,6 @@ test.describe('Slideshow', () => {
 
     await expect(page.getByRole('button', { name: 'Exit Slideshow' })).toBeVisible();
     await page.keyboard.press('f');
-    await expect(page.locator('#notification-list')).not.toBeVisible();
+    await expect(page.getByText('Added to favorites')).not.toBeVisible();
   });
 });

e2e/src/web/specs/auth.e2e-spec.ts

@@ -38,6 +38,7 @@ test.describe('Registration', () => {
     await page.getByRole('button', { name: 'User Privacy' }).click();
     await page.getByRole('button', { name: 'Storage Template' }).click();
     await page.getByRole('button', { name: 'Backups' }).click();
+    await page.getByRole('button', { name: 'Mobile App' }).click();
     await page.getByRole('button', { name: 'Done' }).click();
 
     // success
@@ -85,6 +86,7 @@ test.describe('Registration', () => {
     await page.getByRole('button', { name: 'Theme' }).click();
     await page.getByRole('button', { name: 'Language' }).click();
     await page.getByRole('button', { name: 'User Privacy' }).click();
+    await page.getByRole('button', { name: 'Mobile App' }).click();
     await page.getByRole('button', { name: 'Done' }).click();
 
     // success

i18n/en.json

@@ -120,7 +120,7 @@
     "library_settings_description": "Manage external library settings",
     "library_tasks_description": "Scan external libraries for new and/or changed assets",
     "library_watching_enable_description": "Watch external libraries for file changes",
-    "library_watching_settings": "Library watching (EXPERIMENTAL)",
+    "library_watching_settings": "Library watching [EXPERIMENTAL]",
     "library_watching_settings_description": "Automatically watch for changed files",
     "logging_enable_description": "Enable logging",
     "logging_level_description": "When enabled, what log level to use.",
@@ -154,6 +154,18 @@
     "machine_learning_min_detection_score_description": "Minimum confidence score for a face to be detected from 0-1. Lower values will detect more faces but may result in false positives.",
     "machine_learning_min_recognized_faces": "Minimum recognized faces",
     "machine_learning_min_recognized_faces_description": "The minimum number of recognized faces for a person to be created. Increasing this makes Facial Recognition more precise at the cost of increasing the chance that a face is not assigned to a person.",
+    "machine_learning_ocr": "OCR",
+    "machine_learning_ocr_description": "Use machine learning to recognize text in images",
+    "machine_learning_ocr_enabled": "Enable OCR",
+    "machine_learning_ocr_enabled_description": "If disabled, images will not undergo text recognition.",
+    "machine_learning_ocr_max_resolution": "Maximum resolution",
+    "machine_learning_ocr_max_resolution_description": "Previews above this resolution will be resized while preserving aspect ratio. Higher values are more accurate, but take longer to process and use more memory.",
+    "machine_learning_ocr_min_detection_score": "Minimum detection score",
+    "machine_learning_ocr_min_detection_score_description": "Minimum confidence score for text to be detected from 0-1. Lower values will detect more text but may result in false positives.",
+    "machine_learning_ocr_min_recognition_score": "Minimum recognition score",
+    "machine_learning_ocr_min_score_recognition_description": "Minimum confidence score for detected text to be recognized from 0-1. Lower values will recognize more text but may result in false positives.",
+    "machine_learning_ocr_model": "OCR model",
+    "machine_learning_ocr_model_description": "Server models are more accurate than mobile models, but take longer to process and use more memory.",
     "machine_learning_settings": "Machine Learning Settings",
     "machine_learning_settings_description": "Manage machine learning features and settings",
     "machine_learning_smart_search": "Smart Search",
@@ -211,6 +223,8 @@
     "notification_email_ignore_certificate_errors_description": "Ignore TLS certificate validation errors (not recommended)",
     "notification_email_password_description": "Password to use when authenticating with the email server",
     "notification_email_port_description": "Port of the email server (e.g 25, 465, or 587)",
+    "notification_email_secure": "SMTPS",
+    "notification_email_secure_description": "Use SMTPS (SMTP over TLS)",
     "notification_email_sent_test_email_button": "Send test email and save",
     "notification_email_setting_description": "Settings for sending email notifications",
     "notification_email_test_email": "Send test email",
@@ -243,6 +257,7 @@
     "oauth_storage_quota_default_description": "Quota in GiB to be used when no claim is provided.",
     "oauth_timeout": "Request Timeout",
     "oauth_timeout_description": "Timeout for requests in milliseconds",
+    "ocr_job_description": "Use machine learning to recognize text in images",
     "password_enable_description": "Login with email and password",
     "password_settings": "Password Login",
     "password_settings_description": "Manage password login settings",
@@ -333,7 +348,7 @@
     "transcoding_max_b_frames": "Maximum B-frames",
     "transcoding_max_b_frames_description": "Higher values improve compression efficiency, but slow down encoding. May not be compatible with hardware acceleration on older devices. 0 disables B-frames, while -1 sets this value automatically.",
     "transcoding_max_bitrate": "Maximum bitrate",
-    "transcoding_max_bitrate_description": "Setting a max bitrate can make file sizes more predictable at a minor cost to quality. At 720p, typical values are 2600 kbit/s for VP9 or HEVC, or 4500 kbit/s for H.264. Disabled if set to 0.",
+    "transcoding_max_bitrate_description": "Setting a max bitrate can make file sizes more predictable at a minor cost to quality. At 720p, typical values are 2600 kbit/s for VP9 or HEVC, or 4500 kbit/s for H.264. Disabled if set to 0. When no unit is specified, k (for kbit/s) is assumed; therefore 5000, 5000k, and 5M (for Mbit/s) are equivalent.",
     "transcoding_max_keyframe_interval": "Maximum keyframe interval",
     "transcoding_max_keyframe_interval_description": "Sets the maximum frame distance between keyframes. Lower values worsen compression efficiency, but improve seek times and may improve quality in scenes with fast movement. 0 sets this value automatically.",
     "transcoding_optimal_description": "Videos higher than target resolution or not in an accepted format",
@@ -351,7 +366,7 @@
     "transcoding_target_resolution": "Target resolution",
     "transcoding_target_resolution_description": "Higher resolutions can preserve more detail but take longer to encode, have larger file sizes, and can reduce app responsiveness.",
     "transcoding_temporal_aq": "Temporal AQ",
-    "transcoding_temporal_aq_description": "Applies only to NVENC. Increases quality of high-detail, low-motion scenes. May not be compatible with older devices.",
+    "transcoding_temporal_aq_description": "Applies only to NVENC. Temporal Adaptive Quantization increases quality of high-detail, low-motion scenes. May not be compatible with older devices.",
     "transcoding_threads": "Threads",
     "transcoding_threads_description": "Higher values lead to faster encoding, but leave less room for the server to process other tasks while active. This value should not be more than the number of CPU cores. Maximizes utilization if set to 0.",
     "transcoding_tone_mapping": "Tone-mapping",
@@ -402,11 +417,11 @@
   "advanced_settings_prefer_remote_subtitle": "Some devices are painfully slow to load thumbnails from local assets. Activate this setting to load remote images instead.",
   "advanced_settings_prefer_remote_title": "Prefer remote images",
   "advanced_settings_proxy_headers_subtitle": "Define proxy headers Immich should send with each network request",
-  "advanced_settings_proxy_headers_title": "Proxy Headers",
+  "advanced_settings_proxy_headers_title": "Custom proxy headers [EXPERIMENTAL]",
   "advanced_settings_readonly_mode_subtitle": "Enables the read-only mode where the photos can be only viewed, things like selecting multiple images, sharing, casting, delete are all disabled. Enable/Disable read-only via user avatar from the main screen",
-  "advanced_settings_readonly_mode_title": "Read-only Mode",
+  "advanced_settings_readonly_mode_title": "Read-only mode",
   "advanced_settings_self_signed_ssl_subtitle": "Skips SSL certificate verification for the server endpoint. Required for self-signed certificates.",
-  "advanced_settings_self_signed_ssl_title": "Allow self-signed SSL certificates",
+  "advanced_settings_self_signed_ssl_title": "Allow self-signed SSL certificates [EXPERIMENTAL]",
   "advanced_settings_sync_remote_deletions_subtitle": "Automatically delete or restore an asset on this device when that action is taken on the web",
   "advanced_settings_sync_remote_deletions_title": "Sync remote deletions [EXPERIMENTAL]",
   "advanced_settings_tile_subtitle": "Advanced user's settings",
@@ -466,10 +481,14 @@
   "api_key_description": "This value will only be shown once. Please be sure to copy it before closing the window.",
   "api_key_empty": "Your API Key name shouldn't be empty",
   "api_keys": "API Keys",
+  "app_architecture_variant": "Variant (Architecture)",
   "app_bar_signout_dialog_content": "Are you sure you want to sign out?",
   "app_bar_signout_dialog_ok": "Yes",
   "app_bar_signout_dialog_title": "Sign out",
+  "app_download_links": "App Download Links",
   "app_settings": "App Settings",
+  "app_stores": "App Stores",
+  "app_update_available": "App update is available",
   "appears_in": "Appears in",
   "apply_count": "Apply ({count, number})",
   "archive": "Archive",
@@ -553,6 +572,7 @@
   "backup_albums_sync": "Backup albums synchronization",
   "backup_all": "All",
   "backup_background_service_backup_failed_message": "Failed to backup assets. Retrying…",
+  "backup_background_service_complete_notification": "Asset backup complete",
   "backup_background_service_connection_failed_message": "Failed to connect to the server. Retrying…",
   "backup_background_service_current_upload_notification": "Uploading {filename}",
   "backup_background_service_default_notification": "Checking for new assets…",
@@ -662,6 +682,8 @@
   "change_password_description": "This is either the first time you are signing into the system or a request has been made to change your password. Please enter the new password below.",
