feat(mobile): stack original + edited photo on ios

Detect an iOS edit, upload the unedited original, and stack the edited version on top of it. Reverting in Photos flips the stack cover back to the original and keeps the edits. Adds an optional stackParentId field to the asset upload on the server.
fix: plugin prod build typo (#28566 )
2026-05-22 23:52:32 -04:00 · 2026-05-23 03:47:26 +06:00 · 2026-05-22 11:01:18 -05:00 · 2026-05-22 15:20:47 +00:00 · 2026-05-22 17:40:11 +05:30 · 2026-05-21 12:25:20 -05:00
416 changed files with 32494 additions and 14141 deletions
@@ -16,7 +16,7 @@ services:
      - ${UPLOAD_LOCATION:-upload-devcontainer-volume}${UPLOAD_LOCATION:+/photos}:/data
      - /etc/localtime:/etc/localtime:ro
      - pnpm_store_server:/buildcache/pnpm-store
-      - ../packages/plugins:/build/corePlugin
+      - ../packages/plugin-core:/build/plugins/immich-plugin-core
  immich-web:
    env_file: !reset []
  immich-machine-learning:
@@ -91,7 +91,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -116,7 +116,6 @@ jobs:
            ~/.gradle/wrapper
            ~/.android/sdk
            mobile/android/.gradle
-            mobile/.dart_tool
          key: build-mobile-gradle-${{ runner.os }}-main

      - name: Setup Android SDK
@@ -160,14 +159,14 @@ jobs:

      - name: Comment APK download link on PR
        if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
-        uses: mshick/add-pr-comment@8e4927817251f1ff60c001f04568532b38e0b4a0 # v3.11.0
+        uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
        env:
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          APK_URL: ${{ steps.upload-apk.outputs.artifact-url }}
        with:
-          github-token: ${{ steps.token.outputs.token }}
-          message-id: 'mobile-android-apk'
-          message: |
+          id: mobile-android-apk
+          token: ${{ steps.token.outputs.token }}
+          body: |
            📱 **Android release APK (universal)** — `${{ env.HEAD_SHA }}`

            Download: ${{ env.APK_URL }}
@@ -189,7 +188,6 @@ jobs:
            ~/.gradle/wrapper
            ~/.android/sdk
            mobile/android/.gradle
-            mobile/.dart_tool
          key: ${{ steps.cache-gradle-restore.outputs.cache-primary-key }}

  build-sign-ios:
@@ -218,7 +216,7 @@ jobs:
          persist-credentials: false

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -233,7 +231,7 @@ jobs:
        run: mise //mobile:codegen:pigeon

      - name: Setup Ruby
-        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1.306.0
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
        with:
          ruby-version: '3.3'
          bundler-cache: true
@@ -290,7 +288,6 @@ jobs:
          APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
          APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
          ENVIRONMENT: ${{ inputs.environment || 'development' }}
-          BUNDLE_ID_SUFFIX: ${{ inputs.environment == 'production' && '' || 'development' }}
          GITHUB_REF: ${{ github.ref }}
          FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: 120
          FASTLANE_XCODEBUILD_SETTINGS_RETRIES: 6
@@ -24,7 +24,7 @@ jobs:
          persist-credentials: false

      - name: Check for breaking API changes
-        uses: oasdiff/oasdiff-action/breaking@26ccb332c67a45ca649de9faf60552ef1b8260d9 # v0.0.46
+        uses: oasdiff/oasdiff-action/breaking@6147a58e5d1249a12f42fc864ab791d571a30015 # v0.0.47
        with:
          base: https://raw.githubusercontent.com/${{ github.repository }}/main/open-api/immich-openapi-specs.json
          revision: open-api/immich-openapi-specs.json
@@ -43,7 +43,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -57,7 +57,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -70,7 +70,7 @@ jobs:
      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -83,6 +83,6 @@ jobs:
      #   ./location_of_script_within_repo/buildscript.sh

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
        with:
          category: '/language:${{matrix.language}}'
@@ -66,7 +66,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -131,7 +131,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -213,12 +213,11 @@ jobs:
        run: 'mise run //deployment:tf apply'

      - name: Comment
-        uses: actions-cool/maintain-one-comment@909842216bc8e8658364c572ec52100f4c2cc50a # v3.3.0
+        uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
        if: ${{ steps.parameters.outputs.event == 'pr' }}
        with:
+          id: docs-pr-url
          token: ${{ steps.token.outputs.token }}
          number: ${{ fromJson(needs.checks.outputs.parameters).pr_number }}
          body: |
            📖 Documentation deployed to [${{ steps.docs-output.outputs.subdomain }}](https://${{ steps.docs-output.outputs.subdomain }})
-          emojis: 'rocket'
-          body-include: '<!-- Docs PR URL -->'
@@ -29,7 +29,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -44,9 +44,8 @@ jobs:
        run: 'mise run //deployment:tf destroy -- -refresh=false'

      - name: Comment
-        uses: actions-cool/maintain-one-comment@909842216bc8e8658364c572ec52100f4c2cc50a # v3.3.0
+        uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
        with:
+          id: docs-pr-url
          token: ${{ steps.token.outputs.token }}
-          number: ${{ github.event.number }}
          delete: true
-          body-include: '<!-- Docs PR URL -->'
@@ -28,7 +28,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -31,7 +31,7 @@ jobs:
      - name: Generate a token
        id: generate_token
        if: ${{ inputs.skip != true }}
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
@@ -13,3 +13,4 @@ jobs:
      actions: read
      contents: read
      security-events: write
+    secrets: inherit
@@ -62,7 +62,7 @@ jobs:
          ref: main

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -119,7 +119,7 @@ jobs:
    steps:
      - name: Generate a token
        id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
@@ -19,11 +19,11 @@ jobs:
          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}

-      - uses: mshick/add-pr-comment@8e4927817251f1ff60c001f04568532b38e0b4a0 # v3.11.0
+      - uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
        with:
-          github-token: ${{ steps.token.outputs.token }}
-          message-id: 'preview-status'
-          message: 'Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.build/'
+          id: preview-status
+          token: ${{ steps.token.outputs.token }}
+          body: 'Deploying preview environment to https://pr-${{ github.event.pull_request.number }}.preview.internal.immich.build/'

  remove-label:
    runs-on: ubuntu-latest
@@ -48,16 +48,16 @@ jobs:
              name: 'preview'
            })

-      - uses: mshick/add-pr-comment@8e4927817251f1ff60c001f04568532b38e0b4a0 # v3.11.0
+      - uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
        if: ${{ github.event.pull_request.head.repo.fork }}
        with:
-          github-token: ${{ steps.token.outputs.token }}
-          message-id: 'preview-status'
-          message: 'PRs from forks cannot have preview environments.'
+          id: preview-status
+          token: ${{ steps.token.outputs.token }}
+          body: 'PRs from forks cannot have preview environments.'

-      - uses: mshick/add-pr-comment@8e4927817251f1ff60c001f04568532b38e0b4a0 # v3.11.0
+      - uses: immich-app/devtools/actions/sticky-comment@0135acd12ad9f3369b94a2aa3c0ae8c835a4e926 # sticky-comment-action-v1.0.0
        if: ${{ !github.event.pull_request.head.repo.fork }}
        with:
-          github-token: ${{ steps.token.outputs.token }}
-          message-id: 'preview-status'
-          message: 'Preview environment has been removed.'
+          id: preview-status
+          token: ${{ steps.token.outputs.token }}
+          body: 'Preview environment has been removed.'
@@ -28,7 +28,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -61,7 +61,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -30,25 +30,32 @@ jobs:
          filters: |
            i18n:
              - 'i18n/**'
+              - 'mise.toml'
            web:
              - 'web/**'
              - 'i18n/**'
              - 'packages/sdk/**'
              - 'pnpm-lock.yaml'
+              - 'mise.toml'
            server:
              - 'server/**'
              - 'pnpm-lock.yaml'
+              - 'mise.toml'
            cli:
              - 'packages/cli/**'
              - 'packages/sdk/**'
              - 'pnpm-lock.yaml'
+              - 'mise.toml'
            e2e:
              - 'e2e/**'
              - 'pnpm-lock.yaml'
+              - 'mise.toml'
            mobile:
              - 'mobile/**'
+              - 'mise.toml'
            machine-learning:
              - 'machine-learning/**'
+              - 'mise.toml'
            .github:
              - '.github/**'
          force-filters: |
@@ -62,9 +69,6 @@ jobs:
    runs-on: ubuntu-latest
    permissions:
      contents: read
-    defaults:
-      run:
-        working-directory: ./server
    steps:
      - id: token
        uses: immich-app/devtools/actions/create-workflow-token@caa599d954228439ea3e8ce1c3328f41ab120ee6 # create-workflow-token-action-v2.0.0
@@ -79,12 +83,12 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

      - name: Run ci-unit
-        run: mise run ci-unit
+        run: mise run //server:ci-unit

  cli-unit-tests:
    name: Unit Test CLI
@@ -110,7 +114,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -141,7 +145,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -185,7 +189,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -223,7 +227,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -251,7 +255,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -301,7 +305,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -334,7 +338,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -380,7 +384,7 @@ jobs:
          cache-dependency-path: '**/pnpm-lock.yaml'

      - name: Setup packages
-        run: pnpm --filter "@immich/*" install --frozen-lockfile && pnpm --filter "@immich/*" build
+        run: pnpm --filter @immich/sdk --filter @immich/cli install --frozen-lockfile && pnpm --filter @immich/sdk --filter @immich/cli build

      - name: Run setup web
        run: pnpm install --frozen-lockfile && pnpm exec svelte-kit sync
@@ -553,7 +557,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -565,7 +569,7 @@ jobs:
        run: mise //mobile:codegen:translation

      - name: Run tests
-        run: mise //mobile:test -j 1
+        run: mise //mobile:test

  ml-unit-tests:
    name: Unit Test ML
@@ -590,7 +594,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -621,7 +625,7 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

@@ -672,13 +676,12 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

      - name: Install server dependencies
        run: SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm --filter immich install --frozen-lockfile
-
      - name: Run API generation
        run: mise //:open-api
        working-directory: open-api
@@ -717,9 +720,6 @@ jobs:
          --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
        ports:
          - 5432:5432
-    defaults:
-      run:
-        working-directory: ./server
    steps:
      - id: token
        uses: immich-app/devtools/actions/create-workflow-token@caa599d954228439ea3e8ce1c3328f41ab120ee6 # create-workflow-token-action-v2.0.0
@@ -734,25 +734,28 @@ jobs:
          token: ${{ steps.token.outputs.token }}

      - name: Setup Mise
-        uses: immich-app/devtools/actions/use-mise@cf6e190bacde3d7bda59372a786b36ac7d01536a # use-mise-action-v2.0.1
+        uses: immich-app/devtools/actions/use-mise@7b8610a904d57da241e4ddba17fa62b62b15aed4 # use-mise-action-v2.0.2
        with:
          github_token: ${{ steps.token.outputs.token }}

      - name: Install server dependencies
        run: SHARP_IGNORE_GLOBAL_LIBVIPS=true pnpm install --frozen-lockfile

+      - name: Build plugins
+        run: mise //:plugins
+
      - name: Build the app
-        run: pnpm build
+        run: mise //server:build

      - name: Run existing migrations
-        run: pnpm migrations:run
+        run: pnpm --filter immich migrations:run

      - name: Test npm run schema:reset command works
-        run: pnpm schema:reset
+        run: pnpm --filter immich schema:reset

      - name: Generate new migrations
        continue-on-error: true
-        run: pnpm migrations:generate src/TestMigration
+        run: pnpm --filter migrations:generate src/TestMigration

      - name: Find file changes
        uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf # v20.0.4
@@ -768,7 +771,7 @@ jobs:
        run: |
          echo "ERROR: Generated migration files not up to date!"
          echo "Changed files: ${CHANGED_FILES}"
-          cat ./src/*-TestMigration.ts
+          cat ./server/src/*-TestMigration.ts
          exit 1

      - name: Run SQL generation
@@ -0,0 +1,65 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools.opentofu]]
+version = "1.11.6"
+backend = "aqua:opentofu/opentofu"
+
+[tools.opentofu."platforms.linux-arm64"]
+checksum = "sha256:d4f2ab15776925864b049bb329d69682851de6f5204f256e9fa86d07a0308850"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_arm64.tar.gz"
+
+[tools.opentofu."platforms.linux-arm64-musl"]
+checksum = "sha256:d4f2ab15776925864b049bb329d69682851de6f5204f256e9fa86d07a0308850"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_arm64.tar.gz"
+
+[tools.opentofu."platforms.linux-x64"]
+checksum = "sha256:02800fafa2753a9f50c38483e2fdf5bc353fd62895eb9e25eec9a5145df3a69e"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_amd64.tar.gz"
+
+[tools.opentofu."platforms.linux-x64-musl"]
+checksum = "sha256:02800fafa2753a9f50c38483e2fdf5bc353fd62895eb9e25eec9a5145df3a69e"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_amd64.tar.gz"
+
+[tools.opentofu."platforms.macos-arm64"]
+checksum = "sha256:62d7fa8539e13b444827aa0a3b90c5972da5c47e8f8882d9dcf2e430e78840c1"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_darwin_arm64.tar.gz"
+
+[tools.opentofu."platforms.macos-x64"]
+checksum = "sha256:1408cdef1c380f914565e6b4bb70794c6b163f195fcb233357f3d6c5745906b6"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_darwin_amd64.tar.gz"
+
+[tools.opentofu."platforms.windows-x64"]
+checksum = "sha256:27323f70c875b8251bfd7e61a4cffc3ebff4e56ed1e611b955016f0c7077367e"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_windows_amd64.tar.gz"
+
+[[tools.terragrunt]]
+version = "1.0.3"
+backend = "aqua:gruntwork-io/terragrunt"
+
+[tools.terragrunt."platforms.linux-arm64"]
+checksum = "sha256:e5b60ab05b5214db694e6bc215d8124fb626e277cdb56b86f6147ae110d510fe"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_arm64.tar.gz"
+
+[tools.terragrunt."platforms.linux-arm64-musl"]
+checksum = "sha256:e5b60ab05b5214db694e6bc215d8124fb626e277cdb56b86f6147ae110d510fe"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_arm64.tar.gz"
+
+[tools.terragrunt."platforms.linux-x64"]
+checksum = "sha256:6d48049baf82e0bf9c804368dc85cbfeadc10955e33777e9e8de3e020b94b073"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_amd64.tar.gz"
+
+[tools.terragrunt."platforms.linux-x64-musl"]
+checksum = "sha256:6d48049baf82e0bf9c804368dc85cbfeadc10955e33777e9e8de3e020b94b073"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_amd64.tar.gz"
+
+[tools.terragrunt."platforms.macos-arm64"]
+checksum = "sha256:aacb5be2ca5475300cbce246dfbd8a45eb47510fbaa70fab8561c49ef5db03aa"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_darwin_arm64.tar.gz"
+
+[tools.terragrunt."platforms.macos-x64"]
+checksum = "sha256:3133c2251e191aede8e3dd2a5b3aee2e91c5f08f88f117aee40eed9a24c8ef6b"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_darwin_amd64.tar.gz"
+
+[tools.terragrunt."platforms.windows-x64"]
+checksum = "sha256:183b2745b4e04980a6bfa4450ff81956a12596ca22d70f7aaa793980f5b036db"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_windows_amd64.exe.tar.gz"
@@ -2,37 +2,37 @@
 # Manual edits may be lost in future updates.

 provider "registry.opentofu.org/cloudflare/cloudflare" {
-  version     = "4.52.5"
-  constraints = "4.52.5"
+  version     = "4.52.7"
+  constraints = "4.52.7"
  hashes = [
-    "h1:+rfzF+16ZcWZWnTyW/p1HHTzYbPKX8Zt2nIFtR/+f+E=",
-    "h1:18bXaaOSq8MWKuMxo/4y7EB7/i7G90y5QsKHZRmkoDo=",
-    "h1:4vZVOpKeEQZsF2VrARRZFeL37Ed/gD4rRMtfnvWQres=",
-    "h1:BZOsTF83QPKXTAaYqxPKzdl1KRjk/L2qbPpFjM0w28A=",
-    "h1:CDuC+HXLvc1z6wkCRsSDcc/+QENIHEtssYshiWg3opA=",
-    "h1:DE+YFzLnqSe79pI2R4idRGx5QzLdrA7RXvngTkGfZ30=",
-    "h1:DfaJwH3Ml4yrRbdAY4AcDVy0QTQk5T3A622TXzS/u2E=",
-    "h1:EIDXP0W3kgIv2pecrFmqtK/DnlqkyckzBzhxKaXU+4A=",
-    "h1:EV4kYyaOnwGA0bh/3hU6Ezqnt1PFDxopH7i85e48IzY=",
-    "h1:M0iXabfzamU+MPDi0G9XACpbacFKMakmM+Z9HZ8HrsM=",
-    "h1:YWmCbGF/KbsrUzcYVBLscwLizidbp95TDQa0N2qpmVo=",
-    "h1:cxPcCB5gbrpUO1+IXkQYs1YTY50/0IlApCzGea0cwuQ=",
-    "h1:g6DldikTV2HXUu9uoeNY5FuLufgaYWF4ufgZg7wq62s=",
-    "h1:oi/Hrx9pwoQ+Z52CBC+rrowVH387EIj0qvnxQgDeI+0=",
-    "zh:1a3400cb38863b2585968d1876706bcfc67a148e1318a1d325c6c7704adc999b",
-    "zh:4c5062cb9e9da1676f06ae92b8370186d98976cc4c7030d3cd76df12af54282a",
-    "zh:52110f493b5f0587ef77a1cfd1a67001fd4c617b14c6502d732ab47352bdc2f7",
-    "zh:5aa536f9eaeb43823aaf2aa80e7d39b25ef2b383405ed034aa16a28b446a9238",
-    "zh:5cc39459a1c6be8a918f17054e4fbba573825ed5597dcada588fe99614d98a5b",
-    "zh:629ae6a7ba298815131da826474d199312d21cec53a4d5ded4fa56a692e6f072",
-    "zh:719cc7c75dc1d3eb30c22ff5102a017996d9788b948078c7e1c5b3446aeca661",
-    "zh:8698635a3ca04383c1e93b21d6963346bdae54d27177a48e4b1435b7f731731c",
+    "h1:+O72J3QYiZtYmYYZM/Eh0f4NNfl1BvjX1eju43qTQsQ=",
+    "h1:0oqjYIPXcXh7XiDiKI085cHDYQQ5mh8kDl9dmBtvtog=",
+    "h1:4b4ESb87MGv5bnadgYe7sK5rEkKMZhbkQcwPubQTsR4=",
+    "h1:6mTr3eA1Ddb348lLmJuyvn98z4KF+ejqaUEJ76D1rzQ=",
+    "h1:9/3YH+9k9HqsvFtbmBf7SO2+xqZeZrXNKzLkjNuhUEA=",
+    "h1:Jcq4tBWgyH4/2JsojNBSRaN0mcItVMchO+lynonrlqc=",
+    "h1:Y4Vv/2RdP0Q+uxqhOxzOdKxuuEMjXPDcU0vPc5bCQzI=",
+    "h1:a0gW8FBKsbP9Fi0HEDoy49WIbEWVHk9+BR4/iwuBdDQ=",
+    "h1:gElv6iqJtg8OKN77gbw+MjrkrQmJHPkkMEi1J+0xkpU=",
+    "h1:oslXUugD/NQ+duJgT4BhKQyfGbuFOANknMvR73fiOeM=",
+    "h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
+    "h1:u67GWw8GwD9NDlDzp9Y5VRnSQGcCrE8rSpkGPaBpDl0=",
+    "h1:uUUa9dY0XQOycI8pxg16PFFtL0WCTi9uEJz8trTQ7pU=",
+    "h1:y3rV8KF2q6GEMANNlf5EkKJurlfbKlIKpjGcdxoy7pQ=",
+    "zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
+    "zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
+    "zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
+    "zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
+    "zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:8a9993f1dcadf1dd6ca43b23348abe374605d29945a2fafc07fb3457644e6a54",
-    "zh:b1b9a1e6bcc24d5863a664a411d2dc906373ae7a2399d2d65548ce7377057852",
-    "zh:b270184cdeec277218e84b94cb136fead753da717f9b9dc378e51907f3f00bb0",
-    "zh:dff2bc10071210181726ce270f954995fe42c696e61e2e8f874021fed02521e5",
-    "zh:e8e87b40b6a87dc097b0fdc20d3f725cec0d82abc9cc3755c1f89f8f6e8b0036",
-    "zh:ee964a6573d399a5dd22ce328fb38ca1207797a02248f14b2e4913ee390e7803",
+    "zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
+    "zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
+    "zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
+    "zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
+    "zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
+    "zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
+    "zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
+    "zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
+    "zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
  ]
 }
@@ -5,7 +5,7 @@ terraform {
  required_providers {
    cloudflare = {
      source = "cloudflare/cloudflare"
-      version = "4.52.5"
+      version = "4.52.7"
    }
  }
 }
@@ -2,37 +2,37 @@
 # Manual edits may be lost in future updates.

