Prepare local11 release and cover concurrent JPEG XL color transforms

fix: watch asset delete/archive in search (#31343 )
* fix: watch asset delete/archive in search * fix: restore via toast * chore: format * refactor: simplify search asset pruning * chore: implement suggestions * chore: more suggestions * fix: mounted check (cherry picked from commit f7b8ae5da370f947223b006618e5b4e5fb42fd33)
2026-10-26 22:38:18 +03:00 · 2026-10-26 22:35:01 +03:00 · 2026-10-26 22:34:24 +03:00 · 2026-10-26 22:34:24 +03:00 · 2026-10-25 16:24:17 +03:00 · 2026-10-25 16:23:45 +03:00
482 changed files with 13755 additions and 5011 deletions
@@ -9,6 +9,8 @@ body:
        Stick to only a single feature per request. If you list multiple different features at once, 
        your request will be closed.

+        Please read our [contributing guidelines](https://github.com/immich-app/immich/blob/main/CONTRIBUTING.md) before opening a feature request.
+
  - type: checkboxes
    attributes:
      label: I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.
@@ -1,6 +1,11 @@
 name: Report an issue with Immich
 description: Report an issue with Immich
 body:
+  - type: markdown
+    attributes:
+      value: |
+        Please read our [contributing guidelines](https://github.com/immich-app/immich/blob/main/CONTRIBUTING.md) before opening an issue.
+
  - type: checkboxes
    attributes:
      label: I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.
@@ -204,7 +204,7 @@ jobs:
      contents: read
    # Run on main branch or workflow_dispatch, or on PRs/other branches (build only, no upload)
    if: ${{ !github.event.pull_request.head.repo.fork && fromJSON(needs.pre-job.outputs.should_run).mobile == true }}
-    runs-on: macos-26
+    runs-on: xcode-27

    steps:
      - id: token
@@ -214,8 +214,8 @@ jobs:
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
          permission-contents: read

-      - name: Select Xcode 26
-        run: sudo xcode-select -s /Applications/Xcode_26.2.app/Contents/Developer
+      - name: Select Xcode 27.1
+        run: sudo xcode-select -s /Applications/Xcode_27.1.app/Contents/Developer

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -230,7 +230,7 @@ jobs:
          working_directory: ./mobile

      - name: Setup Ruby
-        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1.323.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
        with:
          ruby-version: '3.4'
          bundler-cache: true # zizmor: ignore[cache-poisoning] release branches cannot read caches written by pull requests
@@ -200,8 +200,9 @@ jobs:
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
        working-directory: 'deployment/modules/cloudflare/docs'
+        shell: bash
        run: |
-          mise run //deployment:tf output -- -json | jq -r '
+          mise run //deployment:tf output -json | jq -r '
            "projectName=\(.pages_project_name.value)",
            "subdomain=\(.immich_app_branch_subdomain.value)"
          ' >> $GITHUB_OUTPUT
@@ -43,7 +43,7 @@ jobs:
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          TF_STATE_POSTGRES_CONN_STR: ${{ secrets.TF_STATE_POSTGRES_CONN_STR }}
        working-directory: 'deployment/modules/cloudflare/docs'
-        run: 'mise run //deployment:tf destroy -- -refresh=false'
+        run: 'mise run //deployment:tf destroy -refresh=false'

      - name: Comment
        uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
@@ -115,7 +115,7 @@ jobs:
    steps:
      - name: Generate a token
        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
@@ -31,7 +31,7 @@ jobs:
      - name: Generate a token
        id: generate_token
        if: ${{ inputs.skip != true }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
@@ -22,3 +22,4 @@ jobs:
      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
        with:
          repo-token: ${{ steps.token.outputs.token }}
+          sync-labels: true
@@ -1 +1 @@
-24.21.0
+24.22.1
@@ -1,43 +1,33 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html

 [[tools.opentofu]]
-version = "1.12.6"
+version = "1.13.1"
 backend = "aqua:opentofu/opentofu"

 [tools.opentofu."platforms.linux-arm64"]
-checksum = "sha256:9bd0228a81bcd0c88f7045c74378f45a815779f19897191dff7d9efba9976b9e"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762688"
-
-[tools.opentofu."platforms.linux-arm64-musl"]
-checksum = "sha256:9bd0228a81bcd0c88f7045c74378f45a815779f19897191dff7d9efba9976b9e"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762688"
+checksum = "sha256:9c1ef375aa1852db0b2888aa921b640c71f8140d4682aa4fec99378a64fa7dc3"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708055"

 [tools.opentofu."platforms.linux-x64"]
-checksum = "sha256:50a6106fa4de523d09c87af85f3db1dd47535fc005727fdca6852146476b88ec"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762723"
-
-[tools.opentofu."platforms.linux-x64-musl"]
-checksum = "sha256:50a6106fa4de523d09c87af85f3db1dd47535fc005727fdca6852146476b88ec"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762723"
+checksum = "sha256:378ada19d4bc70c43732004e8159be771b23b9a5afdf059e5f8a2b3fa2c70a69"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708017"

 [tools.opentofu."platforms.macos-arm64"]
-checksum = "sha256:f958ec5e511063be9feb180ca015a4cb7977566a9cf6a8550bba8c2a9b5aba74"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_darwin_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762710"
+checksum = "sha256:be78f659f04ef06a9dbd9b3934d46af95d787a3aa38396d459dea395261816a9"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_darwin_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708059"

 [tools.opentofu."platforms.macos-x64"]
-checksum = "sha256:44bb1855f372f17f365fb94517906e78da5001da10f4c98de57a39bf982f3a92"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_darwin_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762655"
+checksum = "sha256:a73720443ba38712d7d96dc1e857add02c15a790919c653ad07492e9952f8c27"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_darwin_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708142"

 [tools.opentofu."platforms.windows-x64"]
-checksum = "sha256:bcbcd9ca744af6c4053e2d5e75dae79ff33ad7dc38d45e1233e693d096284538"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_windows_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762708"
+checksum = "sha256:6825ae311e9a15747ce2ede7b7e97c8bb744a4d271fa8113259eeeee3d09438c"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_windows_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708102"

 [[tools.terragrunt]]
 version = "1.0.3"
@@ -1,13 +1,13 @@
 [tools]
 terragrunt = "1.1.1"
-opentofu = "1.12.6"
+opentofu = "1.13.1"

 [tasks."tg:fmt"]
 run = "terragrunt hclfmt"
 description = "Format terragrunt files"

 [tasks.tf]
-run = "terragrunt run --all"
+run = "terragrunt run --all --"
 description = "Wrapper for terragrunt run-all"
 dir = "{{cwd}}"

@@ -16,5 +16,5 @@ run = "tofu fmt -recursive tf/"
 description = "Format terraform files"

 [tasks."tf:init"]
-run = { task = "tf init -- -reconfigure" }
+run = { task = "tf init -reconfigure" }
 dir = "{{cwd}}"
@@ -97,7 +97,7 @@ services:
    command: ['./run.sh', '-disable-reporting']
    ports:
      - 3000:3000
-    image: grafana/grafana:12.4.11-ubuntu@sha256:23f2328b859c7677c7065c81b479600706ef9cc9004977af5bbd68b159b8ea60
+    image: grafana/grafana:13.2.4-ubuntu@sha256:d838696907b4350d9232eb8da1503dc1d1010a0359d3ce4b3f7d2ff7db28eb75
    volumes:
      - grafana-data:/var/lib/grafana

@@ -209,6 +209,11 @@ The default configuration looks like this:
    "timeout": 30000,
    "tokenEndpointAuthMethod": "client_secret_post"
  },
+  "passkey": {
+    "enabled": true,
+    "domain": null,
+    "additionalDomains": []
+  },
  "passwordLogin": {
    "enabled": true
  },
@@ -1,7 +1,7 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html

 [[tools.wrangler]]
-version = "4.137.0"
+version = "4.151.0"
 backend = "npm:wrangler"

 [tools.wrangler.options]
@@ -28,4 +28,4 @@ run = "prettier --write ."
 run = "wrangler pages deploy build --project-name=${PROJECT_NAME} --branch=${BRANCH_NAME}"

 [tools]
-wrangler = "4.137.0"
+wrangler = "4.151.0"
@@ -41,7 +41,7 @@
    "eslint-config-prettier": "^10.1.8",
    "eslint-plugin-prettier": "^5.1.3",
    "eslint-plugin-unicorn": "^75.0.0",
-    "exiftool-vendored": "^35.0.0",
+    "exiftool-vendored": "^39.0.0",
    "globals": "^17.0.0",
    "luxon": "^3.4.4",
    "pg": "^8.11.3",
@@ -55,6 +55,6 @@
    "typescript": "npm:@typescript/typescript6@^6.0.2",
    "typescript-eslint": "^8.28.0",
    "utimes": "^5.2.1",
-    "vitest": "^4.0.0"
+    "vitest": "^5.0.0"
  }
 }
@@ -91,7 +91,7 @@ describe('/admin/database-backups', () => {

  // => action: restore database flow

-  describe.sequential('POST /start-restore', () => {
+  describe('POST /start-restore', { concurrent: false }, () => {
    afterAll(async () => {
      await request(app).post('/admin/maintenance').set('cookie', cookie!).send({ action: 'end' });
      await utils.poll(
@@ -104,14 +104,14 @@ describe('/admin/database-backups', () => {
      });
    });

-    it.sequential('should not work when the server is configured', async () => {
+    it('should not work when the server is configured', { concurrent: false }, async () => {
      const { status, body } = await request(app).post('/admin/database-backups/start-restore').send();

      expect(status).toBe(400);
      expect(body).toEqual(errorDto.badRequest('Admin setup is not available'));
    });

-    it.sequential('should enter maintenance mode in "database restore mode"', async () => {
+    it('should enter maintenance mode in "database restore mode"', { concurrent: false }, async () => {
      await utils.resetDatabase(); // reset database before running this test

      const { status, headers } = await request(app).post('/admin/database-backups/start-restore').send();
@@ -145,7 +145,7 @@ describe('/admin/database-backups', () => {

  // => action: restore database

-  describe.sequential('POST /backups/restore', () => {
+  describe('POST /backups/restore', { concurrent: false }, () => {
    beforeAll(async () => {
      await utils.disconnectDatabase();
    });
@@ -154,7 +154,7 @@ describe('/admin/database-backups', () => {
      await utils.connectDatabase();
    });

-    it.sequential('should restore a backup', { timeout: 60_000 }, async () => {
+    it('should restore a backup', { timeout: 60_000, concurrent: false }, async () => {
      let filename = await utils.createBackup(admin.accessToken);

      // work-around until test is running on released version
@@ -212,7 +212,7 @@ describe('/admin/database-backups', () => {
        .toBeFalsy();
    });

-    it.sequential('fail to restore a corrupted backup', { timeout: 60_000 }, async () => {
+    it('fail to restore a corrupted backup', { timeout: 60_000, concurrent: false }, async () => {
      await utils.prepareTestBackup('corrupted');

      const { status, headers } = await request(app)
@@ -283,7 +283,7 @@ describe('/admin/database-backups', () => {
      );
    });

-    it.sequential('rollback to restore point if backup is missing admin', { timeout: 60_000 }, async () => {
+    it('rollback to restore point if backup is missing admin', { timeout: 60_000, concurrent: false }, async () => {
      await utils.prepareTestBackup('empty');

      const { status, headers } = await request(app)
@@ -45,7 +45,7 @@ describe('/admin/maintenance', () => {

  // => enter maintenance mode

-  describe.sequential('POST /', () => {
+  describe('POST /', { concurrent: false }, () => {
    it('should be a no-op if try to exit maintenance mode', async () => {
      const { status } = await request(app)
        .post('/admin/maintenance')
@@ -87,7 +87,7 @@ describe('/admin/maintenance', () => {

  // => in maintenance mode

-  describe.sequential('in maintenance mode', () => {
+  describe('in maintenance mode', { concurrent: false }, () => {
    describe('GET ~/server/config', async () => {
      it('should indicate we are in maintenance mode', async () => {
        const { status, body } = await request(app).get('/server/config');
@@ -152,7 +152,7 @@ describe('/admin/maintenance', () => {

  // => exit maintenance mode

-  describe.sequential('POST /', () => {
+  describe('POST /', { concurrent: false }, () => {
    it('should exit maintenance mode', async () => {
      const { status } = await request(app).post('/admin/maintenance').set('cookie', cookie!).send({
        action: 'end',
@@ -96,7 +96,7 @@ describe('/admin/integrity', () => {
  });

  describe('POST /summary (& jobs)', async () => {
-    it.sequential('reports no issues', async () => {
+    it('reports no issues', { concurrent: false }, async () => {
      await utils.createJob(admin.accessToken, {
        name: ManualJobName.IntegrityUntrackedFiles,
      });
@@ -130,7 +130,7 @@ describe('/admin/integrity', () => {
      });
    });

-    it.sequential('should detect an untracked file (job: check untracked files)', async () => {
+    it('should detect an untracked file (job: check untracked files)', { concurrent: false }, async () => {
      await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked1.png`);

      await utils.createJob(admin.accessToken, {
@@ -152,31 +152,35 @@ describe('/admin/integrity', () => {
      );
    });

-    it.sequential('should detect outdated untracked file reports (job: refresh untracked files)', async () => {
-      // these should not be detected:
-      await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked2.png`);
-      await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked3.png`);
+    it(
+      'should detect outdated untracked file reports (job: refresh untracked files)',
+      { concurrent: false },
+      async () => {
+        // these should not be detected:
+        await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked2.png`);
+        await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked3.png`);

-      await utils.createJob(admin.accessToken, {
-        name: ManualJobName.IntegrityUntrackedFilesRefresh,
-      });
+        await utils.createJob(admin.accessToken, {
+          name: ManualJobName.IntegrityUntrackedFilesRefresh,
+        });

-      await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);
+        await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);

-      const { status, body } = await request(app)
-        .get('/admin/integrity/summary')
-        .set('Authorization', `Bearer ${admin.accessToken}`)
-        .send();
+        const { status, body } = await request(app)
+          .get('/admin/integrity/summary')
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send();

-      expect(status).toBe(200);
-      expect(body).toEqual(
-        expect.objectContaining({
-          untracked_file: 0,
-        }),
-      );
-    });
+        expect(status).toBe(200);
+        expect(body).toEqual(
+          expect.objectContaining({
+            untracked_file: 0,
+          }),
+        );
+      },
+    );

-    it.sequential('should delete untracked files (job: delete all untracked file reports)', async () => {
+    it('should delete untracked files (job: delete all untracked file reports)', { concurrent: false }, async () => {
      await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked1.png`);

      await utils.createJob(admin.accessToken, {
@@ -204,30 +208,34 @@ describe('/admin/integrity', () => {
      );
    });

-    it.sequential('should detect a missing file and not a checksum mismatch (job: check missing files)', async () => {
-      await utils.deleteFolder(`/data/upload/${admin.userId}`);
+    it(
+      'should detect a missing file and not a checksum mismatch (job: check missing files)',
+      { concurrent: false },
+      async () => {
+        await utils.deleteFolder(`/data/upload/${admin.userId}`);

-      await utils.createJob(admin.accessToken, {
-        name: ManualJobName.IntegrityMissingFiles,
-      });
+        await utils.createJob(admin.accessToken, {
+          name: ManualJobName.IntegrityMissingFiles,
+        });

-      await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);
+        await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);

-      const { status, body } = await request(app)
-        .get('/admin/integrity/summary')
-        .set('Authorization', `Bearer ${admin.accessToken}`)
-        .send();
+        const { status, body } = await request(app)
+          .get('/admin/integrity/summary')
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send();

-      expect(status).toBe(200);
-      expect(body).toEqual(
-        expect.objectContaining({
-          missing_file: 1,
-          checksum_mismatch: 0,
-        }),
-      );
-    });
+        expect(status).toBe(200);
+        expect(body).toEqual(
+          expect.objectContaining({
+            missing_file: 1,
+            checksum_mismatch: 0,
+          }),
+        );
+      },
+    );

-    it.sequential('should detect outdated missing file reports (job: refresh missing files)', async () => {
+    it('should detect outdated missing file reports (job: refresh missing files)', { concurrent: false }, async () => {
      await utils.createJob(admin.accessToken, {
        name: ManualJobName.IntegrityMissingFilesRefresh,
      });
@@ -248,53 +256,57 @@ describe('/admin/integrity', () => {
      );
    });

-    it.sequential('should delete assets with missing files (job: delete all missing file reports)', async () => {
-      await utils.deleteFolder(`/data/upload/${user1.userId}`);
+    it(
+      'should delete assets with missing files (job: delete all missing file reports)',
+      { concurrent: false },
+      async () => {
+        await utils.deleteFolder(`/data/upload/${user1.userId}`);

-      await utils.createJob(admin.accessToken, {
-        name: ManualJobName.IntegrityMissingFiles,
-      });
+        await utils.createJob(admin.accessToken, {
+          name: ManualJobName.IntegrityMissingFiles,
+        });

-      await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);
+        await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);

-      const { status: listStatus, body: listBody } = await request(app)
-        .get('/admin/integrity/summary')
-        .set('Authorization', `Bearer ${admin.accessToken}`)
-        .send();
+        const { status: listStatus, body: listBody } = await request(app)
+          .get('/admin/integrity/summary')
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send();

-      expect(listStatus).toBe(200);
-      expect(listBody).toEqual(
-        expect.objectContaining({
-          missing_file: 1,
-        }),
-      );
+        expect(listStatus).toBe(200);
+        expect(listBody).toEqual(
+          expect.objectContaining({
+            missing_file: 1,
+          }),
+        );

-      await utils.createJob(admin.accessToken, {
-        name: ManualJobName.IntegrityMissingFilesDeleteAll,
-      });
+        await utils.createJob(admin.accessToken, {
+          name: ManualJobName.IntegrityMissingFilesDeleteAll,
+        });

-      await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);
+        await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);

-      const { status, body } = await request(app)
-        .get('/admin/integrity/summary')
-        .set('Authorization', `Bearer ${admin.accessToken}`)
-        .send();
+        const { status, body } = await request(app)
+          .get('/admin/integrity/summary')
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send();

-      expect(status).toBe(200);
-      expect(body).toEqual(
-        expect.objectContaining({
-          missing_file: 0,
-        }),
-      );
+        expect(status).toBe(200);
+        expect(body).toEqual(
+          expect.objectContaining({
+            missing_file: 0,
+          }),
+        );

-      await expect(utils.getAssetInfo(user1.accessToken, asset1.id)).resolves.toEqual(
-        expect.objectContaining({
-          isTrashed: true,
-        }),
-      );
-    });
+        await expect(utils.getAssetInfo(user1.accessToken, asset1.id)).resolves.toEqual(
+          expect.objectContaining({
+            isTrashed: true,
+          }),
+        );
+      },
+    );

-    it.sequential('should detect a checksum mismatch (job: check file checksums)', async () => {
+    it('should detect a checksum mismatch (job: check file checksums)', { concurrent: false }, async () => {
      await utils.truncateFolder(`/data/upload/${admin.userId}`);

      await utils.createJob(admin.accessToken, {
@@ -316,28 +328,33 @@ describe('/admin/integrity', () => {
      );
    });

-    it.sequential('should detect outdated checksum mismatch reports (job: refresh file checksums)', async () => {
-      await utils.createJob(admin.accessToken, {
-        name: ManualJobName.IntegrityChecksumMismatchRefresh,
-      });
+    it(
+      'should detect outdated checksum mismatch reports (job: refresh file checksums)',
+      { concurrent: false },
+      async () => {
+        await utils.createJob(admin.accessToken, {
+          name: ManualJobName.IntegrityChecksumMismatchRefresh,
+        });

-      await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);
+        await utils.waitForQueueFinish(admin.accessToken, QueueName.IntegrityCheck);

-      const { status, body } = await request(app)
-        .get('/admin/integrity/summary')
-        .set('Authorization', `Bearer ${admin.accessToken}`)
-        .send();
+        const { status, body } = await request(app)
+          .get('/admin/integrity/summary')
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send();

-      expect(status).toBe(200);
-      expect(body).toEqual(
-        expect.objectContaining({
-          checksum_mismatch: 0,
-        }),
-      );
-    });
+        expect(status).toBe(200);
+        expect(body).toEqual(
+          expect.objectContaining({
+            checksum_mismatch: 0,
+          }),
+        );
+      },
+    );

-    it.sequential(
+    it(
      'should delete assets with mismatched checksum (job: delete all checksum mismatch reports)',
+      { concurrent: false },
      async () => {
        await utils.truncateFolder(`/data/upload/${user2.userId}`);

@@ -387,7 +404,7 @@ describe('/admin/integrity', () => {
  });

  describe('POST /report', async () => {
-    it.sequential('reports untracked files', async () => {
+    it('reports untracked files', { concurrent: false }, async () => {
      await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked1.png`);

      await utils.createJob(admin.accessToken, {
@@ -417,7 +434,7 @@ describe('/admin/integrity', () => {
      });
    });

-    it.sequential('reports missing files', async () => {
+    it('reports missing files', { concurrent: false }, async () => {
      await utils.deleteFolder(`/data/upload/${admin.userId}`);

      await utils.createJob(admin.accessToken, {
@@ -447,7 +464,7 @@ describe('/admin/integrity', () => {
      });
    });

-    it.sequential('reports checksum mismatched files', async () => {
+    it('reports checksum mismatched files', { concurrent: false }, async () => {
      await utils.truncateFolder(`/data/upload/${admin.userId}`);

      await utils.createJob(admin.accessToken, {
@@ -479,7 +496,7 @@ describe('/admin/integrity', () => {
  });

  describe('DELETE /report/:id', async () => {
-    it.sequential('delete untracked files', async () => {
+    it('delete untracked files', { concurrent: false }, async () => {
      await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked1.png`);

      await utils.createJob(admin.accessToken, {
@@ -529,7 +546,7 @@ describe('/admin/integrity', () => {
      );
    });

-    it.sequential('delete assets missing files', async () => {
+    it('delete assets missing files', { concurrent: false }, async () => {
      await utils.deleteFolder(`/data/upload/${admin.userId}`);

      await utils.createJob(admin.accessToken, {
@@ -570,7 +587,7 @@ describe('/admin/integrity', () => {
      expect(listBody2.items.length).toBe(0);
    });