   "change_password_form_confirm_password": "Confirm Password",
   "change_password_form_description": "Hi {name},\n\nThis is either the first time you are signing into the system or a request has been made to change your password. Please enter the new password below.",
+  "change_password_form_log_out": "Log out all other devices",
+  "change_password_form_log_out_description": "It is recommended to log out of all other devices",
   "change_password_form_new_password": "New Password",
   "change_password_form_password_mismatch": "Passwords do not match",
   "change_password_form_reenter_new_password": "Re-enter New Password",
@@ -688,8 +710,8 @@
   "client_cert_import_success_msg": "Client certificate is imported",
   "client_cert_invalid_msg": "Invalid certificate file or wrong password",
   "client_cert_remove_msg": "Client certificate is removed",
-  "client_cert_subtitle": "Supports PKCS12 (.p12, .pfx) format only. Certificate Import/Remove is available only before login",
-  "client_cert_title": "SSL Client Certificate",
+  "client_cert_subtitle": "Supports PKCS12 (.p12, .pfx) format only. Certificate import/removal is available only before login",
+  "client_cert_title": "SSL client certificate [EXPERIMENTAL]",
   "clockwise": "Сlockwise",
   "close": "Close",
   "collapse": "Collapse",
@@ -701,7 +723,6 @@
   "comments_and_likes": "Comments & likes",
   "comments_are_disabled": "Comments are disabled",
   "common_create_new_album": "Create new album",
-  "common_server_error": "Please check your network connection, make sure the server is reachable and app/server versions are compatible.",
   "completed": "Completed",
   "confirm": "Confirm",
   "confirm_admin_password": "Confirm Admin Password",
@@ -740,6 +761,7 @@
   "create": "Create",
   "create_album": "Create album",
   "create_album_page_untitled": "Untitled",
+  "create_api_key": "Create API key",
   "create_library": "Create Library",
   "create_link": "Create link",
   "create_link_to_share": "Create link to share",
@@ -769,6 +791,7 @@
   "daily_title_text_date_year": "E, MMM dd, yyyy",
   "dark": "Dark",
   "dark_theme": "Toggle dark theme",
+  "date": "Date",
   "date_after": "Date after",
   "date_and_time": "Date and Time",
   "date_before": "Date before",
@@ -883,7 +906,6 @@
   "edit_tag": "Edit tag",
   "edit_title": "Edit Title",
   "edit_user": "Edit user",
-  "edited": "Edited",
   "editor": "Editor",
   "editor_close_without_save_prompt": "The changes will not be saved",
   "editor_close_without_save_title": "Close editor?",
@@ -1078,6 +1100,7 @@
   "features_setting_description": "Manage the app features",
   "file_name": "File name",
   "file_name_or_extension": "File name or extension",
+  "file_size": "File size",
   "filename": "Filename",
   "filetype": "Filetype",
   "filter": "Filter",
@@ -1117,11 +1140,10 @@
   "hash_asset": "Hash asset",
   "hashed_assets": "Hashed assets",
   "hashing": "Hashing",
-  "header_settings_add_header_tip": "Add Header",
+  "header_settings_add_header_tip": "Add header",
   "header_settings_field_validator_msg": "Value cannot be empty",
   "header_settings_header_name_input": "Header name",
   "header_settings_header_value_input": "Header value",
-  "headers_settings_tile_subtitle": "Define proxy headers the app should send with each network request",
   "headers_settings_tile_title": "Custom proxy headers",
   "hi_user": "Hi {name} ({email})",
   "hide_all_people": "Hide all people",
@@ -1242,6 +1264,7 @@
   "local_media_summary": "Local Media Summary",
   "local_network": "Local network",
   "local_network_sheet_info": "The app will connect to the server through this URL when using the specified Wi-Fi network",
+  "location": "Location",
   "location_permission": "Location permission",
   "location_permission_content": "In order to use the auto-switching feature, Immich needs precise location permission so it can read the current Wi-Fi network's name",
   "location_picker_choose_on_map": "Choose on map",
@@ -1346,6 +1369,8 @@
   "minute": "Minute",
   "minutes": "Minutes",
   "missing": "Missing",
+  "mobile_app": "Mobile App",
+  "mobile_app_download_onboarding_note": "Download the companion mobile app using the following options",
   "model": "Model",
   "month": "Month",
   "monthly_title_text_date_format": "MMMM y",
@@ -1364,6 +1389,8 @@
   "my_albums": "My albums",
   "name": "Name",
   "name_or_nickname": "Name or nickname",
+  "navigate": "Navigate",
+  "navigate_to_time": "Navigate to Time",
   "network_requirement_photos_upload": "Use cellular data to backup photos",
   "network_requirement_videos_upload": "Use cellular data to backup videos",
   "network_requirements": "Network Requirements",
@@ -1373,6 +1400,7 @@
   "never": "Never",
   "new_album": "New Album",
   "new_api_key": "New API Key",
+  "new_date_range": "New date range",
   "new_password": "New password",
   "new_person": "New person",
   "new_pin_code": "New PIN code",
@@ -1423,6 +1451,9 @@
   "notifications": "Notifications",
   "notifications_setting_description": "Manage notifications",
   "oauth": "OAuth",
+  "obtainium_configurator": "Obtainium Configurator",
+  "obtainium_configurator_instructions": "Use Obtainium to install and update the Android app directly from Immich GitHub's release. Create an API key and select a variant to create your Obtainium configuration link",
+  "ocr": "OCR",
   "official_immich_resources": "Official Immich Resources",
   "offline": "Offline",
   "offset": "Offset",
@@ -1527,6 +1558,9 @@
   "play_memories": "Play memories",
   "play_motion_photo": "Play Motion Photo",
   "play_or_pause_video": "Play or pause video",
+  "play_original_video": "Play original video",
+  "play_original_video_setting_description": "Prefer playback of original videos rather than transcoded videos. If original asset is not compatible it may not playback correctly.",
+  "play_transcoded_video": "Play transcoded video",
   "please_auth_to_access": "Please authenticate to access",
   "port": "Port",
   "preferences_settings_subtitle": "Manage the app's preferences",
@@ -1544,13 +1578,9 @@
   "privacy": "Privacy",
   "profile": "Profile",
   "profile_drawer_app_logs": "Logs",
-  "profile_drawer_client_out_of_date_major": "Mobile App is out of date. Please update to the latest major version.",
-  "profile_drawer_client_out_of_date_minor": "Mobile App is out of date. Please update to the latest minor version.",
   "profile_drawer_client_server_up_to_date": "Client and Server are up-to-date",
   "profile_drawer_github": "GitHub",
   "profile_drawer_readonly_mode": "Read-only mode enabled. Long-press the user avatar icon to exit.",
-  "profile_drawer_server_out_of_date_major": "Server is out of date. Please update to the latest major version.",
-  "profile_drawer_server_out_of_date_minor": "Server is out of date. Please update to the latest minor version.",
   "profile_image_of_user": "Profile image of {user}",
   "profile_picture_set": "Profile picture set.",
   "public_album": "Public album",
@@ -1667,6 +1697,7 @@
   "reset_sqlite_confirmation": "Are you sure you want to reset the SQLite database? You will need to log out and log in again to resync the data",
   "reset_sqlite_success": "Successfully reset the SQLite database",
   "reset_to_default": "Reset to default",
+  "resolution": "Resolution",
   "resolve_duplicates": "Resolve duplicates",
   "resolved_all_duplicates": "Resolved all duplicates",
   "restore": "Restore",
@@ -1685,6 +1716,7 @@
   "running": "Running",
   "save": "Save",
   "save_to_gallery": "Save to gallery",
+  "saved": "Saved",
   "saved_api_key": "Saved API Key",
   "saved_profile": "Saved profile",
   "saved_settings": "Saved settings",
@@ -1701,6 +1733,9 @@
   "search_by_description_example": "Hiking day in Sapa",
   "search_by_filename": "Search by file name or extension",
   "search_by_filename_example": "i.e. IMG_1234.JPG or PNG",
+  "search_by_ocr": "Search by OCR",
+  "search_by_ocr_example": "Latte",
+  "search_camera_lens_model": "Search lens model...",
   "search_camera_make": "Search camera make...",
   "search_camera_model": "Search camera model...",
   "search_city": "Search city...",
@@ -1717,6 +1752,7 @@
   "search_filter_location_title": "Select location",
   "search_filter_media_type": "Media Type",
   "search_filter_media_type_title": "Select media type",
+  "search_filter_ocr": "Search by OCR",
   "search_filter_people_title": "Select people",
   "search_for": "Search for",
   "search_for_existing_person": "Search for existing person",
@@ -1779,6 +1815,7 @@
   "server_online": "Server Online",
   "server_privacy": "Server Privacy",
   "server_stats": "Server Stats",
+  "server_update_available": "Server update is available",
   "server_version": "Server Version",
   "set": "Set",
   "set_as_album_cover": "Set as album cover",
@@ -1807,6 +1844,8 @@
   "setting_notifications_subtitle": "Adjust your notification preferences",
   "setting_notifications_total_progress_subtitle": "Overall upload progress (done/total assets)",
   "setting_notifications_total_progress_title": "Show background backup total progress",
+  "setting_video_viewer_auto_play_subtitle": "Automatically start playing videos when they are opened",
+  "setting_video_viewer_auto_play_title": "Auto play videos",
   "setting_video_viewer_looping_title": "Looping",
   "setting_video_viewer_original_video_subtitle": "When streaming a video from the server, play the original even when a transcode is available. May lead to buffering. Videos available locally are played in original quality regardless of this setting.",
   "setting_video_viewer_original_video_title": "Force original video",
@@ -1986,6 +2025,7 @@
   "theme_setting_three_stage_loading_title": "Enable three-stage loading",
   "they_will_be_merged_together": "They will be merged together",
   "third_party_resources": "Third-Party Resources",
+  "time": "Time",
   "time_based_memories": "Time-based memories",
   "timeline": "Timeline",
   "timezone": "Timezone",
@@ -2018,6 +2058,7 @@
   "troubleshoot": "Troubleshoot",
   "type": "Type",
   "unable_to_change_pin_code": "Unable to change PIN code",
+  "unable_to_check_version": "Unable to check app or server version",
   "unable_to_setup_pin_code": "Unable to setup PIN code",
   "unarchive": "Unarchive",
   "unarchive_action_prompt": "{count} removed from Archive",

machine-learning/Dockerfile

@@ -70,7 +70,8 @@ RUN if [ "$DEVICE" = "rocm" ]; then \
 
 FROM python:3.11-slim-bookworm@sha256:873f91540d53b36327ed4fb018c9669107a4e2a676719720edb4209c4b15d029 AS prod-cpu
 