 provider "registry.opentofu.org/cloudflare/cloudflare" {
-  version     = "4.52.5"
-  constraints = "4.52.5"
+  version     = "4.52.7"
+  constraints = "4.52.7"
  hashes = [
-    "h1:+rfzF+16ZcWZWnTyW/p1HHTzYbPKX8Zt2nIFtR/+f+E=",
-    "h1:18bXaaOSq8MWKuMxo/4y7EB7/i7G90y5QsKHZRmkoDo=",
-    "h1:4vZVOpKeEQZsF2VrARRZFeL37Ed/gD4rRMtfnvWQres=",
-    "h1:BZOsTF83QPKXTAaYqxPKzdl1KRjk/L2qbPpFjM0w28A=",
-    "h1:CDuC+HXLvc1z6wkCRsSDcc/+QENIHEtssYshiWg3opA=",
-    "h1:DE+YFzLnqSe79pI2R4idRGx5QzLdrA7RXvngTkGfZ30=",
-    "h1:DfaJwH3Ml4yrRbdAY4AcDVy0QTQk5T3A622TXzS/u2E=",
-    "h1:EIDXP0W3kgIv2pecrFmqtK/DnlqkyckzBzhxKaXU+4A=",
-    "h1:EV4kYyaOnwGA0bh/3hU6Ezqnt1PFDxopH7i85e48IzY=",
-    "h1:M0iXabfzamU+MPDi0G9XACpbacFKMakmM+Z9HZ8HrsM=",
-    "h1:YWmCbGF/KbsrUzcYVBLscwLizidbp95TDQa0N2qpmVo=",
-    "h1:cxPcCB5gbrpUO1+IXkQYs1YTY50/0IlApCzGea0cwuQ=",
-    "h1:g6DldikTV2HXUu9uoeNY5FuLufgaYWF4ufgZg7wq62s=",
-    "h1:oi/Hrx9pwoQ+Z52CBC+rrowVH387EIj0qvnxQgDeI+0=",
-    "zh:1a3400cb38863b2585968d1876706bcfc67a148e1318a1d325c6c7704adc999b",
-    "zh:4c5062cb9e9da1676f06ae92b8370186d98976cc4c7030d3cd76df12af54282a",
-    "zh:52110f493b5f0587ef77a1cfd1a67001fd4c617b14c6502d732ab47352bdc2f7",
-    "zh:5aa536f9eaeb43823aaf2aa80e7d39b25ef2b383405ed034aa16a28b446a9238",
-    "zh:5cc39459a1c6be8a918f17054e4fbba573825ed5597dcada588fe99614d98a5b",
-    "zh:629ae6a7ba298815131da826474d199312d21cec53a4d5ded4fa56a692e6f072",
-    "zh:719cc7c75dc1d3eb30c22ff5102a017996d9788b948078c7e1c5b3446aeca661",
-    "zh:8698635a3ca04383c1e93b21d6963346bdae54d27177a48e4b1435b7f731731c",
+    "h1:+O72J3QYiZtYmYYZM/Eh0f4NNfl1BvjX1eju43qTQsQ=",
+    "h1:0oqjYIPXcXh7XiDiKI085cHDYQQ5mh8kDl9dmBtvtog=",
+    "h1:4b4ESb87MGv5bnadgYe7sK5rEkKMZhbkQcwPubQTsR4=",
+    "h1:6mTr3eA1Ddb348lLmJuyvn98z4KF+ejqaUEJ76D1rzQ=",
+    "h1:9/3YH+9k9HqsvFtbmBf7SO2+xqZeZrXNKzLkjNuhUEA=",
+    "h1:Jcq4tBWgyH4/2JsojNBSRaN0mcItVMchO+lynonrlqc=",
+    "h1:Y4Vv/2RdP0Q+uxqhOxzOdKxuuEMjXPDcU0vPc5bCQzI=",
+    "h1:a0gW8FBKsbP9Fi0HEDoy49WIbEWVHk9+BR4/iwuBdDQ=",
+    "h1:gElv6iqJtg8OKN77gbw+MjrkrQmJHPkkMEi1J+0xkpU=",
+    "h1:oslXUugD/NQ+duJgT4BhKQyfGbuFOANknMvR73fiOeM=",
+    "h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
+    "h1:u67GWw8GwD9NDlDzp9Y5VRnSQGcCrE8rSpkGPaBpDl0=",
+    "h1:uUUa9dY0XQOycI8pxg16PFFtL0WCTi9uEJz8trTQ7pU=",
+    "h1:y3rV8KF2q6GEMANNlf5EkKJurlfbKlIKpjGcdxoy7pQ=",
+    "zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
+    "zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
+    "zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
+    "zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
+    "zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:8a9993f1dcadf1dd6ca43b23348abe374605d29945a2fafc07fb3457644e6a54",
-    "zh:b1b9a1e6bcc24d5863a664a411d2dc906373ae7a2399d2d65548ce7377057852",
-    "zh:b270184cdeec277218e84b94cb136fead753da717f9b9dc378e51907f3f00bb0",
-    "zh:dff2bc10071210181726ce270f954995fe42c696e61e2e8f874021fed02521e5",
-    "zh:e8e87b40b6a87dc097b0fdc20d3f725cec0d82abc9cc3755c1f89f8f6e8b0036",
-    "zh:ee964a6573d399a5dd22ce328fb38ca1207797a02248f14b2e4913ee390e7803",
+    "zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
+    "zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
+    "zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
+    "zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
+    "zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
+    "zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
+    "zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
+    "zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
+    "zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
  ]
 }
@@ -5,7 +5,7 @@ terraform {
  required_providers {
    cloudflare = {
      source = "cloudflare/cloudflare"
-      version = "4.52.5"
+      version = "4.52.7"
    }
  }
 }
@@ -74,7 +74,7 @@ services:
      - ${UPLOAD_LOCATION}/photos:/data
      - /etc/localtime:/etc/localtime:ro
      - pnpm_store_server:/buildcache/pnpm-store
-      - ../packages/plugins:/build/corePlugin
+      - ../packages/plugin-core:/build/plugins/immich-plugin-core
    env_file:
      - .env
    environment:
@@ -13,8 +13,11 @@ The `immich-server` docker image comes preinstalled with an administrative CLI (
 | `enable-oauth-login`       | Enable OAuth login                                            |
 | `disable-oauth-login`      | Disable OAuth login                                           |
 | `list-users`               | List Immich users                                             |
+| `grant-admin`              | Grant admin privileges to a user (by email)                   |
+| `revoke-admin`             | Revoke admin privileges from a user (by email)                |
 | `version`                  | Print Immich version                                          |
 | `change-media-location`    | Change database file paths to align with a new media location |
+| `schema-check`             | Verify database migrations and check for schema drift         |

 ## How to run a command

@@ -102,6 +105,22 @@ immich-admin list-users
 ]
 ```

+Grant Admin
+
+```
+immich-admin grant-admin
+? Please enter the user email:  user@example.com
+Admin access has been granted to user@example.com
+```
+
+Revoke Admin
+
+```
+immich-admin revoke-admin
+? Please enter the user email:  user@example.com
+Admin access has been revoked from user@example.com
+```
+
 Print Immich Version