-    it.sequential('delete assets with failing checksum', async () => {
+    it('delete assets with failing checksum', { concurrent: false }, async () => {
      await utils.truncateFolder(`/data/upload/${admin.userId}`);

      await utils.createJob(admin.accessToken, {
@@ -613,7 +630,7 @@ describe('/admin/integrity', () => {
  });

  describe('GET /report/:type/csv', () => {
-    it.sequential('exports untracked files as csv', async () => {
+    it('exports untracked files as csv', { concurrent: false }, async () => {
      await utils.putTextFile('untracked', `/data/upload/${admin.userId}/untracked1.png`);

      await utils.createJob(admin.accessToken, {
@@ -637,7 +654,7 @@ describe('/admin/integrity', () => {
  });

  describe('GET /report/:id/file', () => {
-    it.sequential('downloads untracked file', async () => {
+    it('downloads untracked file', { concurrent: false }, async () => {
      await utils.putTextFile('untracked-content', `/data/upload/${admin.userId}/untracked1.png`);

      await utils.createJob(admin.accessToken, {
@@ -384,6 +384,27 @@ describe('/search', () => {
      expect(status).toBe(200);
      expect(body.assets.items).toEqual([expect.objectContaining({ id: asset.id })]);
    });
+
+    it('should strip metadata for a shared link without metadata', async () => {
+      const asset = await utils.createAsset(admin.accessToken);
+      const album = await utils.createAlbum(admin.accessToken, { albumName: 'foo', assetIds: [asset.id] });
+      const sharedLink = await utils.createSharedLink(admin.accessToken, {
+        type: SharedLinkType.Album,
+        albumId: album.id,
+        showMetadata: false,
+      });
+
+      const { status, body } = await request(app)
+        .post(`/search/metadata?key=${sharedLink.key}`)
+        .send({ albumIds: [album.id], withExif: true });
+      expect(status).toBe(200);
+      expect(body.assets.items).toHaveLength(1);
+      expect(body.assets.items[0]).toEqual(expect.objectContaining({ id: asset.id, hasMetadata: false }));
+      expect(body.assets.items[0]).not.toHaveProperty('exifInfo');
+      expect(body.assets.items[0]).not.toHaveProperty('originalPath');
+      expect(body.assets.items[0]).not.toHaveProperty('originalFileName');
+      expect(body.assets.items[0]).not.toHaveProperty('ownerId');
+    });
  });

  describe('POST /search/random', () => {
@@ -546,7 +567,7 @@ describe('/search', () => {
        'New York',
        'Shanghai',
        'State of Berlin',
-        'St.-Petersburg',
+        'St. Petersburg',
        'Tbilisi',
        'Tokyo',
        'Virginia',
@@ -570,7 +591,7 @@ describe('/search', () => {
        'New York',
        'Shanghai',
        'State of Berlin',
-        'St.-Petersburg',
+        'St. Petersburg',
        'Tbilisi',
        'Tokyo',
        'Virginia',
@@ -206,6 +206,13 @@ describe('/shared-links', () => {
      );
    });

+    it('should not return album users', async () => {
+      const { status, body } = await request(app).get('/shared-links/me').query({ key: linkWithAlbum.key });
+
+      expect(status).toBe(200);
+      expect(body.album.albumUsers).toEqual([]);
+    });
+
    it('should return unauthorized for incorrect shared link', async () => {
      const { status, body } = await request(app)
        .get('/shared-links/me')
@@ -1,40 +0,0 @@
-import { LoginResponseDto, getMyUser, login } from '@immich/sdk';
-import { createUserDto } from 'src/fixtures.js';
-import { app, asBearerAuth, utils } from 'src/utils.js';
-import request from 'supertest';
-import { beforeAll, describe, expect, it } from 'vitest';
-
-describe('/users', () => {
-  let admin: LoginResponseDto;
-  let nonAdmin: LoginResponseDto;
-
-  beforeAll(async () => {
-    await utils.resetDatabase();
-    admin = await utils.adminSetup({ onboarding: false });
-    nonAdmin = await utils.userSetup(admin.accessToken, createUserDto.user2);
-  });
-
-  describe('PUT /users/me', () => {
-    /** @deprecated */
-    it('should allow a user to change their password (deprecated)', async () => {
-      const user = await getMyUser({ headers: asBearerAuth(nonAdmin.accessToken) });
-
-      expect(user.shouldChangePassword).toBe(true);
-
-      const { status, body } = await request(app)
-        .put(`/users/me`)
-        .send({ password: 'super-secret' })
-        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
-
-      expect(status).toBe(200);
-      expect(body).toMatchObject({
-        email: nonAdmin.userEmail,
-        shouldChangePassword: false,
-      });
-
-      const token = await login({ loginCredentialDto: { email: nonAdmin.userEmail, password: 'super-secret' } });
-
-      expect(token.accessToken).toBeDefined();
-    });
-  });
-});
@@ -27,8 +27,8 @@ test.describe('Registration', () => {
    await expect(page).toHaveTitle(/Login/);
    await page.goto('/auth/login?autoLaunch=0');
    await page.getByLabel('Email').fill('admin@immich.app');
-    await page.getByLabel('Password').fill('password');
-    await page.getByRole('button', { name: 'Login' }).click();
+    await page.getByLabel('Password', { exact: true }).fill('password');
+    await page.getByRole('button', { name: 'Login', exact: true }).click();

    // onboarding
    await expect(page).toHaveURL('/auth/onboarding');
@@ -66,11 +66,12 @@ test.describe('Registration', () => {
    await page.goto('/auth/login?autoLaunch=0');
    await page.getByLabel('Email').fill('user@immich.cloud');
    await page.getByLabel('Password').fill('password');
-    await page.getByRole('button', { name: 'Login' }).click();
+    await page.getByRole('button', { name: 'Login', exact: true }).click();

    // change password
    await expect(page.getByRole('heading')).toHaveText('Change Password');
    await expect(page).toHaveURL('/auth/change-password');
+    await page.getByLabel('Password', { exact: true }).fill('password');
    await page.getByLabel('New Password').fill('new-password');
    await page.getByLabel('Confirm Password').fill('new-password');
    await page.getByRole('button', { name: 'Change password' }).click();
@@ -79,7 +80,7 @@ test.describe('Registration', () => {
    await expect(page).toHaveURL('/auth/login?autoLaunch=0');
    await page.getByLabel('Email').fill('user@immich.cloud');
    await page.getByLabel('Password').fill('new-password');
-    await page.getByRole('button', { name: 'Login' }).click();
+    await page.getByRole('button', { name: 'Login', exact: true }).click();

    // onboarding
    await expect(page).toHaveURL('/auth/onboarding');
@@ -80,7 +80,7 @@ test.describe('Shared Links', () => {
    const input = page.getByPlaceholder('Password');
    await input.fill('test-password');
    await page.getByRole('button', { name: 'Show password' }).click();
-    // await page.getByText('test-password', { exact: true }).waitFor();
+    // await page.getByText('test-password').waitFor();
    await expect(input).toHaveAttribute('type', 'text');
  });

@@ -1,5 +1,6 @@
 import { BrowserContext } from '@playwright/test';
 import { playwrightHost } from 'src/../playwright.config.js';
+import { adminConfig, publicConfig, userConfig } from 'src/ui/mock-network/config-fixtures.js';

 export const setupBaseMockApiRoutes = async (context: BrowserContext, adminUserId: string) => {
  await context.addCookies([
@@ -113,6 +114,27 @@ export const setupBaseMockApiRoutes = async (context: BrowserContext, adminUserI
      },
    });
  });
+  await context.route('**/api/public/config', async (route) => {
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      json: publicConfig,
+    });
+  });
+  await context.route('**/api/config', async (route) => {
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      json: userConfig,
+    });
+  });
+  await context.route('**/api/admin/config', async (route) => {
+    return route.fulfill({
+      status: 200,
+      contentType: 'application/json',
+      json: adminConfig,
+    });
+  });
  await context.route('**/api/server/features', async (route) => {
    return route.fulfill({
      status: 200,
@@ -0,0 +1,171 @@
+export const publicConfig = {
+  ffmpeg: { realtime: { enabled: false } },
+  map: {
+    enabled: true,
+    lightStyle: 'https://tiles.immich.cloud/v1/style/light.json',
+    darkStyle: 'https://tiles.immich.cloud/v1/style/dark.json',
+  },
+  oauth: { autoLaunch: false, buttonText: 'Login with OAuth', enabled: false },
+  passkey: { enabled: true },
+  passwordLogin: { enabled: true },
+  server: { loginPageMessage: '' },
+};
+
+export const userConfig = {
+  ffmpeg: { realtime: { enabled: false, videoCodecs: ['h264', 'hevc'], resolutions: [480, 720, 1080] } },
+  machineLearning: {
+    enabled: false,
+    clip: { enabled: true },
+    duplicateDetection: { enabled: true },
+    facialRecognition: { enabled: true, minFaces: 3 },
+    ocr: { enabled: true },
+  },
+  map: {
+    enabled: true,
+    lightStyle: 'https://tiles.immich.cloud/v1/style/light.json',
+    darkStyle: 'https://tiles.immich.cloud/v1/style/dark.json',
+  },
+  reverseGeocoding: { enabled: true },
+  oauth: { autoLaunch: false, buttonText: 'Login with OAuth', enabled: false, accountManagementUrl: '' },
+  passkey: { enabled: true },
+  passwordLogin: { enabled: true },
+  image: { thumbnail: { size: 250 }, preview: { size: 1440 }, fullsize: { enabled: false } },
+  trash: { enabled: true, days: 30 },
+  notifications: { smtp: { enabled: false } },
+  server: { externalDomain: '', loginPageMessage: '', publicUsers: true },
+  user: { deleteDelay: 7 },
+};
+
+export const adminConfig = {
+  backup: { database: { enabled: true, cronExpression: '0 02 * * *', keepLastAmount: 14 } },
+  ffmpeg: {
+    crf: 23,
+    threads: 0,
+    preset: 'ultrafast',
+    targetVideoCodec: 'h264',
+    acceptedVideoCodecs: ['h264'],
+    targetAudioCodec: 'aac',
+    acceptedAudioCodecs: ['aac', 'mp3', 'opus'],
+    acceptedContainers: ['mov', 'ogg', 'webm'],
+    targetResolution: '720',
+    maxBitrate: '0',
+    bframes: -1,
+    refs: 0,
+    gopSize: 0,
+    temporalAQ: false,
+    cqMode: 'auto',
+    twoPass: false,
+    preferredHwDevice: 'auto',
+    transcode: 'required',
+    tonemap: 'hable',
+    accel: 'disabled',
+    accelDecode: true,
+    realtime: { enabled: false, videoCodecs: ['h264', 'hevc'], resolutions: [480, 720, 1080] },
+  },
+  integrityChecks: {
+    missingFiles: { enabled: true, cronExpression: '0 03 * * *' },
+    untrackedFiles: { enabled: true, cronExpression: '0 03 * * *' },
+    checksumFiles: { enabled: true, cronExpression: '0 03 * * *', timeLimit: 3_600_000, percentageLimit: 1 },
+  },
+  job: {
+    thumbnailGeneration: { concurrency: 3 },
+    metadataExtraction: { concurrency: 5 },
+    videoConversion: { concurrency: 1 },
+    faceDetection: { concurrency: 2 },
+    smartSearch: { concurrency: 2 },
+    backgroundTask: { concurrency: 5 },
+    migration: { concurrency: 5 },
+    search: { concurrency: 5 },
+    sidecar: { concurrency: 5 },
+    library: { concurrency: 5 },
+    notifications: { concurrency: 5 },
+    ocr: { concurrency: 1 },
+    workflow: { concurrency: 5 },
+    editor: { concurrency: 2 },
+    integrityCheck: { concurrency: 1 },
+  },
+  logging: { enabled: true, level: 'log' },
+  machineLearning: {
+    enabled: false,
+    urls: ['http://immich-machine-learning:3003'],
+    availabilityChecks: { enabled: true, timeout: 2000, interval: 30_000 },
+    clip: { enabled: true, modelName: 'ViT-B-32__openai' },
+    duplicateDetection: { enabled: true, maxDistance: 0.01 },
+    facialRecognition: { enabled: true, modelName: 'buffalo_l', minScore: 0.7, maxDistance: 0.5, minFaces: 3 },
+    ocr: {
+      enabled: true,
+      modelName: 'PP-OCRv5_mobile',
+      minDetectionScore: 0.5,
+      minRecognitionScore: 0.8,
+      maxResolution: 736,
+    },
+  },
+  map: {
+    enabled: true,
+    lightStyle: 'https://tiles.immich.cloud/v1/style/light.json',
+    darkStyle: 'https://tiles.immich.cloud/v1/style/dark.json',
+  },
+  reverseGeocoding: { enabled: true },
+  metadata: { faces: { import: false } },
+  oauth: {
+    autoLaunch: false,
+    autoRegister: true,
+    buttonText: 'Login with OAuth',
+    clientId: '',
+    clientSecret: '',
+    defaultStorageQuota: null,
+    enabled: false,
+    issuerUrl: '',
+    accountManagementUrl: '',
+    endSessionEndpoint: '',
+    mobileOverrideEnabled: false,
+    mobileRedirectUri: '',
+    prompt: '',
+    scope: 'openid email profile',
+    signingAlgorithm: 'RS256',
+    profileSigningAlgorithm: 'none',
+    storageLabelClaim: 'preferred_username',
+    storageQuotaClaim: 'immich_quota',
+    roleClaim: 'immich_role',
+    tokenEndpointAuthMethod: 'client_secret_post',
+    timeout: 30_000,
+    allowInsecureRequests: false,
+  },
+  passkey: { enabled: true, domain: null, additionalDomains: [] },
+  passwordLogin: { enabled: true },
+  storageTemplate: {
+    enabled: false,
+    hashVerificationEnabled: true,
+    template: '{{y}}/{{y}}-{{MM}}-{{dd}}/{{filename}}',
+  },
+  image: {
+    thumbnail: { format: 'webp', size: 250, quality: 80, progressive: false },
+    preview: { format: 'jpeg', size: 1440, quality: 80, progressive: false },
+    colorspace: 'p3',
+    extractEmbedded: false,
+    fullsize: { enabled: false, format: 'jpeg', quality: 80, progressive: false },
+  },
+  newVersionCheck: { enabled: true, channel: 'stable' },
+  nightlyTasks: {
+    startTime: '00:00',
+    databaseCleanup: true,
+    generateMemories: true,
+    syncQuotaUsage: true,
+    missingThumbnails: true,
+    clusterNewFaces: true,
+  },
+  trash: { enabled: true, days: 30 },
+  theme: { customCss: '' },
+  library: { scan: { enabled: true, cronExpression: '0 0 * * *' }, watch: { enabled: false } },
+  server: { externalDomain: '', loginPageMessage: '', publicUsers: true },
+  notifications: {
+    smtp: {
+      enabled: false,
+      from: '',
+      replyTo: '',
+      transport: { ignoreCert: false, host: '', port: 587, secure: false, username: '', password: '' },
+    },
+  },
+  templates: { email: { welcomeTemplate: '', albumInviteTemplate: '', albumUpdateTemplate: '' } },
+  user: { deleteDelay: 7 },
+};
@@ -494,7 +494,7 @@ test.describe('Timeline', () => {
        force: false,
        ids: [assetToTrash.id],
      });
-      await page.getByText('Trash', { exact: true }).click();
+      await page.getByRole('link', { name: 'Trash' }).click();
      await thumbnailUtils.expectInViewport(page, assetToTrash.id);
      await thumbnailUtils.withAssetId(page, assetToTrash.id).hover();
      await thumbnailUtils.selectButton(page, assetToTrash.id).click();
@@ -507,12 +507,12 @@ test.describe('Timeline', () => {
          json: { count: requestJson.ids.length },
        });
      });
-      await page.getByText('Restore', { exact: true }).click();
+      await page.getByText('Restore').click();
      await expect(restoreRequest).resolves.toEqual({
        ids: [assetToTrash.id],
      });
      await expect(thumbnailUtils.withAssetId(page, assetToTrash.id)).toHaveCount(0);
-      await page.getByText('Photos', { exact: true }).click();
+      await page.getByRole('link', { name: 'Photos' }).click();
      await thumbnailUtils.expectInViewport(page, assetToTrash.id);
    });
    test('open album, trash photo, open /trash, restore', async ({ page }) => {
@@ -537,7 +537,7 @@ test.describe('Timeline', () => {
        ids: [assetToTrash.id],
      });
      await page.locator('#control-bar').getByLabel('Close').click();
-      await page.getByText('Trash', { exact: true }).click();
+      await page.getByRole('link', { name: 'Trash' }).click();
      await timelineUtils.waitForTimelineLoad(page);
      await thumbnailUtils.expectInViewport(page, assetToTrash.id);
      await thumbnailUtils.withAssetId(page, assetToTrash.id).hover();
@@ -551,7 +551,7 @@ test.describe('Timeline', () => {
          json: { count: requestJson.ids.length },
        });
      });
-      await page.getByText('Restore', { exact: true }).click();
+      await page.getByText('Restore').click();
      await expect(restoreRequest).resolves.toEqual({
        ids: [assetToTrash.id],
      });
@@ -603,7 +603,7 @@ test.describe('Timeline', () => {
        ids: [assetToArchive.id],
      });
      await expect(thumbnailUtils.withAssetId(page, assetToArchive.id)).toHaveCount(0);
-      await page.getByText('Photos', { exact: true }).click();
+      await page.getByRole('link', { name: 'Photos' }).click();
      await thumbnailUtils.expectInViewport(page, assetToArchive.id);
    });
    test('open /archive, favorite photo, unfavorite', async ({ page }) => {
@@ -749,7 +749,7 @@ test.describe('Timeline', () => {
        ids: [assetToFavorite.id],
      });
      await expect(thumbnailUtils.withAssetId(page, assetToFavorite.id)).toHaveCount(0);
-      await page.getByText('Photos', { exact: true }).click();
+      await page.getByRole('link', { name: 'Photos' }).click();
      await thumbnailUtils.expectInViewport(page, assetToFavorite.id);
    });
    test.skip('open /favorites, archive photo, unarchive photo', async ({ page }) => {
@@ -657,13 +657,13 @@ export const utils = {
  isQueueEmpty: async (accessToken: string, queue: keyof QueuesResponseLegacyDto) => {
    const queues = await getQueuesLegacy({ headers: asBearerAuth(accessToken) });
    const jobCounts = queues[queue].jobCounts;
-    return !jobCounts.active && !jobCounts.waiting;
+    return !jobCounts.active && (!jobCounts.waiting || queues[queue].queueStatus.isPaused);
  },

  waitForQueueFinish: (accessToken: string, queue: keyof QueuesResponseLegacyDto, ms?: number) => {
    // eslint-disable-next-line no-async-promise-executor
    return new Promise<void>(async (resolve, reject) => {
-      const timeout = setTimeout(() => reject(new Error('Timed out waiting for queue to empty')), ms || 10_000);
+      const timeout = setTimeout(() => reject(new Error('Timed out waiting for queue to empty')), ms || 15_000);