-ENV LD_PRELOAD=/usr/lib/libmimalloc.so.2
+ENV LD_PRELOAD=/usr/lib/libmimalloc.so.2 \
+    MACHINE_LEARNING_MODEL_ARENA=false
 
 FROM python:3.11-slim-bookworm@sha256:873f91540d53b36327ed4fb018c9669107a4e2a676719720edb4209c4b15d029 AS prod-openvino
 
@@ -88,10 +89,12 @@ RUN apt-get update && \
 
 FROM nvidia/cuda:12.2.2-runtime-ubuntu22.04@sha256:94c1577b2cd9dd6c0312dc04dff9cb2fdce2b268018abc3d7c2dbcacf1155000 AS prod-cuda
 
-ENV LD_PRELOAD=/usr/lib/libmimalloc.so.2
+ENV LD_PRELOAD=/usr/lib/libmimalloc.so.2 \
+    MACHINE_LEARNING_MODEL_ARENA=false
 
 RUN apt-get update && \
-    apt-get install --no-install-recommends -yqq libcudnn9-cuda-12 && \
+    # Pascal support was dropped in 9.11
+    apt-get install --no-install-recommends -yqq libcudnn9-cuda-12=9.10.2.21-1 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
@@ -104,7 +107,8 @@ FROM rocm/dev-ubuntu-22.04:6.4.3-complete@sha256:1f7e92ca7e3a3785680473329ed1091
 FROM prod-cpu AS prod-armnn
 
 ENV LD_LIBRARY_PATH=/opt/armnn \
-    LD_PRELOAD=/usr/lib/libmimalloc.so.2
+    LD_PRELOAD=/usr/lib/libmimalloc.so.2 \
+    MACHINE_LEARNING_MODEL_ARENA=false
 
 RUN apt-get update && apt-get install -y --no-install-recommends ocl-icd-libopencl1 mesa-opencl-icd libgomp1 && \
     rm -rf /var/lib/apt/lists/* && \
@@ -127,7 +131,8 @@ FROM prod-cpu AS prod-rknn
 # renovate: datasource=github-tags depName=airockchip/rknn-toolkit2
 ARG RKNN_TOOLKIT_VERSION="v2.3.0"
 
-ENV LD_PRELOAD=/usr/lib/libmimalloc.so.2
+ENV LD_PRELOAD=/usr/lib/libmimalloc.so.2 \
+    MACHINE_LEARNING_MODEL_ARENA=false
 
 ADD --checksum=sha256:73993ed4b440460825f21611731564503cc1d5a0c123746477da6cd574f34885 "https://github.com/airockchip/rknn-toolkit2/raw/refs/tags/${RKNN_TOOLKIT_VERSION}/rknpu2/runtime/Linux/librknn_api/aarch64/librknnrt.so" /usr/lib/
 
@@ -136,7 +141,7 @@ FROM prod-${DEVICE} AS prod
 ARG DEVICE
 
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends tini $(if ! [ "$DEVICE" = "openvino" ] && ! [ "$DEVICE" = "rocm" ]; then echo "libmimalloc2.0"; fi) && \
+    apt-get install -y --no-install-recommends tini ccache libgl1 libglib2.0-0 libgomp1 $(if ! [ "$DEVICE" = "openvino" ] && ! [ "$DEVICE" = "rocm" ]; then echo "libmimalloc2.0"; fi) && \
     apt-get autoremove -yqq && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*

machine-learning/immich_ml/config.py

@@ -41,6 +41,7 @@ class PreloadModelData(BaseModel):
 
 class MaxBatchSize(BaseModel):
     facial_recognition: int | None = None
+    text_recognition: int | None = None
 
 
 class Settings(BaseSettings):
@@ -61,6 +62,7 @@ class Settings(BaseSettings):
     request_threads: int = os.cpu_count() or 4
     model_inter_op_threads: int = 0
     model_intra_op_threads: int = 0
+    model_arena: bool = True
     ann: bool = True
     ann_fp16_turbo: bool = False
     ann_tuning_level: int = 2

machine-learning/immich_ml/main.py

@@ -183,7 +183,9 @@ async def run_inference(payload: Image | str, entries: InferenceEntries) -> Infe
     response: InferenceResponse = {}
 
     async def _run_inference(entry: InferenceEntry) -> None:
-        model = await model_cache.get(entry["name"], entry["type"], entry["task"], ttl=settings.model_ttl)
+        model = await model_cache.get(
+            entry["name"], entry["type"], entry["task"], ttl=settings.model_ttl, **entry["options"]
+        )
         inputs = [payload]
         for dep in model.depends:
             try:

machine-learning/immich_ml/models/__init__.py

@@ -3,6 +3,8 @@ from typing import Any
 from immich_ml.models.base import InferenceModel
 from immich_ml.models.clip.textual import MClipTextualEncoder, OpenClipTextualEncoder
 from immich_ml.models.clip.visual import OpenClipVisualEncoder
+from immich_ml.models.ocr.detection import TextDetector
+from immich_ml.models.ocr.recognition import TextRecognizer
 from immich_ml.schemas import ModelSource, ModelTask, ModelType
 
 from .constants import get_model_source
@@ -28,6 +30,12 @@ def get_model_class(model_name: str, model_type: ModelType, model_task: ModelTas
         case ModelSource.INSIGHTFACE, ModelType.RECOGNITION, ModelTask.FACIAL_RECOGNITION:
             return FaceRecognizer
 
+        case ModelSource.PADDLE, ModelType.DETECTION, ModelTask.OCR:
+            return TextDetector
+
+        case ModelSource.PADDLE, ModelType.RECOGNITION, ModelTask.OCR:
+            return TextRecognizer
+
         case _:
             raise ValueError(f"Unknown model combination: {source}, {model_type}, {model_task}")
 

machine-learning/immich_ml/models/base.py

@@ -38,9 +38,8 @@ class InferenceModel(ABC):
 
     def download(self) -> None:
         if not self.cached:
-            log.info(
-                f"Downloading {self.model_type.replace('-', ' ')} model '{self.model_name}'. This may take a while."
-            )
+            model_type = self.model_type.replace("-", " ")
+            log.info(f"Downloading {model_type} model '{self.model_name}' to {self.model_path}. This may take a while.")
             self._download()
 
     def load(self) -> None:
@@ -58,7 +57,7 @@ class InferenceModel(ABC):
         self.load()
         if model_kwargs:
             self.configure(**model_kwargs)
-        return self._predict(*inputs, **model_kwargs)
+        return self._predict(*inputs)
 
     @abstractmethod
     def _predict(self, *inputs: Any, **model_kwargs: Any) -> Any: ...

machine-learning/immich_ml/models/clip/textual.py

@@ -19,7 +19,7 @@ class BaseCLIPTextualEncoder(InferenceModel):
     depends = []
     identity = (ModelType.TEXTUAL, ModelTask.SEARCH)
 
-    def _predict(self, inputs: str, language: str | None = None, **kwargs: Any) -> str:
+    def _predict(self, inputs: str, language: str | None = None) -> str:
         tokens = self.tokenize(inputs, language=language)
         res: NDArray[np.float32] = self.session.run(None, tokens)[0][0]
         return serialize_np_array(res)

machine-learning/immich_ml/models/clip/visual.py

@@ -26,7 +26,7 @@ class BaseCLIPVisualEncoder(InferenceModel):
     depends = []
     identity = (ModelType.VISUAL, ModelTask.SEARCH)
 
-    def _predict(self, inputs: Image.Image | bytes, **kwargs: Any) -> str:
+    def _predict(self, inputs: Image.Image | bytes) -> str:
         image = decode_pil(inputs)
         res: NDArray[np.float32] = self.session.run(None, self.transform(image))[0][0]
         return serialize_np_array(res)

machine-learning/immich_ml/models/constants.py

@@ -75,10 +75,16 @@ _INSIGHTFACE_MODELS = {
 }
 
 
+_PADDLE_MODELS = {
+    "PP-OCRv5_server",
+    "PP-OCRv5_mobile",
+}
+
 SUPPORTED_PROVIDERS = [
     "CUDAExecutionProvider",
     "ROCMExecutionProvider",
     "OpenVINOExecutionProvider",
+    "CoreMLExecutionProvider",
     "CPUExecutionProvider",
 ]
 
@@ -158,4 +164,7 @@ def get_model_source(model_name: str) -> ModelSource | None:
     if cleaned_name in _OPENCLIP_MODELS:
         return ModelSource.OPENCLIP
 