 ```
@@ -126,3 +145,12 @@ immich-admin change-media-location
 Database file paths updated successfully! 🎉
 ...
 ```
+
+Schema Check
+
+```
+immich-admin schema-check
+Migrations are up to date
+
+No schema drift detected
+```
@@ -18,7 +18,7 @@ make e2e
 Before you can run the tests, you need to run the following commands _once_:

 - `pnpm install`
- `pnpm --filter "@immich/*" build`
+- `pnpm --filter @immich/sdk --filter @immich/cli build`
 - `mise //:open-api`

 Once the test environment is running, the e2e tests can be run via:
@@ -52,7 +52,7 @@ Scroll to the bottom of the "**Details**" section and find the `IP Address` list

 ## Step 4 - Configure Firewall Settings

-Once your project completes the build process, your containers will start. In order to be able to access Immich from your browser, you need to configure the firewall settings for your Synology NAS.
+Once your project completes the build process, your containers will start. In order to be able to access Immich from your browser, you need to configure the firewall settings for your Synology NAS to allow communication between the Immich containers.

 Open "**Control Panel**" on your Synology NAS, and select "**Security**". Navigate to "**Firewall**"

@@ -74,6 +74,7 @@ Read the [Post Installation](/install/post-install.mdx) steps and [upgrade instr

 <details>
  <summary>Updating Immich using Container Manager</summary>
+
 Check the post installation and upgrade instructions at the links above before proceeding with this section.

 ## Step 1. Backup
@@ -110,7 +111,7 @@ Go to **Project**, select **Action** then **Build**. This will download, unpack,

 ## Step 5. Update firewall rule

-The default behavior is to automatically start the containers once installed. If `immich_server` runs for a few seconds and then stops, it may be because the firewall rule no longer matches the server IP address.
+Without a fixed subnet, the default behavior is to automatically start the containers once installed. If `immich_server` runs for a few seconds and then stops, it may be because the firewall rule no longer matches the server IP address.

 Go to the **Container** section. Click on `immich_server` and scroll down on **General** to find the IP address.
 ![Container IP](../../static/img/synology-container-ip.png)
@@ -123,4 +124,67 @@ In this example, the IP addresses mismatch and the firewall rule needs to be edi

 ![Edit IP](../../static/img/synology-fw-ipedit.png)

+To prevent future firewall issues, you may set a fixed subnet. [See Set Fixed Subnet](#set-fixed-subnet) for instructions.
+
+</details>
+
+<details id="set-fixed-subnet">
+  <summary>Set Fixed Subnet</summary>
+
+Docker by default assigns dynamic subnets to bridge networks which can change when rebuilding containers and can cause firewall rules to break. To avoid this, define a fixed subnet in your `docker-compose.yml`:
+
+## Step 1. Determine current subnet
+
+Go to the **Container** section. Click on `immich_server` and scroll down on **General** to find the IP address.
+![Container IP](../../static/img/synology-container-ip.png)
+
+## Step 2. Add network configuration
+
+Add the following network configuration at the end of your `docker-compose.yml` file:
+
+```yaml
+networks:
+  immich-network:
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.20.0.0/16
+          gateway: 172.20.0.1
+```
+
+If your docker container is running on a different subnet then update accordingly.
+
+## Step 3. Add network to each service
+
+Add the network to each service (immich-server, immich-machine-learning, redis, database):
+
+```yaml
+services:
+  immich-server:
+    # other config options
+    networks:
+      - immich-network
+
+  immich-machine-learning:
+    # other config options
+    networks:
+      - immich-network
+
+  redis:
+    # other config options
+    networks:
+      - immich-network
+
+  database:
+    # other config options
+    networks:
+      - immich-network
+```
+
+Save your changes. Synology will ask if you want to save changes only or rebuild containers. Select rebuild containers.
+
+## Step 4. Update Firewall Rules, if necessary
+
+If your firewall rules were not already set for this subnet, the firewall rules will need to be updated. See [Step 4 - Configure Firewall Settings](#step-4---configure-firewall-settings).
+
 </details>
@@ -10,7 +10,6 @@ const config = {
  url: 'https://docs.immich.app',
  baseUrl: '/',
  onBrokenLinks: 'throw',
-  onBrokenMarkdownLinks: 'warn',
  favicon: 'img/favicon.png',

  // GitHub pages deployment config.
@@ -29,6 +28,9 @@ const config = {
  // Mermaid diagrams
  markdown: {
    mermaid: true,
+    hooks: {
+      onBrokenMarkdownLinks: 'warn',
+    },
  },
  themes: ['@docusaurus/theme-mermaid'],

@@ -0,0 +1,5 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools.wrangler]]
+version = "4.66.0"
+backend = "npm:wrangler"
@@ -28,4 +28,4 @@ run = "prettier --write ."
 run = "wrangler pages deploy build --project-name=${PROJECT_NAME} --branch=${BRANCH_NAME}"

 [tools]
-wrangler = "4.66.0"
+wrangler = "4.91.0"
@@ -32,7 +32,7 @@
    "@playwright/test": "^1.44.1",
    "@socket.io/component-emitter": "^3.1.2",
    "@types/luxon": "^3.4.2",
-    "@types/node": "^24.12.2",
+    "@types/node": "^24.12.4",
    "@types/pg": "^8.15.1",
    "@types/pngjs": "^6.0.4",
    "@types/supertest": "^7.0.0",
@@ -2,7 +2,7 @@ import { LoginResponseDto, ManualJobName } from '@immich/sdk';
 import { errorDto } from 'src/responses';
 import { app, utils } from 'src/utils';
 import request from 'supertest';
-import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';

 describe('/admin/database-backups', () => {
  let cookie: string | undefined;
@@ -13,6 +13,9 @@ describe('/admin/database-backups', () => {
    admin = await utils.adminSetup({
      onboarding: false,
    });
+  });
+
+  beforeEach(async () => {
    await utils.resetBackups(admin.accessToken);
  });

@@ -568,6 +568,8 @@ export const utils = {
      name: ManualJobName.BackupDatabase,
    });

+    await utils.waitForQueueFinish(accessToken, 'backupDatabase');
+
    return utils.poll(
      () => request(app).get('/admin/database-backups').set('Authorization', `Bearer ${accessToken}`),
      ({ status, body }) => status === 200 && body.backups.length === 1,
@@ -22,13 +22,12 @@
  "add_birthday": "Add a birthday",
  "add_endpoint": "Add endpoint",
  "add_exclusion_pattern": "Add exclusion pattern",
-  "add_filter": "Add filter",
-  "add_filter_description": "Click to add a filter condition",
  "add_location": "Add location",
  "add_more_users": "Add more users",
  "add_partner": "Add partner",
  "add_path": "Add path",
  "add_photos": "Add photos",
+  "add_step": "Add step",
  "add_tag": "Add tag",
  "add_to": "Add to…",
  "add_to_album": "Add to album",
@@ -42,7 +41,6 @@
  "add_to_shared_album": "Add to shared album",
  "add_upload_to_stack": "Add upload to stack",
  "add_url": "Add URL",
-  "add_workflow_step": "Add workflow step",
  "added_to_archive": "Added to archive",
  "added_to_favorites": "Added to favorites",
  "added_to_favorites_count": "Added {count, number} to favorites",
@@ -733,6 +731,7 @@
  "cannot_update_the_description": "Cannot update the description",
  "cast": "Cast",
  "cast_description": "Configure available cast destinations",
+  "change": "Change",
  "change_date": "Change date",
  "change_description": "Change description",
  "change_display_order": "Change display order",
@@ -761,6 +760,7 @@
  "check_corrupt_asset_backup_description": "Run this check only over Wi-Fi and once all assets have been backed-up. The procedure might take a few minutes.",
  "check_logs": "Check Logs",
  "checksum": "Checksum",
+  "choose": "Choose",
  "choose_matching_people_to_merge": "Choose matching people to merge",
  "city": "City",
  "cleanup_confirm_description": "Immich found {count} assets (created before {date}) safely backed up to the server. Remove the local copies from this device?",
@@ -778,6 +778,7 @@
  "clear": "Clear",
  "clear_all": "Clear all",
  "clear_all_recent_searches": "Clear all recent searches",
+  "clear_failed_count": "Clear failed ({count})",
  "clear_file_cache": "Clear File Cache",
  "clear_message": "Clear message",
  "clear_value": "Clear value",
@@ -809,6 +810,7 @@
  "comments_are_disabled": "Comments are disabled",
  "common_create_new_album": "Create new album",
  "completed": "Completed",
+  "configuration": "Configuration",
  "confirm": "Confirm",
  "confirm_admin_password": "Confirm Admin Password",
  "confirm_delete_face": "Are you sure you want to delete {name} face from the asset?",
@@ -823,6 +825,7 @@
  "contain": "Contain",
  "context": "Context",
  "continue": "Continue",
+  "control_bottom_app_bar_add_tags": "Add Tags",
  "control_bottom_app_bar_create_new_album": "Create new album",
  "control_bottom_app_bar_delete_from_immich": "Delete from Immich",
  "control_bottom_app_bar_delete_from_local": "Delete from device",
@@ -885,17 +888,16 @@
  "cutoff_date_description": "Keep photos from the last…",
  "cutoff_day": "{count, plural, one {day} other {days}}",
  "cutoff_year": "{count, plural, one {year} other {years}}",
-  "daily_title_text_date": "E, MMM dd",
-  "daily_title_text_date_year": "E, MMM dd, yyyy",
  "dark": "Dark",
  "dark_theme": "Switch to dark theme",
  "date": "Date",
  "date_after": "Date after",
  "date_and_time": "Date and Time",
  "date_before": "Date before",
-  "date_format": "E, LLL d, y • h:mm a",
+  "date_of_birth": "Date of birth",
  "date_of_birth_saved": "Date of birth saved successfully",
  "date_range": "Date range",
+  "date_time_original": "Date/Time Original",
  "day": "Day",
  "days": "Days",
  "deduplicate_all": "Deduplicate All",
@@ -1076,6 +1078,7 @@
    "failed_to_remove_product_key": "Failed to remove product key",
    "failed_to_reset_pin_code": "Failed to reset PIN code",
    "failed_to_stack_assets": "Failed to stack assets",
+    "failed_to_tag_assets": "Failed to tag assets",
    "failed_to_unstack_assets": "Failed to un-stack assets",
    "failed_to_update_notification_status": "Failed to update notification status",
    "incorrect_email_or_password": "Incorrect email or password",
@@ -1195,11 +1198,13 @@
  "export_as_json": "Export as JSON",
  "export_database": "Export Database",
  "export_database_description": "Export the SQLite database",
+  "exposure_time": "Exposure Time",
  "extension": "Extension",
  "external": "External",
  "external_libraries": "External Libraries",
  "external_network": "External network",
  "external_network_sheet_info": "When not on the preferred Wi-Fi network, the app will connect to the server through the first of the below URLs it can reach, starting from top to bottom",
+  "f_number": "F-Number",
  "face_unassigned": "Unassigned",
  "failed": "Failed",
  "failed_count": "Failed: {count}",
@@ -1217,7 +1222,6 @@
  "features_setting_description": "Manage the app features",
  "file_name_or_extension": "File name or extension",
  "file_name_text": "File name",
-  "file_name_with_value": "File name: {file_name}",
  "file_size": "File size",
  "filename": "Filename",
  "filetype": "Filetype",
@@ -1230,6 +1234,7 @@
  "find_them_fast": "Find them fast by name with search",
  "first": "First",
  "fix_incorrect_match": "Fix incorrect match",
+  "focal_length": "Focal Length",
  "folder": "Folder",
  "folder_not_found": "Folder not found",
  "folders": "Folders",
@@ -1350,6 +1355,7 @@
  "ios_debug_info_no_sync_yet": "No background sync job has run yet",
  "ios_debug_info_processes_queued": "{count, plural, one {{count} background process queued} other {{count} background processes queued}}",
  "ios_debug_info_processing_ran_at": "Processing ran {dateTime}",
+  "iso": "ISO",
  "items_count": "{count, plural, one {# item} other {# items}}",
  "jobs": "Jobs",
  "json_editor": "JSON editor",
@@ -1403,6 +1409,7 @@
  "link_to_oauth": "Link to OAuth",
  "linked_oauth_account": "Linked OAuth account",
  "list": "List",
+  "live": "Live",
  "loading": "Loading",
  "loading_search_results_failed": "Loading search results failed",
  "local": "Local",
@@ -1581,9 +1588,10 @@
  "mobile_app": "Mobile App",
  "mobile_app_download_onboarding_note": "Download the companion mobile app using the following options",
  "model": "Model",
+  "modify_date": "Modify Date",
  "month": "Month",
-  "monthly_title_text_date_format": "MMMM y",
  "more": "More",
+  "motion": "Motion",
  "move": "Move",
  "move_down": "Move down",
  "move_off_locked_folder": "Move out of locked folder",
@@ -1629,7 +1637,6 @@
  "next": "Next",
  "next_memory": "Next memory",
  "no": "No",
-  "no_actions_added": "No actions added yet",
  "no_albums_found": "No albums found",
  "no_albums_message": "Create an album to organize your photos and videos",
  "no_albums_with_name_yet": "It looks like you do not have any albums with this name yet.",
@@ -1646,7 +1653,6 @@
  "no_exif_info_available": "No exif info available",
  "no_explore_results_message": "Upload more photos to explore your collection.",
  "no_favorites_message": "Add favorites to quickly find your best pictures and videos",
-  "no_filters_added": "No filters added yet",
  "no_libraries_message": "Create an external library to view your photos and videos",
  "no_local_assets_found": "No local assets found with this checksum",
  "no_location_set": "No location set",
@@ -1659,6 +1665,7 @@
  "no_results": "No results",
  "no_results_description": "Try a synonym or more general keyword",
  "no_shared_albums_message": "Create an album to share photos and videos with people in your network",
+  "no_steps": "No steps added yet",
  "no_uploads_in_progress": "No uploads in progress",
  "none": "None",
  "not_allowed": "Not allowed",
@@ -1704,6 +1711,7 @@
  "organize_into_albums": "Organize into albums",
  "organize_into_albums_description": "Put existing photos into albums using current sync settings",
  "organize_your_library": "Organize your library",
+  "orientation": "Orientation",
  "original": "original",
  "other": "Other",
  "other_devices": "Other devices",
@@ -1795,6 +1803,8 @@
  "play_original_video_setting_description": "Prefer playback of original videos rather than transcoded videos. If original asset is not compatible it may not playback correctly.",
  "play_transcoded_video": "Play transcoded video",
  "please_auth_to_access": "Please authenticate to access",
+  "plugin_method_filter_type": "Filter",
+  "plugin_method_filter_type_description": "This method can filter events and conditionally prevent subsequent steps from running",
  "port": "Port",
  "preferences_settings_subtitle": "Manage the app's preferences",
  "preferences_settings_title": "Preferences",
@@ -1816,6 +1826,7 @@
  "profile_drawer_readonly_mode": "Read-only mode enabled. Long-press the user avatar icon to exit.",
  "profile_image_of_user": "Profile image of {user}",
  "profile_picture_set": "Profile picture set.",
+  "projection_type": "Projection Type",
  "public_album": "Public album",
  "public_share": "Public Share",
  "purchase_account_info": "Supporter",
@@ -2185,7 +2196,9 @@
  "show_in_timeline": "Show in timeline",
  "show_in_timeline_setting_description": "Show photos and videos from this user in your timeline",
  "show_keyboard_shortcuts": "Show keyboard shortcuts",
+  "show_less": "Show less",
  "show_metadata": "Show metadata",
+  "show_more_fields": "{count, plural, one {Show # more field} other {Show # more fields}}",
  "show_or_hide_info": "Show or hide info",
  "show_password": "Show password",
  "show_person_options": "Show person options",
@@ -2237,6 +2250,10 @@
  "start_date_before_end_date": "Start date must be before end date",
  "state": "State",
  "status": "Status",
+  "step_delete": "Delete step",
+  "step_delete_confirm": "Are you sure you want to delete this step?",
+  "step_details": "Step details",
+  "steps": "Steps",
  "stop_casting": "Stop casting",
  "stop_motion_photo": "Stop Motion Photo",
  "stop_photo_sharing": "Stop sharing your photos?",
@@ -2330,7 +2347,7 @@
  "trash_page_title": "Trash ({count})",
  "trashed_items_will_be_permanently_deleted_after": "Trashed items will be permanently deleted after {days, plural, one {# day} other {# days}}.",
  "trigger": "Trigger",
-  "trigger_asset_uploaded": "Asset Uploaded",
+  "trigger_asset_uploaded": "Asset Upload",
  "trigger_asset_uploaded_description": "Triggered when a new asset is uploaded",
  "trigger_description": "An event that kicks off the workflow",
  "trigger_person_recognized": "Person Recognized",
@@ -2370,7 +2387,6 @@
  "unsupported_field_type": "Unsupported field type",
  "unsupported_file_type": "File {file} can't be uploaded because its file type {type} is not supported.",
  "untagged": "Untagged",
-  "untitled_workflow": "Untitled workflow",
  "up_next": "Up next",
  "update_location_action_prompt": "Update the location of {count} selected assets with:",
  "updated_at": "Updated",
@@ -2462,6 +2478,7 @@
  "welcome_to_immich": "Welcome to Immich",
  "width": "Width",
  "wifi_name": "Wi-Fi Name",
+  "workflow": "Workflow",
  "workflow_delete_prompt": "Are you sure you want to delete this workflow?",
  "workflow_deleted": "Workflow deleted",
  "workflow_description": "Workflow description",
@@ -0,0 +1,72 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools.python]]
+version = "3.11.15"
+backend = "core:python"
+
+[tools.python."platforms.linux-arm64"]
+checksum = "sha256:243f794278eff6adba96ed3677ec6877175df84c25f140e17f09f9be82d0f12a"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython-3.11.15+20260510-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.linux-arm64-musl"]
+checksum = "sha256:52b4c52094ff8b383a45c694acf4c5c0e883152be6d5229a35a8186ce907c6eb"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython-3.11.15+20260510-aarch64-unknown-linux-musl-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.linux-x64"]
+checksum = "sha256:171dffd8c0f66e8a0725364a7428015b22fc18dd298b24f541392e17dd0e561f"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython-3.11.15+20260510-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.linux-x64-musl"]
+checksum = "sha256:2ac90fef8917ebd14826a6d667593a06cf0ae5f745ba9b1147dc086dd35f5284"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython-3.11.15+20260510-x86_64-unknown-linux-musl-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.macos-arm64"]
+checksum = "sha256:fdfc363b538662eb7441a14e06f72c4a992c56af7f401f5730ea5081f8f8ad6e"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython-3.11.15+20260510-aarch64-apple-darwin-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.macos-x64"]
+checksum = "sha256:5f1eb247cbca2c0ad5ccbf6d299a4f54b31b5c63b492d74c3531dc4344a42f88"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython-3.11.15+20260510-x86_64-apple-darwin-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.windows-x64"]
+checksum = "sha256:756d7f148498b8822f6aedf44a020613576f09983161f346ad36dcef6238cdc3"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260510/cpython-3.11.15+20260510-x86_64-pc-windows-msvc-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[[tools.uv]]
+version = "0.8.15"
+backend = "aqua:astral-sh/uv"
+
+[tools.uv."platforms.linux-arm64"]
+checksum = "sha256:23ea21a05c62c4c307ce691f29bff2f15c94c4f07f2b83d9b356f0664bc8b3a2"
+url = "https://github.com/astral-sh/uv/releases/download/0.8.15/uv-aarch64-unknown-linux-musl.tar.gz"
+
+[tools.uv."platforms.linux-arm64-musl"]
+checksum = "sha256:23ea21a05c62c4c307ce691f29bff2f15c94c4f07f2b83d9b356f0664bc8b3a2"
+url = "https://github.com/astral-sh/uv/releases/download/0.8.15/uv-aarch64-unknown-linux-musl.tar.gz"
+
+[tools.uv."platforms.linux-x64"]
+checksum = "sha256:d0fec58f3124e05e0a1af0f6541abfce4333253cdaf23c7b6bb2e6128bf138ea"
+url = "https://github.com/astral-sh/uv/releases/download/0.8.15/uv-x86_64-unknown-linux-musl.tar.gz"
+
+[tools.uv."platforms.linux-x64-musl"]
+checksum = "sha256:d0fec58f3124e05e0a1af0f6541abfce4333253cdaf23c7b6bb2e6128bf138ea"
+url = "https://github.com/astral-sh/uv/releases/download/0.8.15/uv-x86_64-unknown-linux-musl.tar.gz"
+
+[tools.uv."platforms.macos-arm64"]
+checksum = "sha256:103367962c5cb00bf7370d84cbaa3fec5a9807be9cc833ea9d8eea400c119fa2"
+url = "https://github.com/astral-sh/uv/releases/download/0.8.15/uv-aarch64-apple-darwin.tar.gz"
+
+[tools.uv."platforms.macos-x64"]
+checksum = "sha256:2bbef70982e97dfc36454de173f35ec1a5e83ae11e3885df6a50db3fd76171cb"
+url = "https://github.com/astral-sh/uv/releases/download/0.8.15/uv-x86_64-apple-darwin.tar.gz"
+
+[tools.uv."platforms.windows-x64"]
+checksum = "sha256:459d95892a5cc5c21779532f4f41b9238594b79e312a5142da2148ecfa10e705"
+url = "https://github.com/astral-sh/uv/releases/download/0.8.15/uv-x86_64-pc-windows-msvc.zip"
@@ -0,0 +1,332 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.en.dev/dev-tools/mise-lock.html
+
+[[tools."aqua:flutter/flutter"]]
+version = "3.41.9"
+backend = "aqua:flutter/flutter"
+
+[[tools.flutter]]
+version = "3.41.9-stable"
+backend = "asdf:flutter"
+
+[[tools."github:CQLabs/homebrew-dcm"]]
+version = "1.37.0"
+backend = "github:CQLabs/homebrew-dcm"
+
+[tools."github:CQLabs/homebrew-dcm"."platforms.linux-arm64"]
+checksum = "sha256:253da2512b149913dfe345bf9a62a79acb2d730f66e71162ba4a92dfc4224b82"
+url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-linux-arm-release.zip"
+url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543838"
+
+[tools."github:CQLabs/homebrew-dcm"."platforms.linux-arm64-musl"]
+checksum = "sha256:253da2512b149913dfe345bf9a62a79acb2d730f66e71162ba4a92dfc4224b82"
+url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-linux-arm-release.zip"
+url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543838"
+
+[tools."github:CQLabs/homebrew-dcm"."platforms.linux-x64"]
+checksum = "sha256:477e086d4099c12f21e5ccd83b005d5fb945dd4cac4fd127fd9a08d7649af1cf"
+url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-linux-x64-release.zip"
+url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543797"
+
+[tools."github:CQLabs/homebrew-dcm"."platforms.linux-x64-musl"]
+checksum = "sha256:477e086d4099c12f21e5ccd83b005d5fb945dd4cac4fd127fd9a08d7649af1cf"
+url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-linux-x64-release.zip"
+url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543797"
+
+[tools."github:CQLabs/homebrew-dcm"."platforms.macos-arm64"]
+checksum = "sha256:30bede64367d09067093cc57af6ec9496d7717898138ded5cb98a16ac8dd9d93"
+url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-macos-arm-release.zip"
+url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543757"
+
+[tools."github:CQLabs/homebrew-dcm"."platforms.macos-x64"]
+checksum = "sha256:e56cb99872be7445a4de1d37e5438ca70e3bcd83be7a2b9b385e3538881f8068"
+url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-macos-x64-release.zip"
+url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543727"
+
+[tools."github:CQLabs/homebrew-dcm"."platforms.windows-x64"]
+checksum = "sha256:f133470daa3fb0427f039b424392af7e917d7e7db6b556aa2a968ab0e31587da"
+url = "https://github.com/CQLabs/homebrew-dcm/releases/download/1.37.0/dcm-windows-release.zip"
+url_api = "https://api.github.com/repos/CQLabs/homebrew-dcm/releases/assets/404543660"
+
+[[tools."github:extism/cli"]]
+version = "1.6.3"
+backend = "github:extism/cli"
+
+[tools."github:extism/cli"."platforms.linux-arm64"]
+checksum = "sha256:d92f830c9be39637569feacb04e9750c28848df6d9a219db94152a9b4eb9452b"
+url = "https://github.com/extism/cli/releases/download/v1.6.3/extism-v1.6.3-linux-arm64.tar.gz"
+url_api = "https://api.github.com/repos/extism/cli/releases/assets/275694030"
+
+[tools."github:extism/cli"."platforms.linux-arm64-musl"]
+checksum = "sha256:d92f830c9be39637569feacb04e9750c28848df6d9a219db94152a9b4eb9452b"
+url = "https://github.com/extism/cli/releases/download/v1.6.3/extism-v1.6.3-linux-arm64.tar.gz"
+url_api = "https://api.github.com/repos/extism/cli/releases/assets/275694030"
+
+[tools."github:extism/cli"."platforms.linux-x64"]
+checksum = "sha256:34e7ae9bfded6e2c32dee83f70a4e50d34f9d3e80d1762b09625fe82e214d02d"
+url = "https://github.com/extism/cli/releases/download/v1.6.3/extism-v1.6.3-linux-amd64.tar.gz"
+url_api = "https://api.github.com/repos/extism/cli/releases/assets/275694025"
+
+[tools."github:extism/cli"."platforms.linux-x64-musl"]
+checksum = "sha256:34e7ae9bfded6e2c32dee83f70a4e50d34f9d3e80d1762b09625fe82e214d02d"
+url = "https://github.com/extism/cli/releases/download/v1.6.3/extism-v1.6.3-linux-amd64.tar.gz"