      while (true) {
        const done = await utils.isQueueEmpty(accessToken, queue);
@@ -324,6 +324,13 @@
    "oauth_timeout": "Request Timeout",
    "oauth_timeout_description": "Timeout for requests in milliseconds",
    "ocr_job_description": "Use machine learning to recognize text in images",
+    "passkey_additional_domains": "Additional domains",
+    "passkey_additional_domains_description": "Additional, trusted domains (related origin requests). These will only work if the passkey domain is also accessible.",
+    "passkey_domain": "Passkey domain",
+    "passkey_domain_description": "Domain used for passkeys (relying party). Leave blank to infer from the origin header. Changing this value will result in existing passkeys no longer working.",
+    "passkey_enable_description": "Login with a passkey",
+    "passkey_settings": "Passkey Login",
+    "passkey_settings_description": "Manage passkey login settings",
    "password_enable_description": "Login with email and password",
    "password_settings": "Password Login",
    "password_settings_description": "Manage password login settings",
@@ -874,6 +881,8 @@
  "delete_local_dialog_ok_backed_up_only": "Delete Backed Up Only",
  "delete_local_dialog_ok_force": "Delete Anyway",
  "delete_others": "Delete others",
+  "delete_passkey": "Delete passkey",
+  "delete_passkey_prompt": "Are you sure you want to delete this passkey?",
  "delete_permanently": "Delete permanently",
  "delete_permanently_action_prompt": "{count} deleted permanently",
  "delete_shared_link": "Delete shared link",
@@ -943,6 +952,7 @@
  "edit_location_action_prompt": "{count} location edited",
  "edit_location_dialog_title": "Location",
  "edit_name": "Edit name",
+  "edit_passkey": "Edit passkey",
  "edit_people": "Edit people",
  "edit_person": "Edit person",
  "edit_tag": "Edit tag",
@@ -1287,6 +1297,7 @@
  "last": "Last",
  "last_months": "{count, plural, one {Last month} other {Last # months}}",
  "last_seen": "Last seen",
+  "last_used": "Last used",
  "latest_version": "Latest Version",
  "latitude": "Latitude",
  "leave": "Leave",
@@ -1379,6 +1390,7 @@
  "login_has_been_disabled": "Login has been disabled",
  "login_password_changed_error": "There was an error updating your password",
  "login_password_changed_success": "Password updated successfully",
+  "login_with_passkey": "Login with passkey",
  "logout_all_device_confirmation": "Are you sure you want to log out all devices?",
  "logout_this_device_confirmation": "Are you sure you want to log out this device?",
  "logs": "Logs",
@@ -1427,6 +1439,7 @@
  "manage_your_api_keys": "Manage your API keys",
  "manage_your_devices": "Manage your logged-in devices",
  "manage_your_oauth_connection": "Manage your OAuth connection",
+  "manage_your_passkeys": "Manage your passkeys",
  "map": "Map",
  "map_assets_in_bounds": "{count, plural, =0 {No photos in this area} one {# photo} other {# photos}}",
  "map_cannot_get_user_location": "Cannot get user's location",
@@ -1546,6 +1559,7 @@
  "new_album": "New Album",
  "new_api_key": "New API Key",
  "new_feature": "New Feature",
+  "new_passkey": "New passkey",
  "new_password": "New password",
  "new_person": "New person",
  "new_pin_code": "New PIN code",
@@ -1658,6 +1672,8 @@
  "partner_sharing": "Partner Sharing",
  "partners": "Partners",
  "partners_description": "Share your photos and videos with other users",
+  "passkeys": "{count, plural, one {Passkey} other {Passkeys}}",
+  "passkeys_not_supported": "Passkeys are not supported by this browser",
  "password": "Password",
  "password_does_not_match": "Password does not match",
  "password_required": "Password Required",
@@ -1842,6 +1858,7 @@
  "removed_from_favorites_count": "{count, plural, other {Removed #}} from favorites",
  "removed_from_stack": "Removed asset from stack",
  "removed_memory": "Removed memory",
+  "removed_passkey": "Removed passkey: {name}",
  "removed_tagged_assets": "Removed tag from {count, plural, one {# asset} other {# assets}}",
  "rename": "Rename",
  "repository": "Repository",
@@ -2025,6 +2042,7 @@
  "share_everyone": "Share everyone",
  "share_everyone_description": "Give {user} access to all of your people.",
  "share_link": "Share Link",
+  "share_logs": "Share Logs",
  "share_original": "Use original (large)",
  "share_preview": "Use preview (small)",
  "share_quality_body": "Press and hold the share button to choose the image quality before you share.",
@@ -2203,6 +2221,8 @@
  "theme": "Theme",
  "theme_selection": "Theme selection",
  "theme_selection_description": "Automatically set the theme to light or dark based on your browser's system preference",
+  "theme_setting_asset_list_smooth_scrubbing_subtitle": "Scroll continuously when dragging the scrollbar instead of snapping to months",
+  "theme_setting_asset_list_smooth_scrubbing_title": "Smooth timeline scrubbing",
  "theme_setting_asset_list_storage_indicator_title": "Show storage indicator on asset tiles",
  "theme_setting_asset_list_tiles_per_row_title": "Number of assets per row ({count})",
  "theme_setting_colorful_interface_subtitle": "Apply primary color to background surfaces.",
@@ -323,6 +323,13 @@
    "oauth_timeout": "Таймаут для запросов",
    "oauth_timeout_description": "Максимальное время, в течение которого ожидать ответа, в миллисекундах",
    "ocr_job_description": "Использование машинного обучения для распознавания текста на изображениях",
+    "passkey_additional_domains": "Дополнительные домены",
+    "passkey_additional_domains_description": "Дополнительные доверенные домены. Для их работы основной домен ключей доступа также должен быть доступен.",
+    "passkey_domain": "Домен ключей доступа",
+    "passkey_domain_description": "Домен для ключей доступа. Оставьте пустым для определения по адресу сайта. При изменении домена существующие ключи перестанут работать.",
+    "passkey_enable_description": "Вход с помощью ключа доступа",
+    "passkey_settings": "Вход по ключу доступа",
+    "passkey_settings_description": "Настройки входа по ключу доступа",
    "password_enable_description": "Вход по электронной почте и паролю",
    "password_settings": "Настройки входа с паролем",
    "password_settings_description": "Управление настройками входа по паролю",
@@ -873,6 +880,8 @@
  "delete_local_dialog_ok_backed_up_only": "Удалить только резервные копии",
  "delete_local_dialog_ok_force": "Все равно удалить",
  "delete_others": "Удалить остальные",
+  "delete_passkey": "Удалить ключ доступа",
+  "delete_passkey_prompt": "Удалить этот ключ доступа?",
  "delete_permanently": "Удалить навсегда",
  "delete_permanently_action_prompt": "Объекты удалены безвозвратно ({count} шт.)",
  "delete_shared_link": "Удалить публичную ссылку",
@@ -942,6 +951,7 @@
  "edit_location_action_prompt": "Места изменены ({count} шт.)",
  "edit_location_dialog_title": "Местоположение",
  "edit_name": "Изменить имя",
+  "edit_passkey": "Изменить ключ доступа",
  "edit_people": "Изменить людей",
  "edit_person": "Изменить человека",
  "edit_tag": "Изменить тег",
@@ -1287,6 +1297,7 @@
  "last": "Последний",
  "last_months": "{count, plural, one {Последний месяц} many {# последних месяцев} other {# последних месяца}}",
  "last_seen": "Последний доступ",
+  "last_used": "Последнее использование",
  "latest_version": "Последняя версия",
  "latitude": "Широта",
  "leave": "Покинуть",
@@ -1379,6 +1390,7 @@
  "login_has_been_disabled": "Вход в систему был отключён",
  "login_password_changed_error": "Произошла ошибка при обновлении пароля",
  "login_password_changed_success": "Пароль успешно обновлен",
+  "login_with_passkey": "Войти с ключом доступа",
  "logout_all_device_confirmation": "Вы действительно хотите завершить все сеансы, кроме текущего?",
  "logout_this_device_confirmation": "Вы действительно хотите завершить сеанс на этом устройстве?",
  "logs": "Журнал событий",
@@ -1427,6 +1439,7 @@
  "manage_your_api_keys": "Управление API ключами для взаимодействия с другими программами",
  "manage_your_devices": "Управление устройствами, на которых вы входили в свой аккаунт",
  "manage_your_oauth_connection": "Настройки подключённого OAuth",
+  "manage_your_passkeys": "Управление ключами доступа",
  "map": "Карта",
  "map_assets_in_bounds": "{count, plural, =0 {Нет фото в этой области} other {# фото}}",
  "map_cannot_get_user_location": "Невозможно получить местоположение пользователя",
@@ -1546,6 +1559,7 @@
  "new_album": "Новый альбом",
  "new_api_key": "Новый API ключ",
  "new_feature": "Новая функциональность",
+  "new_passkey": "Новый ключ доступа",
  "new_password": "Новый пароль",
  "new_person": "Новый человек",
  "new_pin_code": "Новый PIN-код",
@@ -1658,6 +1672,8 @@
  "partner_sharing": "Совместное использование",
  "partners": "Партнёры",
  "partners_description": "Делитесь своими фото и видео с другими пользователями",
+  "passkeys": "{count, plural, one {Ключ доступа} few {Ключи доступа} many {Ключи доступа} other {Ключи доступа}}",
+  "passkeys_not_supported": "Этот браузер не поддерживает ключи доступа",
  "password": "Пароль",
  "password_does_not_match": "Пароли не совпадают",
  "password_required": "Требуется пароль",
@@ -1842,6 +1858,7 @@
  "removed_from_favorites_count": "{count, plural, one {# объект удалён} many {# объектов удалено} other {# объекта удалено}} из избранного",
  "removed_from_stack": "Объект удалён из группы",
  "removed_memory": "Воспоминание удалено",
+  "removed_passkey": "Удалён ключ доступа: {name}",
  "removed_tagged_assets": "Тег удалён у {count, plural, one {# объекта} other {# объектов}}",
  "rename": "Переименовать",
  "repository": "Репозиторий",
@@ -2027,6 +2044,7 @@
  "share_everyone": "Поделиться со всеми",
  "share_everyone_description": "Предоставить пользователю {user} доступ всем своим людям.",
  "share_link": "Создать ссылку",
+  "share_logs": "Поделиться журналами",
  "share_original": "Оригинал (большой размер)",
  "share_preview": "Предпросмотр (небольшой размер)",
  "share_quality_body": "Нажмите и удерживайте кнопку «Поделиться», чтобы выбрать качество изображения перед отправкой.",
@@ -2206,6 +2224,8 @@
  "theme": "Тема",
  "theme_selection": "Выбор темы",
  "theme_selection_description": "Автоматически устанавливать светлую или тёмную тему в зависимости от настроек вашего браузера",
+  "theme_setting_asset_list_smooth_scrubbing_subtitle": "Прокручивать ленту плавно при перетаскивании полосы прокрутки, без переходов по месяцам",
+  "theme_setting_asset_list_smooth_scrubbing_title": "Плавная прокрутка ленты",
  "theme_setting_asset_list_storage_indicator_title": "Отображать индикатор хранилища на плитках объектов",
  "theme_setting_asset_list_tiles_per_row_title": "Количество объектов в строке ({count})",
  "theme_setting_colorful_interface_subtitle": "Добавить оттенок к фону.",
@@ -1,8 +1,8 @@
 ARG DEVICE=cpu

-FROM python:3.13-slim-trixie@sha256:9d2e5553305c7c7b0097999bb17187c69b921ccd6bc9d40e4bb5ebe652c00285 AS builder-cpu
+FROM python:3.13-slim-trixie@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f AS builder-cpu

-FROM python:3.13-slim-trixie@sha256:7c61056e61ac89e852de05f3dc6fa51a6dd2181797bceed46aa725dd7cb2cd3b AS builder-openvino
+FROM python:3.13-slim-trixie@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f AS builder-openvino

 # renovate: datasource=github-releases depName=microsoft/onnxruntime
 ARG ONNXRUNTIME_VERSION="v1.30.0"
@@ -59,7 +59,7 @@ RUN mkdir /opt/armnn && \
    cd /opt/ann && \
    sh build.sh

-FROM python:3.12-slim-trixie@sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea AS builder-rknn
+FROM python:3.12-slim-trixie@sha256:cb33f7f771ecec2ef1225cf39b159591a040391bd73e4c01f00fdfc4c47611d2 AS builder-rknn

 # Warning: 25GiB+ disk space required to pull this image
 # TODO: find a way to reduce the image size
@@ -81,11 +81,11 @@ RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --extra ${DEVICE} --no-dev --no-editable --no-install-project --compile-bytecode --no-progress --active --link-mode copy && \
    if [ "$DEVICE" = "openvino" ]; then uv pip install --no-deps /opt/onnxruntime_openvino-*.whl; fi

-FROM python:3.13-slim-trixie@sha256:9d2e5553305c7c7b0097999bb17187c69b921ccd6bc9d40e4bb5ebe652c00285 AS prod-cpu
+FROM python:3.13-slim-trixie@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f AS prod-cpu

 ENV MACHINE_LEARNING_MODEL_ARENA=false

-FROM python:3.13-slim-trixie@sha256:9d2e5553305c7c7b0097999bb17187c69b921ccd6bc9d40e4bb5ebe652c00285 AS prod-openvino
+FROM python:3.13-slim-trixie@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f AS prod-openvino

 RUN apt-get update && \
    apt-get install --no-install-recommends -yqq ocl-icd-libopencl1 wget && \
@@ -141,7 +141,7 @@ COPY --from=builder-armnn \
    /opt/ann/build.sh \
    /opt/armnn/

-FROM python:3.12-slim-trixie@sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea AS prod-rknn
+FROM python:3.12-slim-trixie@sha256:cb33f7f771ecec2ef1225cf39b159591a040391bd73e4c01f00fdfc4c47611d2 AS prod-rknn

 # renovate: datasource=github-tags depName=airockchip/rknn-toolkit2
 ARG RKNN_TOOLKIT_VERSION="v2.3.0"
@@ -150,7 +150,7 @@ ENV MACHINE_LEARNING_MODEL_ARENA=false

 ADD --chmod=644 --checksum=sha256:73993ed4b440460825f21611731564503cc1d5a0c123746477da6cd574f34885 "https://github.com/airockchip/rknn-toolkit2/raw/refs/tags/${RKNN_TOOLKIT_VERSION}/rknpu2/runtime/Linux/librknn_api/aarch64/librknnrt.so" /usr/lib/

-FROM python:3.13-slim-trixie@sha256:9d2e5553305c7c7b0097999bb17187c69b921ccd6bc9d40e4bb5ebe652c00285 AS mimalloc
+FROM python:3.13-slim-trixie@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f AS mimalloc
 RUN echo "deb http://deb.debian.org/debian trixie-backports main" > /etc/apt/sources.list.d/backports.list && \
    apt-get update && \
    apt-get install -y --no-install-recommends libmimalloc3/trixie-backports && \
@@ -3,6 +3,7 @@ from collections.abc import Hashable
 from typing import Any

 from immich_ml import allocator
+from immich_ml.config import clean_name
 from immich_ml.models.base import InferenceEntry, InferenceModel
 from immich_ml.schemas import Options

@@ -15,7 +16,8 @@ class ModelCache:
        self._expiries: dict[Key, asyncio.TimerHandle] = {}

    def get[O: Options](self, entry: InferenceEntry[O], ttl: int | None = None) -> InferenceModel[O]:
-        key = (entry.model, entry.name, entry.model.graph(entry.options))
+        # names that differ only in what cleaning drops, like an `immich-app/` prefix, are the same model
+        key = (entry.model, clean_name(entry.name), entry.model.graph(entry.options))
        if key not in self._models:
            self._models[key] = entry.model.create(entry.name, entry.options)
        elif key not in self._expiries:
@@ -14,7 +14,7 @@ dependencies = [
    "onnx>=1.22.0",
    "opencv-python-headless>=4.7.0.72,<5.0",
    "orjson>=3.9.5",
-    "pillow>=12.2,<13",
+    "pillow>=13,<14",
    "pydantic>=2.0.0,<3",
    "pydantic-settings>=2.5.2,<3",
    "python-multipart>=0.0.6,<1.0",
@@ -64,7 +64,7 @@ compile-bytecode = true
 override-dependencies = ["opencv-python ; sys_platform == 'never'"] # only install the headless version

 [tool.uv.sources]
-immich-model = { git = "https://github.com/immich-app/ml-models.git", rev = "8bf3fd1b44b0c8608f52fb6e50ddff52826576d8" }
+immich-model = { git = "https://github.com/immich-app/ml-models.git", rev = "a1eeff2c2118d76067efecf4cc4630998eac519a" }
 onnxruntime-gpu = { index = "onnxruntime-cuda-12" }
 openvino = { index = "openvino-nightly" }

@@ -1856,6 +1856,14 @@ class TestCache:
        assert len(model_cache._models) == 1
        model.create.assert_called_once()

+    async def test_shares_an_instance_across_names_of_the_same_model(self) -> None:
+        model_cache = ModelCache()
+        bare = model_cache.get(InferenceEntry(OpenClipTextualEncoder, "ViT-B-32__openai", TextualOptions()))
+        prefixed = model_cache.get(
+            InferenceEntry(OpenClipTextualEncoder, "immich-app/ViT-B-32__openai", TextualOptions(language="en-US"))
+        )
+        assert bare is prefixed
+
    async def test_separate_instances_per_graph_option(self) -> None:
        # the real TextDetector, so that keying it on anything but its resolution fails this
        model_cache = ModelCache()
@@ -212,36 +212,37 @@ checksum = "sha256:b6c17e747ae78cdd6de4d7532b3164b277daee97c007d3eaa2b39cca99882
 url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_windows-x64_bin.zip"

 [[tools.node]]
-version = "24.21.0"
+version = "24.22.1"
 backend = "core:node"
+specifiers = ["24.22.1"]

 [tools.node."platforms.linux-arm64"]
-checksum = "sha256:724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5"
-url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-linux-arm64.tar.gz"
+checksum = "sha256:33c37be234ba8bee041961047b19160f4d7d0f164e8e246f78bdd10feff148b3"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-arm64.tar.gz"

 [tools.node."platforms.linux-arm64-musl"]
 checksum = "sha256:3048b0811e158ca0d8672b59c839861763e144492980d8d29b369dfee45747e4"
 url = "https://unofficial-builds.nodejs.org/download/release/v24.21.0/node-v24.21.0-linux-arm64-musl.tar.gz"

 [tools.node."platforms.linux-x64"]
-checksum = "sha256:6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff"
-url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-linux-x64.tar.gz"
+checksum = "sha256:eb6728e77c576a35162c122c45ccadf224d89ff00abc8dae46cc2897c6002d7c"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.gz"

 [tools.node."platforms.linux-x64-musl"]
 checksum = "sha256:01a713e34da98e7b4d2a3191ee7ca3f93dd0384d1a2ef23c379b2161ee6e133a"
 url = "https://unofficial-builds.nodejs.org/download/release/v24.21.0/node-v24.21.0-linux-x64-musl.tar.gz"

 [tools.node."platforms.macos-arm64"]
-checksum = "sha256:bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057"
-url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz"
+checksum = "sha256:89c682593d76cd44233fa53b1563264e7de9cbb189cad169135c5b4fadfbc0a7"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-arm64.tar.gz"

 [tools.node."platforms.macos-x64"]
-checksum = "sha256:1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097"
-url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-x64.tar.gz"
+checksum = "sha256:d132557e7ee2b85af08b0c8c34338e65c6430f2238d01f727728ef42dc83b035"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-darwin-x64.tar.gz"

 [tools.node."platforms.windows-x64"]
-checksum = "sha256:158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541"
-url = "https://nodejs.org/dist/v24.21.0/node-v24.21.0-win-x64.zip"
+checksum = "sha256:d2046d28c2c3dcd211ac5145c0bf30e2047ef9dfb306693c8c6e2eccd8b95fa5"
+url = "https://nodejs.org/dist/v24.22.1/node-v24.22.1-win-x64.zip"

 [[tools."npm:@openapitools/openapi-generator-cli"]]
 version = "2.41.0"
@@ -252,13 +253,14 @@ version = "7.5.0"
 backend = "npm:oazapfts"

 [[tools.opentofu]]
-version = "1.12.6"
+version = "1.13.1"
 backend = "aqua:opentofu/opentofu"
+specifiers = ["1.13.1"]

 [tools.opentofu."platforms.linux-arm64"]
-checksum = "sha256:9bd0228a81bcd0c88f7045c74378f45a815779f19897191dff7d9efba9976b9e"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762688"
+checksum = "sha256:9c1ef375aa1852db0b2888aa921b640c71f8140d4682aa4fec99378a64fa7dc3"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708055"

 [tools.opentofu."platforms.linux-arm64-musl"]
 checksum = "sha256:9bd0228a81bcd0c88f7045c74378f45a815779f19897191dff7d9efba9976b9e"
@@ -266,9 +268,9 @@ url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.
 url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762688"

 [tools.opentofu."platforms.linux-x64"]
-checksum = "sha256:50a6106fa4de523d09c87af85f3db1dd47535fc005727fdca6852146476b88ec"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762723"
+checksum = "sha256:378ada19d4bc70c43732004e8159be771b23b9a5afdf059e5f8a2b3fa2c70a69"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708017"

 [tools.opentofu."platforms.linux-x64-musl"]
 checksum = "sha256:50a6106fa4de523d09c87af85f3db1dd47535fc005727fdca6852146476b88ec"
@@ -276,58 +278,53 @@ url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.
 url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762723"

 [tools.opentofu."platforms.macos-arm64"]
-checksum = "sha256:f958ec5e511063be9feb180ca015a4cb7977566a9cf6a8550bba8c2a9b5aba74"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_darwin_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762710"
+checksum = "sha256:be78f659f04ef06a9dbd9b3934d46af95d787a3aa38396d459dea395261816a9"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_darwin_arm64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708059"

 [tools.opentofu."platforms.macos-x64"]
-checksum = "sha256:44bb1855f372f17f365fb94517906e78da5001da10f4c98de57a39bf982f3a92"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_darwin_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762655"
+checksum = "sha256:a73720443ba38712d7d96dc1e857add02c15a790919c653ad07492e9952f8c27"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_darwin_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708142"

 [tools.opentofu."platforms.windows-x64"]
-checksum = "sha256:bcbcd9ca744af6c4053e2d5e75dae79ff33ad7dc38d45e1233e693d096284538"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.6/tofu_1.12.6_windows_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/520762708"
+checksum = "sha256:6825ae311e9a15747ce2ede7b7e97c8bb744a4d271fa8113259eeeee3d09438c"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.13.1/tofu_1.13.1_windows_amd64.tar.gz"
+url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/603708102"

 [[tools.pnpm]]
-version = "11.27.1"
+version = "12.14.0"
 backend = "aqua:pnpm/pnpm"
+specifiers = ["12.14.0"]

 [tools.pnpm."platforms.linux-arm64"]
-checksum = "sha256:dbf8f84263d2bc696306d4219be68256d881d9af409345374d878676a7edcf0c"
-url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-linux-arm64.tar.gz"
-url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602580"
-provenance = "github-attestations"
-
-[tools.pnpm."platforms.linux-arm64-musl"]
-checksum = "sha256:7a7854e90bdb7d339430d9943ea482b34d7bde817cfc1c749d3c04ddd464142d"
-url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-linux-arm64-musl.tar.gz"
-url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602583"
+checksum = "sha256:cfc780b9e690549e6633e1045fb1fb6ef84e390711e2099e6ccbae91c32456ea"
+url = "https://github.com/pnpm/pnpm/releases/download/v12.14.0/pnpm-linux-arm64.tar.gz"
+url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/643957409"
 provenance = "github-attestations"

 [tools.pnpm."platforms.linux-x64"]
-checksum = "sha256:6be1426540406747b7731564a46c5b30d3023ea6c19e4ce99f994c4ec122f3d2"
-url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-linux-x64.tar.gz"
-url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602576"
-provenance = "github-attestations"
-
-[tools.pnpm."platforms.linux-x64-musl"]
-checksum = "sha256:cc66c1558a1a03b320ff5b4022f755386fa1de54db3f97ff624112015be1ccf1"
-url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-linux-x64-musl.tar.gz"
-url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602579"
+checksum = "sha256:3910c3852136bed5bc1511b9137a45fd4357ed6b3970d9d08893641e9005867e"
+url = "https://github.com/pnpm/pnpm/releases/download/v12.14.0/pnpm-linux-x64.tar.gz"
+url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/643957410"
 provenance = "github-attestations"

 [tools.pnpm."platforms.macos-arm64"]
-checksum = "sha256:352f67ceaaa5aba294a53f483da93c376005b4c7e785fe5411e0ce720fe74741"
-url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-darwin-arm64.tar.gz"
-url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602575"
+checksum = "sha256:50f48e0e17508952790a3fbf58fcf14f3b82efa5f594ca04ad904e29aaf854b0"
+url = "https://github.com/pnpm/pnpm/releases/download/v12.14.0/pnpm-darwin-arm64.tar.gz"
+url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/643957413"
+provenance = "github-attestations"
+
+[tools.pnpm."platforms.macos-x64"]
+checksum = "sha256:2c412e07382049b4edb04fa6da78f3d4ef7810b75853c80544dcfb7c0ed79880"
+url = "https://github.com/pnpm/pnpm/releases/download/v12.14.0/pnpm-darwin-x64.tar.gz"
+url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/643957411"
 provenance = "github-attestations"