+    if cleaned_name in _PADDLE_MODELS:
+        return ModelSource.PADDLE
+
     return None

machine-learning/immich_ml/models/facial_recognition/detection.py

@@ -24,7 +24,7 @@ class FaceDetector(InferenceModel):
 
         return session
 
-    def _predict(self, inputs: NDArray[np.uint8] | bytes, **kwargs: Any) -> FaceDetectionOutput:
+    def _predict(self, inputs: NDArray[np.uint8] | bytes) -> FaceDetectionOutput:
         inputs = decode_cv2(inputs)
 
         bboxes, landmarks = self._detect(inputs)

machine-learning/immich_ml/models/facial_recognition/recognition.py

@@ -44,7 +44,7 @@ class FaceRecognizer(InferenceModel):
         return session
 
     def _predict(
-        self, inputs: NDArray[np.uint8] | bytes | Image.Image, faces: FaceDetectionOutput, **kwargs: Any
+        self, inputs: NDArray[np.uint8] | bytes | Image.Image, faces: FaceDetectionOutput
     ) -> FacialRecognitionOutput:
         if faces["boxes"].shape[0] == 0:
             return []

machine-learning/immich_ml/models/ocr/detection.py

@@ -0,0 +1,86 @@
+from typing import Any
+
+import numpy as np
+from PIL import Image
+from rapidocr.ch_ppocr_det import TextDetector as RapidTextDetector
+from rapidocr.inference_engine.base import FileInfo, InferSession
+from rapidocr.utils import DownloadFile, DownloadFileInput
+from rapidocr.utils.typings import EngineType, LangDet, OCRVersion, TaskType
+from rapidocr.utils.typings import ModelType as RapidModelType
+
+from immich_ml.config import log
+from immich_ml.models.base import InferenceModel
+from immich_ml.models.transforms import decode_cv2
+from immich_ml.schemas import ModelFormat, ModelSession, ModelTask, ModelType
+from immich_ml.sessions.ort import OrtSession
+
+from .schemas import OcrOptions, TextDetectionOutput
+
+
+class TextDetector(InferenceModel):
+    depends = []
+    identity = (ModelType.DETECTION, ModelTask.OCR)
+
+    def __init__(self, model_name: str, **model_kwargs: Any) -> None:
+        super().__init__(model_name, **model_kwargs, model_format=ModelFormat.ONNX)
+        self.max_resolution = 736
+        self.min_score = 0.5
+        self.score_mode = "fast"
+        self._empty: TextDetectionOutput = {
+            "image": np.empty(0, dtype=np.float32),
+            "boxes": np.empty(0, dtype=np.float32),
+            "scores": np.empty(0, dtype=np.float32),
+        }
+
+    def _download(self) -> None:
+        model_info = InferSession.get_model_url(
+            FileInfo(
+                engine_type=EngineType.ONNXRUNTIME,
+                ocr_version=OCRVersion.PPOCRV5,
+                task_type=TaskType.DET,
+                lang_type=LangDet.CH,
+                model_type=RapidModelType.MOBILE if "mobile" in self.model_name else RapidModelType.SERVER,
+            )
+        )
+        download_params = DownloadFileInput(
+            file_url=model_info["model_dir"],
+            sha256=model_info["SHA256"],
+            save_path=self.model_path,
+            logger=log,
+        )
+        DownloadFile.run(download_params)
+
+    def _load(self) -> ModelSession:
+        # TODO: support other runtime sessions
+        session = OrtSession(self.model_path)
+        self.model = RapidTextDetector(
+            OcrOptions(
+                session=session.session,
+                limit_side_len=self.max_resolution,
+                limit_type="min",
+                box_thresh=self.min_score,
+                score_mode=self.score_mode,
+            )
+        )
+        return session
+
+    def _predict(self, inputs: bytes | Image.Image) -> TextDetectionOutput:
+        results = self.model(decode_cv2(inputs))
+        if results.boxes is None or results.scores is None or results.img is None:
+            return self._empty
+        return {
+            "image": results.img,
+            "boxes": np.array(results.boxes, dtype=np.float32),
+            "scores": np.array(results.scores, dtype=np.float32),
+        }
+
+    def configure(self, **kwargs: Any) -> None:
+        if (max_resolution := kwargs.get("maxResolution")) is not None:
+            self.max_resolution = max_resolution
+            self.model.limit_side_len = max_resolution
+        if (min_score := kwargs.get("minScore")) is not None:
+            self.min_score = min_score
+            self.model.postprocess_op.box_thresh = min_score
+        if (score_mode := kwargs.get("scoreMode")) is not None:
+            self.score_mode = score_mode
+            self.model.postprocess_op.score_mode = score_mode

machine-learning/immich_ml/models/ocr/recognition.py

@@ -0,0 +1,117 @@
+from typing import Any
+
+import cv2
+import numpy as np
+from numpy.typing import NDArray
+from PIL.Image import Image
+from rapidocr.ch_ppocr_rec import TextRecInput
+from rapidocr.ch_ppocr_rec import TextRecognizer as RapidTextRecognizer
+from rapidocr.inference_engine.base import FileInfo, InferSession
+from rapidocr.utils import DownloadFile, DownloadFileInput
+from rapidocr.utils.typings import EngineType, LangRec, OCRVersion, TaskType
+from rapidocr.utils.typings import ModelType as RapidModelType
+
+from immich_ml.config import log, settings
+from immich_ml.models.base import InferenceModel
+from immich_ml.schemas import ModelFormat, ModelSession, ModelTask, ModelType
+from immich_ml.sessions.ort import OrtSession
+
+from .schemas import OcrOptions, TextDetectionOutput, TextRecognitionOutput
+
+
+class TextRecognizer(InferenceModel):
+    depends = [(ModelType.DETECTION, ModelTask.OCR)]
+    identity = (ModelType.RECOGNITION, ModelTask.OCR)
+
+    def __init__(self, model_name: str, **model_kwargs: Any) -> None:
+        self.min_score = model_kwargs.get("minScore", 0.9)
+        self._empty: TextRecognitionOutput = {
+            "box": np.empty(0, dtype=np.float32),
+            "boxScore": np.empty(0, dtype=np.float32),
+            "text": [],
+            "textScore": np.empty(0, dtype=np.float32),
+        }
+        super().__init__(model_name, **model_kwargs, model_format=ModelFormat.ONNX)
+
+    def _download(self) -> None:
+        model_info = InferSession.get_model_url(
+            FileInfo(
+                engine_type=EngineType.ONNXRUNTIME,
+                ocr_version=OCRVersion.PPOCRV5,
+                task_type=TaskType.REC,
+                lang_type=LangRec.CH,
+                model_type=RapidModelType.MOBILE if "mobile" in self.model_name else RapidModelType.SERVER,
+            )
+        )
+        download_params = DownloadFileInput(
+            file_url=model_info["model_dir"],
+            sha256=model_info["SHA256"],
+            save_path=self.model_path,
+            logger=log,
+        )
+        DownloadFile.run(download_params)
+
+    def _load(self) -> ModelSession:
+        # TODO: support other runtimes
+        session = OrtSession(self.model_path)
+        self.model = RapidTextRecognizer(
+            OcrOptions(
+                session=session.session,
+                rec_batch_num=settings.max_batch_size.text_recognition if settings.max_batch_size is not None else 6,
+                rec_img_shape=(3, 48, 320),
+            )
+        )
+        return session
+
+    def _predict(self, _: Image, texts: TextDetectionOutput) -> TextRecognitionOutput:
+        boxes, img, box_scores = texts["boxes"], texts["image"], texts["scores"]
+        if boxes.shape[0] == 0:
+            return self._empty
+        rec = self.model(TextRecInput(img=self.get_crop_img_list(img, boxes)))
+        if rec.txts is None:
+            return self._empty
+
+        height, width = img.shape[0:2]
+        boxes[:, :, 0] /= width
+        boxes[:, :, 1] /= height
+
+        text_scores = np.array(rec.scores)
+        valid_text_score_idx = text_scores > self.min_score
+        valid_score_idx_list = valid_text_score_idx.tolist()
+        return {
+            "box": boxes.reshape(-1, 8)[valid_text_score_idx].reshape(-1),
+            "text": [rec.txts[i] for i in range(len(rec.txts)) if valid_score_idx_list[i]],
+            "boxScore": box_scores[valid_text_score_idx],
+            "textScore": text_scores[valid_text_score_idx],
+        }
+
+    def get_crop_img_list(self, img: NDArray[np.float32], boxes: NDArray[np.float32]) -> list[NDArray[np.float32]]:
+        img_crop_width = np.maximum(
+            np.linalg.norm(boxes[:, 1] - boxes[:, 0], axis=1), np.linalg.norm(boxes[:, 2] - boxes[:, 3], axis=1)
+        ).astype(np.int32)
+        img_crop_height = np.maximum(
+            np.linalg.norm(boxes[:, 0] - boxes[:, 3], axis=1), np.linalg.norm(boxes[:, 1] - boxes[:, 2], axis=1)
+        ).astype(np.int32)
+        pts_std = np.zeros((img_crop_width.shape[0], 4, 2), dtype=np.float32)
+        pts_std[:, 1:3, 0] = img_crop_width[:, None]
+        pts_std[:, 2:4, 1] = img_crop_height[:, None]
+
+        img_crop_sizes = np.stack([img_crop_width, img_crop_height], axis=1).tolist()
+        imgs: list[NDArray[np.float32]] = []
+        for box, pts_std, dst_size in zip(list(boxes), list(pts_std), img_crop_sizes):
+            M = cv2.getPerspectiveTransform(box, pts_std)
+            dst_img: NDArray[np.float32] = cv2.warpPerspective(
+                img,
+                M,
+                dst_size,
+                borderMode=cv2.BORDER_REPLICATE,
+                flags=cv2.INTER_CUBIC,
+            )  # type: ignore
+            dst_height, dst_width = dst_img.shape[0:2]
+            if dst_height * 1.0 / dst_width >= 1.5:
+                dst_img = np.rot90(dst_img)
+            imgs.append(dst_img)
+        return imgs
+
+    def configure(self, **kwargs: Any) -> None:
+        self.min_score = kwargs.get("minScore", self.min_score)

machine-learning/immich_ml/models/ocr/schemas.py

@@ -0,0 +1,28 @@
+from typing import Any, Iterable
+
+import numpy as np
+import numpy.typing as npt
+from rapidocr.utils.typings import EngineType, LangRec
+from typing_extensions import TypedDict
+
+
+class TextDetectionOutput(TypedDict):
+    image: npt.NDArray[np.float32]
+    boxes: npt.NDArray[np.float32]
+    scores: npt.NDArray[np.float32]
+
+
+class TextRecognitionOutput(TypedDict):
+    box: npt.NDArray[np.float32]
+    boxScore: npt.NDArray[np.float32]
+    text: Iterable[str]
+    textScore: npt.NDArray[np.float32]
+
+
+# RapidOCR expects `engine_type`, `lang_type`, and `font_path` to be attributes
+class OcrOptions(dict[str, Any]):
+    def __init__(self, **options: Any) -> None:
+        super().__init__(**options)
+        self.engine_type = EngineType.ONNXRUNTIME
+        self.lang_type = LangRec.CH
+        self.font_path = None

machine-learning/immich_ml/schemas.py

@@ -23,6 +23,7 @@ class BoundingBox(TypedDict):
 class ModelTask(StrEnum):
     FACIAL_RECOGNITION = "facial-recognition"
     SEARCH = "clip"
+    OCR = "ocr"
 
 
 class ModelType(StrEnum):
@@ -42,6 +43,7 @@ class ModelSource(StrEnum):
     INSIGHTFACE = "insightface"
     MCLIP = "mclip"
     OPENCLIP = "openclip"
+    PADDLE = "paddle"
 