+url_api = "https://api.github.com/repos/extism/cli/releases/assets/275694025"
+
+[tools."github:extism/cli"."platforms.macos-arm64"]
+checksum = "sha256:b4ddbc575b5ac000115247f781723f9b9f284ed87b29c600539d72161b5b29fc"
+url = "https://github.com/extism/cli/releases/download/v1.6.3/extism-v1.6.3-darwin-arm64.tar.gz"
+url_api = "https://api.github.com/repos/extism/cli/releases/assets/275694029"
+
+[tools."github:extism/cli"."platforms.macos-x64"]
+checksum = "sha256:9a2f71b6e6009685a622cc3084e52d2a1a8e23c98d29ffa72e666e9dc699855f"
+url = "https://github.com/extism/cli/releases/download/v1.6.3/extism-v1.6.3-darwin-amd64.tar.gz"
+url_api = "https://api.github.com/repos/extism/cli/releases/assets/275694026"
+
+[tools."github:extism/cli"."platforms.windows-x64"]
+checksum = "sha256:47e4ed2782445b2b08a4d1ac127211588f8b4d1fc25fd6481d4cb65151b5213c"
+url = "https://github.com/extism/cli/releases/download/v1.6.3/extism-v1.6.3-windows-amd64.zip"
+url_api = "https://api.github.com/repos/extism/cli/releases/assets/275694035"
+
+[[tools."github:extism/js-pdk"]]
+version = "1.6.0"
+backend = "github:extism/js-pdk"
+
+[tools."github:extism/js-pdk"."platforms.linux-arm64"]
+checksum = "sha256:15a186250e68d6bff4ec839fff275d45a90e383a69209dcc1239eb9e3aee6e1b"
+url = "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-aarch64-linux-v1.6.0.gz"
+url_api = "https://api.github.com/repos/extism/js-pdk/releases/assets/353223214"
+
+[tools."github:extism/js-pdk"."platforms.linux-arm64-musl"]
+checksum = "sha256:15a186250e68d6bff4ec839fff275d45a90e383a69209dcc1239eb9e3aee6e1b"
+url = "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-aarch64-linux-v1.6.0.gz"
+url_api = "https://api.github.com/repos/extism/js-pdk/releases/assets/353223214"
+
+[tools."github:extism/js-pdk"."platforms.linux-x64"]
+checksum = "sha256:4ded271ccf465031ccd0dc35e7a140e134d7f30721671cc4a8e1ff805d4aad68"
+url = "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-x86_64-linux-v1.6.0.gz"
+url_api = "https://api.github.com/repos/extism/js-pdk/releases/assets/353223119"
+
+[tools."github:extism/js-pdk"."platforms.linux-x64-musl"]
+checksum = "sha256:4ded271ccf465031ccd0dc35e7a140e134d7f30721671cc4a8e1ff805d4aad68"
+url = "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-x86_64-linux-v1.6.0.gz"
+url_api = "https://api.github.com/repos/extism/js-pdk/releases/assets/353223119"
+
+[tools."github:extism/js-pdk"."platforms.macos-arm64"]
+checksum = "sha256:548e25bda3971a07c32d78a249135cf8cb7b3eede101e878e06e53e01ac2e0ce"
+url = "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-aarch64-macos-v1.6.0.gz"
+url_api = "https://api.github.com/repos/extism/js-pdk/releases/assets/353223215"
+
+[tools."github:extism/js-pdk"."platforms.macos-x64"]
+checksum = "sha256:d85a875c2a071f0c29fe572764c52c3a499f157ab7f9efac8939a4364390e29b"
+url = "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-x86_64-macos-v1.6.0.gz"
+url_api = "https://api.github.com/repos/extism/js-pdk/releases/assets/353223239"
+
+[tools."github:extism/js-pdk"."platforms.windows-x64"]
+checksum = "sha256:97b7b746141e4777e1ca2b76febdeb16dc9d314ff6a4257df05a476b67228acc"
+url = "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-x86_64-windows-v1.6.0.gz"
+url_api = "https://api.github.com/repos/extism/js-pdk/releases/assets/353224133"
+
+[[tools."github:jellyfin/jellyfin-ffmpeg"]]
+version = "7.1.3-6"
+backend = "github:jellyfin/jellyfin-ffmpeg"
+
+[tools."github:jellyfin/jellyfin-ffmpeg"."platforms.linux-arm64"]
+checksum = "sha256:bea03c670e8cc5bfe9edc0c5d624d4735421610cef5e808db93e7d8596952886"
+url = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v7.1.3-6/jellyfin-ffmpeg_7.1.3-6_portable_linuxarm64-gpl.tar.xz"
+url_api = "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/assets/409048876"
+
+[tools."github:jellyfin/jellyfin-ffmpeg"."platforms.linux-arm64-musl"]
+checksum = "sha256:bea03c670e8cc5bfe9edc0c5d624d4735421610cef5e808db93e7d8596952886"
+url = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v7.1.3-6/jellyfin-ffmpeg_7.1.3-6_portable_linuxarm64-gpl.tar.xz"
+url_api = "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/assets/409048876"
+
+[tools."github:jellyfin/jellyfin-ffmpeg"."platforms.linux-x64"]
+checksum = "sha256:39e99a7927468a6abec5f65d00f55010e8ff2ae3c2605294f179c94f6ae21af2"
+url = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v7.1.3-6/jellyfin-ffmpeg_7.1.3-6_portable_linux64-gpl.tar.xz"
+url_api = "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/assets/409048879"
+
+[tools."github:jellyfin/jellyfin-ffmpeg"."platforms.linux-x64-musl"]
+checksum = "sha256:39e99a7927468a6abec5f65d00f55010e8ff2ae3c2605294f179c94f6ae21af2"
+url = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v7.1.3-6/jellyfin-ffmpeg_7.1.3-6_portable_linux64-gpl.tar.xz"
+url_api = "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/assets/409048879"
+
+[tools."github:jellyfin/jellyfin-ffmpeg"."platforms.macos-arm64"]
+checksum = "sha256:e024d5e78d5414e75f0181036cd21373fafb9270c72894dfd7dbda2572439820"
+url = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v7.1.3-6/jellyfin-ffmpeg_7.1.3-6_portable_macarm64-gpl.tar.xz"
+url_api = "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/assets/408995838"
+
+[tools."github:jellyfin/jellyfin-ffmpeg"."platforms.macos-x64"]
+checksum = "sha256:066ede9774aaae97a18098aaeea8b7e0d286653eb8618f640476e99c59a536c2"
+url = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v7.1.3-6/jellyfin-ffmpeg_7.1.3-6_portable_mac64-gpl.tar.xz"
+url_api = "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/assets/408995889"
+
+[tools."github:jellyfin/jellyfin-ffmpeg"."platforms.windows-x64"]
+checksum = "sha256:7b7168149689610296f3a187c717056ce0786cc125a31caf28056737e9ba1cc1"
+url = "https://github.com/jellyfin/jellyfin-ffmpeg/releases/download/v7.1.3-6/jellyfin-ffmpeg_7.1.3-6_portable_win64-clang-gpl.zip"
+url_api = "https://api.github.com/repos/jellyfin/jellyfin-ffmpeg/releases/assets/409036094"
+
+[[tools."github:webassembly/binaryen"]]
+version = "version_124"
+backend = "github:webassembly/binaryen"
+
+[tools."github:webassembly/binaryen"."platforms.linux-arm64"]
+checksum = "sha256:6291bd9a57d8e046f3bc099a4db386c147433a87f71c783a901c5b1792e38de3"
+url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-aarch64-linux.tar.gz"
+url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288927659"
+
+[tools."github:webassembly/binaryen"."platforms.linux-arm64-musl"]
+checksum = "sha256:6291bd9a57d8e046f3bc099a4db386c147433a87f71c783a901c5b1792e38de3"
+url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-aarch64-linux.tar.gz"
+url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288927659"
+
+[tools."github:webassembly/binaryen"."platforms.linux-x64"]
+checksum = "sha256:0290c3779fedf592b8da0ded3032ff55c41a2b7bfa2d6bf7b7bac6f0e6e28963"
+url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-x86_64-linux.tar.gz"
+url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288926769"
+
+[tools."github:webassembly/binaryen"."platforms.linux-x64-musl"]
+checksum = "sha256:0290c3779fedf592b8da0ded3032ff55c41a2b7bfa2d6bf7b7bac6f0e6e28963"
+url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-x86_64-linux.tar.gz"
+url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288926769"
+
+[tools."github:webassembly/binaryen"."platforms.macos-arm64"]
+checksum = "sha256:86a2c960ff62c6d2ea6009d1f89745c22c70100d394a095eab45eb941bdaa24c"
+url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-arm64-macos.tar.gz"
+url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288926134"
+
+[tools."github:webassembly/binaryen"."platforms.macos-x64"]
+checksum = "sha256:b389bb0731758d86c3cb266d01d28a12725c23bd3cabc3df34faa162af0887e9"
+url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-x86_64-macos.tar.gz"
+url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288926135"
+
+[tools."github:webassembly/binaryen"."platforms.windows-x64"]
+checksum = "sha256:b5e1d2a1ad3c03229ddc89823848f4a1c11f9c6402a51fa26f0aaa5f1d7a2203"
+url = "https://github.com/WebAssembly/binaryen/releases/download/version_124/binaryen-version_124-x86_64-windows.tar.gz"
+url_api = "https://api.github.com/repos/WebAssembly/binaryen/releases/assets/288925833"
+
+[[tools.java]]
+version = "21.0.2"
+backend = "core:java"
+
+[tools.java."platforms.linux-arm64"]
+checksum = "sha256:08db1392a48d4eb5ea5315cf8f18b89dbaf36cda663ba882cf03c704c9257ec2"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-aarch64_bin.tar.gz"
+
+[tools.java."platforms.linux-x64"]
+checksum = "sha256:a2def047a73941e01a73739f92755f86b895811afb1f91243db214cff5bdac3f"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-x64_bin.tar.gz"
+
+[tools.java."platforms.macos-arm64"]
+checksum = "sha256:b3d588e16ec1e0ef9805d8a696591bd518a5cea62567da8f53b5ce32d11d22e4"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-aarch64_bin.tar.gz"
+
+[tools.java."platforms.macos-x64"]
+checksum = "sha256:8fd09e15dc406387a0aba70bf5d99692874e999bf9cd9208b452b5d76ac922d3"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_macos-x64_bin.tar.gz"
+
+[tools.java."platforms.windows-x64"]
+checksum = "sha256:b6c17e747ae78cdd6de4d7532b3164b277daee97c007d3eaa2b39cca99882664"
+url = "https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_windows-x64_bin.zip"
+
+[[tools.node]]
+version = "24.15.0"
+backend = "core:node"
+
+[tools.node."platforms.linux-arm64"]
+checksum = "sha256:73afc234d558c24919875f51c2d1ea002a2ada4ea6f83601a383869fefa64eed"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-arm64.tar.gz"
+
+[tools.node."platforms.linux-arm64-musl"]
+checksum = "sha256:31e98aa960a067da91edffd5d93bc46657b5d2a8029612c359f5f2ac0060152a"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.15.0/node-v24.15.0-linux-arm64-musl.tar.gz"
+
+[tools.node."platforms.linux-x64"]
+checksum = "sha256:44836872d9aec49f1e6b52a9a922872db9a2b02d235a616a5681b6a85fec8d89"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-linux-x64.tar.gz"
+
+[tools.node."platforms.linux-x64-musl"]
+checksum = "sha256:f55af5bd489c5347b113ca6594cae00a54b30ba57ac5875324311bfc6f4762e3"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.15.0/node-v24.15.0-linux-x64-musl.tar.gz"
+
+[tools.node."platforms.macos-arm64"]
+checksum = "sha256:372331b969779ab5d15b949884fc6eaf88d5afe87bde8ba881d6400b9100ffc4"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-darwin-arm64.tar.gz"
+
+[tools.node."platforms.macos-x64"]
+checksum = "sha256:ffd5ee293467927f3ee731a553eb88fd1f48cf74eebc2d74a6babe4af228673b"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-darwin-x64.tar.gz"
+
+[tools.node."platforms.windows-x64"]
+checksum = "sha256:cc5149eabd53779ce1e7bdc5401643622d0c7e6800ade18928a767e940bb0e62"
+url = "https://nodejs.org/dist/v24.15.0/node-v24.15.0-win-x64.zip"
+
+[[tools."npm:oazapfts"]]
+version = "7.5.0"
+backend = "npm:oazapfts"
+
+[[tools.opentofu]]
+version = "1.11.6"
+backend = "aqua:opentofu/opentofu"
+
+[tools.opentofu."platforms.linux-arm64"]
+checksum = "sha256:d4f2ab15776925864b049bb329d69682851de6f5204f256e9fa86d07a0308850"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_arm64.tar.gz"
+
+[tools.opentofu."platforms.linux-arm64-musl"]
+checksum = "sha256:d4f2ab15776925864b049bb329d69682851de6f5204f256e9fa86d07a0308850"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_arm64.tar.gz"
+
+[tools.opentofu."platforms.linux-x64"]
+checksum = "sha256:02800fafa2753a9f50c38483e2fdf5bc353fd62895eb9e25eec9a5145df3a69e"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_amd64.tar.gz"
+
+[tools.opentofu."platforms.linux-x64-musl"]
+checksum = "sha256:02800fafa2753a9f50c38483e2fdf5bc353fd62895eb9e25eec9a5145df3a69e"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_linux_amd64.tar.gz"
+
+[tools.opentofu."platforms.macos-arm64"]
+checksum = "sha256:62d7fa8539e13b444827aa0a3b90c5972da5c47e8f8882d9dcf2e430e78840c1"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_darwin_arm64.tar.gz"
+
+[tools.opentofu."platforms.macos-x64"]
+checksum = "sha256:1408cdef1c380f914565e6b4bb70794c6b163f195fcb233357f3d6c5745906b6"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_darwin_amd64.tar.gz"
+
+[tools.opentofu."platforms.windows-x64"]
+checksum = "sha256:27323f70c875b8251bfd7e61a4cffc3ebff4e56ed1e611b955016f0c7077367e"
+url = "https://github.com/opentofu/opentofu/releases/download/v1.11.6/tofu_1.11.6_windows_amd64.tar.gz"
+
+[[tools.pnpm]]
+version = "10.33.4"
+backend = "aqua:pnpm/pnpm"
+
+[[tools.terragrunt]]
+version = "1.0.3"
+backend = "aqua:gruntwork-io/terragrunt"
+
+[tools.terragrunt."platforms.linux-arm64"]
+checksum = "sha256:e5b60ab05b5214db694e6bc215d8124fb626e277cdb56b86f6147ae110d510fe"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_arm64.tar.gz"
+
+[tools.terragrunt."platforms.linux-arm64-musl"]
+checksum = "sha256:e5b60ab05b5214db694e6bc215d8124fb626e277cdb56b86f6147ae110d510fe"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_arm64.tar.gz"
+
+[tools.terragrunt."platforms.linux-x64"]
+checksum = "sha256:6d48049baf82e0bf9c804368dc85cbfeadc10955e33777e9e8de3e020b94b073"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_amd64.tar.gz"
+
+[tools.terragrunt."platforms.linux-x64-musl"]
+checksum = "sha256:6d48049baf82e0bf9c804368dc85cbfeadc10955e33777e9e8de3e020b94b073"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_linux_amd64.tar.gz"
+
+[tools.terragrunt."platforms.macos-arm64"]
+checksum = "sha256:aacb5be2ca5475300cbce246dfbd8a45eb47510fbaa70fab8561c49ef5db03aa"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_darwin_arm64.tar.gz"
+
+[tools.terragrunt."platforms.macos-x64"]
+checksum = "sha256:3133c2251e191aede8e3dd2a5b3aee2e91c5f08f88f117aee40eed9a24c8ef6b"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_darwin_amd64.tar.gz"
+
+[tools.terragrunt."platforms.windows-x64"]
+checksum = "sha256:183b2745b4e04980a6bfa4450ff81956a12596ca22d70f7aaa793980f5b036db"
+url = "https://github.com/gruntwork-io/terragrunt/releases/download/v1.0.3/terragrunt_windows_amd64.exe.tar.gz"
@@ -2,7 +2,7 @@ experimental_monorepo_root = true

 [monorepo]
 config_roots = [
-  "packages/plugins",
+  "packages/plugin-core",
  "server",
  "packages/cli",
  "deployment",
@@ -16,18 +16,28 @@ config_roots = [

 [tools]
 node = "24.15.0"
-flutter = "3.41.9"
-pnpm = "10.33.1"
+"aqua:flutter/flutter" = "3.41.9"
+pnpm = "10.33.4"
 terragrunt = "1.0.3"
 opentofu = "1.11.6"
 java = "21.0.2"
 "npm:oazapfts" = "7.5.0"
+"github:extism/cli" = "1.6.3"
+"github:webassembly/binaryen" = "version_124"
+"github:extism/js-pdk" = "1.6.0"

 [tools."github:CQLabs/homebrew-dcm"]
 version = "1.37.0"
 bin = "dcm"
 postinstall = "chmod +x \"$MISE_TOOL_INSTALL_PATH/dcm\" || true"

+[tools."github:CQLabs/homebrew-dcm".platforms]
+linux-x64 = { asset_pattern = "dcm-linux-x64-release.zip" }
+linux-arm64 = { asset_pattern = "dcm-linux-arm-release.zip" }
+macos-x64 = { asset_pattern = "dcm-macos-x64-release.zip" }
+macos-arm64 = { asset_pattern = "dcm-macos-arm-release.zip" }
+windows-x64 = { asset_pattern = "dcm-windows-release.zip" }
+
 [tools."github:jellyfin/jellyfin-ffmpeg"]
 version = "7.1.3-6"

@@ -40,6 +50,13 @@ macos-arm64 = { asset_pattern = "jellyfin-ffmpeg_*_portable_macarm64-gpl.tar.xz"
 [settings]
 experimental = true
 pin = true
+lockfile = true
+
+[tasks.plugins]
+run = [
+  "pnpm --filter @immich/plugin-sdk --filter @immich/plugin-core install --frozen-lockfile",
+  "pnpm --filter @immich/plugin-sdk --filter @immich/plugin-core build",
+]

 [tasks.open-api-typescript]
 run = [
@@ -55,11 +72,13 @@ run = "bash ./bin/generate-dart-sdk.sh"
 [tasks.open-api]
 env = { SHARP_IGNORE_GLOBAL_LIBVIPS = true }
 run = [
+  { task = "//:plugins" },
+  { task = "//server:build" },
  { task = "//server:install" },
  { task = "//server:build" },
  { task = "//server:sync-open-api" },
-  { task = ":open-api-typescript"},
-  { task = ":open-api-dart"},
+  { task = ":open-api-typescript" },
+  { task = ":open-api-dart" },
 ]

 [tasks.sql]
@@ -89,6 +89,13 @@ flutter {
 }

 dependencies {
+  constraints {
+    implementation("androidx.glance:glance-appwidget") {
+      version { strictly libs.versions.glance.get() }
+      because 'home_widget requests 1.+ which can resolve to pre-releases incompatible with our compileSdk/AGP'
+    }
+  }
+
  implementation libs.okhttp
  implementation libs.cronet.embedded
  implementation libs.media3.datasource.okhttp
@@ -17,6 +17,8 @@ import app.alextran.immich.images.LocalImageApi
 import app.alextran.immich.images.LocalImagesImpl
 import app.alextran.immich.images.RemoteImageApi
 import app.alextran.immich.images.RemoteImagesImpl
+import app.alextran.immich.permission.PermissionApi
+import app.alextran.immich.permission.PermissionApiImpl
 import app.alextran.immich.sync.NativeSyncApi
 import app.alextran.immich.sync.NativeSyncApiImpl26
 import app.alextran.immich.sync.NativeSyncApiImpl30
@@ -44,7 +46,9 @@ class MainActivity : FlutterFragmentActivity() {
        } else {
          NativeSyncApiImpl30(ctx)
        }
+      val permissionApiImpl = PermissionApiImpl(ctx)
      NativeSyncApi.setUp(messenger, nativeSyncApiImpl)
+      PermissionApi.setUp(messenger, permissionApiImpl)
      LocalImageApi.setUp(messenger, LocalImagesImpl(ctx))
      RemoteImageApi.setUp(messenger, RemoteImagesImpl(ctx))

@@ -53,6 +57,7 @@ class MainActivity : FlutterFragmentActivity() {

      flutterEngine.plugins.add(backgroundEngineLockImpl)
      flutterEngine.plugins.add(nativeSyncApiImpl)
+      flutterEngine.plugins.add(permissionApiImpl)
    }

    fun cancelPlugins(flutterEngine: FlutterEngine) {
@@ -60,6 +65,8 @@ class MainActivity : FlutterFragmentActivity() {
        flutterEngine.plugins.get(NativeSyncApiImpl26::class.java) as ImmichPlugin?
          ?: flutterEngine.plugins.get(NativeSyncApiImpl30::class.java) as ImmichPlugin?
      nativeApi?.detachFromEngine()
+      val permissionApi = flutterEngine.plugins.get(PermissionApiImpl::class.java) as ImmichPlugin?
+      permissionApi?.detachFromEngine()
    }
  }
 }
@@ -315,6 +315,7 @@ interface NetworkApi {
  fun hasCertificate(): Boolean
  fun getClientPointer(): Long
  fun setRequestHeaders(headers: Map<String, String>, serverUrls: List<String>, token: String?)
+  fun getAppGroupId(): String

  companion object {
    /** The codec used by NetworkApi. */
@@ -430,6 +431,21 @@ interface NetworkApi {
          channel.setMessageHandler(null)
        }
      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NetworkApi.getAppGroupId$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            val wrapped: List<Any?> = try {
+              listOf(api.getAppGroupId())
+            } catch (exception: Throwable) {
+              NetworkPigeonUtils.wrapError(exception)
+            }
+            reply.reply(wrapped)
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
    }
  }
 }
@@ -13,7 +13,7 @@ class NetworkApiPlugin : FlutterPlugin, ActivityAware {
  private var networkApi: NetworkApiImpl? = null

  override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
-    networkApi = NetworkApiImpl()
+    networkApi = NetworkApiImpl(binding.applicationContext)
    NetworkApi.setUp(binding.binaryMessenger, networkApi)
  }

@@ -39,9 +39,11 @@ class NetworkApiPlugin : FlutterPlugin, ActivityAware {
  }
 }

-private class NetworkApiImpl : NetworkApi {
+private class NetworkApiImpl(private val context: Context) : NetworkApi {
  var activity: Activity? = null

+  override fun getAppGroupId(): String = context.packageName
+
  override fun addCertificate(clientData: ClientCertData, callback: (Result<Unit>) -> Unit) {
    try {
      HttpClientManager.setKeyEntry(clientData.data, clientData.password.toCharArray())
@@ -23,6 +23,8 @@ import java.io.IOException
 import java.nio.ByteBuffer
 import java.util.concurrent.ConcurrentHashMap

+private const val MAX_PREALLOC_BYTES = 128 * 1024 * 1024
+
 private class RemoteRequest(val cancellationSignal: CancellationSignal)

 class RemoteImagesImpl(context: Context) : RemoteImageApi {
@@ -228,7 +230,6 @@ private class CronetImageFetcher : ImageFetcher {
    private val onComplete: () -> Unit,
  ) : UrlRequest.Callback() {
    private var buffer: NativeByteBuffer? = null
-    private var wrapped: ByteBuffer? = null
    private var error: Exception? = null

    override fun onRedirectReceived(request: UrlRequest, info: UrlResponseInfo, newUrl: String) {
@@ -242,15 +243,16 @@ private class CronetImageFetcher : ImageFetcher {
      }

      try {
+        // Content-Length is a size hint only. With Content-Encoding (gzip/br/...),
+        // Cronet auto-decompresses and writes decompressed bytes to our buffer, which
+        // may exceed the wire/compressed Content-Length. Always use the growable
+        // buffer path so we can't overflow.
        val contentLength = info.allHeaders["content-length"]?.firstOrNull()?.toIntOrNull() ?: 0
-        if (contentLength > 0) {
-          buffer = NativeByteBuffer(contentLength + 1)
-          wrapped = NativeBuffer.wrap(buffer!!.pointer, contentLength + 1)
-          request.read(wrapped)
-        } else {
-          buffer = NativeByteBuffer(INITIAL_BUFFER_SIZE)
-          request.read(buffer!!.wrapRemaining())
-        }
+        // Cap the up-front alloc: Content-Length is untrusted and can be huge or near
+        // Int.MAX_VALUE (overflowing `+1`). For larger responses the grow path takes over.
+        val initialSize = if (contentLength in 1..MAX_PREALLOC_BYTES) contentLength + 1 else INITIAL_BUFFER_SIZE
+        buffer = NativeByteBuffer(initialSize)
+        request.read(buffer!!.wrapRemaining())
      } catch (e: Exception) {
        error = e
        return request.cancel()
@@ -263,14 +265,14 @@ private class CronetImageFetcher : ImageFetcher {
      byteBuffer: ByteBuffer
    ) {
      try {
-        val buf = if (wrapped == null) {
-          buffer!!.run {
-            advance(byteBuffer.position())
-            ensureHeadroom()
-            wrapRemaining()
-          }
-        } else {
-          wrapped
+        // Always pass a fresh wrap so byteBuffer.position() represents only the
+        // bytes Cronet wrote in this iteration. Reusing the caller-supplied
+        // ByteBuffer breaks advance(): Cronet's position keeps accumulating
+        // across reads, which would double-count previous iterations' bytes.
+        val buf = buffer!!.run {
+          advance(byteBuffer.position())
+          ensureHeadroom()
+          wrapRemaining()
        }
        request.read(buf)
      } catch (e: Exception) {
@@ -280,7 +282,6 @@ private class CronetImageFetcher : ImageFetcher {
    }

    override fun onSucceeded(request: UrlRequest, info: UrlResponseInfo) {
-      wrapped?.let { buffer!!.advance(it.position()) }
      onSuccess(buffer!!)
      onComplete()
    }
@@ -0,0 +1,96 @@
+package app.alextran.immich.permission
+
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import android.provider.MediaStore
+import android.provider.Settings
+import androidx.core.net.toUri
+import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
+import io.flutter.plugin.common.PluginRegistry
+
+class ManageMediaPermissionDelegate(
+  context: Context,
+  private val requestCode: Int = 1003,
+) : PluginRegistry.ActivityResultListener {
+  private val ctx = context.applicationContext
+  private var activityBinding: ActivityPluginBinding? = null
+  private var pendingResult: ((Result<Boolean>) -> Unit)? = null
+
+  fun hasManageMediaPermission(): Boolean {
+    return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+      MediaStore.canManageMedia(ctx)
+    } else {
+      false
+    }
+  }
+
+  fun requestManageMediaPermission(callback: (Result<Boolean>) -> Unit) {
+    if (hasManageMediaPermission()) {
+      callback(Result.success(true))
+      return
+    }
+
+    openManageMediaPermissionSettings(callback)
+  }
+
+  fun manageMediaPermission(callback: (Result<Boolean>) -> Unit) {
+    openManageMediaPermissionSettings(callback)
+  }
+
+  private fun openManageMediaPermissionSettings(callback: (Result<Boolean>) -> Unit) {
+    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.S) {
+      callback(Result.success(false))
+      return
+    }
+
+    val activity = activityBinding?.activity
+    if (activity == null) {
+      callback(Result.failure(FlutterError("NO_ACTIVITY", "Activity not available", null)))
+      return
+    }
+
+    pendingResult = callback
+    val intent = Intent(Settings.ACTION_REQUEST_MANAGE_MEDIA).apply {