 [tools.pnpm."platforms.windows-x64"]
-checksum = "sha256:4b56d1184c3390b08146060fa4b414b8ceec9164aa41bf996e87a0f0bc135851"
-url = "https://github.com/pnpm/pnpm/releases/download/v11.27.1/pnpm-win32-x64.zip"
-url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/577602578"
+checksum = "sha256:6f0f38e917c8ce76ef31db528c357e2bfa354a1bcb16464e3cdec39e6530d784"
+url = "https://github.com/pnpm/pnpm/releases/download/v12.14.0/pnpm-win32-x64.zip"
+url_api = "https://api.github.com/repos/pnpm/pnpm/releases/assets/643957404"
 provenance = "github-attestations"

 [[tools.terragrunt]]
@@ -15,10 +15,10 @@ config_roots = [
 ]

 [tools]
-node = "24.21.0"
-pnpm = "11.27.1"
+node = "24.22.1"
+pnpm = "12.14.0"
 terragrunt = "1.1.1"
-opentofu = "1.12.6"
+opentofu = "1.13.1"
 "npm:@openapitools/openapi-generator-cli" = "2.41.0"
 "npm:oazapfts" = "7.5.0"
 "github:extism/cli" = "1.6.3"
@@ -127,6 +127,12 @@ dart_code_metrics:
            severity: perf
          - name: tr
            description: 'Use context.t.<key> or StaticTranslations.instance.<key> instead of tr().'
+          - type: Locale
+            entries:
+              - name: toLanguageTag
+                description: 'Pass resolvedDateTimeLocale() to DateFormat, not the raw locale. DateFormat throws for locales intl has no date data for (e.g. mi).'
+                exclude-paths:
+                  - 'lib/main.dart'
          - type: String
            entries:
              - name: tr
@@ -1,13 +0,0 @@
-cmake_minimum_required(VERSION 3.12)
-
-set(CMAKE_C_STANDARD 17)
-set(CMAKE_C_STANDARD_REQUIRED ON)
-
-project(native_buffer LANGUAGES C)
-
-add_library(native_buffer SHARED
-    src/main/cpp/native_buffer.c
-    src/main/cpp/native_image.c
-)
-
-target_link_libraries(native_buffer jnigraphics)
@@ -79,11 +79,6 @@ android {
  }
  namespace 'app.alextran.immich'

-  externalNativeBuild {
-    cmake {
-      path "CMakeLists.txt"
-    }
-  }
 }

 flutter {
@@ -1,52 +0,0 @@
-#include <jni.h>
-#include <stdlib.h>
-#include <string.h>
-
-JNIEXPORT jlong JNICALL
-Java_app_alextran_immich_NativeBuffer_allocate(
-        JNIEnv *env, jclass clazz, jint size) {
-    void *ptr = malloc(size);
-    return (jlong) ptr;
-}
-
-JNIEXPORT void JNICALL
-Java_app_alextran_immich_NativeBuffer_free(
-        JNIEnv *env, jclass clazz, jlong address) {
-    free((void *) address);
-}
-
-JNIEXPORT jlong JNICALL
-Java_app_alextran_immich_NativeBuffer_realloc(
-        JNIEnv *env, jclass clazz, jlong address, jint size) {
-    void *ptr = realloc((void *) address, size);
-    return (jlong) ptr;
-}
-
-JNIEXPORT jobject JNICALL
-Java_app_alextran_immich_NativeBuffer_wrap(
-        JNIEnv *env, jclass clazz, jlong address, jint capacity) {
-    return (*env)->NewDirectByteBuffer(env, (void *) address, capacity);
-}
-
-JNIEXPORT void JNICALL
-Java_app_alextran_immich_NativeBuffer_copy(
-        JNIEnv *env, jclass clazz, jobject buffer, jlong destAddress, jint offset, jint length) {
-    void *src = (*env)->GetDirectBufferAddress(env, buffer);
-    if (src != NULL) {
-        memcpy((void *) destAddress, (char *) src + offset, length);
-    }
-}
-
-/**
- * Creates a JNI global reference to the given object and returns its address.
- * The caller is responsible for deleting the global reference when it's no longer needed.
- */
-JNIEXPORT jlong JNICALL
-Java_app_alextran_immich_NativeBuffer_createGlobalRef(JNIEnv *env, jobject clazz, jobject obj) {
-    if (obj == NULL) {
-        return 0;
-    }
-
-    jobject globalRef = (*env)->NewGlobalRef(env, obj);
-    return (jlong) globalRef;
-}
@@ -1,173 +0,0 @@
-#include <jni.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <android/bitmap.h>
-
-// Cache-friendly block size for the tiled rotation (in pixels). 32x32 uint32 = 4KB, fits L1.
-#define TILE 32
-
-// EXIF orientation values (androidx.exifinterface.media.ExifInterface.ORIENTATION_*).
-enum {
-  ORIENTATION_FLIP_HORIZONTAL = 2,
-  ORIENTATION_ROTATE_180 = 3,
-  ORIENTATION_FLIP_VERTICAL = 4,
-  ORIENTATION_TRANSPOSE = 5,
-  ORIENTATION_ROTATE_90 = 6,
-  ORIENTATION_TRANSVERSE = 7,
-  ORIENTATION_ROTATE_270 = 8,
-};
-
-// The orientations that swap width and height. Must stay in sync with affine_for's dim usage.
-static int swaps_dims(int o) {
-  return o == ORIENTATION_ROTATE_90 || o == ORIENTATION_ROTATE_270 ||
-         o == ORIENTATION_TRANSPOSE || o == ORIENTATION_TRANSVERSE;
-}
-
-// A source pixel (sx, sy) maps to destination index base + sx*stepX + sy*stepY, where dw is the
-// destination width. This affine form covers all 8 EXIF orientations and matches the pixel layout
-// of Bitmap.createBitmap(src, matrixForExifOrientation(o)). int64_t so it stays correct on
-// armeabi-v7a (32-bit long) regardless of how large MAX_RAW_DECODE_PIXELS grows.
-static void affine_for(int o, int sw, int sh, int dw, int64_t *base, int64_t *stepX, int64_t *stepY) {
-  switch (o) {
-    case ORIENTATION_ROTATE_90:       *base = sh - 1;                             *stepX = dw;  *stepY = -1;  break;
-    case ORIENTATION_ROTATE_270:      *base = (int64_t) (sw - 1) * dw;            *stepX = -dw; *stepY = 1;   break;
-    case ORIENTATION_ROTATE_180:      *base = (int64_t) (sh - 1) * dw + (sw - 1); *stepX = -1;  *stepY = -dw; break;
-    case ORIENTATION_FLIP_HORIZONTAL: *base = sw - 1;                             *stepX = -1;  *stepY = dw;  break;
-    case ORIENTATION_FLIP_VERTICAL:   *base = (int64_t) (sh - 1) * dw;            *stepX = 1;   *stepY = -dw; break;
-    case ORIENTATION_TRANSPOSE:       *base = 0;                                  *stepX = dw;  *stepY = 1;   break;
-    case ORIENTATION_TRANSVERSE:      *base = (int64_t) (sw - 1) * dw + (sh - 1); *stepX = -dw; *stepY = -1;  break;
-    default:                          *base = 0;                                  *stepX = 1;   *stepY = dw;  break;
-  }
-}
-
-// Copy each source pixel (whole uint32, so channel order/premult is irrelevant) to its rotated
-// destination, walking TILE x TILE blocks so the scattered writes of a 90/270 transpose stay
-// cache-resident. dst is densely packed (rowBytes == dw*4, no padding), which the affine math relies on.
-static void rotate_tiled(const uint8_t *src, int srcStride, uint32_t *dst,
-                         int sw, int sh, int64_t base, int64_t stepX, int64_t stepY) {
-  for (int ty = 0; ty < sh; ty += TILE) {
-    int yEnd = ty + TILE < sh ? ty + TILE : sh;
-    for (int tx = 0; tx < sw; tx += TILE) {
-      int xEnd = tx + TILE < sw ? tx + TILE : sw;
-      for (int sy = ty; sy < yEnd; sy++) {
-        const uint32_t *srcRow = (const uint32_t *) (src + (size_t) sy * srcStride);
-        int64_t idx = base + (int64_t) sy * stepY + (int64_t) tx * stepX;
-        for (int sx = tx; sx < xEnd; sx++) {
-          dst[idx] = srcRow[sx];
-          idx += stepX;
-        }
-      }
-    }
-  }
-}
-
-// Rotates an RGBA_8888 bitmap to the given EXIF orientation into a freshly malloc'd buffer (free it
-// via NativeBuffer.free). Fills outInfo with {width, height, rowBytes} and returns the buffer
-// address, or 0 if the bitmap can't be handled (e.g. a non-8888 format) so the caller can fall back.
-JNIEXPORT jlong JNICALL
-Java_app_alextran_immich_NativeImage_rotate(
-    JNIEnv *env, jclass clazz, jobject bitmap, jint orientation, jintArray outInfo) {
-  AndroidBitmapInfo info;
-  if (AndroidBitmap_getInfo(env, bitmap, &info) != ANDROID_BITMAP_RESULT_SUCCESS) {
-    return 0;
-  }
-  if (info.format != ANDROID_BITMAP_FORMAT_RGBA_8888) {
-    return 0;
-  }
-
-  int sw = (int) info.width;
-  int sh = (int) info.height;
-  int dw = swaps_dims(orientation) ? sh : sw;
-  int dh = swaps_dims(orientation) ? sw : sh;
-
-  uint32_t *dst = (uint32_t *) malloc((size_t) dw * dh * 4);
-  if (dst == NULL) {
-    return 0;
-  }
-
-  void *srcPixels = NULL;
-  if (AndroidBitmap_lockPixels(env, bitmap, &srcPixels) != ANDROID_BITMAP_RESULT_SUCCESS) {
-    free(dst);
-    return 0;
-  }
-
-  int64_t base, stepX, stepY;
-  affine_for(orientation, sw, sh, dw, &base, &stepX, &stepY);
-  rotate_tiled((const uint8_t *) srcPixels, (int) info.stride, dst, sw, sh, base, stepX, stepY);
-
-  AndroidBitmap_unlockPixels(env, bitmap);
-
-  jint dims[3] = {dw, dh, dw * 4};
-  (*env)->SetIntArrayRegion(env, outInfo, 0, 3, dims);
-  // Keep ownership in C until the buffer is safely handed back: if outInfo was somehow too small,
-  // SetIntArrayRegion left a pending exception and Kotlin will never receive (or free) dst.
-  if ((*env)->ExceptionCheck(env)) {
-    free(dst);
-    return 0;
-  }
-  return (jlong) dst;
-}
-
-// Convert an RGBA_1010102 buffer to densely-packed RGBA_8888, matching Skia's
-// Bitmap.copy(ARGB_8888) byte-for-byte so it's a drop-in for the intermediate 8888 bitmap.
-// Each source pixel is a native (little-endian on every Android ABI) u32 with R in bits 0-9,
-// G in 10-19, B in 20-29, A in 30-31 (standard RGB10_A2). Each 10-bit channel maps to 8-bit via
-// round(v*255/1023). The 2-bit alpha maps to a*85. Both are kept as plain arithmetic as the whole
-// loop auto-vectorizes to NEON and measures faster than a LUT on-device. Output is R,G,B,A bytes
-// per pixel, i.e. Android ARGB_8888 memory == Dart PixelFormat.rgba8888.
-static void convert_1010102(const uint8_t *src, int srcStride, uint32_t *dst, int w, int h) {
-  for (int y = 0; y < h; y++) {
-    const uint32_t *srcRow = (const uint32_t *) (src + (size_t) y * srcStride);
-    uint32_t *dstRow = dst + (size_t) y * w;
-    for (int x = 0; x < w; x++) {
-      uint32_t px = srcRow[x];
-      uint32_t r = ((px & 0x3FF) * 16336u + 32768u) >> 16;
-      uint32_t g = (((px >> 10) & 0x3FF) * 16336u + 32768u) >> 16;
-      uint32_t b = (((px >> 20) & 0x3FF) * 16336u + 32768u) >> 16;
-      uint32_t a = ((px >> 30) & 0x3) * 85u;
-      dstRow[x] = r | (g << 8) | (b << 16) | (a << 24);
-    }
-  }
-}
-
-// Converts an RGBA_1010102 bitmap (what a 10-bit HEIC/AVIF decodes to on API 33+) into a freshly
-// malloc'd RGBA_8888 buffer. Fills outInfo with {width, height, rowBytes} and returns the buffer
-// address, or 0 (so the caller falls back to a Skia copy) if the bitmap isn't 1010102 or can't be
-// locked. Same ownership contract as rotate: free the returned buffer via NativeBuffer.free.
-JNIEXPORT jlong JNICALL
-Java_app_alextran_immich_NativeImage_convert1010102(
-    JNIEnv *env, jclass clazz, jobject bitmap, jintArray outInfo) {
-  AndroidBitmapInfo info;
-  if (AndroidBitmap_getInfo(env, bitmap, &info) != ANDROID_BITMAP_RESULT_SUCCESS) {
-    return 0;
-  }
-  if (info.format != ANDROID_BITMAP_FORMAT_RGBA_1010102) {
-    return 0;
-  }
-
-  int w = (int) info.width;
-  int h = (int) info.height;
-
-  uint32_t *dst = (uint32_t *) malloc((size_t) w * h * 4);
-  if (dst == NULL) {
-    return 0;
-  }
-
-  void *srcPixels = NULL;
-  if (AndroidBitmap_lockPixels(env, bitmap, &srcPixels) != ANDROID_BITMAP_RESULT_SUCCESS) {
-    free(dst);
-    return 0;
-  }
-
-  convert_1010102((const uint8_t *) srcPixels, (int) info.stride, dst, w, h);
-
-  AndroidBitmap_unlockPixels(env, bitmap);
-
-  jint dims[3] = {w, h, w * 4};
-  (*env)->SetIntArrayRegion(env, outInfo, 0, 3, dims);
-  if ((*env)->ExceptionCheck(env)) {
-    free(dst);
-    return 0;
-  }
-  return (jlong) dst;
-}
@@ -6,7 +6,7 @@ const val INITIAL_BUFFER_SIZE = 32 * 1024

 object NativeBuffer {
  init {
-    System.loadLibrary("native_buffer")
+    System.loadLibrary("native_core_ffi")
  }

  @JvmStatic
@@ -1,11 +1,11 @@
 package app.alextran.immich

 import android.graphics.Bitmap
+import java.nio.ByteBuffer

 object NativeImage {
  init {
-    // rotate() is compiled into the native_buffer shared lib (which already links jnigraphics).
-    System.loadLibrary("native_buffer")
+    System.loadLibrary("native_core_ffi")
  }

  /**
@@ -26,4 +26,24 @@ object NativeImage {
   */
  @JvmStatic
  external fun convert1010102(bitmap: Bitmap, outInfo: IntArray): Long
+
+  /**
+   * Like [convert1010102], but decodes the JPEG XL image of [length] bytes at [address], stopped by
+   * [cancel], downscaled to cover [targetWidth] x [targetHeight] unless either is 0 and to fit
+   * within [maxPixelSize].
+   */
+  @JvmStatic
+  external fun decodeJxl(
+    address: Long,
+    length: Int,
+    targetWidth: Int,
+    targetHeight: Int,
+    maxPixelSize: Int,
+    cancelled: ByteBuffer,
+    outInfo: IntArray
+  ): Long
+
+  /** Stops the [decodeJxl] given this one-byte direct buffer. */
+  @JvmStatic
+  external fun cancel(cancelled: ByteBuffer)
 }
@@ -10,6 +10,7 @@ import androidx.exifinterface.media.ExifInterface
 import app.alextran.immich.INITIAL_BUFFER_SIZE
 import app.alextran.immich.NativeBuffer
 import app.alextran.immich.NativeByteBuffer
+import app.alextran.immich.NativeImage
 import app.alextran.immich.core.HttpClientManager
 import kotlinx.coroutines.*
 import okhttp3.Cache
@@ -29,6 +30,8 @@ import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.Executors

 private const val MAX_PREALLOC_BYTES = 128 * 1024 * 1024
+// Match the upstream GPU texture bound without depending on a newer local image decoder.
+private const val MAX_JXL_PIXEL_SIZE = 16384

 private class RemoteRequest(val cancellationSignal: CancellationSignal)

@@ -56,10 +59,9 @@ private val RAW_MIME_TYPES = setOf(
  "image/x-sony-sr2", "image/x-sony-srf", "image/x3f",
 )

-private fun isRawMime(contentType: String?): Boolean {
-  val mime = contentType?.substringBefore(';')?.trim()?.lowercase() ?: return false
-  return mime in RAW_MIME_TYPES
-}
+private fun mimeType(contentType: String?) = contentType?.substringBefore(';')?.trim()?.lowercase()
+
+private fun isRawMime(contentType: String?) = mimeType(contentType) in RAW_MIME_TYPES

 class RemoteImagesImpl(context: Context) : RemoteImageApi {
  private val requestMap = ConcurrentHashMap<Long, RemoteRequest>()
@@ -97,6 +99,42 @@ class RemoteImagesImpl(context: Context) : RemoteImageApi {
          return@fetch callback(CANCELLED)
        }

+        // Neither Android nor Flutter can decode JPEG XL, so this applies to encoded requests too.
+        if (mimeType(contentType) == "image/jxl") {
+          decodeExecutor.execute {
+            val info = IntArray(3)
+            // The fetch is done, so cancelling now stops the decode instead.
+            val cancelled = ByteBuffer.allocateDirect(1)
+            signal.setOnCancelListener { NativeImage.cancel(cancelled) }
+            val pointer = if (signal.isCanceled) 0L else NativeImage.decodeJxl(
+              buffer.pointer,
+              buffer.offset,
+              width?.toInt() ?: 0,
+              height?.toInt() ?: 0,
+              MAX_JXL_PIXEL_SIZE,
+              cancelled,
+              info
+            )
+            buffer.free()
+            requestMap.remove(requestId)
+            callback(
+              when {
+                pointer != 0L -> Result.success(
+                  mapOf(
+                    "pointer" to pointer,
+                    "width" to info[0].toLong(),
+                    "height" to info[1].toLong(),
+                    "rowBytes" to info[2].toLong()
+                  )
+                )
+                signal.isCanceled -> CANCELLED
+                else -> Result.failure(IOException("Failed to decode JPEG XL image"))
+              }
+            )
+          }
+          return@fetch
+        }
+
        // Decode natively when the caller wants pixels: Flutter's fallback decoder copies
        // 10-bit bitmaps (RGBA_1010102) as if they were rgba8888, garbling colors. Decode on a
        // dedicated pool - the fetch callback threads are shared with video streaming. On any
@@ -272,7 +310,11 @@ private class CronetImageFetcher : ImageFetcher {
      requestBuilder.addHeader(key, value)
    }
    val request = requestBuilder.build()
-    signal.setOnCancelListener(request::cancel)
+    // Cronet's disk cache can still use a read buffer after onCanceled, so only cancel between reads.
+    signal.setOnCancelListener {
+      callback.requestCancel = true
+      if (!callback.receivingResponse) request.cancel()
+    }
    request.start()
  }

@@ -328,12 +370,16 @@ private class CronetImageFetcher : ImageFetcher {
  ) : UrlRequest.Callback() {
    private var buffer: NativeByteBuffer? = null
    private var error: Exception? = null
+    @Volatile var receivingResponse = false
+    @Volatile var requestCancel = false

    override fun onRedirectReceived(request: UrlRequest, info: UrlResponseInfo, newUrl: String) {
      request.followRedirect()
    }

    override fun onResponseStarted(request: UrlRequest, info: UrlResponseInfo) {
+      receivingResponse = true
+      if (requestCancel) return request.cancel()
      if (info.httpStatusCode !in 200..299) {
        error = IOException("HTTP ${info.httpStatusCode}: ${info.httpStatusText}")
        return request.cancel()
@@ -361,6 +407,7 @@ private class CronetImageFetcher : ImageFetcher {
      info: UrlResponseInfo,
      byteBuffer: ByteBuffer
    ) {
+      if (requestCancel) return request.cancel()
      try {
        // Always pass a fresh wrap so byteBuffer.position() represents only the
        // bytes Cronet wrote in this iteration. Reusing the caller-supplied
@@ -0,0 +1,11 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:integration_test/integration_test.dart';
+import 'package:native_core/native_core.dart';
+
+void main() {
+  IntegrationTestWidgetsFlutterBinding.ensureInitialized();
+
+  test('native core loads on device', () {
+    expect(version(), isNotEmpty);
+  });
+}
@@ -0,0 +1,39 @@
+import Foundation
+
+enum NativeCore {
+  private static let library = dlopen("@rpath/native_core_ffi.framework/native_core_ffi", RTLD_NOW)
+
+  private static func symbol<T>(_ name: String, as type: T.Type) -> T? {
+    guard let library, let symbol = dlsym(library, name) else { return nil }
+    return unsafeBitCast(symbol, to: type)
+  }
+
+  private static let coreThumbhash = symbol("native_core_thumbhash", as: NativeCoreThumbhashFn.self)
+  private static let coreJxlDecode = symbol("native_core_jxl_decode", as: NativeCoreJxlDecodeFn.self)
+  private static let coreCancel = symbol("native_core_cancel", as: NativeCoreCancelFn.self)
+
+  static func thumbhash(_ hash: Data) -> (width: Int, height: Int, pointer: UnsafeMutableRawPointer)? {
+    guard let coreThumbhash else { return nil }
+    var width: Int32 = 0
+    var height: Int32 = 0
+    return hash.withUnsafeBytes { bytes in
+      guard let pointer = coreThumbhash(bytes.bindMemory(to: UInt8.self).baseAddress, bytes.count, &width, &height)
+      else { return nil }
+      return (Int(width), Int(height), UnsafeMutableRawPointer(pointer))
+    }
+  }
+
+  static func decodeJxl(_ data: Data, targetWidth: Int64?, targetHeight: Int64?, maxPixelSize: Int, cancelled: UnsafeMutablePointer<Bool>) -> (width: Int, height: Int, pointer: UnsafeMutableRawPointer)? {
+    guard let coreJxlDecode else { return nil }
+    var info = NativeCoreImageInfo()
+    return data.withUnsafeBytes { bytes in
+      guard let pointer = coreJxlDecode(bytes.bindMemory(to: UInt8.self).baseAddress, bytes.count, false, UInt32(clamping: targetWidth ?? 0), UInt32(clamping: targetHeight ?? 0), UInt32(clamping: maxPixelSize), cancelled, &info)
+      else { return nil }
+      return (Int(info.width), Int(info.height), UnsafeMutableRawPointer(pointer))
+    }
+  }
+
+  static func cancel(_ flag: UnsafeMutablePointer<Bool>) {
+    coreCancel?(flag)
+  }
+}
@@ -9,4 +9,6 @@ enum ImageProcessing {
    return q
  }()
  static let cancelledResult = Result<[String: Int64]?, any Error>.success(nil)
+  // Impeller shrinks each side to the GPU texture limit on its own, which squishes long images.
+  static let maxPixelSize = 16384
 }
@@ -20,7 +20,6 @@ class LocalImageApiImpl: LocalImageApi {
    requestOptions.version = .current
    return requestOptions
  }()
-  private static let maxPixelSize: CGFloat = 16384

  private static let registry = RequestRegistry<ImageRequest>()