 
 ModelIdentity = tuple[ModelType, ModelTask]

machine-learning/immich_ml/sessions/ort.py

@@ -14,6 +14,8 @@ from ..config import log, settings
 
 
 class OrtSession:
+    session: ort.InferenceSession
+
     def __init__(
         self,
         model_path: Path | str,
@@ -96,6 +98,14 @@ class OrtSession:
                         "precision": "FP32",
                         "cache_dir": (self.model_path.parent / "openvino").as_posix(),
                     }
+                case "CoreMLExecutionProvider":
+                    options = {
+                        "ModelFormat": "MLProgram",
+                        "MLComputeUnits": "ALL",
+                        "SpecializationStrategy": "FastPrediction",
+                        "AllowLowPrecisionAccumulationOnGPU": "1",
+                        "ModelCacheDirectory": (self.model_path.parent / "coreml").as_posix(),
+                    }
                 case _:
                     options = {}
             provider_options.append(options)
@@ -115,7 +125,7 @@ class OrtSession:
     @property
     def _sess_options_default(self) -> ort.SessionOptions:
         sess_options = ort.SessionOptions()
-        sess_options.enable_cpu_mem_arena = False
+        sess_options.enable_cpu_mem_arena = settings.model_arena
 
         # avoid thread contention between models
         if settings.model_inter_op_threads > 0:

machine-learning/pyproject.toml

@@ -22,6 +22,8 @@ dependencies = [
     "rich>=13.4.2",
     "tokenizers>=0.15.0,<1.0",
     "uvicorn[standard]>=0.22.0,<1.0",
+    "setuptools>=78.1.0",
+    "rapidocr>=3.1.0",
 ]
 
 [dependency-groups]

machine-learning/test_main.py

@@ -180,6 +180,7 @@ class TestOrtSession:
     CUDA_EP_OUT_OF_ORDER = ["CPUExecutionProvider", "CUDAExecutionProvider"]
     TRT_EP = ["TensorrtExecutionProvider", "CUDAExecutionProvider", "CPUExecutionProvider"]
     ROCM_EP = ["ROCMExecutionProvider", "CPUExecutionProvider"]
+    COREML_EP = ["CoreMLExecutionProvider", "CPUExecutionProvider"]
 
     @pytest.mark.providers(CPU_EP)
     def test_sets_cpu_provider(self, providers: list[str]) -> None:
@@ -225,6 +226,12 @@ class TestOrtSession:
 
         assert session.providers == self.ROCM_EP
 
+    @pytest.mark.providers(COREML_EP)
+    def test_uses_coreml(self, providers: list[str]) -> None:
+        session = OrtSession("ViT-B-32__openai")
+
+        assert session.providers == self.COREML_EP
+
     def test_sets_provider_kwarg(self) -> None:
         providers = ["CUDAExecutionProvider"]
         session = OrtSession("ViT-B-32__openai", providers=providers)
@@ -284,7 +291,6 @@ class TestOrtSession:
         assert session.sess_options.execution_mode == ort.ExecutionMode.ORT_SEQUENTIAL
         assert session.sess_options.inter_op_num_threads == 1
         assert session.sess_options.intra_op_num_threads == 2
-        assert session.sess_options.enable_cpu_mem_arena is False
 
     def test_sets_default_sess_options_does_not_set_threads_if_non_cpu_and_default_threads(self) -> None:
         session = OrtSession("ViT-B-32__openai", providers=["CUDAExecutionProvider", "CPUExecutionProvider"])
@@ -302,6 +308,26 @@ class TestOrtSession:
         assert session.sess_options.inter_op_num_threads == 2
         assert session.sess_options.intra_op_num_threads == 4
 
+    def test_uses_arena_if_enabled(self, mocker: MockerFixture) -> None:
+        mock_settings = mocker.patch("immich_ml.sessions.ort.settings", autospec=True)
+        mock_settings.model_inter_op_threads = 0
+        mock_settings.model_intra_op_threads = 0
+        mock_settings.model_arena = True
+
+        session = OrtSession("ViT-B-32__openai", providers=["CPUExecutionProvider"])
+
+        assert session.sess_options.enable_cpu_mem_arena
+
+    def test_does_not_use_arena_if_disabled(self, mocker: MockerFixture) -> None:
+        mock_settings = mocker.patch("immich_ml.sessions.ort.settings", autospec=True)
+        mock_settings.model_inter_op_threads = 0
+        mock_settings.model_intra_op_threads = 0
+        mock_settings.model_arena = False
+
+        session = OrtSession("ViT-B-32__openai", providers=["CPUExecutionProvider"])
+
+        assert not session.sess_options.enable_cpu_mem_arena
+
     def test_sets_sess_options_kwarg(self) -> None:
         sess_options = ort.SessionOptions()
         session = OrtSession(

mise.toml

@@ -1,7 +1,9 @@
 [tools]
-node = "22.20.0"
-flutter = "3.35.5"
+node = "22.21.0"
+flutter = "3.35.7"
 pnpm = "10.18.1"
+terragrunt = "0.91.2"
+opentofu = "1.10.6"
 
 [tools."github:CQLabs/homebrew-dcm"]
 version = "1.30.0"
@@ -505,3 +507,21 @@ description = "Auto-fix Dart Code Metrics"
 dir = "mobile"
 hide = true
 run = "dcm fix lib"
+
+# docs deployment
+[tasks."tg:fmt"]
+run = "terragrunt hclfmt"
+description = "Format terragrunt files"
+
+[tasks.tf]
+run = "terragrunt run --all"
+description = "Wrapper for terragrunt run-all"
+dir = "{{cwd}}"
+
+[tasks."tf:fmt"]
+run = "tofu fmt -recursive tf/"
+description = "Format terraform files"
+
+[tasks."tf:init"]
+run = "mise run tf init -- -reconfigure"
+dir = "{{cwd}}"

mobile/.fvmrc

@@ -1,3 +1,3 @@
 {
-  "flutter": "3.35.4"
+  "flutter": "3.35.7"
 }

mobile/.vscode/settings.json

@@ -1,5 +1,5 @@
 {
-  "dart.flutterSdkPath": ".fvm/versions/3.35.4",
+  "dart.flutterSdkPath": ".fvm/versions/3.35.7",
   "dart.lineLength": 120,
   "[dart]": {
     "editor.rulers": [120]

mobile/analysis_options.yaml

@@ -17,7 +17,7 @@ linter:
   # section below to disable rules from the `package:flutter_lints/flutter.yaml`
   # included above or to enable additional rules. A list of all available lints
   # and their documentation is published at
-  # https://dart-lang.github.io/linter/lints/index.html.
+  # https://dart.dev/tools/linter-rules
   #
   # Instead of disabling a lint rule for the entire project in the
   # section below, it can also be suppressed for a single line of code
@@ -28,6 +28,7 @@ linter:
   rules:
     # avoid_print: false  # Uncomment to disable the `avoid_print` rule
     # prefer_single_quotes: true # Uncomment to enable the `prefer_single_quotes` rule
+    unawaited_futures: true
     use_build_context_synchronously: false
     require_trailing_commas: true
     unrelated_type_equality_checks: true
@@ -46,6 +47,8 @@ analyzer:
   # TODO: Re-enable after upgrading custom_lint
   # plugins:
   #   - custom_lint
+  errors:
+    unawaited_futures: warning
 