+      data = "package:${activity.packageName}".toUri()
+    }
+    try {
+      activity.startActivityForResult(intent, requestCode)
+    } catch (e: Exception) {
+      pendingResult = null
+      callback(
+        Result.failure(
+          FlutterError("ACTIVITY_LAUNCH_FAILED", "Failed to launch MANAGE_MEDIA settings", e.toString())
+        )
+      )
+    }
+  }
+
+  fun onAttachedToActivity(binding: ActivityPluginBinding) {
+    activityBinding = binding
+    binding.addActivityResultListener(this)
+  }
+
+  fun onDetachedFromActivity() {
+    failPending("ACTIVITY_DETACHED", "Activity detached before MANAGE_MEDIA result")
+    activityBinding?.removeActivityResultListener(this)
+    activityBinding = null
+  }
+
+  override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
+    if (requestCode == this.requestCode) {
+      val callback = pendingResult
+      pendingResult = null
+      callback?.invoke(Result.success(hasManageMediaPermission()))
+      return true
+    }
+
+    return false
+  }
+
+  private fun failPending(code: String, message: String) {
+    val callback = pendingResult ?: return
+    pendingResult = null
+    callback(Result.failure(FlutterError(code, message, null)))
+  }
+}
@@ -0,0 +1,128 @@
+// Autogenerated from Pigeon (v26.3.4), do not edit directly.
+// See also: https://pub.dev/packages/pigeon
+@file:Suppress("UNCHECKED_CAST", "ArrayInDataClass")
+
+package app.alextran.immich.permission
+
+import android.util.Log
+import io.flutter.plugin.common.BasicMessageChannel
+import io.flutter.plugin.common.BinaryMessenger
+import io.flutter.plugin.common.EventChannel
+import io.flutter.plugin.common.MessageCodec
+import io.flutter.plugin.common.StandardMethodCodec
+import io.flutter.plugin.common.StandardMessageCodec
+import java.io.ByteArrayOutputStream
+import java.nio.ByteBuffer
+private object PermissionApiPigeonUtils {
+
+  fun wrapResult(result: Any?): List<Any?> {
+    return listOf(result)
+  }
+
+  fun wrapError(exception: Throwable): List<Any?> {
+    return if (exception is FlutterError) {
+      listOf(
+        exception.code,
+        exception.message,
+        exception.details
+      )
+    } else {
+      listOf(
+        exception.javaClass.simpleName,
+        exception.toString(),
+        "Cause: " + exception.cause + ", Stacktrace: " + Log.getStackTraceString(exception)
+      )
+    }
+  }
+}
+
+/**
+ * Error class for passing custom error details to Flutter via a thrown PlatformException.
+ * @property code The error code.
+ * @property message The error message.
+ * @property details The error details. Must be a datatype supported by the api codec.
+ */
+class FlutterError (
+  val code: String,
+  override val message: String? = null,
+  val details: Any? = null
+) : RuntimeException()
+private open class PermissionApiPigeonCodec : StandardMessageCodec() {
+  override fun readValueOfType(type: Byte, buffer: ByteBuffer): Any? {
+    return     super.readValueOfType(type, buffer)
+  }
+  override fun writeValue(stream: ByteArrayOutputStream, value: Any?)   {
+    super.writeValue(stream, value)
+  }
+}
+
+
+/** Generated interface from Pigeon that represents a handler of messages from Flutter. */
+interface PermissionApi {
+  fun hasManageMediaPermission(): Boolean
+  fun requestManageMediaPermission(callback: (Result<Boolean>) -> Unit)
+  fun manageMediaPermission(callback: (Result<Boolean>) -> Unit)
+
+  companion object {
+    /** The codec used by PermissionApi. */
+    val codec: MessageCodec<Any?> by lazy {
+      PermissionApiPigeonCodec()
+    }
+    /** Sets up an instance of `PermissionApi` to handle messages through the `binaryMessenger`. */
+    @JvmOverloads
+    fun setUp(binaryMessenger: BinaryMessenger, api: PermissionApi?, messageChannelSuffix: String = "") {
+      val separatedMessageChannelSuffix = if (messageChannelSuffix.isNotEmpty()) ".$messageChannelSuffix" else ""
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.PermissionApi.hasManageMediaPermission$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            val wrapped: List<Any?> = try {
+              listOf(api.hasManageMediaPermission())
+            } catch (exception: Throwable) {
+              PermissionApiPigeonUtils.wrapError(exception)
+            }
+            reply.reply(wrapped)
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.PermissionApi.requestManageMediaPermission$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            api.requestManageMediaPermission{ result: Result<Boolean> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(PermissionApiPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(PermissionApiPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.PermissionApi.manageMediaPermission$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { _, reply ->
+            api.manageMediaPermission{ result: Result<Boolean> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(PermissionApiPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(PermissionApiPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+    }
+  }
+}
@@ -0,0 +1,37 @@
+package app.alextran.immich.permission
+
+import android.content.Context
+import app.alextran.immich.core.ImmichPlugin
+import io.flutter.embedding.engine.plugins.activity.ActivityAware
+import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
+
+class PermissionApiImpl(context: Context) : ImmichPlugin(), PermissionApi, ActivityAware {
+  private val manageMediaPermissionDelegate = ManageMediaPermissionDelegate(context)
+
+  override fun hasManageMediaPermission(): Boolean =
+    manageMediaPermissionDelegate.hasManageMediaPermission()
+
+  override fun requestManageMediaPermission(callback: (Result<Boolean>) -> Unit) {
+    manageMediaPermissionDelegate.requestManageMediaPermission { completeWhenActive(callback, it) }
+  }
+
+  override fun manageMediaPermission(callback: (Result<Boolean>) -> Unit) {
+    manageMediaPermissionDelegate.manageMediaPermission { completeWhenActive(callback, it) }
+  }
+
+  override fun onAttachedToActivity(binding: ActivityPluginBinding) {
+    manageMediaPermissionDelegate.onAttachedToActivity(binding)
+  }
+
+  override fun onDetachedFromActivityForConfigChanges() {
+    manageMediaPermissionDelegate.onDetachedFromActivity()
+  }
+
+  override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
+    manageMediaPermissionDelegate.onAttachedToActivity(binding)
+  }
+
+  override fun onDetachedFromActivity() {
+    manageMediaPermissionDelegate.onDetachedFromActivity()
+  }
+}
@@ -0,0 +1,133 @@
+package app.alextran.immich.sync
+
+import android.app.Activity
+import android.content.ContentResolver
+import android.content.ContentUris
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import android.os.Build
+import android.os.Bundle
+import android.provider.MediaStore
+import androidx.annotation.RequiresApi
+import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
+import io.flutter.plugin.common.PluginRegistry
+
+class MediaTrashDelegate(
+  context: Context,
+  private val trashRequestCode: Int = 1002,
+) : PluginRegistry.ActivityResultListener {
+  private val ctx = context.applicationContext
+  private var activityBinding: ActivityPluginBinding? = null
+  private var pendingResult: ((Result<Boolean>) -> Unit)? = null
+
+  private fun hasManageMediaPermission(): Boolean {
+    return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+      MediaStore.canManageMedia(ctx)
+    } else {
+      false
+    }
+  }
+
+  fun restoreFromTrashById(mediaId: String, type: Long, callback: (Result<Boolean>) -> Unit) {
+    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.R || !hasManageMediaPermission()) {
+      callback(Result.failure(FlutterError("PERMISSION_DENIED", "Media permission required", null)))
+      return
+    }
+
+    val id = mediaId.toLongOrNull()
+    if (id == null) {
+      callback(Result.failure(FlutterError("INVALID_ID", "The file id is not a valid number: $mediaId", null)))
+      return
+    }
+
+    if (!isInTrash(id)) {
+      callback(Result.failure(FlutterError("TRASH_NOT_FOUND", "Item with id=$id not found in trash", null)))
+      return
+    }
+
+    restoreUri(ContentUris.withAppendedId(contentUriForType(type.toInt()), id), callback)
+  }
+
+  @RequiresApi(Build.VERSION_CODES.R)
+  private fun restoreUri(
+    contentUri: Uri,
+    callback: (Result<Boolean>) -> Unit,
+  ) {
+    val activity = activityBinding?.activity
+    if (activity == null) {
+      callback(Result.failure(FlutterError("NO_ACTIVITY", "Activity not available", null)))
+      return
+    }
+
+    try {
+      val pendingIntent = MediaStore.createTrashRequest(ctx.contentResolver, listOf(contentUri), false)
+      pendingResult = callback
+      activity.startIntentSenderForResult(
+        pendingIntent.intentSender,
+        trashRequestCode,
+        null,
+        0,
+        0,
+        0,
+      )
+    } catch (e: Exception) {
+      pendingResult = null
+      callback(
+        Result.failure(
+          FlutterError("TRASH_ERROR", "Error creating or starting trash request", e.toString())
+        )
+      )
+    }
+  }
+
+  @RequiresApi(Build.VERSION_CODES.R)
+  private fun isInTrash(id: Long): Boolean {
+    val filesUri = MediaStore.Files.getContentUri(MediaStore.VOLUME_EXTERNAL)
+    val args = Bundle().apply {
+      putString(ContentResolver.QUERY_ARG_SQL_SELECTION, "${MediaStore.Files.FileColumns._ID}=?")
+      putStringArray(ContentResolver.QUERY_ARG_SQL_SELECTION_ARGS, arrayOf(id.toString()))
+      putInt(MediaStore.QUERY_ARG_MATCH_TRASHED, MediaStore.MATCH_ONLY)
+      putInt(ContentResolver.QUERY_ARG_LIMIT, 1)
+    }
+    return ctx.contentResolver.query(filesUri, arrayOf(MediaStore.Files.FileColumns._ID), args, null)
+      ?.use { it.moveToFirst() } == true
+  }
+
+  private fun contentUriForType(type: Int): Uri =
+    when (type) {
+      // Same order as AssetType from Dart.
+      1 -> MediaStore.Images.Media.EXTERNAL_CONTENT_URI
+      2 -> MediaStore.Video.Media.EXTERNAL_CONTENT_URI
+      3 -> MediaStore.Audio.Media.EXTERNAL_CONTENT_URI
+      else -> MediaStore.Files.getContentUri(MediaStore.VOLUME_EXTERNAL)
+    }
+
+  fun onAttachedToActivity(binding: ActivityPluginBinding) {
+    activityBinding = binding
+    binding.addActivityResultListener(this)
+  }
+
+  fun onDetachedFromActivity() {
+    failPending("ACTIVITY_DETACHED", "Activity detached before trash result")
+    activityBinding?.removeActivityResultListener(this)
+    activityBinding = null
+  }
+
+  override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
+    if (requestCode == trashRequestCode) {
+      val callback = pendingResult
+      pendingResult = null
+      callback?.invoke(Result.success(resultCode == Activity.RESULT_OK))
+      return true
+    }
+
+    return false
+  }
+
+  private fun failPending(code: String, message: String) {
+    val callback = pendingResult ?: return
+    pendingResult = null
+    callback(Result.failure(FlutterError(code, message, null)))
+  }
+}
@@ -207,6 +207,18 @@ enum class PlatformAssetPlaybackStyle(val raw: Int) {
  }
 }

+enum class EditState(val raw: Int) {
+  NOT_EDITED(0),
+  EDITED(1),
+  UNKNOWN(2);
+
+  companion object {
+    fun ofRaw(raw: Int): EditState? {
+      return values().firstOrNull { it.raw == raw }
+    }
+  }
+}
+
 /** Generated class from Pigeon that represents data sent in messages. */
 data class PlatformAsset (
  val id: String,
@@ -472,6 +484,52 @@ data class CloudIdResult (
    return result
  }
 }
+
+/** Generated class from Pigeon that represents data sent in messages. */
+data class BaseResource (
+  val path: String,
+  val sha1: String,
+  val sizeBytes: Long,
+  val mimeType: String
+)
+ {
+  companion object {
+    fun fromList(pigeonVar_list: List<Any?>): BaseResource {
+      val path = pigeonVar_list[0] as String
+      val sha1 = pigeonVar_list[1] as String
+      val sizeBytes = pigeonVar_list[2] as Long
+      val mimeType = pigeonVar_list[3] as String
+      return BaseResource(path, sha1, sizeBytes, mimeType)
+    }
+  }
+  fun toList(): List<Any?> {
+    return listOf(
+      path,
+      sha1,
+      sizeBytes,
+      mimeType,
+    )
+  }
+  override fun equals(other: Any?): Boolean {
+    if (other == null || other.javaClass != javaClass) {
+      return false
+    }
+    if (this === other) {
+      return true
+    }
+    val other = other as BaseResource
+    return MessagesPigeonUtils.deepEquals(this.path, other.path) && MessagesPigeonUtils.deepEquals(this.sha1, other.sha1) && MessagesPigeonUtils.deepEquals(this.sizeBytes, other.sizeBytes) && MessagesPigeonUtils.deepEquals(this.mimeType, other.mimeType)
+  }
+
+  override fun hashCode(): Int {
+    var result = javaClass.hashCode()
+    result = 31 * result + MessagesPigeonUtils.deepHash(this.path)
+    result = 31 * result + MessagesPigeonUtils.deepHash(this.sha1)
+    result = 31 * result + MessagesPigeonUtils.deepHash(this.sizeBytes)
+    result = 31 * result + MessagesPigeonUtils.deepHash(this.mimeType)
+    return result
+  }
+}
 private open class MessagesPigeonCodec : StandardMessageCodec() {
  override fun readValueOfType(type: Byte, buffer: ByteBuffer): Any? {
    return when (type) {
@@ -481,30 +539,40 @@ private open class MessagesPigeonCodec : StandardMessageCodec() {
        }
      }
      130.toByte() -> {
-        return (readValue(buffer) as? List<Any?>)?.let {
-          PlatformAsset.fromList(it)
+        return (readValue(buffer) as Long?)?.let {
+          EditState.ofRaw(it.toInt())
        }
      }
      131.toByte() -> {
        return (readValue(buffer) as? List<Any?>)?.let {
-          PlatformAlbum.fromList(it)
+          PlatformAsset.fromList(it)
        }
      }
      132.toByte() -> {
        return (readValue(buffer) as? List<Any?>)?.let {
-          SyncDelta.fromList(it)
+          PlatformAlbum.fromList(it)
        }
      }
      133.toByte() -> {
        return (readValue(buffer) as? List<Any?>)?.let {
-          HashResult.fromList(it)
+          SyncDelta.fromList(it)
        }
      }
      134.toByte() -> {
+        return (readValue(buffer) as? List<Any?>)?.let {
+          HashResult.fromList(it)
+        }
+      }
+      135.toByte() -> {
        return (readValue(buffer) as? List<Any?>)?.let {
          CloudIdResult.fromList(it)
        }
      }
+      136.toByte() -> {
+        return (readValue(buffer) as? List<Any?>)?.let {
+          BaseResource.fromList(it)
+        }
+      }
      else -> super.readValueOfType(type, buffer)
    }
  }
@@ -514,26 +582,34 @@ private open class MessagesPigeonCodec : StandardMessageCodec() {
        stream.write(129)
        writeValue(stream, value.raw.toLong())
      }
-      is PlatformAsset -> {
+      is EditState -> {
        stream.write(130)
-        writeValue(stream, value.toList())
+        writeValue(stream, value.raw.toLong())
      }
-      is PlatformAlbum -> {
+      is PlatformAsset -> {
        stream.write(131)
        writeValue(stream, value.toList())
      }
-      is SyncDelta -> {
+      is PlatformAlbum -> {
        stream.write(132)
        writeValue(stream, value.toList())
      }
-      is HashResult -> {
+      is SyncDelta -> {
        stream.write(133)
        writeValue(stream, value.toList())
      }
-      is CloudIdResult -> {
+      is HashResult -> {
        stream.write(134)
        writeValue(stream, value.toList())
      }
+      is CloudIdResult -> {
+        stream.write(135)
+        writeValue(stream, value.toList())
+      }
+      is BaseResource -> {
+        stream.write(136)
+        writeValue(stream, value.toList())
+      }
      else -> super.writeValue(stream, value)
    }
  }
@@ -553,7 +629,10 @@ interface NativeSyncApi {
  fun hashAssets(assetIds: List<String>, allowNetworkAccess: Boolean, callback: (Result<List<HashResult>>) -> Unit)
  fun cancelHashing()
  fun getTrashedAssets(): Map<String, List<PlatformAsset>>
+  fun restoreFromTrashById(mediaId: String, type: Long, callback: (Result<Boolean>) -> Unit)
  fun getCloudIdForAssetIds(assetIds: List<String>): List<CloudIdResult>
+  fun getBaseResource(assetId: String, allowNetworkAccess: Boolean, callback: (Result<BaseResource?>) -> Unit)
+  fun getEditState(assetId: String, allowNetworkAccess: Boolean, callback: (Result<EditState>) -> Unit)

  companion object {
    /** The codec used by NativeSyncApi. */
@@ -747,6 +826,27 @@ interface NativeSyncApi {
          channel.setMessageHandler(null)
        }
      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NativeSyncApi.restoreFromTrashById$separatedMessageChannelSuffix", codec)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val mediaIdArg = args[0] as String
+            val typeArg = args[1] as Long
+            api.restoreFromTrashById(mediaIdArg, typeArg) { result: Result<Boolean> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(MessagesPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
      run {
        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getCloudIdForAssetIds$separatedMessageChannelSuffix", codec, taskQueue)
        if (api != null) {
@@ -764,6 +864,48 @@ interface NativeSyncApi {
          channel.setMessageHandler(null)
        }
      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getBaseResource$separatedMessageChannelSuffix", codec, taskQueue)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val assetIdArg = args[0] as String
+            val allowNetworkAccessArg = args[1] as Boolean
+            api.getBaseResource(assetIdArg, allowNetworkAccessArg) { result: Result<BaseResource?> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(MessagesPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
+      run {
+        val channel = BasicMessageChannel<Any?>(binaryMessenger, "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getEditState$separatedMessageChannelSuffix", codec, taskQueue)
+        if (api != null) {
+          channel.setMessageHandler { message, reply ->
+            val args = message as List<Any?>
+            val assetIdArg = args[0] as String
+            val allowNetworkAccessArg = args[1] as Boolean
+            api.getEditState(assetIdArg, allowNetworkAccessArg) { result: Result<EditState> ->
+              val error = result.exceptionOrNull()
+              if (error != null) {
+                reply.reply(MessagesPigeonUtils.wrapError(error))
+              } else {
+                val data = result.getOrNull()
+                reply.reply(MessagesPigeonUtils.wrapResult(data))
+              }
+            }
+          }
+        } else {
+          channel.setMessageHandler(null)
+        }
+      }
    }
  }
 }
@@ -17,6 +17,8 @@ import com.bumptech.glide.Glide
 import com.bumptech.glide.load.ImageHeaderParser
 import com.bumptech.glide.load.ImageHeaderParserUtils
 import com.bumptech.glide.load.resource.bitmap.DefaultImageHeaderParser
+import io.flutter.embedding.engine.plugins.activity.ActivityAware
+import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
@@ -39,10 +41,11 @@ sealed class AssetResult {
 private const val TAG = "NativeSyncApiImplBase"

@SuppressLint("InlinedApi")
-open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
+open class NativeSyncApiImplBase(context: Context) : ImmichPlugin(), ActivityAware {
  private val ctx: Context = context.applicationContext

  private var hashTask: Job? = null
+  private val mediaTrashDelegate = MediaTrashDelegate(ctx)

  companion object {
    private const val MAX_CONCURRENT_HASH_OPERATIONS = 16
@@ -448,9 +451,39 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
    hashTask = null
  }

+  fun restoreFromTrashById(mediaId: String, type: Long, callback: (Result<Boolean>) -> Unit) {
+    mediaTrashDelegate.restoreFromTrashById(mediaId, type) { completeWhenActive(callback, it) }
+  }
+
+  override fun onAttachedToActivity(binding: ActivityPluginBinding) {
+    mediaTrashDelegate.onAttachedToActivity(binding)
+  }
+
+  override fun onDetachedFromActivityForConfigChanges() {
+    mediaTrashDelegate.onDetachedFromActivity()
+  }
+
+  override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
+    mediaTrashDelegate.onAttachedToActivity(binding)
+  }
+
+  override fun onDetachedFromActivity() {
+    mediaTrashDelegate.onDetachedFromActivity()
+  }
+
  // This method is only implemented on iOS; on Android, we do not have a concept of cloud IDs
  @Suppress("unused", "UNUSED_PARAMETER")
  fun getCloudIdForAssetIds(assetIds: List<String>): List<CloudIdResult> {
    return emptyList()
  }
+
+  // Android has no Photos-style edit original to stack; iOS-only.
+  fun getBaseResource(assetId: String, allowNetworkAccess: Boolean, callback: (Result<BaseResource?>) -> Unit) {
+    callback(Result.success(null))
+  }
+
+  // iOS-only; Android assets never carry a Photos-style edit.
+  fun getEditState(assetId: String, allowNetworkAccess: Boolean, callback: (Result<EditState>) -> Unit) {
+    callback(Result.success(EditState.NOT_EDITED))
+  }
 }
@@ -19,6 +19,8 @@
 		B21E34AC2E5B09190031FDB9 /* BackgroundWorker.swift in Sources */ = {isa = PBXBuildFile; fileRef = B21E34AB2E5B09100031FDB9 /* BackgroundWorker.swift */; };
 		B25D377A2E72CA15008B6CA7 /* Connectivity.g.swift in Sources */ = {isa = PBXBuildFile; fileRef = B25D37782E72CA15008B6CA7 /* Connectivity.g.swift */; };
 		B25D377C2E72CA26008B6CA7 /* ConnectivityApiImpl.swift in Sources */ = {isa = PBXBuildFile; fileRef = B25D377B2E72CA20008B6CA7 /* ConnectivityApiImpl.swift */; };
+		B2EE00022E72CA15008B6CA7 /* PermissionApi.g.swift in Sources */ = {isa = PBXBuildFile; fileRef = B2EE00012E72CA15008B6CA7 /* PermissionApi.g.swift */; };
+		B2EE00042E72CA15008B6CA7 /* PermissionApiImpl.swift in Sources */ = {isa = PBXBuildFile; fileRef = B2EE00032E72CA15008B6CA7 /* PermissionApiImpl.swift */; };
 		B2BE315F2E5E5229006EEF88 /* BackgroundWorker.g.swift in Sources */ = {isa = PBXBuildFile; fileRef = B2BE315E2E5E5229006EEF88 /* BackgroundWorker.g.swift */; };
 		D218389C4A4C4693F141F7D1 /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 886774DBDDE6B35BF2B4F2CD /* Pods_Runner.framework */; };
 		F02538E92DFBCBDD008C3FA3 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FD1CF9000F007C117D /* Assets.xcassets */; };
@@ -105,6 +107,8 @@
 		B21E34AB2E5B09100031FDB9 /* BackgroundWorker.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BackgroundWorker.swift; sourceTree = "<group>"; };
 		B25D37782E72CA15008B6CA7 /* Connectivity.g.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Connectivity.g.swift; sourceTree = "<group>"; };
 		B25D377B2E72CA20008B6CA7 /* ConnectivityApiImpl.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ConnectivityApiImpl.swift; sourceTree = "<group>"; };
+		B2EE00012E72CA15008B6CA7 /* PermissionApi.g.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PermissionApi.g.swift; sourceTree = "<group>"; };
+		B2EE00032E72CA15008B6CA7 /* PermissionApiImpl.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PermissionApiImpl.swift; sourceTree = "<group>"; };
 		B2BE315E2E5E5229006EEF88 /* BackgroundWorker.g.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BackgroundWorker.g.swift; sourceTree = "<group>"; };
 		E0E99CDC17B3EB7FA8BA2332 /* Pods-Runner.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.release.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.release.xcconfig"; sourceTree = "<group>"; };
 		F0B57D382DF764BD00DC5BCC /* WidgetExtension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = WidgetExtension.appex; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -283,6 +287,7 @@
 				B25D37792E72CA15008B6CA7 /* Connectivity */,
 				B21E34A62E5AF9760031FDB9 /* Background */,
 				B2CF7F8C2DDE4EBB00744BF6 /* Sync */,
+				B2EE00052E72CA15008B6CA7 /* Permission */,
 				FA9973382CF6DF4B000EF859 /* Runner.entitlements */,
 				FAC7416727DB9F5500C668D8 /* RunnerProfile.entitlements */,
 				97C146FA1CF9000F007C117D /* Main.storyboard */,
@@ -317,6 +322,15 @@
 			path = Connectivity;
 			sourceTree = "<group>";
 		};
+		B2EE00052E72CA15008B6CA7 /* Permission */ = {
+			isa = PBXGroup;
+			children = (
+				B2EE00032E72CA15008B6CA7 /* PermissionApiImpl.swift */,
+				B2EE00012E72CA15008B6CA7 /* PermissionApi.g.swift */,
+			);
+			path = Permission;
+			sourceTree = "<group>";
+		};
 		FAC6F8B62D287F120078CB2F /* ShareExtension */ = {
 			isa = PBXGroup;
 			children = (
@@ -619,6 +633,8 @@
 				FE5499F42F1197D8006016CB /* RemoteImages.g.swift in Sources */,