@@ -111,7 +110,7 @@ class LocalImageApiImpl: LocalImageApi {

      let isOriginal = !(width > 0 && height > 0)
      let targetSize = isOriginal
-        ? CGSize(width: Self.maxPixelSize, height: Self.maxPixelSize)
+        ? CGSize(width: ImageProcessing.maxPixelSize, height: ImageProcessing.maxPixelSize)
        : CGSize(width: Double(width), height: Double(height))
      let contentMode: PHImageContentMode = isOriginal ? .aspectFit : .aspectFill
      var image: UIImage?
@@ -136,7 +135,7 @@ class LocalImageApiImpl: LocalImageApi {
      }

      // .fast can return larger than the target, so retry with .exact to guarantee the bound.
-      if max(cgImage.width, cgImage.height) > Int(Self.maxPixelSize) {
+      if max(cgImage.width, cgImage.height) > ImageProcessing.maxPixelSize {
        let exactOptions = Self.requestOptions.copy() as! PHImageRequestOptions
        exactOptions.resizeMode = .exact
        image = nil
@@ -7,15 +7,23 @@ import Photos
 final class RemoteImageRequest: ImageRequest {
  var task: URLSessionDataTask?
  let id: Int64
+  /// Lets cancellation stop a native decode partway through.
+  let decodeCancelled = UnsafeMutablePointer<Bool>.allocate(capacity: 1)

  init(id: Int64, completion: @escaping @Sendable (Result<[String: Int64]?, any Error>) -> Void) {
    self.id = id
    super.init(completion: completion)
+    decodeCancelled.initialize(to: false)
+  }
+
+  deinit {
+    decodeCancelled.deallocate()
  }

  override func cancel() {
    super.cancel()
    task?.cancel()
+    NativeCore.cancel(decodeCancelled)
  }
 }

@@ -65,6 +73,38 @@ class RemoteImageApiImpl: NSObject, RemoteImageApi {
      return request.completion(.failure(PigeonError(code: "", message: "No data received", details: nil)))
    }

+    // Flutter can't decode JPEG XL and older iOS versions can't either, so this applies to encoded requests too.
+    if response?.mimeType == "image/jxl" {
+      ImageProcessing.queue.addOperation {
+        if request.isCancelled {
+          return request.completion(ImageProcessing.cancelledResult)
+        }
+
+        guard let (width, height, pointer) = NativeCore.decodeJxl(data, targetWidth: width, targetHeight: height, maxPixelSize: ImageProcessing.maxPixelSize, cancelled: request.decodeCancelled) else {
+          registry.remove(requestId: request.id)
+          if request.isCancelled {
+            return request.completion(ImageProcessing.cancelledResult)
+          }
+          return request.completion(.failure(PigeonError(code: "", message: "Failed to decode JPEG XL image", details: nil)))
+        }
+
+        if request.isCancelled {
+          free(pointer)
+          return request.completion(ImageProcessing.cancelledResult)
+        }
+
+        registry.remove(requestId: request.id)
+        request.completion(
+          .success([
+            "pointer": Int64(Int(bitPattern: pointer)),
+            "width": Int64(width),
+            "height": Int64(height),
+            "rowBytes": Int64(width * 4),
+          ]))
+      }
+      return
+    }
+
    if encoded {
      let length = data.count
      let pointer = malloc(length)!
@@ -1 +1,7 @@
 #import "GeneratedPluginRegistrant.h"
+#include "../../../native/crates/native_core_ffi/include/native_core.h"
+
+// The function pointer type comes from the declaration, so nothing is retyped here.
+typedef __typeof__(&native_core_thumbhash) NativeCoreThumbhashFn;
+typedef __typeof__(&native_core_jxl_decode) NativeCoreJxlDecodeFn;
+typedef __typeof__(&native_core_cancel) NativeCoreCancelFn;
@@ -122,7 +122,7 @@ class Drift extends $Drift {
  @override
  Future<void> close() async {
    await super.close();
-    _updatePool?.close();
+    await _updatePool?.close();
  }

  Future<void> reset() async {
@@ -75,6 +75,7 @@ abstract class AppConfig with _$AppConfig {
            .timelineTilesPerRow => timeline.tilesPerRow,
            .timelineGroupAssetsBy => timeline.groupAssetsBy,
            .timelineStorageIndicator => timeline.storageIndicator,
+            .timelineSmoothScrubbing => timeline.smoothScrubbing,
            .mapShowFavoriteOnly => map.favoritesOnly,
            .mapRelativeDate => map.relativeDays,
            .mapCustomFrom => map.customFrom,
@@ -131,6 +132,7 @@ abstract class AppConfig with _$AppConfig {
      .timelineTilesPerRow => copyWith(timeline: timeline.copyWith(tilesPerRow: value as int)),
      .timelineGroupAssetsBy => copyWith(timeline: timeline.copyWith(groupAssetsBy: value as GroupAssetsBy)),
      .timelineStorageIndicator => copyWith(timeline: timeline.copyWith(storageIndicator: value as bool)),
+      .timelineSmoothScrubbing => copyWith(timeline: timeline.copyWith(smoothScrubbing: value as bool)),
      .mapShowFavoriteOnly => copyWith(map: map.copyWith(favoritesOnly: value as bool)),
      .mapRelativeDate => copyWith(map: map.copyWith(relativeDays: value as int)),
      .mapCustomFrom => copyWith(map: map.copyWith(customFrom: .fromNullable(value as DateTime?))),
@@ -10,5 +10,6 @@ abstract class TimelineConfig with _$TimelineConfig {
    @Default(4) int tilesPerRow,
    @Default(GroupAssetsBy.day) GroupAssetsBy groupAssetsBy,
    @Default(true) bool storageIndicator,
+    @Default(false) bool smoothScrubbing,
  }) = _TimelineConfig;
 }
@@ -48,6 +48,7 @@ enum SettingsKey<T> {
  timelineTilesPerRow<int>(),
  timelineGroupAssetsBy<GroupAssetsBy>(codec: EnumCodec(GroupAssetsBy.values)),
  timelineStorageIndicator<bool>(),
+  timelineSmoothScrubbing<bool>(),

  // Log
  logLevel<LogLevel>(codec: EnumCodec(LogLevel.values)),
@@ -1,12 +1,16 @@
 import 'dart:async';

+import 'package:http/http.dart' show ClientException;
 import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/domain/models/log.model.dart';
 import 'package:immich_mobile/domain/models/settings_key.dart';
+import 'package:immich_mobile/domain/models/store.model.dart';
+import 'package:immich_mobile/domain/services/store.service.dart';
 import 'package:immich_mobile/infrastructure/repositories/log.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/settings.repository.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
 import 'package:logging/logging.dart';
+import 'package:openapi/api.dart' show ApiException;

 /// Service responsible for handling application logging.
 ///
@@ -14,8 +18,15 @@ import 'package:logging/logging.dart';
 /// writes them to a persistent [LogRepository], and manages log levels via
 /// [SettingsRepository].
 class LogService {
+  static final _schemeAndHost = RegExp(r'''https?://[^\s/?#'"<>(),]*''');
+  static final _ipAddress = RegExp(
+    r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b|'
+    r'\[?\b(?:(?:[0-9a-f]{1,4}:){7}[0-9a-f]{1,4}|(?:[0-9a-f]{1,4}:)+(?::[0-9a-f]{1,4})+)(?:%\w+)?\]?',
+  );
+
  final LogRepository _logRepository;
  final SettingsRepository _settingsRepository;
+  final StoreService _storeService;

  final List<LogMessage> _msgBuffer = [];

@@ -39,11 +50,13 @@ class LogService {
  static Future<LogService> init({
    required LogRepository logRepository,
    required SettingsRepository settingsRepository,
+    required StoreService storeService,
    bool shouldBuffer = true,
  }) async {
    _instance ??= await create(
      logRepository: logRepository,
      settingsRepository: settingsRepository,
+      storeService: storeService,
      shouldBuffer: shouldBuffer,
    );
    return _instance!;
@@ -52,16 +65,17 @@ class LogService {
  static Future<LogService> create({
    required LogRepository logRepository,
    required SettingsRepository settingsRepository,
+    required StoreService storeService,
    bool shouldBuffer = true,
  }) async {
-    final instance = LogService._(logRepository, settingsRepository, shouldBuffer);
+    final instance = LogService._(logRepository, settingsRepository, storeService, shouldBuffer);
    await logRepository.truncate(limit: kLogTruncateLimit);
    final level = instance._settingsRepository.appConfig.logLevel;
    Logger.root.level = Level.LEVELS.elementAtOrNull(level.index) ?? Level.INFO;
    return instance;
  }

-  LogService._(this._logRepository, this._settingsRepository, this._shouldBuffer) {
+  LogService._(this._logRepository, this._settingsRepository, this._storeService, this._shouldBuffer) {
    _logSubscription = Logger.root.onRecord.listen(_handleLogRecord);
  }

@@ -74,12 +88,12 @@ class LogService {
    );

    final record = LogMessage(
-      message: r.message,
+      message: _redact(r.message),
      level: r.level.toLogLevel(),
      createdAt: r.time,
      logger: r.loggerName,
-      error: r.error?.toString(),
-      stack: r.stackTrace?.toString(),
+      error: r.error == null ? null : _redactError(r.error!),
+      stack: r.stackTrace == null ? null : _redact(r.stackTrace.toString()),
    );

    if (_shouldBuffer) {
@@ -100,6 +114,64 @@ class LogService {
    return [..._msgBuffer.reversed, ...logsFromDb];
  }

+  String _redact(String text) {
+    var redacted = text.replaceAllMapped(_schemeAndHost, (match) => _urlLabel(Uri.tryParse(match[0]!)));
+    final accessToken = _storeService.tryGet(StoreKey.accessToken);
+    if (accessToken != null) {
+      redacted = redacted.replaceAll(accessToken, '[ACCESS TOKEN]');
+    }
+    // as a header map prints it, so a short value like "1" can't match other text
+    for (final header in _settingsRepository.appConfig.network.customHeaders.entries) {
+      redacted = redacted.replaceAll(
+        RegExp('${RegExp.escape(header.key)}:\\s+${RegExp.escape(header.value)}'),
+        '${header.key}: [HEADER VALUE]',
+      );
+    }
+    return redacted;
+  }
+
+  String _redactError(Object error) {
+    final redacted = _redact(error.toString());
+    final httpError = error is ApiException ? error.innerException : error;
+    if (httpError is! ClientException) {
+      return redacted;
+    }
+
+    // ok_http also prints the host and its ip on their own: "Failed to connect to host/203.0.113.9:443"
+    final url = httpError.uri;
+    final withoutHost = url == null || url.host.isEmpty
+        ? redacted
+        : redacted.replaceAll(RegExp('\\b${RegExp.escape(url.host)}\\b'), _urlLabel(url));
+    return withoutHost.replaceAll(_ipAddress, '[IP ADDRESS]');
+  }
+
+  String _urlLabel(Uri? url) {
+    if (url == null) {
+      return '[OTHER URL]';
+    }
+
+    // a server url that is also a switching entry gets the entry's label
+    final network = _settingsRepository.appConfig.network;
+    for (var i = 0; i < network.externalEndpointList.length; i++) {
+      if (_isSameAddress(url, network.externalEndpointList[i])) {
+        return '[EXTERNAL ENDPOINT ${i + 1}]';
+      }
+    }
+    if (_isSameAddress(url, network.localEndpoint)) {
+      return '[LOCAL ENDPOINT]';
+    }
+    if (_isSameAddress(url, _storeService.tryGet(StoreKey.serverUrl)) ||
+        _isSameAddress(url, _storeService.tryGet(StoreKey.serverEndpoint))) {
+      return '[SERVER URL]';
+    }
+    return '[OTHER URL]';
+  }
+
+  bool _isSameAddress(Uri url, String? savedUrl) {
+    final saved = savedUrl == null ? null : Uri.tryParse(savedUrl);
+    return saved != null && saved.scheme == url.scheme && saved.host == url.host && saved.port == url.port;
+  }
+
  Future<void> clearLogs() async {
    _flushTimer?.cancel();
    _flushTimer = null;
@@ -79,8 +79,7 @@ abstract class ImageRequest {
    return (codec, descriptor);
  }

-  Future<ui.FrameInfo?> _fromEncodedPlatformImage(int address, int length, {ui.Size? decodeSize}) async {
-    final result = await _codecFromEncodedPlatformImage(address, length, decodeSize: decodeSize);
+  Future<ui.FrameInfo?> _firstFrame((ui.Codec, ui.ImageDescriptor)? result) async {
    if (result == null) {
      return null;
    }
@@ -116,7 +115,12 @@ abstract class ImageRequest {
    return ((width * scale).ceil(), (height * scale).ceil());
  }

-  Future<ui.FrameInfo?> _fromDecodedPlatformImage(int address, int width, int height, int rowBytes) async {
+  Future<(ui.Codec, ui.ImageDescriptor)?> _codecFromDecodedPlatformImage(
+    int address,
+    int width,
+    int height,
+    int rowBytes,
+  ) async {
    final pointer = Pointer<Uint8>.fromAddress(address);
    if (_isCancelled) {
      malloc.free(pointer);
@@ -152,14 +156,6 @@ abstract class ImageRequest {
      return null;
    }

-    final frame = await codec.getNextFrame();
-    descriptor.dispose();
-    codec.dispose();
-    if (_isCancelled) {
-      frame.image.dispose();
-      return null;
-    }
-
-    return frame;
+    return (codec, descriptor);
  }
 }
@@ -28,7 +28,9 @@ class LocalImageRequest extends ImageRequest {
      return null;
    }

-    final frame = await _fromDecodedPlatformImage(info["pointer"]!, info["width"]!, info["height"]!, info["rowBytes"]!);
+    final frame = await _firstFrame(
+      await _codecFromDecodedPlatformImage(info["pointer"]!, info["width"]!, info["height"]!, info["rowBytes"]!),
+    );
    return frame == null ? null : ImageInfo(image: frame.image, scale: scale);
  }

@@ -21,22 +21,7 @@ class RemoteImageRequest extends ImageRequest {
      width: decodeSize?.width.ceil(),
      height: decodeSize?.height.ceil(),
    );
-    // Android falls back to encoded data if native decoding fails, so check for both shapes of the response.
-    final frame = switch (info) {
-      {'pointer': final int pointer, 'length': final int length} => await _fromEncodedPlatformImage(
-        pointer,
-        length,
-        decodeSize: decodeSize,
-      ),
-      {
-        'pointer': final int pointer,
-        'width': final int width,
-        'height': final int height,
-        'rowBytes': final int rowBytes,
-      } =>
-        await _fromDecodedPlatformImage(pointer, width, height, rowBytes),
-      _ => null,
-    };
+    final frame = await _firstFrame(await _codecFromResponse(info, decodeSize: decodeSize));
    return frame == null ? null : ImageInfo(image: frame.image, scale: scale);
  }

@@ -53,14 +38,29 @@ class RemoteImageRequest extends ImageRequest {
      width: null,
      height: null,
    );
-    if (info == null) {
-      return null;
-    }
-
-    final (codec, _) = await _codecFromEncodedPlatformImage(info['pointer']!, info['length']!) ?? (null, null);
-    return codec;
+    final result = await _codecFromResponse(info);
+    return result?.$1;
  }

+  // Android falls back to encoded data if native decoding fails, and JPEG XL arrives decoded even when the encoded image
+  // is requested, so check for both shapes of the response.
+  Future<(ui.Codec, ui.ImageDescriptor)?> _codecFromResponse(Map<String, int>? info, {ui.Size? decodeSize}) =>
+      switch (info) {
+        {'pointer': final int pointer, 'length': final int length} => _codecFromEncodedPlatformImage(
+          pointer,
+          length,
+          decodeSize: decodeSize,
+        ),
+        {
+          'pointer': final int pointer,
+          'width': final int width,
+          'height': final int height,
+          'rowBytes': final int rowBytes,
+        } =>
+          _codecFromDecodedPlatformImage(pointer, width, height, rowBytes),
+        _ => Future.value(),
+      };
+
  @override
  Future<void> _onCancelled() {
    return remoteImageApi.cancelRequest(requestId);
@@ -12,7 +12,9 @@ class ThumbhashImageRequest extends ImageRequest {
    }

    final Map<String, int> info = await localImageApi.getThumbhash(thumbhash);
-    final frame = await _fromDecodedPlatformImage(info["pointer"]!, info["width"]!, info["height"]!, info["rowBytes"]!);
+    final frame = await _firstFrame(
+      await _codecFromDecodedPlatformImage(info["pointer"]!, info["width"]!, info["height"]!, info["rowBytes"]!),
+    );
    return frame == null ? null : ImageInfo(image: frame.image, scale: scale);
  }

@@ -41,6 +41,23 @@ class RemoteAssetRepository extends DatabaseAccessor<Drift> with $RemoteAssetRep
    return _assetSelectable(id).watchSingleOrNull();
  }

+  Stream<Set<String>> watchDeletedAssetIds(Iterable<String> ids, AssetVisibility visibility) {
+    final idList = ids.toList(growable: false);
+    if (idList.isEmpty) {
+      return Stream.value(const <String>{});
+    }
+
+    final query = _db.remoteAssetEntity.selectOnly()
+      ..addColumns([_db.remoteAssetEntity.id])
+      ..where(
+        _db.remoteAssetEntity.id.isIn(idList) &
+            (_db.remoteAssetEntity.deletedAt.isNotNull() |
+                _db.remoteAssetEntity.visibility.equalsValue(visibility).not()),
+      );
+
+    return query.map((row) => row.read(_db.remoteAssetEntity.id)!).watch().map((rows) => rows.toSet());
+  }
+
  Future<RemoteAsset?> get(String id) {
    return _assetSelectable(id).getSingleOrNull();
  }
@@ -1,7 +1,6 @@
 import 'dart:async';

 import 'package:drift/drift.dart';
-import 'package:easy_localization/easy_localization.dart';
 import 'package:immich_mobile/data/db/main/database.dart';
 import 'package:immich_mobile/data/db/main/table/local/asset.dart';
 import 'package:immich_mobile/data/db/main/table/remote/asset.dart';
@@ -13,6 +12,7 @@ import 'package:immich_mobile/domain/models/timeline.model.dart';
 import 'package:immich_mobile/domain/services/timeline.service.dart';
 import 'package:immich_mobile/infrastructure/repositories/map.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/timeline.repository.drift.dart';
+import 'package:intl/intl.dart';
 import 'package:stream_transform/stream_transform.dart';

@DriftAccessor()
@@ -40,6 +40,7 @@ import 'package:immich_mobile/theme/theme_data.dart';
 import 'package:immich_mobile/utils/bootstrap.dart';
 import 'package:immich_mobile/utils/cache/widgets_binding.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
+import 'package:immich_mobile/utils/fallback_localizations.dart';
 import 'package:immich_mobile/utils/licenses.dart';
 import 'package:immich_mobile/utils/migration.dart';
 import 'package:immich_mobile/wm_executor.dart';
@@ -73,6 +74,7 @@ void main() async {
      ),
    );
  } catch (error, stack) {
+    Logger('main').severe('Failed to start', error, stack);
    runApp(BootstrapErrorWidget(error: error.toString(), stack: stack.toString()));
  }
 }
@@ -279,7 +281,7 @@ class ImmichAppState extends ConsumerState<ImmichApp> with WidgetsBindingObserve
        title: 'Immich',
        debugShowCheckedModeBanner: true,
        scaffoldMessengerKey: scaffoldMessengerKey,
-        localizationsDelegates: context.localizationDelegates,
+        localizationsDelegates: [...context.localizationDelegates, ...fallbackLocalizationDelegates],
        supportedLocales: context.supportedLocales,
        locale: context.locale,
        themeMode: ref.watch(appConfigProvider.select((config) => config.theme.mode)),
@@ -6,6 +6,7 @@ import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:immich_mobile/domain/models/log.model.dart';
 import 'package:immich_mobile/domain/services/log.service.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/extensions/theme_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/routing/router.dart';
@@ -105,7 +106,7 @@ class AppLogPage extends HookWidget {
              style: TextStyle(fontSize: 14.0, color: context.colorScheme.onSurface, fontFamily: "GoogleSansCode"),
            ),
            subtitle: Text(
-              "at ${DateFormat("HH:mm:ss.SSS").format(logMessage.createdAt)} in ${logMessage.logger}",
+              "at ${DateFormat("HH:mm:ss.SSS", resolvedDateTimeLocale()).format(logMessage.createdAt)} in ${logMessage.logger}",
              style: TextStyle(fontSize: 12.0, color: context.colorScheme.onSurfaceSecondary),
            ),
            leading: buildLeadingIcon(logMessage.level),
@@ -22,8 +22,10 @@ import 'package:immich_mobile/providers/server_info.provider.dart';
 import 'package:immich_mobile/providers/view_intent/view_intent_handler.provider.dart';
 import 'package:immich_mobile/providers/websocket.provider.dart';
 import 'package:immich_mobile/routing/router.dart';
+import 'package:immich_mobile/services/immich_logger.service.dart';
 import 'package:immich_mobile/theme/color_scheme.dart';
 import 'package:immich_mobile/theme/theme_data.dart';
+import 'package:immich_mobile/utils/fallback_localizations.dart';
 import 'package:immich_mobile/widgets/common/immich_logo.dart';
 import 'package:immich_mobile/widgets/common/immich_title_text.dart';
 import 'package:logging/logging.dart';
@@ -50,7 +52,7 @@ class BootstrapErrorWidget extends StatelessWidget {
        builder: (lCtx) => MaterialApp(
          title: 'Immich',
          debugShowCheckedModeBanner: true,
-          localizationsDelegates: lCtx.localizationDelegates,
+          localizationsDelegates: [...lCtx.localizationDelegates, ...fallbackLocalizationDelegates],
          supportedLocales: lCtx.supportedLocales,
          locale: lCtx.locale,
          themeMode: ThemeMode.system,
@@ -77,9 +79,12 @@ class BootstrapErrorWidget extends StatelessWidget {
                    ),
                  ),
                  const Divider(height: 1),
-                  const SafeArea(
+                  SafeArea(
                    top: false,
-                    child: Padding(padding: EdgeInsets.fromLTRB(24, 16, 24, 16), child: _BottomPanel()),
+                    child: Padding(
+                      padding: const EdgeInsets.fromLTRB(24, 16, 24, 16),
+                      child: _BottomPanel(startupError: '$error\n\n$stack'),
+                    ),
                  ),
                ],
              ),
@@ -92,7 +97,9 @@ class BootstrapErrorWidget extends StatelessWidget {
 }

 class _BottomPanel extends StatefulWidget {
-  const _BottomPanel();
+  final String startupError;
+
+  const _BottomPanel({required this.startupError});