 custom_lint:
   debug: true
@@ -152,160 +155,6 @@ dart_code_metrics:
   #  - avoid-passing-async-when-sync-expected
   #  - avoid-throw-in-catch-block
     - avoid-unused-parameters
-  #  - avoid-unnecessary-type-assertions
-  #  - avoid-unnecessary-type-casts
-  #  - avoid-unrelated-type-assertions
-  #  - avoid-unrelated-type-casts
-  #  - no-empty-block
-  #  - no-equal-then-else
-  #  - prefer-correct-test-file-name
     - prefer-const-border-radius
-  #  - prefer-match-file-name
-  #  - prefer-return-await
-  #  - avoid-self-assignment
-  #  - avoid-self-compare
-  #  - avoid-shadowing
-  #  - prefer-iterable-of
-  #  - no-equal-switch-case
-  #  - no-equal-conditions
-  #  - avoid-equal-expressions
-  #  - avoid-missed-calls
-  #  - avoid-unnecessary-negations
-  #  - avoid-unused-generics
-  #  - function-always-returns-null
-  #  - avoid-throw-objects-without-tostring
-  #  - avoid-unsafe-collection-methods
-  #  - prefer-wildcard-pattern
-  #  - no-equal-switch-expression-cases
-  #  - avoid-future-tostring
-  #  - avoid-unassigned-late-fields
-  #  - avoid-nested-futures
-  #  - avoid-generics-shadowing
-  #  - prefer-parentheses-with-if-null
-  #  - no-equal-nested-conditions
-  #  - avoid-shadowed-extension-methods
-  #  - avoid-unnecessary-conditionals
-  #  - avoid-double-slash-imports
-  #  - avoid-map-keys-contains
-  #  - prefer-correct-json-casts
-  #  - avoid-duplicate-mixins
-  #  - avoid-nullable-interpolation
-  #  - avoid-unused-instances
-  #  - prefer-correct-for-loop-increment
-  #  - prefer-public-exception-classes
-  #  - avoid-uncaught-future-errors
-  #  - always-remove-listener
-  #  - avoid-unnecessary-setstate
-  #  - check-for-equals-in-render-object-setters
-  #  - consistent-update-render-object
-  #  - use-setstate-synchronously
-  #  - avoid-incomplete-copy-with
-  #  - proper-super-calls
-  #  - dispose-fields
-  #  - avoid-empty-setstate
-  #  - avoid-state-constructors
-  #  - avoid-recursive-widget-calls
-  #  - avoid-missing-image-alt
-  #  - avoid-passing-self-as-argument
-  #  - avoid-unnecessary-if
-  #  - avoid-unconditional-break
-  #  - avoid-referencing-discarded-variables
-  #  - avoid-unnecessary-local-late
-  #  - avoid-wildcard-cases-with-enums
-  #  - match-getter-setter-field-names
-  #  - avoid-accessing-collections-by-constant-index
-  #  - prefer-unique-test-names
-  #  - avoid-duplicate-cascades
-  #  - prefer-specific-cases-first
-  #  - avoid-duplicate-switch-case-conditions
-  #  - prefer-explicit-function-type
-  #  - avoid-misused-test-matchers
-  #  - avoid-duplicate-test-assertions
-  #  - prefer-switch-with-enums
-  #  - prefer-any-or-every
-  #  - avoid-duplicate-map-keys
-  #  - avoid-nullable-tostring
-  #  - avoid-undisposed-instances
-  #  - avoid-duplicate-initializers
-  #  - avoid-unassigned-stream-subscriptions
-  #  - avoid-empty-test-groups
-  #  - avoid-not-encodable-in-to-json
-  #  - avoid-contradictory-expressions
-  #  - avoid-excessive-expressions
-  #  - prefer-private-extension-type-field
-  #  - avoid-renaming-representation-getters
-  #  - avoid-empty-spread
-  #  - avoid-unnecessary-gesture-detector
-  #  - avoid-missing-completer-stack-trace
-  #  - avoid-casting-to-extension-type
-  #  - prefer-overriding-parent-equality
-  #  - avoid-missing-controller
-  #  - avoid-unknown-pragma
-  #  - avoid-conditions-with-boolean-literals
-  #  - avoid-multi-assignment
-  #  - avoid-collection-equality-checks
-  #  - avoid-only-rethrow
-  #  - avoid-incorrect-image-opacity
-  #  - avoid-misused-set-literals
-  #  - dispose-class-fields
-  #  - avoid-suspicious-super-overrides
-  #  - avoid-assignments-as-conditions
-  #  - avoid-unused-assignment
-  #  - avoid-unnecessary-overrides
-  #  - avoid-implicitly-nullable-extension-types
-    # Enable with the next release
-    # - avoid-late-final-reassignment
-    # - avoid-duplicate-constant-values
-    # - function-always-returns-same-value
-    # - avoid-flexible-outside-flex
-    # - avoid-unnecessary-patterns
-    # - use-closest-build-context
-    # - avoid-commented-out-code
-    # - avoid-recursive-tostring
-    # - avoid-enum-values-by-index
-    # - avoid-constant-assert-conditions
-    # - avoid-inconsistent-digit-separators
-    # - pass-existing-future-to-future-builder
-    # - pass-existing-stream-to-stream-builder
-
-    # Code simplification
-  #  - avoid-redundant-async
-  #  - avoid-redundant-else
-  #  - avoid-unnecessary-nullable-return-type
-  #  - avoid-redundant-pragma-inline
-  #  - avoid-nested-records
-  #  - avoid-redundant-positional-field-name
-  #  - avoid-explicit-pattern-field-name
-  #  - prefer-simpler-patterns-null-check
-  #  - avoid-unnecessary-return
-  #  - avoid-duplicate-patterns
-  #  - avoid-keywords-in-wildcard-pattern
-  #  - avoid-unnecessary-futures
-  #  - avoid-unnecessary-reassignment
-  #  - avoid-unnecessary-call
-  #  - avoid-unnecessary-stateful-widgets
-  #  - prefer-dedicated-media-query-methods
-  #  - avoid-unnecessary-overrides-in-state
-  #  - move-variable-closer-to-its-usage
-  #  - avoid-nullable-parameters-with-default-values
-  #  - prefer-null-aware-spread
-  #  - avoid-inferrable-type-arguments
-  #  - avoid-unnecessary-super
-  #  - avoid-unnecessary-collections
-  #  - avoid-unnecessary-extends
-  #  - avoid-unnecessary-enum-arguments
-  #  - prefer-contains
-    # Enable with the next release
-    # - prefer-simpler-boolean-expressions
-    # - prefer-spacing
-    # - avoid-unnecessary-continue
-    # - avoid-unnecessary-compare-to
-
-    # Style
-  #  - prefer-trailing-comma
-  #  - unnecessary-trailing-comma
     - prefer-declaring-const-constructor
-  #  - prefer-single-widget-per-file
     - prefer-switch-expression
-  #  - prefer-prefixed-global-constants
-  #  - prefer-correct-callback-field-name

mobile/android/app/src/main/kotlin/app/alextran/immich/MainActivity.kt

@@ -9,6 +9,7 @@ import app.alextran.immich.background.BackgroundWorkerFgHostApi
 import app.alextran.immich.background.BackgroundWorkerLockApi
 import app.alextran.immich.connectivity.ConnectivityApi
 import app.alextran.immich.connectivity.ConnectivityApiImpl
+import app.alextran.immich.core.ImmichPlugin
 import app.alextran.immich.images.ThumbnailApi
 import app.alextran.immich.images.ThumbnailsImpl
 import app.alextran.immich.sync.NativeSyncApi
@@ -42,6 +43,14 @@ class MainActivity : FlutterFragmentActivity() {
       flutterEngine.plugins.add(BackgroundServicePlugin())
       flutterEngine.plugins.add(HttpSSLOptionsPlugin())
       flutterEngine.plugins.add(backgroundEngineLockImpl)
+      flutterEngine.plugins.add(nativeSyncApiImpl)
+    }
+
+    fun cancelPlugins(flutterEngine: FlutterEngine) {
+      val nativeApi =
+        flutterEngine.plugins.get(NativeSyncApiImpl26::class.java) as ImmichPlugin?
+          ?: flutterEngine.plugins.get(NativeSyncApiImpl30::class.java) as ImmichPlugin?
+      nativeApi?.detachFromEngine()
     }
   }
 }

mobile/android/app/src/main/kotlin/app/alextran/immich/background/BackgroundEngineLock.kt

@@ -2,12 +2,13 @@ package app.alextran.immich.background
 
 import android.content.Context
 import android.util.Log
+import app.alextran.immich.core.ImmichPlugin
 import io.flutter.embedding.engine.plugins.FlutterPlugin
 import java.util.concurrent.atomic.AtomicInteger
 
 private const val TAG = "BackgroundEngineLock"
 
-class BackgroundEngineLock(context: Context) : BackgroundWorkerLockApi, FlutterPlugin {
+class BackgroundEngineLock(context: Context) : BackgroundWorkerLockApi, ImmichPlugin() {
   private val ctx: Context = context.applicationContext
 
   companion object {
@@ -41,12 +42,14 @@ class BackgroundEngineLock(context: Context) : BackgroundWorkerLockApi, FlutterP
   }
 
   override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    super.onAttachedToEngine(binding)
     checkAndEnforceBackgroundLock(binding.applicationContext)
     engineCount.incrementAndGet()
     Log.i(TAG, "Flutter engine attached. Attached Engines count: $engineCount")
   }
 
   override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    super.onDetachedFromEngine(binding)
     engineCount.decrementAndGet()
     Log.i(TAG, "Flutter engine detached. Attached Engines count: $engineCount")
   }

mobile/android/app/src/main/kotlin/app/alextran/immich/background/BackgroundWorker.g.kt

@@ -1,4 +1,4 @@
-// Autogenerated from Pigeon (v26.0.0), do not edit directly.
+// Autogenerated from Pigeon (v26.0.2), do not edit directly.
 // See also: https://pub.dev/packages/pigeon
 @file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
 

mobile/android/app/src/main/kotlin/app/alextran/immich/background/BackgroundWorker.kt

@@ -190,6 +190,9 @@ class BackgroundWorker(context: Context, params: WorkerParameters) :
   private fun complete(success: Result) {
     Log.d(TAG, "About to complete BackupWorker with result: $success")
     isComplete = true
+    if (engine != null) {
+      MainActivity.cancelPlugins(engine!!)
+    }
     engine?.destroy()
     engine = null
     flutterApi = null

mobile/android/app/src/main/kotlin/app/alextran/immich/background/BackgroundWorkerLock.g.kt

@@ -1,4 +1,4 @@
-// Autogenerated from Pigeon (v26.0.0), do not edit directly.
+// Autogenerated from Pigeon (v26.0.2), do not edit directly.
 // See also: https://pub.dev/packages/pigeon
 @file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
 

mobile/android/app/src/main/kotlin/app/alextran/immich/connectivity/Connectivity.g.kt