 				FE5FE4AE2F30FBC000A71243 /* ImageProcessing.swift in Sources */,
 				B25D377A2E72CA15008B6CA7 /* Connectivity.g.swift in Sources */,
+				B2EE00022E72CA15008B6CA7 /* PermissionApi.g.swift in Sources */,
+				B2EE00042E72CA15008B6CA7 /* PermissionApiImpl.swift in Sources */,
 				FE5499F82F1198E2006016CB /* RemoteImagesImpl.swift in Sources */,
 				FEAFA8732E4D42F4001E47FE /* Thumbhash.swift in Sources */,
 				B25D377C2E72CA26008B6CA7 /* ConnectivityApiImpl.swift in Sources */,
@@ -718,6 +734,7 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				COPY_PHASE_STRIP = NO;
+				CUSTOM_GROUP_ID = group.app.immich.share.profile;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
@@ -750,7 +767,6 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_BITCODE = NO;
 				INFOPLIST_FILE = Runner/Info.plist;
@@ -801,6 +817,7 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				COPY_PHASE_STRIP = NO;
+				CUSTOM_GROUP_ID = group.app.immich.share.debug;
 				DEBUG_INFORMATION_FORMAT = dwarf;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
@@ -860,6 +877,7 @@
 				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
 				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
 				COPY_PHASE_STRIP = NO;
+				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
@@ -894,7 +912,6 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_BITCODE = NO;
 				INFOPLIST_FILE = Runner/Info.plist;
@@ -924,7 +941,6 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_BITCODE = NO;
 				INFOPLIST_FILE = Runner/Info.plist;
@@ -1080,7 +1096,6 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
@@ -1124,7 +1139,6 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
@@ -1165,7 +1179,6 @@
 				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 240;
-				CUSTOM_GROUP_ID = group.app.immich.share;
 				DEVELOPMENT_TEAM = 2W7AC6T8T5;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu17;
@@ -26,6 +26,7 @@ import native_video_player

  public static func registerPlugins(with registry: FlutterPluginRegistry, messenger: FlutterBinaryMessenger) {
    NativeSyncApiImpl.register(with: registry.registrar(forPlugin: NativeSyncApiImpl.name)!)
+    PermissionApiSetup.setUp(binaryMessenger: messenger, api: PermissionApiImpl())
    LocalImageApiSetup.setUp(binaryMessenger: messenger, api: LocalImageApiImpl())
    RemoteImageApiSetup.setUp(binaryMessenger: messenger, api: RemoteImageApiImpl())
    BackgroundWorkerFgHostApiSetup.setUp(binaryMessenger: messenger, api: BackgroundWorkerApiImpl())
@@ -288,6 +288,7 @@ protocol NetworkApi {
  func hasCertificate() throws -> Bool
  func getClientPointer() throws -> Int64
  func setRequestHeaders(headers: [String: String], serverUrls: [String], token: String?) throws
+  func getAppGroupId() throws -> String
 }

 /// Generated setup class from Pigeon to handle messages through the `binaryMessenger`.
@@ -388,5 +389,18 @@ class NetworkApiSetup {
    } else {
      setRequestHeadersChannel.setMessageHandler(nil)
    }
+    let getAppGroupIdChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NetworkApi.getAppGroupId\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      getAppGroupIdChannel.setMessageHandler { _, reply in
+        do {
+          let result = try api.getAppGroupId()
+          reply(wrapResult(result))
+        } catch {
+          reply(wrapError(error))
+        }
+      }
+    } else {
+      getAppGroupIdChannel.setMessageHandler(nil)
+    }
  }
 }
@@ -61,6 +61,10 @@ class NetworkApiImpl: NetworkApi {
    return Int64(Int(bitPattern: pointer))
  }
  
+  func getAppGroupId() throws -> String {
+    return Bundle.main.object(forInfoDictionaryKey: "AppGroupId") as! String
+  }
+
  func setRequestHeaders(headers: [String : String], serverUrls: [String], token: String?) throws {
    URLSessionManager.setServerUrls(serverUrls)

@@ -4,7 +4,7 @@ import native_video_player
 let CLIENT_CERT_LABEL = "app.alextran.immich.client_identity"
 let HEADERS_KEY = "immich.request_headers"
 let SERVER_URLS_KEY = "immich.server_urls"
-let APP_GROUP = "group.app.immich.share"
+let APP_GROUP = Bundle.main.object(forInfoDictionaryKey: "AppGroupId") as! String
 let COOKIE_EXPIRY_DAYS: TimeInterval = 400

 enum AuthCookie: CaseIterable {
@@ -0,0 +1,106 @@
+// Autogenerated from Pigeon (v26.3.4), do not edit directly.
+// See also: https://pub.dev/packages/pigeon
+
+import Foundation
+
+#if os(iOS)
+  import Flutter
+#elseif os(macOS)
+  import FlutterMacOS
+#else
+  #error("Unsupported platform.")
+#endif
+
+private func wrapResult(_ result: Any?) -> [Any?] {
+  return [result]
+}
+
+private func wrapError(_ error: Any) -> [Any?] {
+  if let pigeonError = error as? PigeonError {
+    return [
+      pigeonError.code,
+      pigeonError.message,
+      pigeonError.details,
+    ]
+  }
+  if let flutterError = error as? FlutterError {
+    return [
+      flutterError.code,
+      flutterError.message,
+      flutterError.details,
+    ]
+  }
+  return [
+    "\(error)",
+    "\(Swift.type(of: error))",
+    "Stacktrace: \(Thread.callStackSymbols)",
+  ]
+}
+
+private func isNullish(_ value: Any?) -> Bool {
+  return value is NSNull || value == nil
+}
+
+private func nilOrValue<T>(_ value: Any?) -> T? {
+  if value is NSNull { return nil }
+  return value as! T?
+}
+
+/// Generated protocol from Pigeon that represents a handler of messages from Flutter.
+protocol PermissionApi {
+  func hasManageMediaPermission() throws -> Bool
+  func requestManageMediaPermission(completion: @escaping (Result<Bool, Error>) -> Void)
+  func manageMediaPermission(completion: @escaping (Result<Bool, Error>) -> Void)
+}
+
+/// Generated setup class from Pigeon to handle messages through the `binaryMessenger`.
+class PermissionApiSetup {
+  static var codec: FlutterStandardMessageCodec { FlutterStandardMessageCodec.sharedInstance() }
+  /// Sets up an instance of `PermissionApi` to handle messages through the `binaryMessenger`.
+  static func setUp(binaryMessenger: FlutterBinaryMessenger, api: PermissionApi?, messageChannelSuffix: String = "") {
+    let channelSuffix = messageChannelSuffix.count > 0 ? ".\(messageChannelSuffix)" : ""
+    let hasManageMediaPermissionChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.PermissionApi.hasManageMediaPermission\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      hasManageMediaPermissionChannel.setMessageHandler { _, reply in
+        do {
+          let result = try api.hasManageMediaPermission()
+          reply(wrapResult(result))
+        } catch {
+          reply(wrapError(error))
+        }
+      }
+    } else {
+      hasManageMediaPermissionChannel.setMessageHandler(nil)
+    }
+    let requestManageMediaPermissionChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.PermissionApi.requestManageMediaPermission\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      requestManageMediaPermissionChannel.setMessageHandler { _, reply in
+        api.requestManageMediaPermission { result in
+          switch result {
+          case .success(let res):
+            reply(wrapResult(res))
+          case .failure(let error):
+            reply(wrapError(error))
+          }
+        }
+      }
+    } else {
+      requestManageMediaPermissionChannel.setMessageHandler(nil)
+    }
+    let manageMediaPermissionChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.PermissionApi.manageMediaPermission\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      manageMediaPermissionChannel.setMessageHandler { _, reply in
+        api.manageMediaPermission { result in
+          switch result {
+          case .success(let res):
+            reply(wrapResult(res))
+          case .failure(let error):
+            reply(wrapError(error))
+          }
+        }
+      }
+    } else {
+      manageMediaPermissionChannel.setMessageHandler(nil)
+    }
+  }
+}
@@ -0,0 +1,15 @@
+import Foundation
+
+class PermissionApiImpl: PermissionApi {
+  func hasManageMediaPermission() throws -> Bool {
+    return false
+  }
+
+  func requestManageMediaPermission(completion: @escaping (Result<Bool, Error>) -> Void) {
+    completion(.success(false))
+  }
+
+  func manageMediaPermission(completion: @escaping (Result<Bool, Error>) -> Void) {
+    completion(.success(false))
+  }
+}
@@ -10,7 +10,7 @@
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>group.app.immich.share</string>
+		<string>$(CUSTOM_GROUP_ID)</string>
 	</array>
 </dict>
 </plist>
@@ -12,7 +12,7 @@
 	<true/>
 	<key>com.apple.security.application-groups</key>
 	<array>
-		<string>group.app.immich.share</string>
+		<string>$(CUSTOM_GROUP_ID)</string>
 	</array>
 </dict>
 </plist>
@@ -183,6 +183,12 @@ enum PlatformAssetPlaybackStyle: Int {
  case videoLooping = 5
 }

+enum EditState: Int {
+  case notEdited = 0
+  case edited = 1
+  case unknown = 2
+}
+
 /// Generated class from Pigeon that represents data sent in messages.
 struct PlatformAsset: Hashable {
  var id: String
@@ -458,6 +464,52 @@ struct CloudIdResult: Hashable {
  }
 }

+/// Generated class from Pigeon that represents data sent in messages.
+struct BaseResource: Hashable {
+  var path: String
+  var sha1: String
+  var sizeBytes: Int64
+  var mimeType: String
+
+
+  // swift-format-ignore: AlwaysUseLowerCamelCase
+  static func fromList(_ pigeonVar_list: [Any?]) -> BaseResource? {
+    let path = pigeonVar_list[0] as! String
+    let sha1 = pigeonVar_list[1] as! String
+    let sizeBytes = pigeonVar_list[2] as! Int64
+    let mimeType = pigeonVar_list[3] as! String
+
+    return BaseResource(
+      path: path,
+      sha1: sha1,
+      sizeBytes: sizeBytes,
+      mimeType: mimeType
+    )
+  }
+  func toList() -> [Any?] {
+    return [
+      path,
+      sha1,
+      sizeBytes,
+      mimeType,
+    ]
+  }
+  static func == (lhs: BaseResource, rhs: BaseResource) -> Bool {
+    if Swift.type(of: lhs) != Swift.type(of: rhs) {
+      return false
+    }
+    return deepEqualsMessages(lhs.path, rhs.path) && deepEqualsMessages(lhs.sha1, rhs.sha1) && deepEqualsMessages(lhs.sizeBytes, rhs.sizeBytes) && deepEqualsMessages(lhs.mimeType, rhs.mimeType)
+  }
+
+  func hash(into hasher: inout Hasher) {
+    hasher.combine("BaseResource")
+    deepHashMessages(value: path, hasher: &hasher)
+    deepHashMessages(value: sha1, hasher: &hasher)
+    deepHashMessages(value: sizeBytes, hasher: &hasher)
+    deepHashMessages(value: mimeType, hasher: &hasher)
+  }
+}
+
 private class MessagesPigeonCodecReader: FlutterStandardReader {
  override func readValue(ofType type: UInt8) -> Any? {
    switch type {
@@ -468,15 +520,23 @@ private class MessagesPigeonCodecReader: FlutterStandardReader {
      }
      return nil
    case 130:
-      return PlatformAsset.fromList(self.readValue() as! [Any?])
+      let enumResultAsInt: Int? = nilOrValue(self.readValue() as! Int?)
+      if let enumResultAsInt = enumResultAsInt {
+        return EditState(rawValue: enumResultAsInt)
+      }
+      return nil
    case 131:
-      return PlatformAlbum.fromList(self.readValue() as! [Any?])
+      return PlatformAsset.fromList(self.readValue() as! [Any?])
    case 132:
-      return SyncDelta.fromList(self.readValue() as! [Any?])
+      return PlatformAlbum.fromList(self.readValue() as! [Any?])
    case 133:
-      return HashResult.fromList(self.readValue() as! [Any?])
+      return SyncDelta.fromList(self.readValue() as! [Any?])
    case 134:
+      return HashResult.fromList(self.readValue() as! [Any?])
+    case 135:
      return CloudIdResult.fromList(self.readValue() as! [Any?])
+    case 136:
+      return BaseResource.fromList(self.readValue() as! [Any?])
    default:
      return super.readValue(ofType: type)
    }
@@ -488,21 +548,27 @@ private class MessagesPigeonCodecWriter: FlutterStandardWriter {
    if let value = value as? PlatformAssetPlaybackStyle {
      super.writeByte(129)
      super.writeValue(value.rawValue)
-    } else if let value = value as? PlatformAsset {
+    } else if let value = value as? EditState {
      super.writeByte(130)
-      super.writeValue(value.toList())
-    } else if let value = value as? PlatformAlbum {
+      super.writeValue(value.rawValue)
+    } else if let value = value as? PlatformAsset {
      super.writeByte(131)
      super.writeValue(value.toList())
-    } else if let value = value as? SyncDelta {
+    } else if let value = value as? PlatformAlbum {
      super.writeByte(132)
      super.writeValue(value.toList())
-    } else if let value = value as? HashResult {
+    } else if let value = value as? SyncDelta {
      super.writeByte(133)
      super.writeValue(value.toList())
-    } else if let value = value as? CloudIdResult {
+    } else if let value = value as? HashResult {
      super.writeByte(134)
      super.writeValue(value.toList())
+    } else if let value = value as? CloudIdResult {
+      super.writeByte(135)
+      super.writeValue(value.toList())
+    } else if let value = value as? BaseResource {
+      super.writeByte(136)
+      super.writeValue(value.toList())
    } else {
      super.writeValue(value)
    }
@@ -537,7 +603,10 @@ protocol NativeSyncApi {
  func hashAssets(assetIds: [String], allowNetworkAccess: Bool, completion: @escaping (Result<[HashResult], Error>) -> Void)
  func cancelHashing() throws
  func getTrashedAssets() throws -> [String: [PlatformAsset]]
+  func restoreFromTrashById(mediaId: String, type: Int64, completion: @escaping (Result<Bool, Error>) -> Void)
  func getCloudIdForAssetIds(assetIds: [String]) throws -> [CloudIdResult]
+  func getBaseResource(assetId: String, allowNetworkAccess: Bool, completion: @escaping (Result<BaseResource?, Error>) -> Void)
+  func getEditState(assetId: String, allowNetworkAccess: Bool, completion: @escaping (Result<EditState, Error>) -> Void)
 }

 /// Generated setup class from Pigeon to handle messages through the `binaryMessenger`.
@@ -721,6 +790,24 @@ class NativeSyncApiSetup {
    } else {
      getTrashedAssetsChannel.setMessageHandler(nil)
    }
+    let restoreFromTrashByIdChannel = FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NativeSyncApi.restoreFromTrashById\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+    if let api = api {
+      restoreFromTrashByIdChannel.setMessageHandler { message, reply in
+        let args = message as! [Any?]
+        let mediaIdArg = args[0] as! String
+        let typeArg = args[1] as! Int64
+        api.restoreFromTrashById(mediaId: mediaIdArg, type: typeArg) { result in
+          switch result {
+          case .success(let res):
+            reply(wrapResult(res))
+          case .failure(let error):
+            reply(wrapError(error))
+          }
+        }
+      }
+    } else {
+      restoreFromTrashByIdChannel.setMessageHandler(nil)
+    }
    let getCloudIdForAssetIdsChannel = taskQueue == nil
      ? FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getCloudIdForAssetIds\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
      : FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getCloudIdForAssetIds\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec, taskQueue: taskQueue)
@@ -738,5 +825,45 @@ class NativeSyncApiSetup {
    } else {
      getCloudIdForAssetIdsChannel.setMessageHandler(nil)
    }
+    let getBaseResourceChannel = taskQueue == nil
+      ? FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getBaseResource\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+      : FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getBaseResource\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec, taskQueue: taskQueue)
+    if let api = api {
+      getBaseResourceChannel.setMessageHandler { message, reply in
+        let args = message as! [Any?]
+        let assetIdArg = args[0] as! String
+        let allowNetworkAccessArg = args[1] as! Bool
+        api.getBaseResource(assetId: assetIdArg, allowNetworkAccess: allowNetworkAccessArg) { result in
+          switch result {
+          case .success(let res):
+            reply(wrapResult(res))
+          case .failure(let error):
+            reply(wrapError(error))
+          }
+        }
+      }
+    } else {
+      getBaseResourceChannel.setMessageHandler(nil)
+    }
+    let getEditStateChannel = taskQueue == nil
+      ? FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getEditState\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec)
+      : FlutterBasicMessageChannel(name: "dev.flutter.pigeon.immich_mobile.NativeSyncApi.getEditState\(channelSuffix)", binaryMessenger: binaryMessenger, codec: codec, taskQueue: taskQueue)
+    if let api = api {
+      getEditStateChannel.setMessageHandler { message, reply in
+        let args = message as! [Any?]
+        let assetIdArg = args[0] as! String
+        let allowNetworkAccessArg = args[1] as! Bool
+        api.getEditState(assetId: assetIdArg, allowNetworkAccess: allowNetworkAccessArg) { result in
+          switch result {
+          case .success(let res):
+            reply(wrapResult(res))
+          case .failure(let error):
+            reply(wrapError(error))
+          }
+        }
+      }
+    } else {
+      getEditStateChannel.setMessageHandler(nil)
+    }
  }
 }
@@ -1,5 +1,6 @@
 import Photos
 import CryptoKit
+import UniformTypeIdentifiers

 struct AssetWrapper: Hashable, Equatable {
  let asset: PlatformAsset
@@ -110,7 +111,7 @@ class NativeSyncApiImpl: ImmichPlugin, NativeSyncApi, FlutterPlugin {
        
        var domainAlbum = PlatformAlbum(
          id: album.localIdentifier,
-          name: album.localizedTitle!,
+          name: album.localizedTitle ?? album.localIdentifier,
          updatedAt: nil,
          isCloud: isCloud,
          assetCount: Int64(assets.count)
@@ -382,6 +383,10 @@ class NativeSyncApiImpl: ImmichPlugin, NativeSyncApi, FlutterPlugin {
  func getTrashedAssets() throws -> [String: [PlatformAsset]] {
    throw PigeonError(code: "UNSUPPORTED_OS", message: "This feature not supported on iOS.", details: nil)
  }
+
+  func restoreFromTrashById(mediaId: String, type: Int64, completion: @escaping (Result<Bool, Error>) -> Void) {
+    completion(.success(false))
+  }
  
  private func getAssetsFromAlbum(in album: PHAssetCollection, options: PHFetchOptions) -> PHFetchResult<PHAsset> {
    // Ensure to actually getting all assets for the Recents album
@@ -415,4 +420,169 @@ class NativeSyncApiImpl: ImmichPlugin, NativeSyncApi, FlutterPlugin {
    }
    return mappings;
  }
+
+  func getBaseResource(
+    assetId: String,
+    allowNetworkAccess: Bool,
+    completion: @escaping (Result<BaseResource?, Error>) -> Void
+  ) {
+    Task { [weak self] in
+      guard let self = self else { return }
+
+      guard let asset = PHAsset.fetchAssets(withLocalIdentifiers: [assetId], options: nil).firstObject else {
+        return self.completeWhenActive(for: completion, with: .success(nil))
+      }
+
+      let resources = PHAssetResource.assetResources(for: asset)
+      let state = await Self.classifyEdit(resources: resources, allowNetworkAccess: allowNetworkAccess)
+      guard state == .edited, let original = resources.first(where: { $0.type == .photo }) else {
+        return self.completeWhenActive(for: completion, with: .success(nil))
+      }
+
+      do {
+        let result = try await self.streamBaseResource(
+          resource: original,
+          localId: asset.localIdentifier,
+          allowNetworkAccess: allowNetworkAccess
+        )
+        self.completeWhenActive(for: completion, with: .success(result))
+      } catch {
+        self.completeWhenActive(for: completion, with: .failure(error))
+      }
+    }
+  }
+
+  // Returns whether the asset carries a live Photos edit without reading the photo
+  // itself, only the small adjustment metadata. The revert probe relies on this to
+  // tell "not edited" apart from "couldn't read" (offloaded to iCloud), so it never
+  // mistakes an unreadable edit for a revert.
+  func getEditState(
+    assetId: String,
+    allowNetworkAccess: Bool,
+    completion: @escaping (Result<EditState, Error>) -> Void
+  ) {
+    Task { [weak self] in
+      guard let self = self else { return }
+      guard let asset = PHAsset.fetchAssets(withLocalIdentifiers: [assetId], options: nil).firstObject else {
+        // Not in the library, so don't answer "not edited" (the caller acts on that).
+        return self.completeWhenActive(for: completion, with: .success(.unknown))
+      }
+      let state = await Self.classifyEdit(
+        resources: PHAssetResource.assetResources(for: asset),
+        allowNetworkAccess: allowNetworkAccess
+      )
+      self.completeWhenActive(for: completion, with: .success(state))
+    }
+  }
+
+  // adjustmentRenderTypes for a photo with no real edit: a plain capture, a
+  // Photographic Style, or a reverted edit. A real edit changes this value.
+  private static let kNoEditRenderTypes = 27648
+
+  // Works out the edit state from Adjustments.plist only (never reads the photo).
+  // adjustmentRenderTypes is the signal: a real edit moves it off the baseline, while a
+  // plain capture, a Photographic Style, and a reverted edit all sit at the baseline. The
+  // editor id is NOT reliable: com.apple.camera authors both styles and some real edits
+  // (e.g. changing the Photographic Style after capture), so we key off the render types
+  // alone. Cleanup and object-removal write AdjustmentsSecondary.data, which we count as
+  // edited. unknown = couldn't read the plist (offloaded, no network).
+  private static func classifyEdit(resources: [PHAssetResource], allowNetworkAccess: Bool) async -> EditState {
+    if resources.contains(where: { $0.originalFilename == "AdjustmentsSecondary.data" }) {
+      return .edited
+    }
+    guard let adjRes = resources.first(where: { $0.originalFilename == "Adjustments.plist" }) else {
+      return .notEdited
+    }
+    guard let buf = await collectResourceData(adjRes, allowNetworkAccess: allowNetworkAccess),
+      let plist = try? PropertyListSerialization.propertyList(from: buf, options: [], format: nil) as? [String: Any]
+    else {
+      return .unknown
+    }
+    let renderTypes = (plist["adjustmentRenderTypes"] as? NSNumber)?.intValue
+    let isUserEdit = renderTypes != nil && renderTypes != kNoEditRenderTypes
+    return isUserEdit ? .edited : .notEdited
+  }
+
+  private func streamBaseResource(
+    resource: PHAssetResource,
+    localId: String,
+    allowNetworkAccess: Bool
+  ) async throws -> BaseResource {
+    let safeId = localId.replacingOccurrences(of: "/", with: "_")
+    let suffix = UTType(resource.uniformTypeIdentifier)?.preferredFilenameExtension ?? "bin"
+    let tempDir = URL(fileURLWithPath: NSTemporaryDirectory(), isDirectory: true)
+      .appendingPathComponent("immich_base", isDirectory: true)
+    try FileManager.default.createDirectory(at: tempDir, withIntermediateDirectories: true)
+
+    let unique = UUID().uuidString.prefix(8)
+    let tempUrl = tempDir.appendingPathComponent("\(safeId)_\(unique)_base.\(suffix)")
+
+    // Write the resource to disk and hash it chunk by chunk, so a big original (e.g.
+    // ProRAW) never sits fully in memory on the upload thread.
+    FileManager.default.createFile(atPath: tempUrl.path, contents: nil)
+    guard let handle = try? FileHandle(forWritingTo: tempUrl) else {
+      throw NSError(
+        domain: "NativeSyncApi",
+        code: -1,
+        userInfo: [NSLocalizedDescriptionKey: "Failed to open temp file for base resource \(localId)"]
+      )
+    }
+
+    var hasher = Insecure.SHA1()
+    var totalBytes: Int64 = 0
+    let options = PHAssetResourceRequestOptions()
+    options.isNetworkAccessAllowed = allowNetworkAccess
+
+    let succeeded = await withCheckedContinuation { (continuation: CheckedContinuation<Bool, Never>) in
+      var writeFailed = false
+      PHAssetResourceManager.default().requestData(
+        for: resource,
+        options: options,
+        dataReceivedHandler: { chunk in
+          if writeFailed { return }
+          do {
+            try handle.write(contentsOf: chunk)
+            hasher.update(data: chunk)
+            totalBytes += Int64(chunk.count)
+          } catch {
+            writeFailed = true
+          }
+        },
+        completionHandler: { error in continuation.resume(returning: error == nil && !writeFailed) }
+      )
+    }
+
+    try? handle.close()
+
+    guard succeeded else {
+      try? FileManager.default.removeItem(at: tempUrl)
+      throw NSError(
+        domain: "NativeSyncApi",
+        code: -1,