  @override
  State<_BottomPanel> createState() => _BottomPanelState();
@@ -156,8 +163,8 @@ class _BottomPanelState extends State<_BottomPanel> {
          textAlign: TextAlign.center,
          style: Theme.of(context).textTheme.bodySmall,
        ),
-        Row(
-          mainAxisAlignment: MainAxisAlignment.center,
+        Wrap(
+          alignment: WrapAlignment.center,
          children: [
            _ActionLink(
              icon: Icons.chat_bubble_outline,
@@ -172,6 +179,11 @@ class _BottomPanelState extends State<_BottomPanel> {
                mode: LaunchMode.externalApplication,
              ),
            ),
+            _ActionLink(
+              icon: Icons.share_outlined,
+              label: context.t.share_logs,
+              onTap: () => ImmichLogger.shareLogs(context, startupError: widget.startupError),
+            ),
            if (!_cleared)
              _ActionLink(
                icon: Icons.delete_outline,
@@ -287,21 +299,7 @@ class SplashScreenPageState extends ConsumerState<SplashScreenPage> {
  @override
  void initState() {
    super.initState();
-    unawaited(
-      ref
-          .read(authProvider.notifier)
-          .setOpenApiServiceEndpoint()
-          .then(logConnectionInfo)
-          .whenComplete(() => resumeSession()),
-    );
-  }
-
-  void logConnectionInfo(String? endpoint) {
-    if (endpoint == null) {
-      return;
-    }
-
-    log.info("Resuming session at $endpoint");
+    unawaited(ref.read(authProvider.notifier).setOpenApiServiceEndpoint().whenComplete(() => resumeSession()));
  }

  Future<void> resumeSession() async {
@@ -355,7 +353,7 @@ class SplashScreenPageState extends ConsumerState<SplashScreenPage> {
                }
              },
              onError: (exception) {
-                log.severe('Failed to update auth info with access token: $accessToken');
+                log.severe('Failed to update auth info', exception);
                if (!mounted) {
                  return;
                }
@@ -8,6 +8,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/constants/enums.dart';
 import 'package:immich_mobile/domain/services/timeline.service.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/extensions/theme_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/models/folder/recursive_folder.model.dart';
@@ -201,7 +202,7 @@ class FolderContent extends HookConsumerWidget {
                          style: context.textTheme.titleSmall?.copyWith(fontWeight: FontWeight.w600),
                        ),
                        subtitle: Text(
-                          "${asset.exifInfo.fileSize != null ? "${formatBytes(asset.exifInfo.fileSize ?? 0)} • " : ""}${DateFormat.yMMMd().format(asset.createdAt.toLocal())}",
+                          "${asset.exifInfo.fileSize != null ? "${formatBytes(asset.exifInfo.fileSize ?? 0)} • " : ""}${DateFormat.yMMMd(resolvedDateTimeLocale()).format(asset.createdAt.toLocal())}",
                          style: context.textTheme.bodyMedium?.copyWith(color: context.colorScheme.onSurfaceSecondary),
                        ),
                      ),
@@ -6,6 +6,7 @@ import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:fluttertoast/fluttertoast.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/models/shared_link/shared_link.model.dart';
 import 'package:immich_mobile/providers/server_info.provider.dart';
@@ -179,7 +180,7 @@ class SharedLinkEditPage extends HookConsumerWidget {
      );
    }

-    String formatDateTime(DateTime dateTime) => DateFormat.yMMMd(context.locale.toString()).add_Hm().format(dateTime);
+    String formatDateTime(DateTime dateTime) => DateFormat.yMMMd(resolvedDateTimeLocale()).add_Hm().format(dateTime);

    DateTime? getExpiresAtFromPreset(Duration preset) => preset == Duration.zero ? null : DateTime.now().add(preset);

@@ -121,14 +121,14 @@ class DeleteAction extends AssetActionBuilder {
    required bool isLocalOnly,
  }) async {
    final assetService = ref.read(assetServiceProvider);
+    final message = context.t.trash_action_prompt(count: remoteIds.length);
    if (localIds.isNotEmpty) {
-      await _cleanupLocalAssets(context, ref, localIds, isLocalOnly: isLocalOnly);
-      if (!context.mounted) {
+      final count = await _cleanupLocalAssets(context, ref, localIds, isLocalOnly: isLocalOnly);
+      if (count <= 0) {
        return null;
      }
    }

-    final message = context.t.trash_action_prompt(count: remoteIds.length);
    await assetService.trash(remoteIds);
    return message;
  }
@@ -417,21 +417,57 @@ final sharedWithPartnerProvider = StreamProvider.autoDispose<Iterable<Partner>>(
  return ref.watch(partnerServiceProvider).search(currentUser.id, .sharedWith);
 });

+class _QuickAccessItem {
+  final Widget leading;
+  final String title;
+  final VoidCallback onTap;
+  final EdgeInsetsGeometry? contentPadding;
+
+  const _QuickAccessItem({required this.leading, required this.title, required this.onTap, this.contentPadding});
+}
+
 class _QuickAccessButtonList extends ConsumerWidget {
  const _QuickAccessButtonList();

+  static const _tileRadius = 20.0;
+
  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final partnerSharedWithAsync = ref.watch(sharedWithPartnerProvider);
    final partners = partnerSharedWithAsync.valueOrNull ?? [];

+    final items = [
+      _QuickAccessItem(
+        leading: const Icon(Icons.folder_outlined, size: 26),
+        title: context.t.folders,
+        onTap: () => context.pushRoute(FolderRoute()),
+      ),
+      _QuickAccessItem(
+        leading: const Icon(Icons.lock_outline_rounded, size: 26),
+        title: context.t.locked_folder,
+        onTap: () => context.pushRoute(const LockedFolderRoute()),
+      ),
+      _QuickAccessItem(
+        leading: const Icon(Icons.group_outlined, size: 26),
+        title: context.t.partners,
+        onTap: () => context.pushRoute(const PartnerRoute()),
+      ),
+      for (final partner in partners)
+        _QuickAccessItem(
+          contentPadding: const EdgeInsets.only(left: 12.0, right: 18.0),
+          leading: PartnerUserAvatar(userId: partner.id, name: partner.name),
+          title: context.t.partner_list_user_photos(user: partner.name),
+          onTap: () => context.pushRoute(PartnerDetailRoute(partner: partner)),
+        ),
+    ];
+
    return SliverPadding(
      padding: const EdgeInsets.only(left: 16, top: 12, right: 16, bottom: 32),
      sliver: SliverToBoxAdapter(
        child: DecoratedBox(
          decoration: BoxDecoration(
            border: Border.all(color: context.colorScheme.onSurface.withAlpha(10), width: 1),
-            borderRadius: const BorderRadius.all(Radius.circular(20)),
+            borderRadius: const BorderRadius.all(Radius.circular(_tileRadius)),
            gradient: LinearGradient(
              colors: [
                context.colorScheme.primary.withAlpha(10),
@@ -442,83 +478,33 @@ class _QuickAccessButtonList extends ConsumerWidget {
              end: Alignment.bottomCenter,
            ),
          ),
-          child: ListView(
+          child: ListView.builder(
            shrinkWrap: true,
            padding: EdgeInsets.zero,
            physics: const NeverScrollableScrollPhysics(),
-            children: [
-              ListTile(
+            itemCount: items.length,
+            itemBuilder: (context, index) {
+              final item = items[index];
+              final isFirst = index == 0;
+              final isLast = index == items.length - 1;
+              return ListTile(
                shape: RoundedRectangleBorder(
                  borderRadius: BorderRadius.only(
-                    topLeft: const Radius.circular(20),
-                    topRight: const Radius.circular(20),
-                    bottomLeft: Radius.circular(partners.isEmpty ? 20 : 0),
-                    bottomRight: Radius.circular(partners.isEmpty ? 20 : 0),
+                    topLeft: Radius.circular(isFirst ? _tileRadius : 0),
+                    topRight: Radius.circular(isFirst ? _tileRadius : 0),
+                    bottomLeft: Radius.circular(isLast ? _tileRadius : 0),
+                    bottomRight: Radius.circular(isLast ? _tileRadius : 0),
                  ),
                ),
-                leading: const Icon(Icons.folder_outlined, size: 26),
-                title: Text(
-                  context.t.folders,
-                  style: context.textTheme.titleSmall?.copyWith(fontWeight: FontWeight.w500),
-                ),
-                onTap: () => context.pushRoute(FolderRoute()),
-              ),
-              ListTile(
-                leading: const Icon(Icons.lock_outline_rounded, size: 26),
-                title: Text(
-                  context.t.locked_folder,
-                  style: context.textTheme.titleSmall?.copyWith(fontWeight: FontWeight.w500),
-                ),
-                onTap: () => context.pushRoute(const LockedFolderRoute()),
-              ),
-              ListTile(
-                leading: const Icon(Icons.group_outlined, size: 26),
-                title: Text(
-                  context.t.partners,
-                  style: context.textTheme.titleSmall?.copyWith(fontWeight: FontWeight.w500),
-                ),
-                onTap: () => context.pushRoute(const PartnerRoute()),
-              ),
-              _PartnerList(partners: partners.toList()),
-            ],
+                contentPadding: item.contentPadding,
+                leading: item.leading,
+                title: Text(item.title, style: context.textTheme.titleSmall?.copyWith(fontWeight: FontWeight.w500)),
+                onTap: item.onTap,
+              );
+            },
          ),
        ),
      ),
    );
  }
 }
-
-class _PartnerList extends StatelessWidget {
-  const _PartnerList({required this.partners});
-
-  final List<Partner> partners;
-
-  @override
-  Widget build(BuildContext context) {
-    return ListView.builder(
-      padding: EdgeInsets.zero,
-      physics: const NeverScrollableScrollPhysics(),
-      itemCount: partners.length,
-      shrinkWrap: true,
-      itemBuilder: (context, index) {
-        final partner = partners[index];
-        final isLastItem = index == partners.length - 1;
-        return ListTile(
-          shape: RoundedRectangleBorder(
-            borderRadius: BorderRadius.only(
-              bottomLeft: Radius.circular(isLastItem ? 20 : 0),
-              bottomRight: Radius.circular(isLastItem ? 20 : 0),
-            ),
-          ),
-          contentPadding: const EdgeInsets.only(left: 12.0, right: 18.0),
-          leading: PartnerUserAvatar(userId: partner.id, name: partner.name),
-          title: Text(
-            context.t.partner_list_user_photos(user: partner.name),
-            style: const TextStyle(fontWeight: FontWeight.w500),
-          ),
-          onTap: () => context.pushRoute(PartnerDetailRoute(partner: partner)),
-        );
-      },
-    );
-  }
-}
@@ -3,7 +3,9 @@ import 'dart:async';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/domain/services/search.service.dart';
+import 'package:immich_mobile/infrastructure/repositories/remote_asset.repository.dart';
 import 'package:immich_mobile/models/search/search_filter.model.dart';
+import 'package:immich_mobile/providers/infrastructure/db.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/search.provider.dart';

 final searchPreFilterProvider = NotifierProvider<SearchFilterProvider, SearchFilter?>(SearchFilterProvider.new);
@@ -32,16 +34,21 @@ class SearchState {
 }

 final paginatedSearchProvider = StateNotifierProvider<PaginatedSearchNotifier, SearchState>(
-  (ref) => PaginatedSearchNotifier(ref.watch(searchServiceProvider)),
+  (ref) => PaginatedSearchNotifier(ref.watch(searchServiceProvider), ref.watch(driftProvider).remoteAssetRepository),
 );

 class PaginatedSearchNotifier extends StateNotifier<SearchState> {
  final SearchService _searchService;
+  final RemoteAssetRepository _remoteAssetRepository;
  final _assetCountController = StreamController<int>.broadcast();

-  PaginatedSearchNotifier(this._searchService) : super(const SearchState());
+  StreamSubscription<Set<String>>? _deletedIdsSubscription;
+  List<BaseAsset> _results = const [];
+  int? _nextPage = 1;

-  Stream<int> get assetCount => _assetCountController.stream;
+  PaginatedSearchNotifier(this._searchService, this._remoteAssetRepository) : super(const SearchState());
+
+  Stream<int> get assetCount => _assetCountController.stream.distinct();

  Future<void> search(SearchFilter filter) async {
    if (state.nextPage == null || state.isLoading) {
@@ -52,24 +59,47 @@ class PaginatedSearchNotifier extends StateNotifier<SearchState> {

    final result = await _searchService.search(filter, state.nextPage!);

+    if (!mounted) {
+      return;
+    }
+
    if (result == null) {
      state = SearchState(assets: state.assets, nextPage: state.nextPage);
      return;
    }

-    final assets = [...state.assets, ...result.assets];
-    state = SearchState(assets: assets, nextPage: result.nextPage);
-
-    _assetCountController.add(assets.length);
+    _results = [..._results, ...result.assets];
+    _nextPage = result.nextPage;
+    _watchDeletedIds(filter.display.isArchive ? AssetVisibility.archive : AssetVisibility.timeline);
  }

  void clear() {
-    state = const SearchState();
-    _assetCountController.add(0);
+    unawaited(_deletedIdsSubscription?.cancel());
+    _deletedIdsSubscription = null;
+    _results = const [];
+    _nextPage = 1;
+    _emit(const {});
+  }
+
+  void _watchDeletedIds(AssetVisibility visibility) {
+    unawaited(_deletedIdsSubscription?.cancel());
+
+    final ids = _results.whereType<RemoteAsset>().map((asset) => asset.id);
+    _deletedIdsSubscription = _remoteAssetRepository.watchDeletedAssetIds(ids, visibility).listen(_emit);
+  }
+
+  void _emit(Set<String> deletedIds) {
+    final visible = deletedIds.isEmpty
+        ? _results
+        : _results.where((asset) => asset is! RemoteAsset || !deletedIds.contains(asset.id)).toList(growable: false);
+
+    state = SearchState(assets: visible, nextPage: _nextPage);
+    _assetCountController.add(visible.length);
  }

  @override
  void dispose() {
+    unawaited(_deletedIdsSubscription?.cancel());
    unawaited(_assetCountController.close());
    super.dispose();
  }
@@ -99,7 +99,7 @@ class TechnicalDetails extends ConsumerWidget {
  static String _getFileInfo(BaseAsset asset, ExifInfo? exifInfo) {
    final height = asset.height;
    final width = asset.width;
-    final resolution = (width != null && height != null) ? "$width x $height" : null;
+    final resolution = (width != null && height != null) ? "$width × $height" : null;
    final fileSize = exifInfo?.fileSize != null ? formatBytes(exifInfo!.fileSize!) : null;

    return switch ((fileSize, resolution)) {
@@ -4,6 +4,7 @@ import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/domain/models/events.model.dart';
 import 'package:immich_mobile/domain/models/memory.model.dart';
 import 'package:immich_mobile/domain/utils/event_stream.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/presentation/widgets/memory/memory_title.widget.dart';
 import 'package:immich_mobile/routing/router.dart';
@@ -16,7 +17,7 @@ class MemoryBottomInfo extends StatelessWidget {

  @override
  Widget build(BuildContext context) {
-    final df = DateFormat.yMMMMd();
+    final df = DateFormat.yMMMMd(resolvedDateTimeLocale());
    final fileCreatedDate = asset.createdAt;
    return Padding(
      padding: const EdgeInsets.all(16.0),
@@ -5,6 +5,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/data/store.dart';
 import 'package:immich_mobile/domain/models/person.model.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/utils/debug_print.dart';
 import 'package:immich_mobile/widgets/common/immich_toast.dart';
@@ -61,7 +62,7 @@ class _PersonBirthdayEditFormState extends ConsumerState<PersonBirthdayEditForm>
        child: ClipRRect(
          borderRadius: const BorderRadius.all(Radius.circular(16.0)),
          child: ScrollDatePicker(
-            viewType: datePickerColumnOrder(DateFormat.yMd(context.locale.toLanguageTag()).pattern),
+            viewType: datePickerColumnOrder(DateFormat.yMd(resolvedDateTimeLocale()).pattern),
            options: DatePickerOptions(
              backgroundColor: context.colorScheme.surfaceContainerHigh,
              itemExtent: 50,
@@ -1,5 +1,6 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:intl/intl.dart';

@@ -11,11 +12,11 @@ sealed class DateFilterInputModel {
    // If date range is less than 24 hours, set the end date to the end of the day
    final date = asDateTimeRange();
    if (date.end.difference(date.start).inHours < 24) {
-      return DateFormat.yMMMd().format(date.start.toLocal());
+      return DateFormat.yMMMd(resolvedDateTimeLocale()).format(date.start.toLocal());
    } else {
      return context.t.search_filter_date_interval(
-        start: DateFormat.yMMMd().format(date.start.toLocal()),
-        end: DateFormat.yMMMd().format(date.end.toLocal()),
+        start: DateFormat.yMMMd(resolvedDateTimeLocale()).format(date.start.toLocal()),
+        end: DateFormat.yMMMd(resolvedDateTimeLocale()).format(date.end.toLocal()),
      );
    }
  }
@@ -7,6 +7,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/domain/models/timeline.model.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/extensions/theme_extensions.dart';
 import 'package:immich_mobile/providers/haptic_feedback.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/readonly_mode.provider.dart';
@@ -27,15 +28,15 @@ class TimelineHeader extends HookWidget {
    required this.assetOffset,
  });

-  String _formatMonth(BuildContext context, DateTime date) {
+  String _formatMonth(DateTime date) {
    final formatter = date.year == DateTime.now().year
-        ? DateFormat.MMMM(context.locale.toLanguageTag())
-        : DateFormat.yMMMM(context.locale.toLanguageTag());
+        ? DateFormat.MMMM(resolvedDateTimeLocale())
+        : DateFormat.yMMMM(resolvedDateTimeLocale());
    return formatter.format(date);
  }

-  String _formatDay(BuildContext context, DateTime date) {
-    final formatter = DateFormat.yMMMEd(context.locale.toLanguageTag());
+  String _formatDay(DateTime date) {
+    final formatter = DateFormat.yMMMEd(resolvedDateTimeLocale());
    return formatter.format(date);
  }

@@ -61,7 +62,7 @@ class TimelineHeader extends HookWidget {
              Row(
                children: [
                  Text(
-                    toBeginningOfSentenceCase(_formatMonth(context, date)),
+                    toBeginningOfSentenceCase(_formatMonth(date)),
                    style: context.textTheme.labelLarge?.copyWith(fontSize: 24),
                  ),
                  const Spacer(),
@@ -72,7 +73,7 @@ class TimelineHeader extends HookWidget {
              Row(
                children: [
                  Text(
-                    toBeginningOfSentenceCase(_formatDay(context, date)),
+                    toBeginningOfSentenceCase(_formatDay(date)),
                    style: context.textTheme.labelLarge?.copyWith(fontSize: 15),
                  ),
                  const Spacer(),
@@ -7,6 +7,7 @@ import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/domain/models/timeline.model.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/extensions/theme_extensions.dart';
 import 'package:immich_mobile/presentation/widgets/timeline/constants.dart';
 import 'package:immich_mobile/presentation/widgets/timeline/segment.model.dart';
@@ -62,7 +63,7 @@ List<_Segment> _buildSegments({required List<Segment> layoutSegments, required d
    return [];
  }

-  final formatter = DateFormat.yMMM();
+  final formatter = DateFormat.yMMM(resolvedDateTimeLocale());
  DateTime? lastDate;
  double lastOffset = -offsetThreshold;
  for (final layoutSegment in layoutSegments) {
@@ -328,6 +328,8 @@ class _SliverTimelineState extends ConsumerState<_SliverTimeline> with WidgetsBi
    final isMultiSelectStatusVisible = !isSelectionMode && isMultiSelectEnabled;
    final isBottomWidgetVisible =
        widget.bottomSheet != null && (isMultiSelectStatusVisible || widget.persistentBottomBar);
+    final smoothScrubbing = ref.watch(appConfigProvider.select((config) => config.timeline.smoothScrubbing));
+    final snapToMonth = widget.snapToMonth && !smoothScrubbing;

    return PopScope(
      canPop: !isMultiSelectEnabled,
@@ -409,7 +411,7 @@ class _SliverTimelineState extends ConsumerState<_SliverTimeline> with WidgetsBi
                      final Widget timeline;
                      if (widget.withScrubber) {
                        timeline = Scrubber(
-                          snapToMonth: widget.snapToMonth,
+                          snapToMonth: snapToMonth,
                          layoutSegments: segments,
                          timelineHeight: maxHeight,
                          topPadding: topPadding,
@@ -84,8 +84,7 @@ class AppLifeCycleNotifier extends StateNotifier<AppLifeCycleEnum> {
    // Needs to be logged in
    if (isAuthenticated) {
      // switch endpoint if needed
-      final endpoint = await _ref.read(authProvider.notifier).setOpenApiServiceEndpoint();
-      _log.info("Using server URL: $endpoint");
+      await _ref.read(authProvider.notifier).setOpenApiServiceEndpoint();

      await _ref.read(serverInfoProvider.notifier).getServerVersion();
    }
@@ -6,7 +6,6 @@ import 'package:immich_mobile/models/upload/share_intent_attachment.model.dart';
 import 'package:immich_mobile/routing/router.dart';
 import 'package:immich_mobile/services/foreground_upload.service.dart';
 import 'package:immich_mobile/services/share_intent_service.dart';
-import 'package:logging/logging.dart';
 import 'package:path/path.dart' as p;

 final shareIntentUploadProvider = StateNotifierProvider<ShareIntentUploadStateNotifier, List<ShareIntentAttachment>>(
@@ -21,7 +20,6 @@ class ShareIntentUploadStateNotifier extends StateNotifier<List<ShareIntentAttac
  final AppRouter router;
  final ForegroundUploadService _foregroundUploadService;
  final ShareIntentService _shareIntentService;
-  final Logger _logger = Logger('ShareIntentUploadStateNotifier');