@@ -1,4 +1,4 @@
-// Autogenerated from Pigeon (v26.0.0), do not edit directly.
+// Autogenerated from Pigeon (v26.0.2), do not edit directly.
 // See also: https://pub.dev/packages/pigeon
 @file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
 

mobile/android/app/src/main/kotlin/app/alextran/immich/core/ImmichPlugin.kt

@@ -0,0 +1,29 @@
+package app.alextran.immich.core
+
+import androidx.annotation.CallSuper
+import io.flutter.embedding.engine.plugins.FlutterPlugin
+
+abstract class ImmichPlugin : FlutterPlugin {
+  private var detached: Boolean = false;
+
+  @CallSuper
+  override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    detached = false;
+  }
+
+  fun detachFromEngine() {
+    detached = true
+  }
+
+  @CallSuper
+  override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
+    detachFromEngine()
+  }
+
+  fun <T> completeWhenActive(callback: (T) -> Unit, value: T) {
+    if (detached) {
+      return;
+    }
+    callback(value);
+  }
+}

mobile/android/app/src/main/kotlin/app/alextran/immich/images/Thumbnails.g.kt

@@ -1,4 +1,4 @@
-// Autogenerated from Pigeon (v26.0.0), do not edit directly.
+// Autogenerated from Pigeon (v26.0.2), do not edit directly.
 // See also: https://pub.dev/packages/pigeon
 @file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
 

mobile/android/app/src/main/kotlin/app/alextran/immich/sync/Messages.g.kt

@@ -1,4 +1,4 @@
-// Autogenerated from Pigeon (v26.0.0), do not edit directly.
+// Autogenerated from Pigeon (v26.0.2), do not edit directly.
 // See also: https://pub.dev/packages/pigeon
 @file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
 

mobile/android/app/src/main/kotlin/app/alextran/immich/sync/MessagesImplBase.kt

@@ -7,6 +7,7 @@ import android.database.Cursor
 import android.provider.MediaStore
 import android.util.Base64
 import androidx.core.database.getStringOrNull
+import app.alextran.immich.core.ImmichPlugin
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
@@ -27,7 +28,7 @@ sealed class AssetResult {
 }
 
 @SuppressLint("InlinedApi")
-open class NativeSyncApiImplBase(context: Context) {
+open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
   private val ctx: Context = context.applicationContext
 
   private var hashTask: Job? = null
@@ -100,9 +101,15 @@ open class NativeSyncApiImplBase(context: Context) {
 
         while (c.moveToNext()) {
           val id = c.getLong(idColumn).toString()
+          val name = c.getStringOrNull(nameColumn)
+          val bucketId = c.getStringOrNull(bucketIdColumn)
+          val path = c.getStringOrNull(dataColumn)
 
-          val path = c.getString(dataColumn)
-          if (path.isNullOrBlank() || !File(path).exists()) {
+          // Skip assets with invalid metadata
+          if (
+            name.isNullOrBlank() || bucketId.isNullOrBlank() ||
+            path.isNullOrBlank() || !File(path).exists()
+          ) {
             yield(AssetResult.InvalidAsset(id))
             continue
           }
@@ -112,7 +119,6 @@ open class NativeSyncApiImplBase(context: Context) {
             MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO -> 2
             else -> 0
           }
-          val name = c.getString(nameColumn)
           // Date taken is milliseconds since epoch, Date added is seconds since epoch
           val createdAt = (c.getLong(dateTakenColumn).takeIf { it > 0 }?.div(1000))
             ?: c.getLong(dateAddedColumn)
@@ -123,7 +129,6 @@ open class NativeSyncApiImplBase(context: Context) {
           // Duration is milliseconds
           val duration = if (mediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE) 0
           else c.getLong(durationColumn) / 1000
-          val bucketId = c.getString(bucketIdColumn)
           val orientation = c.getInt(orientationColumn)
           val isFavorite = if (favoriteColumn == -1) false else c.getInt(favoriteColumn) != 0
 
@@ -237,7 +242,7 @@ open class NativeSyncApiImplBase(context: Context) {
     callback: (Result<List<HashResult>>) -> Unit
   ) {
     if (assetIds.isEmpty()) {
-      callback(Result.success(emptyList()))
+      completeWhenActive(callback, Result.success(emptyList()))
       return
     }
 
@@ -253,10 +258,10 @@ open class NativeSyncApiImplBase(context: Context) {
           }
         }.awaitAll()
 
-        callback(Result.success(results))
+        completeWhenActive(callback, Result.success(results))
       } catch (e: CancellationException) {
-        callback(
-          Result.failure(
+        completeWhenActive(
+          callback, Result.failure(
             FlutterError(
               HASHING_CANCELLED_CODE,
               "Hashing operation was cancelled",
@@ -265,7 +270,7 @@ open class NativeSyncApiImplBase(context: Context) {
           )
         )
       } catch (e: Exception) {
-        callback(Result.failure(e))
+        completeWhenActive(callback, Result.failure(e))
       }
     }
   }

mobile/ios/.gitignore

@@ -33,3 +33,4 @@ Runner/GeneratedPluginRegistrant.*
 !default.perspectivev3
 
 fastlane/report.xml
+Gemfile.lock

mobile/ios/Gemfile

@@ -1,3 +1,4 @@
 source "https://rubygems.org"
 
 gem "fastlane"
+gem "cocoapods"

mobile/ios/Gemfile.lock

@@ -1,218 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    CFPropertyList (3.0.7)
-      base64
-      nkf
-      rexml
-    addressable (2.8.6)
-      public_suffix (>= 2.0.2, < 6.0)
-    artifactory (3.0.17)
-    atomos (0.1.3)
-    aws-eventstream (1.3.0)
-    aws-partitions (1.932.0)
-    aws-sdk-core (3.196.1)
-      aws-eventstream (~> 1, >= 1.3.0)
-      aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.8)
-      jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.81.0)
-      aws-sdk-core (~> 3, >= 3.193.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.151.0)
-      aws-sdk-core (~> 3, >= 3.194.0)
-      aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.8)
-    aws-sigv4 (1.8.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-    babosa (1.0.4)
-    base64 (0.2.0)
-    claide (1.1.0)
-    colored (1.2)
-    colored2 (3.1.2)
-    commander (4.6.0)
-      highline (~> 2.0.0)
-    declarative (0.0.20)
-    digest-crc (0.6.5)
-      rake (>= 12.0.0, < 14.0.0)
-    domain_name (0.6.20240107)
-    dotenv (2.8.1)
-    emoji_regex (3.2.3)
-    excon (0.110.0)
-    faraday (1.10.3)
-      faraday-em_http (~> 1.0)
-      faraday-em_synchrony (~> 1.0)
-      faraday-excon (~> 1.1)
-      faraday-httpclient (~> 1.0)
-      faraday-multipart (~> 1.0)
-      faraday-net_http (~> 1.0)
-      faraday-net_http_persistent (~> 1.0)
-      faraday-patron (~> 1.0)
-      faraday-rack (~> 1.0)
-      faraday-retry (~> 1.0)
-      ruby2_keywords (>= 0.0.4)
-    faraday-cookie_jar (0.0.7)
-      faraday (>= 0.8.0)
-      http-cookie (~> 1.0.0)
-    faraday-em_http (1.0.0)
-    faraday-em_synchrony (1.0.0)
-    faraday-excon (1.1.0)
-    faraday-httpclient (1.0.1)
-    faraday-multipart (1.0.4)
-      multipart-post (~> 2)
-    faraday-net_http (1.0.1)
-    faraday-net_http_persistent (1.2.0)
-    faraday-patron (1.0.0)
-    faraday-rack (1.0.0)
-    faraday-retry (1.0.3)
-    faraday_middleware (1.2.0)
-      faraday (~> 1.0)
-    fastimage (2.3.1)
-    fastlane (2.214.0)
-      CFPropertyList (>= 2.3, < 4.0.0)
-      addressable (>= 2.8, < 3.0.0)
-      artifactory (~> 3.0)
-      aws-sdk-s3 (~> 1.0)
-      babosa (>= 1.0.3, < 2.0.0)
-      bundler (>= 1.12.0, < 3.0.0)
-      colored
-      commander (~> 4.6)
-      dotenv (>= 2.1.1, < 3.0.0)
-      emoji_regex (>= 0.1, < 4.0)
-      excon (>= 0.71.0, < 1.0.0)
-      faraday (~> 1.0)
-      faraday-cookie_jar (~> 0.0.6)
-      faraday_middleware (~> 1.0)
-      fastimage (>= 2.1.0, < 3.0.0)
-      gh_inspector (>= 1.1.2, < 2.0.0)
-      google-apis-androidpublisher_v3 (~> 0.3)
-      google-apis-playcustomapp_v1 (~> 0.1)
-      google-cloud-storage (~> 1.31)
-      highline (~> 2.0)
-      json (< 3.0.0)
-      jwt (>= 2.1.0, < 3)
-      mini_magick (>= 4.9.4, < 5.0.0)
-      multipart-post (>= 2.0.0, < 3.0.0)
-      naturally (~> 2.2)
-      optparse (~> 0.1.1)
-      plist (>= 3.1.0, < 4.0.0)
-      rubyzip (>= 2.0.0, < 3.0.0)
-      security (= 0.1.3)
-      simctl (~> 1.6.3)
-      terminal-notifier (>= 2.0.0, < 3.0.0)
-      terminal-table (>= 1.4.5, < 2.0.0)
-      tty-screen (>= 0.6.3, < 1.0.0)
-      tty-spinner (>= 0.8.0, < 1.0.0)
-      word_wrap (~> 1.0.0)
-      xcodeproj (>= 1.13.0, < 2.0.0)
-      xcpretty (~> 0.3.0)
-      xcpretty-travis-formatter (>= 0.0.3)
-    gh_inspector (1.1.3)
-    google-apis-androidpublisher_v3 (0.54.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-core (0.11.3)
-      addressable (~> 2.5, >= 2.5.1)
-      googleauth (>= 0.16.2, < 2.a)
-      httpclient (>= 2.8.1, < 3.a)
-      mini_mime (~> 1.0)
-      representable (~> 3.0)
-      retriable (>= 2.0, < 4.a)
-      rexml
-    google-apis-iamcredentials_v1 (0.17.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-playcustomapp_v1 (0.13.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-apis-storage_v1 (0.31.0)
-      google-apis-core (>= 0.11.0, < 2.a)
-    google-cloud-core (1.7.0)
-      google-cloud-env (>= 1.0, < 3.a)
-      google-cloud-errors (~> 1.0)
-    google-cloud-env (1.6.0)
-      faraday (>= 0.17.3, < 3.0)
-    google-cloud-errors (1.4.0)
-    google-cloud-storage (1.47.0)
-      addressable (~> 2.8)
-      digest-crc (~> 0.4)
-      google-apis-iamcredentials_v1 (~> 0.1)
-      google-apis-storage_v1 (~> 0.31.0)
-      google-cloud-core (~> 1.6)
-      googleauth (>= 0.16.2, < 2.a)
-      mini_mime (~> 1.0)
-    googleauth (1.8.1)
-      faraday (>= 0.17.3, < 3.a)
-      jwt (>= 1.4, < 3.0)
-      multi_json (~> 1.11)
-      os (>= 0.9, < 2.0)
-      signet (>= 0.16, < 2.a)
-    highline (2.0.3)
-    http-cookie (1.0.5)
-      domain_name (~> 0.5)
-    httpclient (2.8.3)
-    jmespath (1.6.2)
-    json (2.7.2)
-    jwt (2.8.1)
-      base64
-    mini_magick (4.12.0)
-    mini_mime (1.1.5)
-    multi_json (1.15.0)
-    multipart-post (2.4.1)
-    nanaimo (0.3.0)
-    naturally (2.2.1)
-    nkf (0.2.0)
-    optparse (0.1.1)
-    os (1.1.4)
-    plist (3.7.1)
-    public_suffix (4.0.7)
-    rake (13.2.1)
-    representable (3.2.0)
-      declarative (< 0.1.0)
-      trailblazer-option (>= 0.1.1, < 0.2.0)
-      uber (< 0.2.0)
-    retriable (3.1.2)
-    rexml (3.3.6)
-      strscan
-    rouge (2.0.7)
-    ruby2_keywords (0.0.5)
-    rubyzip (2.3.2)
-    security (0.1.3)
-    signet (0.19.0)
-      addressable (~> 2.8)
-      faraday (>= 0.17.5, < 3.a)
-      jwt (>= 1.5, < 3.0)
-      multi_json (~> 1.10)
-    simctl (1.6.10)
-      CFPropertyList
-      naturally
-    strscan (3.1.0)
-    terminal-notifier (2.0.0)
-    terminal-table (1.8.0)
-      unicode-display_width (~> 1.1, >= 1.1.1)
-    trailblazer-option (0.1.2)
-    tty-cursor (0.7.1)
-    tty-screen (0.8.2)
-    tty-spinner (0.9.3)
-      tty-cursor (~> 0.7)
-    uber (0.1.0)
-    unicode-display_width (1.8.0)
-    word_wrap (1.0.0)
-    xcodeproj (1.25.0)
-      CFPropertyList (>= 2.3.3, < 4.0)
-      atomos (~> 0.1.3)
-      claide (>= 1.0.2, < 2.0)
-      colored2 (~> 3.1)
-      nanaimo (~> 0.3.0)
-      rexml (>= 3.3.2, < 4.0)
-    xcpretty (0.3.0)
-      rouge (~> 2.0.7)
-    xcpretty-travis-formatter (1.0.1)
-      xcpretty (~> 0.2, >= 0.0.7)
-
-PLATFORMS
-  x86_64-darwin-21
-  x86_64-linux
-
-DEPENDENCIES
-  fastlane
-
-BUNDLED WITH
-   2.3.7