+        userInfo: [NSLocalizedDescriptionKey: "Failed to read base resource for \(localId)"]
+      )
+    }
+
+    let sha1 = Data(hasher.finalize()).base64EncodedString()
+    let mime = UTType(resource.uniformTypeIdentifier)?.preferredMIMEType ?? "application/octet-stream"
+    return BaseResource(path: tempUrl.path, sha1: sha1, sizeBytes: totalBytes, mimeType: mime)
+  }
+
+  private static func collectResourceData(
+    _ resource: PHAssetResource,
+    allowNetworkAccess: Bool
+  ) async -> Data? {
+    let options = PHAssetResourceRequestOptions()
+    options.isNetworkAccessAllowed = allowNetworkAccess
+    var buffer = Data()
+    return await withCheckedContinuation { (continuation: CheckedContinuation<Data?, Never>) in
+      PHAssetResourceManager.default().requestData(
+        for: resource,
+        options: options,
+        dataReceivedHandler: { data in buffer.append(data) },
+        completionHandler: { error in continuation.resume(returning: error == nil ? buffer : nil) }
+      )
+    }
+  }
+
 }
@@ -4,7 +4,7 @@
  <dict>
    <key>com.apple.security.application-groups</key>
    <array>
-      <string>group.app.immich.share</string>
+      <string>$(CUSTOM_GROUP_ID)</string>
    </array>
  </dict>
 </plist>
@@ -2,7 +2,7 @@ import Foundation
 import SwiftUI
 import WidgetKit

-let IMMICH_SHARE_GROUP = "group.app.immich.share"
+let IMMICH_SHARE_GROUP = Bundle.main.object(forInfoDictionaryKey: "AppGroupId") as! String

 enum WidgetError: Error, Codable {
  case noLogin
@@ -2,6 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>AppGroupId</key>
+	<string>$(CUSTOM_GROUP_ID)</string>
 	<key>NSAppTransportSecurity</key>
 	<dict>
 		<key>NSAllowsArbitraryLoads</key>
@@ -4,7 +4,7 @@
  <dict>
    <key>com.apple.security.application-groups</key>
    <array>
-      <string>group.app.immich.share</string>
+      <string>$(CUSTOM_GROUP_ID)</string>
    </array>
  </dict>
 </plist>
@@ -21,6 +21,7 @@ platform :ios do
  CODE_SIGN_IDENTITY = "Apple Distribution: FUTO Holdings, Inc. (#{TEAM_ID})"
  BASE_BUNDLE_ID = "app.alextran.immich"
  DEV_BUNDLE_ID  = "tech.futo.immich.testflight"
+  DEV_GROUP_ID   = "group.app.immich.share.testflight"

  # Helper method to get App Store Connect API key
  def get_api_key
@@ -33,6 +34,13 @@ platform :ios do
    )
  end
  
+  # Helper method to assemble xcargs with optional CUSTOM_GROUP_ID override
+  def build_xcargs(group_id: nil)
+    args = "-skipMacroValidation CODE_SIGN_IDENTITY='#{CODE_SIGN_IDENTITY}' CODE_SIGN_STYLE=Manual"
+    args += " CUSTOM_GROUP_ID='#{group_id}'" if group_id
+    args
+  end
+
  # Helper method to get version from pubspec.yaml
 def get_version_from_pubspec
  require 'yaml'
@@ -89,7 +97,8 @@ end
    version_number: nil,
    profile_name_main:,
    profile_name_share:,
-    profile_name_widget:
+    profile_name_widget:,
+    group_id: nil
  )
    app_identifier = base_bundle_id

@@ -97,7 +106,7 @@ end
    if version_number
      increment_version_number(version_number: version_number)
    end
-    
+
    # Increment build number
    increment_build_number(
      build_number: latest_testflight_build_number(
@@ -106,14 +115,14 @@ end
      ) + 1,
      xcodeproj: "./Runner.xcodeproj"
    )
-    
+
    # Build the app
    build_app(
      scheme: "Runner",
      workspace: "Runner.xcworkspace",
      configuration: configuration,
      export_method: "app-store",
-      xcargs: "-skipMacroValidation CODE_SIGN_IDENTITY='#{CODE_SIGN_IDENTITY}' CODE_SIGN_STYLE=Manual",
+      xcargs: build_xcargs(group_id: group_id),
      export_options: {
        provisioningProfiles: {
          "#{app_identifier}" => profile_name_main,
@@ -165,7 +174,8 @@ end
      distribute_external: false,
      profile_name_main: main_profile_name,
      profile_name_share: share_profile_name,
-      profile_name_widget: widget_profile_name
+      profile_name_widget: widget_profile_name,
+      group_id: DEV_GROUP_ID
    )
  end

@@ -274,7 +284,7 @@ end
      configuration: "Release",
      export_method: "app-store",
      skip_package_ipa: true,
-      xcargs: "-skipMacroValidation CODE_SIGN_IDENTITY='#{CODE_SIGN_IDENTITY}' CODE_SIGN_STYLE=Manual",
+      xcargs: build_xcargs(group_id: DEV_GROUP_ID),
      export_options: {
        provisioningProfiles: {
          DEV_BUNDLE_ID => main_profile_name,
@@ -20,6 +20,7 @@ const String kSecuredPinCode = "secured_pin_code";
 const String kManualUploadGroup = 'manual_upload_group';
 const String kBackupGroup = 'backup_group';
 const String kBackupLivePhotoGroup = 'backup_live_photo_group';
+const String kBackupEditPairGroup = 'backup_edit_pair_group';
 const String kDownloadGroupImage = 'group_image';
 const String kDownloadGroupVideo = 'group_video';
 const String kDownloadGroupLivePhoto = 'group_livephoto';
@@ -30,7 +31,6 @@ const int kTimelineAssetLoadBatchSize = 1024;
 const int kTimelineAssetLoadOppositeSize = 64;

 // Widget keys
-const String appShareGroupId = "group.app.immich.share";
 const String kWidgetAuthToken = "widget_auth_token";
 const String kWidgetServerEndpoint = "widget_server_url";
 const String kWidgetCustomHeaders = "widget_custom_headers";
@@ -18,3 +18,7 @@ enum CleanupStep { selectDate, scan, delete }
 enum AssetKeepType { none, photosOnly, videosOnly }

 enum AssetDateAggregation { start, end }
+
+enum SlideshowLook { contain, cover, blurredBackground }
+
+enum SlideshowDirection { forward, backward, shuffle }
@@ -12,6 +12,13 @@ class LocalAsset extends BaseAsset {
  final double? latitude;
  final double? longitude;

+  // Remote id of this asset's previous upload; used to stack a new edit under it.
+  final String? priorRemoteId;
+
+  // Local checksum at the last sync action; lets backup skip an already-handled
+  // local whose current render hashes fresh (the iOS revert case).
+  final String? syncedChecksum;
+
  const LocalAsset({
    required this.id,
    String? remoteId,
@@ -32,6 +39,8 @@ class LocalAsset extends BaseAsset {
    this.latitude,
    this.longitude,
    required super.isEdited,
+    this.priorRemoteId,
+    this.syncedChecksum,
  }) : remoteAssetId = remoteId;

  @override
@@ -120,6 +129,8 @@ class LocalAsset extends BaseAsset {
    double? latitude,
    double? longitude,
    bool? isEdited,
+    String? priorRemoteId,
+    String? syncedChecksum,
  }) {
    return LocalAsset(
      id: id ?? this.id,
@@ -140,6 +151,8 @@ class LocalAsset extends BaseAsset {
      latitude: latitude ?? this.latitude,
      longitude: longitude ?? this.longitude,
      isEdited: isEdited ?? this.isEdited,
+      priorRemoteId: priorRemoteId ?? this.priorRemoteId,
+      syncedChecksum: syncedChecksum ?? this.syncedChecksum,
    );
  }
 }
@@ -11,6 +11,7 @@ class RemoteAsset extends BaseAsset {
  final String ownerId;
  final String? stackId;
  final DateTime? uploadedAt;
+  final DateTime? deletedAt;

  const RemoteAsset({
    required this.id,
@@ -31,6 +32,7 @@ class RemoteAsset extends BaseAsset {
    super.livePhotoVideoId,
    this.stackId,
    required super.isEdited,
+    this.deletedAt,
  }) : localAssetId = localId;

  @override
@@ -48,6 +50,8 @@ class RemoteAsset extends BaseAsset {
  @override
  bool get isEditable => isImage && !isMotionPhoto && !isAnimatedImage;

+  bool get isTrashed => deletedAt != null;
+
  @override
  String toString() {
    return '''Asset {
@@ -86,7 +90,8 @@ class RemoteAsset extends BaseAsset {
        thumbHash == other.thumbHash &&
        visibility == other.visibility &&
        stackId == other.stackId &&
-        uploadedAt == other.uploadedAt;
+        uploadedAt == other.uploadedAt &&
+        deletedAt == other.deletedAt;
  }

  @override
@@ -98,7 +103,8 @@ class RemoteAsset extends BaseAsset {
      thumbHash.hashCode ^
      visibility.hashCode ^
      stackId.hashCode ^
-      uploadedAt.hashCode;
+      uploadedAt.hashCode ^
+      deletedAt.hashCode;

  RemoteAsset copyWith({
    String? id,
@@ -119,6 +125,7 @@ class RemoteAsset extends BaseAsset {
    String? livePhotoVideoId,
    String? stackId,
    bool? isEdited,
+    DateTime? deletedAt,
  }) {
    return RemoteAsset(
      id: id ?? this.id,
@@ -139,6 +146,7 @@ class RemoteAsset extends BaseAsset {
      livePhotoVideoId: livePhotoVideoId ?? this.livePhotoVideoId,
      stackId: stackId ?? this.stackId,
      isEdited: isEdited ?? this.isEdited,
+      deletedAt: deletedAt ?? this.deletedAt,
    );
  }
 }
@@ -156,6 +164,7 @@ class RemoteAssetExif extends RemoteAsset {
    required super.createdAt,
    required super.updatedAt,
    super.uploadedAt,
+    super.deletedAt,
    super.width,
    super.height,
    super.durationMs,
@@ -193,6 +202,7 @@ class RemoteAssetExif extends RemoteAsset {
    DateTime? createdAt,
    DateTime? updatedAt,
    DateTime? uploadedAt,
+    DateTime? deletedAt,
    int? width,
    int? height,
    int? durationMs,
@@ -214,6 +224,7 @@ class RemoteAssetExif extends RemoteAsset {
      createdAt: createdAt ?? this.createdAt,
      updatedAt: updatedAt ?? this.updatedAt,
      uploadedAt: uploadedAt ?? this.uploadedAt,
+      deletedAt: deletedAt ?? this.deletedAt,
      width: width ?? this.width,
      height: height ?? this.height,
      durationMs: durationMs ?? this.durationMs,
@@ -0,0 +1,26 @@
+import 'package:immich_mobile/providers/album/album_sort_by_options.provider.dart';
+
+class AlbumConfig {
+  final AlbumSortMode sortMode;
+  final bool isReverse;
+  final bool isGrid;
+
+  const AlbumConfig({this.sortMode = AlbumSortMode.mostRecent, this.isReverse = true, this.isGrid = false});
+
+  AlbumConfig copyWith({AlbumSortMode? sortMode, bool? isReverse, bool? isGrid}) => AlbumConfig(
+    sortMode: sortMode ?? this.sortMode,
+    isReverse: isReverse ?? this.isReverse,
+    isGrid: isGrid ?? this.isGrid,
+  );
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      (other is AlbumConfig && other.sortMode == sortMode && other.isReverse == isReverse && other.isGrid == isGrid);
+
+  @override
+  int get hashCode => Object.hash(sortMode, isReverse, isGrid);
+
+  @override
+  String toString() => 'AlbumConfig(sortMode: $sortMode, isReverse: $isReverse, isGrid: $isGrid)';
+}
@@ -1,26 +1,56 @@
+import 'package:immich_mobile/domain/models/config/album_config.dart';
+import 'package:immich_mobile/domain/models/config/backup_config.dart';
 import 'package:immich_mobile/domain/models/config/cleanup_config.dart';
+import 'package:immich_mobile/domain/models/config/image_config.dart';
 import 'package:immich_mobile/domain/models/config/map_config.dart';
+import 'package:immich_mobile/domain/models/config/slideshow_config.dart';
 import 'package:immich_mobile/domain/models/config/theme_config.dart';
 import 'package:immich_mobile/domain/models/config/timeline_config.dart';
+import 'package:immich_mobile/domain/models/config/viewer_config.dart';

 class AppConfig {
  final ThemeConfig theme;
  final CleanupConfig cleanup;
  final MapConfig map;
  final TimelineConfig timeline;
+  final ImageConfig image;
+  final ViewerConfig viewer;
+  final SlideshowConfig slideshow;
+  final AlbumConfig album;
+  final BackupConfig backup;

  const AppConfig({
    this.theme = const .new(),
    this.cleanup = const .new(),
    this.map = const .new(),
    this.timeline = const .new(),
+    this.image = const .new(),
+    this.viewer = const .new(),
+    this.slideshow = const .new(),
+    this.album = const .new(),
+    this.backup = const .new(),
  });

-  AppConfig copyWith({ThemeConfig? theme, CleanupConfig? cleanup, MapConfig? map, TimelineConfig? timeline}) => .new(
+  AppConfig copyWith({
+    ThemeConfig? theme,
+    CleanupConfig? cleanup,
+    MapConfig? map,
+    TimelineConfig? timeline,
+    ImageConfig? image,
+    ViewerConfig? viewer,
+    SlideshowConfig? slideshow,
+    AlbumConfig? album,
+    BackupConfig? backup,
+  }) => .new(
    theme: theme ?? this.theme,
    cleanup: cleanup ?? this.cleanup,
    map: map ?? this.map,
    timeline: timeline ?? this.timeline,
+    image: image ?? this.image,
+    viewer: viewer ?? this.viewer,
+    slideshow: slideshow ?? this.slideshow,
+    album: album ?? this.album,
+    backup: backup ?? this.backup,
  );

  @override
@@ -30,11 +60,17 @@ class AppConfig {
          other.theme == theme &&
          other.cleanup == cleanup &&
          other.map == map &&
-          other.timeline == timeline);
+          other.timeline == timeline &&
+          other.image == image &&
+          other.viewer == viewer &&
+          other.slideshow == slideshow &&
+          other.album == album &&
+          other.backup == backup);

  @override
-  int get hashCode => Object.hash(theme, cleanup, map, timeline);
+  int get hashCode => Object.hash(theme, cleanup, map, timeline, image, viewer, slideshow, album, backup);

  @override
-  String toString() => 'AppConfig(theme: $theme, cleanup: $cleanup, map: $map, timeline: $timeline)';
+  String toString() =>
+      'AppConfig(theme: $theme, cleanup: $cleanup, map: $map, timeline: $timeline, image: $image, viewer: $viewer, slideshow: $slideshow, album: $album, backup: $backup)';
 }
@@ -0,0 +1,52 @@
+class BackupConfig {
+  final bool enabled;
+  final bool useCellularForVideos;
+  final bool useCellularForPhotos;
+  final bool requireCharging;
+  final int triggerDelay;
+  final bool syncAlbums;
+
+  const BackupConfig({
+    this.enabled = false,
+    this.useCellularForVideos = false,
+    this.useCellularForPhotos = false,
+    this.requireCharging = false,
+    this.triggerDelay = 30,
+    this.syncAlbums = false,
+  });
+
+  BackupConfig copyWith({
+    bool? enabled,
+    bool? useCellularForVideos,
+    bool? useCellularForPhotos,
+    bool? requireCharging,
+    int? triggerDelay,
+    bool? syncAlbums,
+  }) => BackupConfig(
+    enabled: enabled ?? this.enabled,
+    useCellularForVideos: useCellularForVideos ?? this.useCellularForVideos,
+    useCellularForPhotos: useCellularForPhotos ?? this.useCellularForPhotos,
+    requireCharging: requireCharging ?? this.requireCharging,
+    triggerDelay: triggerDelay ?? this.triggerDelay,
+    syncAlbums: syncAlbums ?? this.syncAlbums,
+  );
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      (other is BackupConfig &&
+          other.enabled == enabled &&
+          other.useCellularForVideos == useCellularForVideos &&
+          other.useCellularForPhotos == useCellularForPhotos &&
+          other.requireCharging == requireCharging &&
+          other.triggerDelay == triggerDelay &&
+          other.syncAlbums == syncAlbums);
+
+  @override
+  int get hashCode =>
+      Object.hash(enabled, useCellularForVideos, useCellularForPhotos, requireCharging, triggerDelay, syncAlbums);
+
+  @override
+  String toString() =>
+      'BackupConfig(enabled: $enabled, useCellularForVideos: $useCellularForVideos, useCellularForPhotos: $useCellularForPhotos, requireCharging: $requireCharging, triggerDelay: $triggerDelay, syncAlbums: $syncAlbums)';
+}
@@ -0,0 +1,20 @@
+class ImageConfig {
+  final bool preferRemote;
+  final bool loadOriginal;
+
+  const ImageConfig({this.preferRemote = false, this.loadOriginal = false});
+
+  ImageConfig copyWith({bool? preferRemote, bool? loadOriginal}) =>
+      ImageConfig(preferRemote: preferRemote ?? this.preferRemote, loadOriginal: loadOriginal ?? this.loadOriginal);
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      (other is ImageConfig && other.preferRemote == preferRemote && other.loadOriginal == loadOriginal);
+
+  @override
+  int get hashCode => Object.hash(preferRemote, loadOriginal);
+
+  @override
+  String toString() => 'ImageConfig(preferRemoteImage: $preferRemote, loadOriginal: $loadOriginal)';
+}
@@ -0,0 +1,54 @@
+import 'package:flutter/foundation.dart';
+
+class NetworkConfig {
+  final bool autoEndpointSwitching;
+  final String? preferredWifiName;
+  final String? localEndpoint;
+  final List<String> externalEndpointList;
+  final Map<String, String> customHeaders;
+
+  const NetworkConfig({
+    this.autoEndpointSwitching = false,
+    this.preferredWifiName,
+    this.localEndpoint,
+    this.externalEndpointList = const [],
+    this.customHeaders = const {},
+  });
+
+  NetworkConfig copyWith({
+    bool? autoEndpointSwitching,
+    String? preferredWifiName,
+    String? localEndpoint,
+    List<String>? externalEndpointList,
+    Map<String, String>? customHeaders,
+  }) => NetworkConfig(
+    autoEndpointSwitching: autoEndpointSwitching ?? this.autoEndpointSwitching,
+    preferredWifiName: preferredWifiName ?? this.preferredWifiName,
+    localEndpoint: localEndpoint ?? this.localEndpoint,
+    externalEndpointList: externalEndpointList ?? this.externalEndpointList,
+    customHeaders: customHeaders ?? this.customHeaders,
+  );
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      (other is NetworkConfig &&
+          other.autoEndpointSwitching == autoEndpointSwitching &&
+          other.preferredWifiName == preferredWifiName &&
+          other.localEndpoint == localEndpoint &&
+          listEquals(other.externalEndpointList, externalEndpointList) &&
+          mapEquals(other.customHeaders, customHeaders));
+
+  @override
+  int get hashCode => Object.hash(
+    autoEndpointSwitching,
+    preferredWifiName,
+    localEndpoint,
+    Object.hashAll(externalEndpointList),
+    Object.hashAllUnordered(customHeaders.entries.map((e) => Object.hash(e.key, e.value))),
+  );
+
+  @override
+  String toString() =>
+      'NetworkConfig(autoEndpointSwitching: $autoEndpointSwitching, preferredWifiName: $preferredWifiName, localEndpoint: $localEndpoint, externalEndpointList: $externalEndpointList, customHeaders: $customHeaders)';
+}
@@ -0,0 +1,48 @@
+import 'package:immich_mobile/constants/enums.dart';
+
+class SlideshowConfig {
+  final bool transition;
+  final bool repeat;
+  final int duration;
+  final SlideshowLook look;
+  final SlideshowDirection direction;
+
+  const SlideshowConfig({
+    this.transition = true,
+    this.repeat = true,
+    this.duration = 5,
+    this.look = SlideshowLook.contain,
+    this.direction = SlideshowDirection.forward,
+  });
+
+  SlideshowConfig copyWith({
+    bool? transition,
+    bool? repeat,
+    int? duration,
+    SlideshowLook? look,
+    SlideshowDirection? direction,
+  }) => SlideshowConfig(
+    transition: transition ?? this.transition,
+    repeat: repeat ?? this.repeat,
+    duration: duration ?? this.duration,
+    look: look ?? this.look,
+    direction: direction ?? this.direction,
+  );
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      (other is SlideshowConfig &&
+          other.transition == transition &&
+          other.repeat == repeat &&
+          other.duration == duration &&
+          other.look == look &&
+          other.direction == direction);
+
+  @override
+  int get hashCode => Object.hash(transition, repeat, duration, look, direction);
+
+  @override
+  String toString() =>
+      'SlideshowConfig(transition: $transition, repeat: $repeat, duration: $duration, look: $look, direction: $direction)';
+}
@@ -1,18 +1,22 @@
+import 'package:immich_mobile/domain/models/config/network_config.dart';
 import 'package:immich_mobile/domain/models/log.model.dart';

 class SystemConfig {
  final LogLevel logLevel;
+  final NetworkConfig network;

-  const SystemConfig({this.logLevel = .info});
+  const SystemConfig({this.logLevel = .info, this.network = const .new()});

-  SystemConfig copyWith({LogLevel? logLevel}) => SystemConfig(logLevel: logLevel ?? this.logLevel);
+  SystemConfig copyWith({LogLevel? logLevel, NetworkConfig? network}) =>
+      SystemConfig(logLevel: logLevel ?? this.logLevel, network: network ?? this.network);

  @override
-  bool operator ==(Object other) => identical(this, other) || (other is SystemConfig && other.logLevel == logLevel);
+  bool operator ==(Object other) =>
+      identical(this, other) || (other is SystemConfig && other.logLevel == logLevel && other.network == network);

  @override
-  int get hashCode => logLevel.hashCode;
+  int get hashCode => Object.hash(logLevel, network);

  @override
-  String toString() => 'SystemConfig(logLevel: $logLevel)';
+  String toString() => 'SystemConfig(logLevel: $logLevel, network: $network)';
 }
@@ -0,0 +1,37 @@
+class ViewerConfig {
+  final bool loopVideo;
+  final bool loadOriginalVideo;
+  final bool autoPlayVideo;
+  final bool tapToNavigate;
+
+  const ViewerConfig({
+    this.loopVideo = true,
+    this.loadOriginalVideo = false,
+    this.autoPlayVideo = true,
+    this.tapToNavigate = false,
+  });
+
+  ViewerConfig copyWith({bool? loopVideo, bool? loadOriginalVideo, bool? autoPlayVideo, bool? tapToNavigate}) =>
+      ViewerConfig(
+        loopVideo: loopVideo ?? this.loopVideo,
+        loadOriginalVideo: loadOriginalVideo ?? this.loadOriginalVideo,
+        autoPlayVideo: autoPlayVideo ?? this.autoPlayVideo,
+        tapToNavigate: tapToNavigate ?? this.tapToNavigate,
+      );
+
+  @override
+  bool operator ==(Object other) =>
+      identical(this, other) ||
+      (other is ViewerConfig &&
+          other.loopVideo == loopVideo &&
+          other.loadOriginalVideo == loadOriginalVideo &&
+          other.autoPlayVideo == autoPlayVideo &&
+          other.tapToNavigate == tapToNavigate);
+
+  @override
+  int get hashCode => Object.hash(loopVideo, loadOriginalVideo, autoPlayVideo, tapToNavigate);
+
+  @override
+  String toString() =>
+      'ViewerConfig(loopVideo: $loopVideo, loadOriginalVideo: $loadOriginalVideo, autoPlayVideo: $autoPlayVideo, tapToNavigate: $tapToNavigate)';
+}
@@ -8,6 +8,7 @@ import 'package:immich_mobile/domain/models/config/app_config.dart';
 import 'package:immich_mobile/domain/models/config/system_config.dart';
 import 'package:immich_mobile/domain/models/log.model.dart';
 import 'package:immich_mobile/domain/models/timeline.model.dart';
+import 'package:immich_mobile/providers/album/album_sort_by_options.provider.dart';

 enum MetadataDomain<T extends Object> {
  appConfig<AppConfig>('config.app'),
@@ -24,6 +25,51 @@ enum MetadataKey<T extends Object> {
  themeDynamic<bool>(.appConfig, 'theme.dynamic', false),
  themeColorfulInterface<bool>(.appConfig, 'theme.colorfulInterface', true),

+  // Image
+  imagePreferRemote<bool>(.appConfig, 'image.preferRemote', false),
+  imageLoadOriginal<bool>(.appConfig, 'image.loadOriginal', false),
+
+  // Viewer
+  viewerLoopVideo<bool>(.appConfig, 'viewer.loopVideo', true),
+  viewerLoadOriginalVideo<bool>(.appConfig, 'viewer.loadOriginalVideo', false),
+  viewerAutoPlayVideo<bool>(.appConfig, 'viewer.autoPlayVideo', true),
+  viewerTapToNavigate<bool>(.appConfig, 'viewer.tapToNavigate', false),
+
+  // Network
+  networkAutoEndpointSwitching<bool>(.systemConfig, 'network.autoEndpointSwitching', false),
+  networkPreferredWifiName<String>(.systemConfig, 'network.preferredWifiName', ''),
+  networkLocalEndpoint<String>(.systemConfig, 'network.localEndpoint', ''),
+  networkExternalEndpointList<List<String>>(
+    .systemConfig,
+    'network.externalEndpointList',
+    [],
+    _ListCodec(_PrimitiveCodec.string),
+  ),
+  networkCustomHeaders<Map<String, String>>(
+    .systemConfig,
+    'network.customHeaders',
+    {},
+    _MapCodec(_PrimitiveCodec.string, _PrimitiveCodec.string),
+  ),
+
+  // Album
+  albumSortMode<AlbumSortMode>(
+    .appConfig,
+    'album.sortMode',
+    AlbumSortMode.mostRecent,
+    _EnumCodec(AlbumSortMode.values),
+  ),
+  albumIsReverse<bool>(.appConfig, 'album.isReverse', true),
+  albumIsGrid<bool>(.appConfig, 'album.isGrid', false),
+
+  // Backup
+  backupEnabled<bool>(.appConfig, 'backup.enabled', false),
+  backupUseCellularForVideos<bool>(.appConfig, 'backup.useCellularForVideos', false),
+  backupUseCellularForPhotos<bool>(.appConfig, 'backup.useCellularForPhotos', false),
+  backupRequireCharging<bool>(.appConfig, 'backup.requireCharging', false),
+  backupTriggerDelay<int>(.appConfig, 'backup.triggerDelay', 30),
+  backupSyncAlbums<bool>(.appConfig, 'backup.syncAlbums', false),
+
  // Timeline
  timelineTilesPerRow<int>(.appConfig, 'timeline.tilesPerRow', 4),
  timelineGroupAssetsBy<GroupAssetsBy>(
@@ -54,7 +100,19 @@ enum MetadataKey<T extends Object> {
  ),
  cleanupKeepAlbumIds<List<String>>(.appConfig, 'cleanup.keepAlbumIds', [], _ListCodec(_PrimitiveCodec.string)),
  cleanupCutoffDaysAgo<int>(.appConfig, 'cleanup.cutoffDaysAgo', -1),
-  cleanupDefaultsInitialized<bool>(.appConfig, 'cleanup.defaultsInitialized', false);
+  cleanupDefaultsInitialized<bool>(.appConfig, 'cleanup.defaultsInitialized', false),
+