  ShareIntentUploadStateNotifier(this.router, this._foregroundUploadService, this._shareIntentService) : super([]);

@@ -74,8 +72,7 @@ class ShareIntentUploadStateNotifier extends StateNotifier<List<ShareIntentAttac
      onSuccess: (fileId, _) {
        _updateStatus(fileId, UploadStatus.complete, progress: 1.0);
      },
-      onError: (fileId, errorMessage) {
-        _logger.warning("Upload failed for file: $fileId, error: $errorMessage");
+      onError: (fileId, _) {
        _updateStatus(fileId, UploadStatus.failed);
      },
    );
@@ -221,8 +221,6 @@ class BackupNotifier extends StateNotifier<BackupState> {
  }

  void _handleForegroundBackupError(String localAssetId, String errorMessage) {
-    _logger.severe("Upload failed for $localAssetId: $errorMessage");
-
    final currentItem = state.uploadItems[localAssetId];
    if (currentItem != null) {
      state = state.copyWith(
@@ -88,7 +88,7 @@ class UploadRepository {
      } on RequestAbortedException {
        rethrow;
      } on ClientException catch (error) {
-        logger.warning("Upload $logContext failed before a response, resending once: $error");
+        logger.warning("Upload $logContext failed before a response, resending once", error);
        response = await client.send(buildRequest());
      }

@@ -124,8 +124,8 @@ class UploadRepository {
      logger.warning("Upload $logContext was cancelled");
      return UploadResult.cancelled();
    } catch (error, stackTrace) {
-      logger.warning("Error uploading $logContext: $error: $stackTrace");
-      return UploadResult.error(errorMessage: error.toString());
+      logger.warning("Error uploading $logContext", error, stackTrace);
+      return UploadResult(isSuccess: false, isCancelled: false, errorMessage: error.toString(), error: error);
    }
  }
 }
@@ -166,6 +166,7 @@ class UploadResult {
  final String? remoteAssetId;
  final String? errorMessage;
  final int? statusCode;
+  final Object? error;

  const UploadResult({
    required this.isSuccess,
@@ -173,6 +174,7 @@ class UploadResult {
    this.remoteAssetId,
    this.errorMessage,
    this.statusCode,
+    this.error,
  });

  factory UploadResult.success({required String remoteAssetId}) {
@@ -162,6 +162,7 @@ class AuthService {
      final localEndpoint = _authRepository.getLocalEndpoint();
      if (localEndpoint != null) {
        await _apiService.resolveAndSetEndpoint(localEndpoint);
+        _log.info("Using local endpoint");
        return localEndpoint;
      }
    } catch (error, stackTrace) {
@@ -181,9 +182,11 @@ class AuthService {
      return null;
    }

-    for (final endpoint in endpointList) {
+    for (var i = 0; i < endpointList.length; i++) {
      try {
-        return await _apiService.resolveAndSetEndpoint(endpoint.url);
+        final url = await _apiService.resolveAndSetEndpoint(endpointList[i].url);
+        _log.info("Using external endpoint ${i + 1}");
+        return url;
      } on ApiException catch (error) {
        _log.severe("Cannot resolve endpoint", error);
        continue;
@@ -182,6 +182,7 @@ class ForegroundUploadService {
        if (result.isSuccess) {
          onSuccess?.call(fileId, result.remoteAssetId!);
        } else if (!result.isCancelled && result.errorMessage != null) {
+          _logger.warning("Error(${result.statusCode}) uploading $fileId", result.error ?? result.errorMessage);
          onError?.call(fileId, result.errorMessage!);
        }
      },
@@ -395,7 +396,8 @@ class ForegroundUploadService {
      } else if (result.errorMessage != null) {
        _logger.severe(
          () =>
-              "Error(${result.statusCode}) uploading ${asset.localId} | $originalFileName | Created on ${asset.createdAt} | ${result.errorMessage}",
+              "Error(${result.statusCode}) uploading ${asset.localId} | $originalFileName | Created on ${asset.createdAt}",
+          result.error ?? result.errorMessage,
        );

        callbacks.onError?.call(asset.localId!, result.errorMessage!);
@@ -2,7 +2,11 @@ import 'dart:async';
 import 'dart:io';

 import 'package:flutter/widgets.dart';
+import 'package:immich_mobile/data/db/logger/database.dart';
+import 'package:immich_mobile/data/db/main/database.dart';
+import 'package:immich_mobile/domain/models/log.model.dart';
 import 'package:immich_mobile/domain/services/log.service.dart';
+import 'package:immich_mobile/infrastructure/repositories/log.repository.dart';
 import 'package:path_provider/path_provider.dart';
 import 'package:share_plus/share_plus.dart';

@@ -15,15 +19,37 @@ import 'package:share_plus/share_plus.dart';
 /// Logs can be shared by calling the `shareLogs` method, which will open a share dialog
 /// and generate a csv file.
 abstract final class ImmichLogger {
-  static Future<void> shareLogs(BuildContext context) async {
+  // the startup error screen can show before the log service starts, and then the startup error was not logged
+  static Future<List<LogMessage>> _read(String? startupError) async {
+    try {
+      return await LogService.I.getMessages();
+    } on LoggerUnInitializedException {
+      final connection = await openSqliteConnection(name: 'immich_logs');
+      final logs = DriftLogger.sqlite(connection);
+      try {
+        return [
+          // if the log service had started, main would have logged this already
+          if (startupError != null)
+            LogMessage(message: startupError, level: LogLevel.severe, createdAt: DateTime.now()),
+          ...await LogRepository(logs).getAll(),
+        ];
+      } finally {
+        await logs.close();
+        await connection.close();
+      }
+    }
+  }
+
+  static Future<void> shareLogs(BuildContext context, {String? startupError}) async {
    final tempDir = await getTemporaryDirectory();
    final dateTime = DateTime.now().toIso8601String();
-    final filePath = '${tempDir.path}/Immich_log_$dateTime.log';
+    final safeTimestamp = dateTime.replaceAll(':', '-');
+    final filePath = '${tempDir.path}/Immich_log_$safeTimestamp.log';
    final logFile = await File(filePath).create();
    final io = logFile.openWrite();
    try {
      // Write messages
-      for (final m in await LogService.I.getMessages()) {
+      for (final m in await _read(startupError)) {
        final created = m.createdAt;
        final level = m.level.name.padRight(8);
        final logger = (m.logger ?? "<UNKNOWN_LOGGER>").padRight(20);
@@ -26,7 +26,7 @@ class OAuthService {
    );

    final authUrl = dto?.url;
-    log.info('Received Authorization URL: $authUrl');
+    log.info('Received Authorization URL');

    return authUrl;
  }
@@ -34,7 +34,7 @@ class OAuthService {
  Future<LoginResponseDto?> oAuthLogin(String oauthUrl, String state, String codeVerifier) async {
    String result = await FlutterWebAuth2.authenticate(url: oauthUrl, callbackUrlScheme: callbackUrlScheme);

-    log.info('Received OAuth callback: $result');
+    log.info('Received OAuth callback');

    if (result.startsWith('app.immich:/oauth-callback')) {
      result = result.replaceAll('app.immich:/oauth-callback', 'app.immich:///oauth-callback');
@@ -3,6 +3,7 @@ import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/data/data_controller.dart';
 import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/services/log.service.dart';
+import 'package:immich_mobile/domain/services/store.service.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/infrastructure/repositories/log.repository.dart';
@@ -72,6 +73,7 @@ abstract final class Bootstrap {
    await LogService.init(
      logRepository: LogRepository(dataController.logDb),
      settingsRepository: settingsRepo,
+      storeService: StoreService.I,
      shouldBuffer: shouldBufferLogs,
    );

@@ -0,0 +1,23 @@
+import 'package:flutter/cupertino.dart';
+import 'package:flutter/material.dart';
+
+// Flutter ships no Material or Cupertino strings for some of our languages, use English for those
+const List<LocalizationsDelegate> fallbackLocalizationDelegates = [
+  _FallbackLocalizationsDelegate<MaterialLocalizations>(DefaultMaterialLocalizations.delegate),
+  _FallbackLocalizationsDelegate<CupertinoLocalizations>(DefaultCupertinoLocalizations.delegate),
+];
+
+class _FallbackLocalizationsDelegate<T> extends LocalizationsDelegate<T> {
+  final LocalizationsDelegate<T> delegate;
+
+  const _FallbackLocalizationsDelegate(this.delegate);
+
+  @override
+  bool isSupported(Locale locale) => true;
+
+  @override
+  Future<T> load(Locale locale) => delegate.load(const Locale('en'));
+
+  @override
+  bool shouldReload(_FallbackLocalizationsDelegate<T> old) => false;
+}
@@ -37,6 +37,7 @@ final Map<String, Map<String, Object?>> openApiPatches = {
    'ffmpeg': {
      'realtime': {'enabled': false},
    },
+    'passkey': {'enabled': false},
  },
  'ServerConfigDto': {
    'mapLightStyleUrl': 'https://tiles.immich.cloud/v1/style/light.json',
@@ -55,12 +56,16 @@ final Map<String, Map<String, Object?>> openApiPatches = {
  'PeopleResponse': {'updateStrategy': 'everyone'},
  'PersonResponseDto': {'otherPeople': const [], 'sharedBy': const [], 'sharedWith': const []},
  'ServerVersionResponseDto': {'featureLevel': 0},
+  'WorkflowResponseDto': {'logging': false},
+  'AdminConfigDto': {
+    'passkey': {'enabled': false, 'domain': null, 'additionalDomains': const []},
+  },
  'UserConfigDto': {
    'notifications': {
      'smtp': {'enabled': false},
    },
+    'passkey': {'enabled': false},
  },
-  'WorkflowResponseDto': {'logging': false},
 };

 // ignore: unused-code
@@ -3,6 +3,7 @@ import 'package:flutter/material.dart';
 import 'package:flutter_hooks/flutter_hooks.dart';
 import 'package:freezed_annotation/freezed_annotation.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/extensions/duration_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/widgets/common/dropdown_search_menu.dart';
@@ -108,7 +109,7 @@ class _DateTimePicker extends HookWidget {
    }

    void popWithDateTime() {
-      final formattedDateTime = DateFormat("yyyy-MM-dd'T'HH:mm:ss").format(date.value);
+      final formattedDateTime = DateFormat("yyyy-MM-dd'T'HH:mm:ss", 'en').format(date.value);
      final dtWithOffset =
          formattedDateTime + Duration(milliseconds: tzOffset.value.offsetInMilliseconds).formatAsOffset();
      context.pop(dtWithOffset);
@@ -149,7 +150,10 @@ class _DateTimePicker extends HookWidget {
              1,
            ),
            trailing: Icon(Icons.edit_outlined, size: 18, color: context.primaryColor),
-            title: Text(DateFormat("dd-MM-yyyy hh:mm a").format(date.value), style: context.textTheme.bodyMedium),
+            title: Text(
+              DateFormat("dd-MM-yyyy hh:mm a", resolvedDateTimeLocale()).format(date.value),
+              style: context.textTheme.bodyMedium,
+            ),
            onTap: pickDate,
          ),
          const SizedBox(height: 24),
@@ -36,64 +36,63 @@ class _MesmerizingSliverAppBarState extends ConsumerState<MesmerizingSliverAppBa
  @override
  Widget build(BuildContext context) {
    final isMultiSelectEnabled = ref.watch(multiSelectProvider.select((s) => s.isEnabled));
+    Widget hideWhenSelecting(Widget child) => IgnorePointer(
+      ignoring: isMultiSelectEnabled,
+      child: AnimatedOpacity(duration: Durations.medium1, opacity: isMultiSelectEnabled ? 0 : 1, child: child),
+    );

-    return isMultiSelectEnabled
-        ? SliverToBoxAdapter(
-            child: switch (_scrollProgress) {
-              < 0.8 => const SizedBox(height: 120),
-              _ => const SizedBox(height: 352),
-            },
-          )
-        : SliverAppBar(
-            expandedHeight: 300.0,
-            floating: false,
-            pinned: true,
-            snap: false,
-            elevation: 0,
-            leading: IconButton(
-              icon: Icon(
-                Platform.isIOS ? Icons.arrow_back_ios_new_rounded : Icons.arrow_back,
-                color: Color.lerp(Colors.white, context.primaryColor, _scrollProgress),
-                shadows: [
-                  _scrollProgress < 0.95
-                      ? Shadow(offset: const Offset(0, 2), blurRadius: 5, color: Colors.black.withValues(alpha: 0.5))
-                      : const Shadow(offset: Offset(0, 2), blurRadius: 0, color: Colors.transparent),
-                ],
-              ),
-              onPressed: () {
-                context.pop();
-              },
-            ),
-            flexibleSpace: Builder(
-              builder: (context) {
-                final settings = context.dependOnInheritedWidgetOfExactType<FlexibleSpaceBarSettings>();
-                final scrollProgress = _calculateScrollProgress(settings);
+    return SliverAppBar(
+      expandedHeight: 300.0,
+      floating: false,
+      pinned: true,
+      snap: false,
+      elevation: 0,
+      leading: hideWhenSelecting(
+        IconButton(
+          icon: Icon(
+            Platform.isIOS ? Icons.arrow_back_ios_new_rounded : Icons.arrow_back,
+            color: Color.lerp(Colors.white, context.primaryColor, _scrollProgress),
+            shadows: [
+              _scrollProgress < 0.95
+                  ? Shadow(offset: const Offset(0, 2), blurRadius: 5, color: Colors.black.withValues(alpha: 0.5))
+                  : const Shadow(offset: Offset(0, 2), blurRadius: 0, color: Colors.transparent),
+            ],
+          ),
+          onPressed: () {
+            context.pop();
+          },
+        ),
+      ),
+      flexibleSpace: Builder(
+        builder: (context) {
+          final settings = context.dependOnInheritedWidgetOfExactType<FlexibleSpaceBarSettings>();
+          final scrollProgress = _calculateScrollProgress(settings);

-                // Update scroll progress for the leading button
-                WidgetsBinding.instance.addPostFrameCallback((_) {
-                  if (mounted && _scrollProgress != scrollProgress) {
-                    setState(() {
-                      _scrollProgress = scrollProgress;
-                    });
-                  }
-                });
+          // Update scroll progress for the leading button
+          WidgetsBinding.instance.addPostFrameCallback((_) {
+            if (mounted && _scrollProgress != scrollProgress) {
+              setState(() {
+                _scrollProgress = scrollProgress;
+              });
+            }
+          });

-                return FlexibleSpaceBar(
-                  centerTitle: true,
-                  title: AnimatedSwitcher(
-                    duration: const Duration(milliseconds: 200),
-                    child: scrollProgress > 0.95
-                        ? Text(
-                            widget.title,
-                            style: TextStyle(color: context.primaryColor, fontWeight: FontWeight.w600, fontSize: 18),
-                          )
-                        : null,
-                  ),
-                  background: _ExpandedBackground(scrollProgress: scrollProgress, title: widget.title),
-                );
-              },
+          return FlexibleSpaceBar(
+            centerTitle: true,
+            title: AnimatedSwitcher(
+              duration: const Duration(milliseconds: 200),
+              child: scrollProgress > 0.95
+                  ? Text(
+                      widget.title,
+                      style: TextStyle(color: context.primaryColor, fontWeight: FontWeight.w600, fontSize: 18),
+                    )
+                  : null,
            ),
+            background: _ExpandedBackground(scrollProgress: scrollProgress, title: widget.title),
          );
+        },
+      ),
+    );
  }
 }

@@ -7,6 +7,7 @@ import 'package:flutter/material.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
 import 'package:immich_mobile/domain/models/person.model.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/presentation/widgets/images/remote_image_provider.dart';
 import 'package:immich_mobile/presentation/widgets/sliver_app_bar/item_count_text.widget.dart';
@@ -53,6 +54,10 @@ class _MesmerizingSliverAppBarState extends ConsumerState<PersonSliverAppBar> {
  @override
  Widget build(BuildContext context) {
    final isMultiSelectEnabled = ref.watch(multiSelectProvider.select((s) => s.isEnabled));
+    Widget hideWhenSelecting(Widget child) => IgnorePointer(
+      ignoring: isMultiSelectEnabled,
+      child: AnimatedOpacity(duration: Durations.medium1, opacity: isMultiSelectEnabled ? 0 : 1, child: child),
+    );
    final Color? actionIconColor = Color.lerp(Colors.white, context.primaryColor, _scrollProgress);
    final List<Shadow> actionIconShadows = [
      if (_scrollProgress < 0.95)
@@ -61,74 +66,74 @@ class _MesmerizingSliverAppBarState extends ConsumerState<PersonSliverAppBar> {
        const Shadow(offset: Offset(0, 2), blurRadius: 0, color: Colors.transparent),
    ];

-    return isMultiSelectEnabled
-        ? SliverToBoxAdapter(
-            child: switch (_scrollProgress) {
-              < 0.8 => const SizedBox(height: 120),
-              _ => const SizedBox(height: 352),
-            },
-          )
-        : SliverAppBar(
-            expandedHeight: 300.0,
-            floating: false,
-            pinned: true,
-            snap: false,
-            elevation: 0,
-            leading: IconButton(
-              icon: Icon(
-                Platform.isIOS ? Icons.arrow_back_ios_new_rounded : Icons.arrow_back,
-                color: Color.lerp(Colors.white, context.primaryColor, _scrollProgress),
-                shadows: [
-                  _scrollProgress < 0.95
-                      ? Shadow(offset: const Offset(0, 2), blurRadius: 5, color: Colors.black.withValues(alpha: 0.5))
-                      : const Shadow(offset: Offset(0, 2), blurRadius: 0, color: Colors.transparent),
-                ],
-              ),
-              onPressed: () {
-                context.pop();
-              },
-            ),
-            actions: [
-              IconButton(
-                icon: Icon(Icons.more_vert, color: actionIconColor, shadows: actionIconShadows),
-                onPressed: widget.onShowOptions,
-              ),
+    return SliverAppBar(
+      expandedHeight: 300.0,
+      floating: false,
+      pinned: true,
+      snap: false,
+      elevation: 0,
+      leading: hideWhenSelecting(
+        IconButton(
+          icon: Icon(
+            Platform.isIOS ? Icons.arrow_back_ios_new_rounded : Icons.arrow_back,
+            color: Color.lerp(Colors.white, context.primaryColor, _scrollProgress),
+            shadows: [
+              _scrollProgress < 0.95
+                  ? Shadow(offset: const Offset(0, 2), blurRadius: 5, color: Colors.black.withValues(alpha: 0.5))
+                  : const Shadow(offset: Offset(0, 2), blurRadius: 0, color: Colors.transparent),
            ],
-            flexibleSpace: Builder(
-              builder: (context) {
-                final settings = context.dependOnInheritedWidgetOfExactType<FlexibleSpaceBarSettings>();
-                final scrollProgress = _calculateScrollProgress(settings);
+          ),
+          onPressed: () {
+            context.pop();
+          },
+        ),
+      ),
+      actions: [
+        hideWhenSelecting(
+          IconButton(
+            icon: Icon(Icons.more_vert, color: actionIconColor, shadows: actionIconShadows),
+            onPressed: widget.onShowOptions,
+          ),
+        ),
+      ],
+      flexibleSpace: Builder(
+        builder: (context) {
+          final settings = context.dependOnInheritedWidgetOfExactType<FlexibleSpaceBarSettings>();
+          final scrollProgress = _calculateScrollProgress(settings);

-                // Update scroll progress for the leading button
-                WidgetsBinding.instance.addPostFrameCallback((_) {
-                  if (mounted && _scrollProgress != scrollProgress) {
-                    setState(() {
-                      _scrollProgress = scrollProgress;
-                    });
-                  }
-                });
+          // Update scroll progress for the leading button
+          WidgetsBinding.instance.addPostFrameCallback((_) {
+            if (mounted && _scrollProgress != scrollProgress) {
+              setState(() {
+                _scrollProgress = scrollProgress;
+              });
+            }
+          });

-                return FlexibleSpaceBar(
-                  centerTitle: true,
-                  title: AnimatedSwitcher(
-                    duration: const Duration(milliseconds: 200),
-                    child: scrollProgress > 0.95
-                        ? Text(
-                            widget.person.name,
-                            style: TextStyle(color: context.primaryColor, fontWeight: FontWeight.w600, fontSize: 18),
-                          )
-                        : null,
-                  ),
-                  background: _ExpandedBackground(
-                    scrollProgress: scrollProgress,
-                    person: widget.person,
-                    onNameTap: widget.onNameTap,
-                    onBirthdayTap: widget.onBirthdayTap,
-                  ),
-                );
-              },
+          return FlexibleSpaceBar(
+            centerTitle: true,
+            title: AnimatedSwitcher(
+              duration: const Duration(milliseconds: 200),
+              child: scrollProgress > 0.95
+                  ? Text(
+                      widget.person.name,
+                      style: TextStyle(color: context.primaryColor, fontWeight: FontWeight.w600, fontSize: 18),
+                    )
+                  : null,
+            ),
+            background: IgnorePointer(
+              ignoring: isMultiSelectEnabled,
+              child: _ExpandedBackground(
+                scrollProgress: scrollProgress,
+                person: widget.person,
+                onNameTap: widget.onNameTap,
+                onBirthdayTap: widget.onBirthdayTap,
+              ),
            ),
          );
+        },
+      ),
+    );
  }
 }

@@ -290,7 +295,7 @@ class _ExpandedBackgroundState extends ConsumerState<_ExpandedBackground> with S