mobile/ios/Podfile.lock

@@ -84,7 +84,7 @@ PODS:
     - FlutterMacOS
   - permission_handler_apple (9.3.0):
     - Flutter
-  - photo_manager (2.0.0):
+  - photo_manager (3.7.1):
     - Flutter
     - FlutterMacOS
   - SAMKeychain (1.5.3)
@@ -262,7 +262,7 @@ SPEC CHECKSUMS:
   fluttertoast: 2c67e14dce98bbdb200df9e1acf610d7a6264ea1
   geolocator_apple: 1560c3c875af2a412242c7a923e15d0d401966ff
   home_widget: f169fc41fd807b4d46ab6615dc44d62adbf9f64f
-  image_picker_ios: 7fe1ff8e34c1790d6fff70a32484959f563a928a
+  image_picker_ios: e0ece4aa2a75771a7de3fa735d26d90817041326
   integration_test: 4a889634ef21a45d28d50d622cf412dc6d9f586e
   isar_community_flutter_libs: bede843185a61a05ff364a05c9b23209523f7e0d
   local_auth_darwin: 553ce4f9b16d3fdfeafce9cf042e7c9f77c1c391
@@ -271,9 +271,9 @@ SPEC CHECKSUMS:
   native_video_player: b65c58951ede2f93d103a25366bdebca95081265
   network_info_plus: cf61925ab5205dce05a4f0895989afdb6aade5fc
   package_info_plus: af8e2ca6888548050f16fa2f1938db7b5a5df499
-  path_provider_foundation: 080d55be775b7414fd5a5ef3ac137b97b097e564
+  path_provider_foundation: bb55f6dbba17d0dccd6737fe6f7f34fbd0376880
   permission_handler_apple: 4ed2196e43d0651e8ff7ca3483a069d469701f2d
-  photo_manager: d2fbcc0f2d82458700ee6256a15018210a81d413
+  photo_manager: 1d80ae07a89a67dfbcae95953a1e5a24af7c3e62
   SAMKeychain: 483e1c9f32984d50ca961e26818a534283b4cd5c
   SDWebImage: f84b0feeb08d2d11e6a9b843cb06d75ebf5b8868
   share_handler_ios: e2244e990f826b2c8eaa291ac3831569438ba0fb
@@ -285,7 +285,7 @@ SPEC CHECKSUMS:
   sqlite3_flutter_libs: f8fc13346870e73fe35ebf6dbb997fbcd156b241
   SwiftyGif: 706c60cf65fa2bc5ee0313beece843c8eb8194d4
   url_launcher_ios: 694010445543906933d732453a59da0a173ae33d
-  wakelock_plus: 04623e3f525556020ebd4034310f20fe7fda8b49
+  wakelock_plus: e29112ab3ef0b318e58cfa5c32326458be66b556
 
 PODFILE CHECKSUM: 7ce312f2beab01395db96f6969d90a447279cf45
 

mobile/ios/Runner.xcodeproj/project.pbxproj

@@ -133,11 +133,15 @@
 /* Begin PBXFileSystemSynchronizedRootGroup section */
 		B231F52D2E93A44A00BC45D1 /* Core */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+			);
 			path = Core;
 			sourceTree = "<group>";
 		};
 		B2CF7F8C2DDE4EBB00744BF6 /* Sync */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
+			exceptions = (
+			);
 			path = Sync;
 			sourceTree = "<group>";
 		};
@@ -526,14 +530,10 @@
 			inputFileListPaths = (
 				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-resources-${CONFIGURATION}-input-files.xcfilelist",
 			);
-			inputPaths = (
-			);
 			name = "[CP] Copy Pods Resources";
 			outputFileListPaths = (
 				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-resources-${CONFIGURATION}-output-files.xcfilelist",
 			);
-			outputPaths = (
-			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
 			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-resources.sh\"\n";
@@ -562,14 +562,10 @@
 			inputFileListPaths = (
 				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks-${CONFIGURATION}-input-files.xcfilelist",
 			);
-			inputPaths = (
-			);
 			name = "[CP] Embed Pods Frameworks";
 			outputFileListPaths = (
 				"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks-${CONFIGURATION}-output-files.xcfilelist",
 			);
-			outputPaths = (
-			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
 			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-Runner/Pods-Runner-frameworks.sh\"\n";
@@ -718,7 +714,7 @@
 				CODE_SIGN_ENTITLEMENTS = Runner/RunnerProfile.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_BITCODE = NO;
@@ -862,7 +858,7 @@
 				CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_BITCODE = NO;
@@ -892,7 +888,7 @@
 				CODE_SIGN_ENTITLEMENTS = Runner/Runner.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_BITCODE = NO;
@@ -926,7 +922,7 @@
 				CODE_SIGN_ENTITLEMENTS = WidgetExtension/WidgetExtension.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
@@ -969,7 +965,7 @@
 				CODE_SIGN_ENTITLEMENTS = WidgetExtension/WidgetExtension.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
@@ -1009,7 +1005,7 @@
 				CODE_SIGN_ENTITLEMENTS = WidgetExtension/WidgetExtension.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
@@ -1048,7 +1044,7 @@
 				CODE_SIGN_ENTITLEMENTS = ShareExtension/ShareExtension.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -1092,7 +1088,7 @@
 				CODE_SIGN_ENTITLEMENTS = ShareExtension/ShareExtension.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -1133,7 +1129,7 @@
 				CODE_SIGN_ENTITLEMENTS = ShareExtension/ShareExtension.entitlements;
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
-				CURRENT_PROJECT_VERSION = 230;
+				CURRENT_PROJECT_VERSION = 231;
 				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2F67MQ8R79;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;

mobile/ios/Runner/Background/BackgroundWorker.g.swift

@@ -1,4 +1,4 @@
-// Autogenerated from Pigeon (v26.0.0), do not edit directly.
+// Autogenerated from Pigeon (v26.0.2), do not edit directly.
 // See also: https://pub.dev/packages/pigeon
 
 import Foundation

mobile/ios/Runner/Connectivity/Connectivity.g.swift

@@ -1,4 +1,4 @@
-// Autogenerated from Pigeon (v26.0.0), do not edit directly.
+// Autogenerated from Pigeon (v26.0.2), do not edit directly.
 // See also: https://pub.dev/packages/pigeon
 
 import Foundation