                            if (widget.person.birthDate != null)
                              Text(
-                                "${DateFormat.yMMMd(context.locale.toString()).format(widget.person.birthDate!)} (${formatAge(widget.person.birthDate!, DateTime.now())})",
+                                "${DateFormat.yMMMd(resolvedDateTimeLocale()).format(widget.person.birthDate!)} (${formatAge(widget.person.birthDate!, DateTime.now())})",
                                style: context.textTheme.labelLarge?.copyWith(
                                  color: Colors.white,
                                  height: 1.2,
@@ -1,6 +1,7 @@
 import 'package:easy_localization/easy_localization.dart';
 import 'package:flutter/material.dart';
 import 'package:immich_mobile/domain/models/time_range.model.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/utils/option.dart';

@@ -19,7 +20,7 @@ class MapTimeRange extends StatelessWidget {
          title: Text(context.t.date_after),
          subtitle: Text(
            timeRange.from != null
-                ? DateFormat.yMMMd(context.locale.toLanguageTag()).add_jm().format(timeRange.from!)
+                ? DateFormat.yMMMd(resolvedDateTimeLocale()).add_jm().format(timeRange.from!)
                : context.t.not_set,
          ),
          trailing: timeRange.from != null
@@ -45,7 +46,7 @@ class MapTimeRange extends StatelessWidget {
          title: Text(context.t.date_before),
          subtitle: Text(
            timeRange.to != null
-                ? DateFormat.yMMMd(context.locale.toLanguageTag()).add_jm().format(timeRange.to!)
+                ? DateFormat.yMMMd(resolvedDateTimeLocale()).add_jm().format(timeRange.to!)
                : context.t.not_set,
          ),
          trailing: timeRange.to != null
@@ -16,6 +16,7 @@ class AssetListSettings extends HookConsumerWidget {
  @override
  Widget build(BuildContext context, WidgetRef ref) {
    final storageIndicator = useValueNotifier(ref.watch(appConfigProvider.select((s) => s.timeline.storageIndicator)));
+    final smoothScrubbing = useValueNotifier(ref.watch(appConfigProvider.select((s) => s.timeline.smoothScrubbing)));

    final assetListSetting = [
      SettingsSwitchListTile(
@@ -27,6 +28,16 @@ class AssetListSettings extends HookConsumerWidget {
          ref.invalidate(settingsProvider);
        },
      ),
+      SettingsSwitchListTile(
+        valueNotifier: smoothScrubbing,
+        title: context.t.theme_setting_asset_list_smooth_scrubbing_title,
+        subtitle: context.t.theme_setting_asset_list_smooth_scrubbing_subtitle,
+        onChanged: (value) {
+          unawaited(ref.read(settingsProvider).write(.timelineSmoothScrubbing, value));
+          ref.invalidate(appSettingsServiceProvider);
+          ref.invalidate(settingsProvider);
+        },
+      ),
      const LayoutSettings(),
      const GroupSettings(),
    ];
@@ -7,6 +7,7 @@ import 'package:immich_mobile/constants/enums.dart';
 import 'package:immich_mobile/domain/models/album/local_album.model.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/extensions/build_context_extensions.dart';
+import 'package:immich_mobile/extensions/datetime_extensions.dart';
 import 'package:immich_mobile/extensions/platform_extensions.dart';
 import 'package:immich_mobile/generated/translations.g.dart';
 import 'package:immich_mobile/providers/cleanup.provider.dart';
@@ -423,7 +424,7 @@ class _FreeUpSpaceSettingsState extends ConsumerState<FreeUpSpaceSettings> {
                  ),
                  subtitle: hasDate
                      ? Text(
-                          DateFormat.yMMMd().format(state.selectedDate!),
+                          DateFormat.yMMMd(resolvedDateTimeLocale()).format(state.selectedDate!),
                          style: context.textTheme.bodyMedium?.copyWith(
                            color: context.colorScheme.primary,
                            fontWeight: FontWeight.w500,
@@ -628,7 +629,7 @@ class _FreeUpSpaceSettingsState extends ConsumerState<FreeUpSpaceSettings> {
                                  Text(
                                    context.t.cleanup_step4_summary(
                                      count: state.assetsToDelete.length,
-                                      date: DateFormat.yMMMd().format(state.selectedDate!),
+                                      date: DateFormat.yMMMd(resolvedDateTimeLocale()).format(state.selectedDate!),
                                    ),
                                    style: context.textTheme.labelLarge?.copyWith(fontSize: 15),
                                  ),
@@ -687,7 +688,10 @@ class _DeleteConfirmationDialog extends StatelessWidget {
    return AlertDialog(
      title: Text(context.t.cleanup_confirm_prompt_title),
      content: Text(
-        context.t.cleanup_confirm_description(count: assetCount, date: DateFormat.yMMMd().format(cutoffDate)),
+        context.t.cleanup_confirm_description(
+          count: assetCount,
+          date: DateFormat.yMMMd(resolvedDateTimeLocale()).format(cutoffDate),
+        ),
        style: context.textTheme.labelLarge?.copyWith(fontSize: 15),
      ),
      actions: [
@@ -1,5 +1,6 @@
 [tools]
 java = "21.0.2"
+rust = { version = "1.99.1", targets = "aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,aarch64-apple-ios,aarch64-apple-ios-sim,x86_64-apple-ios" }

 [tools."aqua:flutter/flutter"]
 version = "3.47.2"
@@ -34,6 +35,7 @@ depends = [
  "codegen:dart",
  "codegen:drift:migration",
  "codegen:drift:schema",
+  "codegen:native",
  "codegen:pigeon",
  "codegen:translation",
 ]
@@ -80,6 +82,11 @@ alias = "watch"
 description = "Watch and auto-generate dart code"
 run = "dart run build_runner watch"

+[tasks."codegen:native"]
+description = "Generate the native C header and Dart bindings"
+dir = "../native/native_core"
+run = ["cargo build -p native_core_ffi", "flutter pub get", "dart run ffigen --config ffigen.yaml"]
+
 [tasks."codegen:pigeon"]
 alias = "pigeon"
 description = "Generate pigeon platform code"
@@ -139,6 +146,7 @@ depends = ["//:open-api-dart"]
 run = [
  # This receives passed `--enforce-lockfile` args
  "flutter pub get",
+  { task = "install:build-runner-patch" },
  { task = "install:ios" },
 ]

@@ -198,6 +206,11 @@ fi
 cd ios && pod install
 '''

+[tasks."install:build-runner-patch"]
+description = "Patch build_runner to prevent crashes when sources are deleted"
+hide = true
+run = "node ./scripts/build_runner_patch.mjs"
+
 [tasks."analyze:dart"]
 description = "Run Dart analysis"
 hide = true
@@ -796,10 +796,10 @@ packages:
    dependency: transitive
    description:
      name: hooks
-      sha256: "9a62a50b50b769a737bc0a8ff381f333529df3ab746b2f6b02e83760231455ba"
+      sha256: eaac480a35ec0814146c2c48d96aaa829e0e44a7662c88ae84c9edf4bc35651f
      url: "https://pub.dev"
    source: hosted
-    version: "2.0.2"
+    version: "2.2.0"
  hooks_riverpod:
    dependency: "direct main"
    description:
@@ -1132,6 +1132,13 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "1.0.5"
+  native_core:
+    dependency: "direct main"
+    description:
+      path: "../native/native_core"
+      relative: true
+    source: path
+    version: "0.0.0"
  native_toolchain_c:
    dependency: transitive
    description:
@@ -1140,6 +1147,14 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "0.19.1"
+  native_toolchain_rust:
+    dependency: transitive
+    description:
+      name: native_toolchain_rust
+      sha256: "8469a0e32a47a5c84b7fd300de9fd0e8082aac76c37922986324f5082a58350d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.6"
  native_video_player:
    dependency: "direct main"
    description:
@@ -1458,10 +1473,10 @@ packages:
    dependency: transitive
    description:
      name: record_use
-      sha256: "2551bd8eecfe95d14ae75f6021ad0248be5c27f138c2ec12fcb52b500b3ba1ed"
+      sha256: "1cb8564af8d43b464294411db9217f5ec04891c6f22ee2c32d73ae05e88a6bd2"
      url: "https://pub.dev"
    source: hosted
-    version: "0.6.0"
+    version: "1.1.1"
  riverpod:
    dependency: transitive
    description:
@@ -1664,10 +1679,10 @@ packages:
    dependency: "direct main"
    description:
      name: sqlite3_connection_pool
-      sha256: ad51972d37bdf82929888e4c85e722bd9a0b5ff8ad389f89b1b00d19603c0d2d
+      sha256: ad8413d9100598ee9ef1a27628f5673b7d9212fb9d15b2742f7fde690f743832
      url: "https://pub.dev"
    source: hosted
-    version: "0.2.7"
+    version: "0.2.13"
  sqlite3_web:
    dependency: transitive
    description:
@@ -1772,6 +1787,14 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "0.9.4"
+  toml:
+    dependency: transitive
+    description:
+      name: toml
+      sha256: "35a35f782228656a2af31e8c73d1353cc4ef3d683fd68af1111b44631879c05e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.18.0"
  typed_data:
    dependency: transitive
    description:
@@ -2,7 +2,7 @@ name: immich_mobile
 description: Immich - selfhosted backup media file on mobile phone

 publish_to: 'none'
-version: 3.3.3-local.4+3030403
+version: 3.3.5-local.11+3030503

 environment:
  sdk: '>=3.12.0 <4.0.0'
@@ -39,6 +39,8 @@ dependencies:
  hooks_riverpod: ^2.6.1
  http: ^1.6.0
  image_picker: ^1.2.3
+  native_core:
+    path: ../native/native_core
  immich_ui:
    path: './packages/ui'
  intl: ^0.20.2
@@ -69,7 +71,7 @@ dependencies:
  stream_transform: ^2.1.1
  sqlite3: ^3.4.0
  sqlite_async: 0.14.2
-  sqlite3_connection_pool: ^0.2.7
+  sqlite3_connection_pool: ^0.2.13
  thumbhash: 0.1.0+1
  timezone: ^0.9.4
  url_launcher: ^6.3.2
@@ -0,0 +1,20 @@
+// Prevents build_runner crashing when a source file is deleted from a path dependency, which commonly occurs to `generated/openapi` on branch switch
+//
+// Fixed upstream in 2.15.3 (https://github.com/dart-lang/build/pull/5022), but we can't take that dependency due to Dart analyzer being locked
+import { readFileSync, writeFileSync } from 'node:fs';
+
+const packageConfig = new URL('../.dart_tool/package_config.json', import.meta.url);
+
+const config = JSON.parse(readFileSync(packageConfig, 'utf8'));
+const buildRunner = new URL(config.packages.find(({ name }) => name === 'build_runner').rootUri);
+
+const file = new URL(`${buildRunner}/lib/src/build_plan/build_plan.dart`);
+
+const buggy = 'for (final id in deletedOutputs) {';
+const fixed = 'for (final id in deletedOutputs.difference(buildInputs.deletedSources.build().asSet())) {';
+
+const source = readFileSync(file, 'utf8');
+if (source.includes(buggy)) {
+  writeFileSync(file, source.replace(buggy, fixed));
+  console.log('build_runner patch: stopped deleting removed sources from path dependencies');
+}
@@ -1,13 +1,23 @@
 import 'package:collection/collection.dart';
+import 'package:drift/drift.dart';
+import 'package:drift/native.dart';
 import 'package:flutter_test/flutter_test.dart';
+import 'package:http/http.dart' show ClientException;
 import 'package:immich_mobile/constants/constants.dart';
+import 'package:immich_mobile/data/db/main/database.dart';
 import 'package:immich_mobile/domain/models/config/app_config.dart';
+import 'package:immich_mobile/domain/models/config/network_config.dart';
 import 'package:immich_mobile/domain/models/log.model.dart';
 import 'package:immich_mobile/domain/models/settings_key.dart';
+import 'package:immich_mobile/domain/models/store.model.dart';
 import 'package:immich_mobile/domain/services/log.service.dart';
+import 'package:immich_mobile/domain/services/store.service.dart';
 import 'package:immich_mobile/infrastructure/repositories/log.repository.dart';
+import 'package:immich_mobile/infrastructure/repositories/settings.repository.dart';
+import 'package:immich_mobile/infrastructure/repositories/store.repository.dart';
 import 'package:logging/logging.dart';
 import 'package:mocktail/mocktail.dart';
+import 'package:openapi/api.dart' show ApiException;

 import '../../infrastructure/repository.mock.dart';
 import '../../test_utils.dart';
@@ -30,6 +40,16 @@ void main() {
  late LogService sut;
  late LogRepository mockLogRepo;
  late MockSettingsRepository mockSettingsRepository;
+  late Drift db;
+
+  setUpAll(() async {
+    db = Drift(DatabaseConnection(NativeDatabase.memory(), closeStreamsSynchronously: true));
+    await StoreService.init(storeRepository: StoreRepository(db), listenUpdates: false);
+  });
+
+  tearDownAll(() async {
+    await db.close();
+  });

  setUp(() async {
    mockLogRepo = MockLogRepository();
@@ -45,11 +65,16 @@ void main() {
    when(() => mockLogRepo.insert(any())).thenAnswer((_) async => true);
    when(() => mockLogRepo.insertAll(any())).thenAnswer((_) async => true);

-    sut = await LogService.create(logRepository: mockLogRepo, settingsRepository: mockSettingsRepository);
+    sut = await LogService.create(
+      logRepository: mockLogRepo,
+      settingsRepository: mockSettingsRepository,
+      storeService: StoreService.I,
+    );
  });

  tearDown(() async {
    await sut.dispose();
+    await StoreService.I.clear();
  });

  group("Log Service Init:", () {
@@ -87,6 +112,7 @@ void main() {
        sut = await LogService.create(
          logRepository: mockLogRepo,
          settingsRepository: mockSettingsRepository,
+          storeService: StoreService.I,
          shouldBuffer: true,
        );

@@ -105,6 +131,7 @@ void main() {
        sut = await LogService.create(
          logRepository: mockLogRepo,
          settingsRepository: mockSettingsRepository,
+          storeService: StoreService.I,
          shouldBuffer: true,
        );

@@ -126,6 +153,7 @@ void main() {
        sut = await LogService.create(
          logRepository: mockLogRepo,
          settingsRepository: mockSettingsRepository,
+          storeService: StoreService.I,
          shouldBuffer: false,
        );

@@ -160,6 +188,7 @@ void main() {
        sut = await LogService.create(
          logRepository: mockLogRepo,
          settingsRepository: mockSettingsRepository,
+          storeService: StoreService.I,
          shouldBuffer: true,
        );

@@ -176,4 +205,144 @@ void main() {
      });
    });
  });
+
+  group("Log Service Redaction:", () {
+    const accessToken = 'Kq3Zr8WbN2xYp5aLm7cT9vQ4sD6fH1jE0gU2iO5wA8y';
+
+    test('Replaces urls, the access token and header values when a line is logged', () async {
+      await StoreService.I.put(StoreKey.serverUrl, 'https://immich.example.com');
+      await StoreService.I.put(StoreKey.serverEndpoint, 'https://api.example.com/api');
+      await StoreService.I.put(StoreKey.accessToken, accessToken);
+      when(() => mockSettingsRepository.appConfig).thenReturn(
+        const AppConfig(
+          network: NetworkConfig(
+            localEndpoint: 'http://192.168.1.5:2283',
+            externalEndpointList: ['https://immich.example.com', 'http://nas.lan:2283'],
+            customHeaders: {'X-Proxy-Key': 'cf-secret-abcdef0123', 'X-Debug': '1'},
+          ),
+        ),
+      );
+      const rows = {
+        'Resuming session at https://immich.example.com/api': 'Resuming session at [EXTERNAL ENDPOINT 1]/api',
+        'GET http://nas.lan:2283/api/server/ping': 'GET [EXTERNAL ENDPOINT 2]/api/server/ping',
+        'GET http://192.168.1.5:2283/api/server/ping': 'GET [LOCAL ENDPOINT]/api/server/ping',
+        'Using server URL: https://api.example.com/api': 'Using server URL: [SERVER URL]/api',
+        'Received Authorization URL: https://auth.example.org/authorize':
+            'Received Authorization URL: [OTHER URL]/authorize',
+        'Causing statement: INSERT INTO "store_entity", parameters: 11, $accessToken':
+            'Causing statement: INSERT INTO "store_entity", parameters: 11, [ACCESS TOKEN]',
+        'Could not enqueue task DownloadTask{headers: {X-Proxy-Key: cf-secret-abcdef0123, X-Debug: 1}, retries: 1}':
+            'Could not enqueue task DownloadTask{headers: {X-Proxy-Key: [HEADER VALUE], X-Debug: [HEADER VALUE]}, retries: 1}',
+        'X-Proxy-Key:\tcf-secret-abcdef0123': 'X-Proxy-Key: [HEADER VALUE]',
+        'Uploaded 1 assets in 1.2s': 'Uploaded 1 assets in 1.2s',
+      };
+      for (final row in rows.keys) {
+        Logger('Test').info(row);
+      }
+      await sut.flush();
+
+      final stored = verify(() => mockLogRepo.insertAll(captureAny())).captured.single as List<LogMessage>;
+      expect(stored.map((m) => m.message), rows.values);
+    });
+
+    test('Hides the host and ip in http client errors', () async {
+      when(
+        () => mockSettingsRepository.appConfig,
+      ).thenReturn(const AppConfig(network: NetworkConfig(externalEndpointList: ['http://immich:2283'])));
+      final connectError = ClientException(
+        'java.net.ConnectException: Failed to connect to immich/192.168.1.5:2283',
+        Uri.parse('http://immich:2283/api/server/ping'),
+      );
+      final unknownHostError = ClientException(
+        'java.net.UnknownHostException: Unable to resolve host "typo.example.org": No address associated with hostname',
+        Uri.parse('https://alice:secret@typo.example.org/api/users/me'),
+      );
+
+      Logger('Test').severe(
+        'Error while checking server availability',
+        ApiException.withInner(
+          400,
+          'HTTP connection failed: GET /server/ping',
+          connectError,
+          StackTrace.fromString('#0 ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart)'),
+        ),
+      );
+      Logger('Test').severe('Error validating auxiliary endpoint', unknownHostError);
+      await sut.flush();
+
+      final stored = verify(() => mockLogRepo.insertAll(captureAny())).captured.single as List<LogMessage>;
+      expect(
+        stored.first.error,
+        'ApiException 400: HTTP connection failed: GET /server/ping (Inner exception: ClientException: '
+        'java.net.ConnectException: Failed to connect to [EXTERNAL ENDPOINT 1]/[IP ADDRESS]:2283, '
+        'uri=[EXTERNAL ENDPOINT 1]/api/server/ping)\n\n'
+        '#0 ApiService._isEndpointAvailable (package:immich_mobile/services/api.service.dart)',
+      );
+      expect(
+        stored.last.error,
+        'ClientException: java.net.UnknownHostException: Unable to resolve host "[OTHER URL]": '
+        'No address associated with hostname, uri=[OTHER URL]/api/users/me',
+      );
+    });
+
+    test('Hides ipv6 addresses in http client errors', () async {
+      const rows = {
+        'java.net.ConnectException: Failed to connect to immich.example.com/[2001:db8::5]:443':
+            'java.net.ConnectException: Failed to connect to [OTHER URL]/[IP ADDRESS]:443',
+        'java.net.ConnectException: Failed to connect to immich.example.com/2001:db8::5:443':
+            'java.net.ConnectException: Failed to connect to [OTHER URL]/[IP ADDRESS]',
+        'java.net.SocketTimeoutException: failed to connect to immich.example.com/2001:db8::5 (port 443) '
+                'from /2001:db8:1234:5678:9abc:def0:1234:5678 (port 41234) after 30000ms':
+            'java.net.SocketTimeoutException: failed to connect to [OTHER URL]/[IP ADDRESS] (port 443) '
+            'from /[IP ADDRESS] (port 41234) after 30000ms',
+        'java.net.ConnectException: Failed to connect to /[fe80::5%wlan0]:2283':
+            'java.net.ConnectException: Failed to connect to /[IP ADDRESS]:2283',
+        'at 12:34:56': 'at 12:34:56',
+        '0:00:01.500000': '0:00:01.500000',
+        'deadbeef': 'deadbeef',
+        '#0      ApiClient.invokeAPI (package:openapi/api_client.dart:131:7)':
+            '#0      ApiClient.invokeAPI (package:openapi/api_client.dart:131:7)',
+      };
+      for (final row in rows.keys) {
+        Logger('Test').severe('Upload error', ClientException(row, Uri.parse('https://immich.example.com/api/assets')));
+      }
+      await sut.flush();
+
+      final stored = verify(() => mockLogRepo.insertAll(captureAny())).captured.single as List<LogMessage>;
+      expect(stored.map((m) => m.error), [
+        for (final row in rows.values) 'ClientException: $row, uri=[OTHER URL]/api/assets',
+      ]);
+    });
+
+    test('Keeps the labels of a line logged before a logout', () async {
+      final settings = await SettingsRepository.ensureInitialized(db);
+      addTearDown(SettingsRepository.reset);
+      await settings.write(SettingsKey.networkExternalEndpointList, ['https://immich.example.com']);
+      await StoreService.I.put(StoreKey.accessToken, accessToken);
+      await sut.dispose();
+      sut = await LogService.create(
+        logRepository: mockLogRepo,
+        settingsRepository: settings,
+        storeService: StoreService.I,
+      );
+
+      Logger('Test').info('Resuming session at https://immich.example.com/api with $accessToken');
+      // the store and settings changes of AuthService.clearLocalData
+      await StoreService.I.delete(StoreKey.accessToken);
+      await settings.clear(const [
+        .networkAutoEndpointSwitching,
+        .networkPreferredWifiName,
+        .networkLocalEndpoint,
+        .networkExternalEndpointList,
+      ]);
+      Logger('Test').info('Resuming session at https://immich.example.com/api');
+      await sut.flush();
+
+      final stored = verify(() => mockLogRepo.insertAll(captureAny())).captured.single as List<LogMessage>;
+      expect(stored.map((m) => m.message), [
+        'Resuming session at [EXTERNAL ENDPOINT 1]/api with [ACCESS TOKEN]',
+        'Resuming session at [OTHER URL]/api',
+      ]);
+    });
+  });
 }
@@ -57,7 +57,7 @@ Future<void> _writerTask(String path) async {
  } finally {
    await db.close();
    await dbConnection.close();
-    sqlitePool.close();
+    await sqlitePool.close();
  }
 }

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .21.0
 .22.1