+  // Slideshow
+  slideshowTransition<bool>(.appConfig, 'slideshow.transition', true),
+  slideshowRepeat<bool>(.appConfig, 'slideshow.repeat', true),
+  slideshowDuration<int>(.appConfig, 'slideshow.duration', 5),
+  slideshowLook<SlideshowLook>(.appConfig, 'slideshow.look', SlideshowLook.contain, _EnumCodec(SlideshowLook.values)),
+  slideshowDirection<SlideshowDirection>(
+    .appConfig,
+    'slideshow.direction',
+    SlideshowDirection.forward,
+    _EnumCodec(SlideshowDirection.values),
+  );

  final MetadataDomain domain;
  final String name;
@@ -121,6 +179,47 @@ final class _DateTimeCodec extends _MetadataCodec<DateTime> {
  DateTime? decode(String raw) => DateTime.tryParse(raw);
 }

+final class _MapCodec<K extends Object, V extends Object> extends _MetadataCodec<Map<K, V>> {
+  final _MetadataCodec<K> _keyCodec;
+  final _MetadataCodec<V> _valueCodec;
+
+  const _MapCodec(this._keyCodec, this._valueCodec);
+
+  @override
+  String encode(Map<K, V> value) {
+    final entries = <String, String>{};
+    value.forEach((k, v) => entries[_keyCodec.encode(k)] = _valueCodec.encode(v));
+    return jsonEncode(entries);
+  }
+
+  @override
+  Map<K, V>? decode(String raw) {
+    try {
+      final decoded = jsonDecode(raw);
+      if (decoded is! Map) {
+        return null;
+      }
+      final result = <K, V>{};
+      for (final entry in decoded.entries) {
+        final rawKey = entry.key;
+        final rawValue = entry.value;
+        if (rawKey is! String || rawValue is! String) {
+          return null;
+        }
+        final k = _keyCodec.decode(rawKey);
+        final v = _valueCodec.decode(rawValue);
+        if (k == null || v == null) {
+          return null;
+        }
+        result[k] = v;
+      }
+      return result;
+    } on FormatException {
+      return null;
+    }
+  }
+}
+
 final class _ListCodec<T extends Object> extends _MetadataCodec<List<T>> {
  final _MetadataCodec<T> _elementCodec;

@@ -1,12 +1,7 @@
 import 'package:immich_mobile/domain/models/store.model.dart';

 enum Setting<T> {
-  loadOriginal<bool>(StoreKey.loadOriginal, false),
-  loadOriginalVideo<bool>(StoreKey.loadOriginalVideo, false),
-  autoPlayVideo<bool>(StoreKey.autoPlayVideo, true),
-  preferRemoteImage<bool>(StoreKey.preferRemoteImage, false),
-  advancedTroubleshooting<bool>(StoreKey.advancedTroubleshooting, false),
-  enableBackup<bool>(StoreKey.enableBackup, false);
+  advancedTroubleshooting<bool>(StoreKey.advancedTroubleshooting, false);

  const Setting(this.storeKey, this.defaultValue);

@@ -4,59 +4,41 @@ import 'package:immich_mobile/domain/models/user.model.dart';
 /// Defines the data type for each value
 enum StoreKey<T> {
  version<int>._(0),
-  assetETag<String>._(1),
  currentUser<UserDto>._(2),
-  deviceIdHash<int>._(3),
  deviceId<String>._(4),
-  backupFailedSince<DateTime>._(5),
-  backupRequireWifi<bool>._(6),
-  backupRequireCharging<bool>._(7),
-  backupTriggerDelay<int>._(8),
  serverUrl<String>._(10),
  accessToken<String>._(11),
  serverEndpoint<String>._(12),
-  autoBackup<bool>._(13),
-  backgroundBackup<bool>._(14),
-  sslClientCertData<String>._(15),
-  sslClientPasswd<String>._(16),
-  uploadErrorNotificationGracePeriod<int>._(106),
-  thumbnailCacheSize<int>._(110),
-  imageCacheSize<int>._(111),
-  albumThumbnailCacheSize<int>._(112),
-  selectedAlbumSortOrder<int>._(113),
  advancedTroubleshooting<bool>._(114),
-  preferRemoteImage<bool>._(116),
-  selfSignedCert<bool>._(120),
-  selectedAlbumSortReverse<bool>._(123),
  enableHapticFeedback<bool>._(126),
-  customHeaders<String>._(127),
-  syncAlbums<bool>._(131),
-
-  // Auto endpoint switching
-  autoEndpointSwitching<bool>._(132),
-  preferredWifiName<String>._(133),
-  localEndpoint<String>._(134),
-  externalEndpointList<String>._(135),

  manageLocalMediaAndroid<bool>._(137),
  // Read-only Mode settings
  readonlyModeEnabled<bool>._(138),
-  albumGridView<bool>._(140),
-  loadOriginal<bool>._(101),

-  // Image viewer navigation settings
-  loopVideo<bool>._(117),
-  loadOriginalVideo<bool>._(136),
-  autoPlayVideo<bool>._(139),
-  tapToNavigate<bool>._(141),
-
-  // Experimental stuff
-  enableBackup<bool>._(1003),
-  useWifiForUploadVideos<bool>._(1004),
-  useWifiForUploadPhotos<bool>._(1005),
  syncMigrationStatus<String>._(1013),

  // Legacy keys that have been migrated to the new metadata store
+  legacyBackupRequireCharging<bool>._(7),
+  legacyBackupTriggerDelay<int>._(8),
+  legacySyncAlbums<bool>._(131),
+  legacyEnableBackup<bool>._(1003),
+  legacyUseWifiForUploadVideos<bool>._(1004),
+  legacyUseWifiForUploadPhotos<bool>._(1005),
+  legacySelectedAlbumSortOrder<int>._(113),
+  legacySelectedAlbumSortReverse<bool>._(123),
+  legacyAlbumGridView<bool>._(140),
+  legacyAutoEndpointSwitching<bool>._(132),
+  legacyPreferredWifiName<String>._(133),
+  legacyLocalEndpoint<String>._(134),
+  legacyExternalEndpointList<String>._(135),
+  legacyCustomHeaders<String>._(127),
+  legacyLoopVideo<bool>._(117),
+  legacyLoadOriginalVideo<bool>._(136),
+  legacyAutoPlayVideo<bool>._(139),
+  legacyTapToNavigate<bool>._(141),
+  legacyPreferRemoteImage<bool>._(116),
+  legacyLoadOriginal<bool>._(101),
  legacyPrimaryColor<String>._(128),
  legacyDynamicTheme<bool>._(129),
  legacyColorfulInterface<bool>._(130),
@@ -11,15 +11,14 @@ import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/extensions/platform_extensions.dart';
 import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/logger_db.repository.dart';
+import 'package:immich_mobile/infrastructure/repositories/metadata.repository.dart';
 import 'package:immich_mobile/platform/background_worker_api.g.dart';
 import 'package:immich_mobile/platform/background_worker_lock_api.g.dart';
-import 'package:immich_mobile/providers/app_settings.provider.dart';
 import 'package:immich_mobile/providers/background_sync.provider.dart';
 import 'package:immich_mobile/providers/backup/drift_backup.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/db.provider.dart';
 import 'package:immich_mobile/providers/infrastructure/platform.provider.dart' show nativeSyncApiProvider;
 import 'package:immich_mobile/providers/user.provider.dart';
-import 'package:immich_mobile/services/app_settings.service.dart';
 import 'package:immich_mobile/services/auth.service.dart';
 import 'package:immich_mobile/services/foreground_upload.service.dart';
 import 'package:immich_mobile/services/localization.service.dart';
@@ -39,16 +38,15 @@ class BackgroundWorkerFgService {
  Future<void> saveNotificationMessage(String title, String body) =>
      _foregroundHostApi.saveNotificationMessage(title, body);

-  Future<void> configure({int? minimumDelaySeconds, bool? requireCharging}) => _foregroundHostApi.configure(
-    BackgroundWorkerSettings(
-      minimumDelaySeconds:
-          minimumDelaySeconds ??
-          Store.get(AppSettingsEnum.backupTriggerDelay.storeKey, AppSettingsEnum.backupTriggerDelay.defaultValue),
-      requiresCharging:
-          requireCharging ??
-          Store.get(AppSettingsEnum.backupRequireCharging.storeKey, AppSettingsEnum.backupRequireCharging.defaultValue),
-    ),
-  );
+  Future<void> configure({int? minimumDelaySeconds, bool? requireCharging}) {
+    final backup = MetadataRepository.instance.appConfig.backup;
+    return _foregroundHostApi.configure(
+      BackgroundWorkerSettings(
+        minimumDelaySeconds: minimumDelaySeconds ?? backup.triggerDelay,
+        requiresCharging: requireCharging ?? backup.requireCharging,
+      ),
+    );
+  }

  Future<void> disable() => _foregroundHostApi.disable();
 }
@@ -71,7 +69,7 @@ class BackgroundWorkerBgService extends BackgroundWorkerFlutterApi {
    BackgroundWorkerFlutterApi.setUp(this);
  }

-  bool get _isBackupEnabled => _ref?.read(appSettingsServiceProvider).getSetting(AppSettingsEnum.enableBackup) ?? false;
+  bool get _isBackupEnabled => MetadataRepository.instance.appConfig.backup.enabled;

  Future<void> init() async {
    try {
@@ -0,0 +1,87 @@
+import 'dart:async';
+
+import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
+import 'package:immich_mobile/infrastructure/repositories/local_asset.repository.dart';
+import 'package:immich_mobile/infrastructure/repositories/stack.repository.dart';
+import 'package:immich_mobile/platform/native_sync_api.g.dart';
+import 'package:immich_mobile/repositories/asset_api.repository.dart';
+import 'package:logging/logging.dart';
+
+/// Handles an edit that was reverted in Photos. The local was uploaded as an edit
+/// before but isn't edited now, so flip the stack primary back to the original (via
+/// prior_remote_id) and mark it handled so we don't re-upload the reverted render.
+/// Nothing is trashed; all the edits stay in the stack.
+class EditRevertService {
+  final NativeSyncApi _nativeSyncApi;
+  final DriftStackRepository _stackRepository;
+  final DriftLocalAssetRepository _localAssetRepository;
+  final AssetApiRepository _assetApiRepository;
+  final _log = Logger('EditRevertService');
+
+  EditRevertService({
+    required NativeSyncApi nativeSyncApi,
+    required DriftStackRepository stackRepository,
+    required DriftLocalAssetRepository localAssetRepository,
+    required AssetApiRepository assetApiRepository,
+  }) : _nativeSyncApi = nativeSyncApi,
+       _stackRepository = stackRepository,
+       _localAssetRepository = localAssetRepository,
+       _assetApiRepository = assetApiRepository;
+
+  /// Returns true if the asset was a revert and was handled (caller skips the
+  /// upload); false to fall through to the normal upload path.
+  Future<bool> tryHandleRevert(LocalAsset asset) async {
+    if (asset.priorRemoteId == null) {
+      return false;
+    }
+
+    // Only "not edited" is a revert. `edited` is a fresh edit, so let the pair flow
+    // take it. `unknown` means we couldn't read the adjustment (offloaded to iCloud,
+    // network off); bail there too instead of mistaking an unreadable edit for a
+    // revert and flipping the stack. Network off keeps this a cheap offline read.
+    try {
+      final editState = await _nativeSyncApi.getEditState(asset.id, allowNetworkAccess: false);
+      if (editState != EditState.notEdited) {
+        return false;
+      }
+    } catch (error, stack) {
+      _log.warning("edit-state probe failed for ${asset.id}", error, stack);
+      return false;
+    }
+
+    // It's a revert. Styled photos hit this path because iOS re-encodes the revert to
+    // fresh bytes, so it looks like a new backup candidate and reaches upload.
+    // Non-styled reverts hash back to the base instead, aren't candidates, and get
+    // flipped at hash time in HashService._reconcileReverts. Fresh bytes match nothing
+    // remote, so flip by structure: prior_remote_id is the current primary (the latest
+    // edit), flip it back to the base.
+    final String stackId;
+    final String baseId;
+    try {
+      final foundStack = await _stackRepository.findStackIdByRemoteId(asset.priorRemoteId!);
+      if (foundStack == null) {
+        return false;
+      }
+      final base = await _stackRepository.findStackBaseId(foundStack, excludeId: asset.priorRemoteId!);
+      if (base == null) {
+        return false;
+      }
+      stackId = foundStack;
+      baseId = base;
+    } catch (error, stack) {
+      _log.warning("revert stack lookup failed for ${asset.id}", error, stack);
+      return false;
+    }
+
+    try {
+      await _assetApiRepository.setStackPrimary(stackId, baseId);
+      await _stackRepository.setPrimary(stackId, baseId);
+      await _localAssetRepository.markSynced(asset.id, priorRemoteId: baseId, syncedChecksum: asset.checksum ?? '');
+    } catch (error, stack) {
+      _log.warning("revert primary flip failed for ${asset.id}", error, stack);
+      return false;
+    }
+
+    return true;
+  }
+}
@@ -5,8 +5,10 @@ import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
 import 'package:immich_mobile/extensions/platform_extensions.dart';
 import 'package:immich_mobile/infrastructure/repositories/local_album.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/local_asset.repository.dart';
+import 'package:immich_mobile/infrastructure/repositories/stack.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/trashed_local_asset.repository.dart';
 import 'package:immich_mobile/platform/native_sync_api.g.dart';
+import 'package:immich_mobile/repositories/asset_api.repository.dart';
 import 'package:logging/logging.dart';

 const String _kHashCancelledCode = "HASH_CANCELLED";
@@ -17,6 +19,8 @@ class HashService {
  final DriftLocalAssetRepository _localAssetRepository;
  final DriftTrashedLocalAssetRepository _trashedLocalAssetRepository;
  final NativeSyncApi _nativeSyncApi;
+  final DriftStackRepository _stackRepository;
+  final AssetApiRepository _assetApiRepository;
  final bool Function()? _cancelChecker;
  final _log = Logger('HashService');

@@ -25,6 +29,8 @@ class HashService {
    required DriftLocalAssetRepository localAssetRepository,
    required DriftTrashedLocalAssetRepository trashedLocalAssetRepository,
    required NativeSyncApi nativeSyncApi,
+    required DriftStackRepository stackRepository,
+    required AssetApiRepository assetApiRepository,
    bool Function()? cancelChecker,
    int? batchSize,
  }) : _localAlbumRepository = localAlbumRepository,
@@ -32,6 +38,8 @@ class HashService {
       _trashedLocalAssetRepository = trashedLocalAssetRepository,
       _cancelChecker = cancelChecker,
       _nativeSyncApi = nativeSyncApi,
+       _stackRepository = stackRepository,
+       _assetApiRepository = assetApiRepository,
       _batchSize = batchSize ?? kBatchHashFileLimit;

  bool get isCancelled => _cancelChecker?.call() ?? false;
@@ -45,6 +53,7 @@ class HashService {

      // Sorted by backupSelection followed by isCloud
      final localAlbums = await _localAlbumRepository.getBackupAlbums();
+      final hashedIds = <String>{};

      for (final album in localAlbums) {
        if (isCancelled) {
@@ -54,7 +63,7 @@ class HashService {

        final assetsToHash = await _localAlbumRepository.getAssetsToHash(album.id);
        if (assetsToHash.isNotEmpty) {
-          await _hashAssets(album, assetsToHash);
+          await _hashAssets(album, assetsToHash, hashedIds: hashedIds);
        }
      }
      if (CurrentPlatform.isAndroid && localAlbums.isNotEmpty) {
@@ -62,9 +71,18 @@ class HashService {
        final trashedToHash = await _trashedLocalAssetRepository.getAssetsToHash(backupAlbumIds);
        if (trashedToHash.isNotEmpty) {
          final pseudoAlbum = LocalAlbum(id: '-pseudoAlbum', name: 'Trash', updatedAt: DateTime.now());
-          await _hashAssets(pseudoAlbum, trashedToHash, isTrashed: true);
+          await _hashAssets(pseudoAlbum, trashedToHash, isTrashed: true, hashedIds: hashedIds);
        }
      }
+
+      // Revert reconcile for non-styled photos: the reverted edit hashes back to the
+      // original's exact bytes, which are already the stack base, so it's not a backup
+      // candidate and never reaches upload. Flip the primary here. Styled photos
+      // re-encode to fresh bytes and get flipped on the upload path instead
+      // (EditRevertService.tryHandleRevert).
+      if (CurrentPlatform.isIOS && hashedIds.isNotEmpty && !isCancelled) {
+        await _reconcileReverts(hashedIds);
+      }
    } on PlatformException catch (e) {
      if (e.code == _kHashCancelledCode) {
        _log.warning("Hashing cancelled by platform");
@@ -81,7 +99,12 @@ class HashService {
  /// Processes a list of [LocalAsset]s, storing their hash and updating the assets in the DB
  /// with hash for those that were successfully hashed. Hashes are looked up in a table
  /// [LocalAssetHashEntity] by local id. Only missing entries are newly hashed and added to the DB.
-  Future<void> _hashAssets(LocalAlbum album, List<LocalAsset> assetsToHash, {bool isTrashed = false}) async {
+  Future<void> _hashAssets(
+    LocalAlbum album,
+    List<LocalAsset> assetsToHash, {
+    bool isTrashed = false,
+    required Set<String> hashedIds,
+  }) async {
    final toHash = <String, LocalAsset>{};

    for (final asset in assetsToHash) {
@@ -92,16 +115,21 @@ class HashService {

      toHash[asset.id] = asset;
      if (toHash.length == _batchSize) {
-        await _processBatch(album, toHash, isTrashed);
+        await _processBatch(album, toHash, isTrashed, hashedIds);
        toHash.clear();
      }
    }

-    await _processBatch(album, toHash, isTrashed);
+    await _processBatch(album, toHash, isTrashed, hashedIds);
  }

  /// Processes a batch of assets.
-  Future<void> _processBatch(LocalAlbum album, Map<String, LocalAsset> toHash, bool isTrashed) async {
+  Future<void> _processBatch(
+    LocalAlbum album,
+    Map<String, LocalAsset> toHash,
+    bool isTrashed,
+    Set<String> hashedIds,
+  ) async {
    if (toHash.isEmpty) {
      return;
    }
@@ -141,5 +169,33 @@ class HashService {
    } else {
      await _localAssetRepository.updateHashes(hashed);
    }
+    hashedIds.addAll(hashed.keys);
+  }
+
+  Future<void> _reconcileReverts(Set<String> localIds) async {
+    final List<StackReconcileTarget> targets;
+    try {
+      targets = await _stackRepository.findRevertReconcileTargets(localIds);
+    } catch (error, stack) {
+      _log.warning("findRevertReconcileTargets failed", error, stack);
+      return;
+    }
+
+    for (final target in targets) {
+      try {
+        await _assetApiRepository.setStackPrimary(target.stackId, target.newPrimaryId);
+        await _stackRepository.setPrimary(target.stackId, target.newPrimaryId);
+        // Roll priorRemoteId forward to the matched member (now the primary) so a
+        // later edit stacks onto THAT (the current render), not the old edit.
+        await _localAssetRepository.markSynced(
+          target.localAssetId,
+          priorRemoteId: target.newPrimaryId,
+          syncedChecksum: target.localAssetChecksum,
+        );
+      } catch (error, stack) {
+        _log.warning("revert reconcile flip failed for stack ${target.stackId}", error, stack);
+        continue;
+      }
+    }
  }
 }
@@ -9,10 +9,10 @@ import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/extensions/platform_extensions.dart';
 import 'package:immich_mobile/infrastructure/repositories/local_album.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/local_asset.repository.dart';
-import 'package:immich_mobile/infrastructure/repositories/storage.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/trashed_local_asset.repository.dart';
 import 'package:immich_mobile/platform/native_sync_api.g.dart';
-import 'package:immich_mobile/repositories/local_files_manager.repository.dart';
+import 'package:immich_mobile/repositories/asset_media.repository.dart';
+import 'package:immich_mobile/repositories/permission.repository.dart';
 import 'package:immich_mobile/utils/datetime_helpers.dart';
 import 'package:immich_mobile/utils/diff.dart';
 import 'package:logging/logging.dart';
@@ -23,29 +23,29 @@ class LocalSyncService {
  final DriftLocalAssetRepository _localAssetRepository;
  final NativeSyncApi _nativeSyncApi;
  final DriftTrashedLocalAssetRepository _trashedLocalAssetRepository;
-  final LocalFilesManagerRepository _localFilesManager;
-  final StorageRepository _storageRepository;
+  final AssetMediaRepository _assetMediaRepository;
+  final IPermissionRepository _permissionRepository;
  final Logger _log = Logger("DeviceSyncService");

  LocalSyncService({
    required DriftLocalAlbumRepository localAlbumRepository,
    required DriftLocalAssetRepository localAssetRepository,
    required DriftTrashedLocalAssetRepository trashedLocalAssetRepository,
-    required LocalFilesManagerRepository localFilesManager,
-    required StorageRepository storageRepository,
+    required AssetMediaRepository assetMediaRepository,
+    required IPermissionRepository permissionRepository,
    required NativeSyncApi nativeSyncApi,
  }) : _localAlbumRepository = localAlbumRepository,
       _localAssetRepository = localAssetRepository,
       _trashedLocalAssetRepository = trashedLocalAssetRepository,
-       _localFilesManager = localFilesManager,
-       _storageRepository = storageRepository,
+       _assetMediaRepository = assetMediaRepository,
+       _permissionRepository = permissionRepository,
       _nativeSyncApi = nativeSyncApi;

  Future<void> sync({bool full = false}) async {
    final Stopwatch stopwatch = Stopwatch()..start();
    try {
      if (CurrentPlatform.isAndroid && Store.get(StoreKey.manageLocalMediaAndroid, false)) {
-        final hasPermission = await _localFilesManager.hasManageMediaPermission();
+        final hasPermission = await _permissionRepository.hasManageMediaPermission();
        if (hasPermission) {
          await _syncTrashedAssets();
        } else {
@@ -373,7 +373,7 @@ class LocalSyncService {

    final assetsToRestore = await _trashedLocalAssetRepository.getToRestore();
    if (assetsToRestore.isNotEmpty) {
-      final restoredIds = await _localFilesManager.restoreAssetsFromTrash(assetsToRestore);
+      final restoredIds = await _assetMediaRepository.restoreAssetsFromTrash(assetsToRestore);
      await _trashedLocalAssetRepository.applyRestoredAssets(restoredIds);
    } else {
      _log.info("syncTrashedAssets, No remote assets found for restoration");
@@ -381,15 +381,15 @@ class LocalSyncService {

    final localAssetsToTrash = await _trashedLocalAssetRepository.getToTrash();
    if (localAssetsToTrash.isNotEmpty) {
-      final mediaUrls = await Future.wait(
-        localAssetsToTrash.values
-            .expand((e) => e)
-            .map((localAsset) => _storageRepository.getAssetEntityForAsset(localAsset).then((e) => e?.getMediaUrl())),
-      );
-      _log.info("Moving to trash ${mediaUrls.join(", ")} assets");
-      final result = await _localFilesManager.moveToTrash(mediaUrls.nonNulls.toList());
-      if (result) {
-        await _trashedLocalAssetRepository.trashLocalAsset(localAssetsToTrash);
+      final localIds = localAssetsToTrash.values.expand((assets) => assets).map((asset) => asset.id).toList();
+      _log.info("Moving to trash ${localIds.join(", ")} assets");
+      final movedIds = await _assetMediaRepository.deleteAll(localIds);
+      if (movedIds.isNotEmpty) {
+        final movedAssetsByAlbum = localAssetsToTrash.map(
+          (albumId, assets) => MapEntry(albumId, assets.where((asset) => movedIds.contains(asset.id)).toList()),
+        )..removeWhere((_, assets) => assets.isEmpty);
+
+        await _trashedLocalAssetRepository.trashLocalAsset(movedAssetsByAlbum);
      }
    } else {
      _log.info("syncTrashedAssets, No assets found in backup-enabled albums for move to trash");
@@ -9,12 +9,47 @@ import 'package:immich_mobile/infrastructure/repositories/remote_album.repositor
 import 'package:immich_mobile/models/albums/album_search.model.dart';
 import 'package:immich_mobile/providers/album/album_sort_by_options.provider.dart';
 import 'package:immich_mobile/repositories/drift_album_api_repository.dart';
+import 'package:immich_mobile/services/foreground_upload.service.dart';
+import 'package:logging/logging.dart';
+
+/// Categorizes a heterogeneous asset selection into the candidates that can
+/// be added to an album immediately (already on the server) and the local-only
+/// candidates that must be uploaded first.
+class AlbumAssetCandidates {
+  final List<String> remoteAssetIds;
+  final List<LocalAsset> localAssetsToUpload;
+
+  const AlbumAssetCandidates({required this.remoteAssetIds, required this.localAssetsToUpload});
+}

 class RemoteAlbumService {
+  static final _logger = Logger('RemoteAlbumService');
+
  final DriftRemoteAlbumRepository _repository;
  final DriftAlbumApiRepository _albumApiRepository;
+  final ForegroundUploadService _uploadService;

-  const RemoteAlbumService(this._repository, this._albumApiRepository);
+  const RemoteAlbumService(this._repository, this._albumApiRepository, this._uploadService);
+
+  /// Categorizes a heterogeneous asset selection into already-on-server IDs
+  /// and local assets that still need to be uploaded.
+  static AlbumAssetCandidates categorizeCandidates(Iterable<BaseAsset> assets) {
+    final remoteIds = <String>[];
+    final localToUpload = <LocalAsset>[];
+    for (final asset in assets) {
+      if (asset is RemoteAsset) {
+        remoteIds.add(asset.id);
+      } else if (asset is LocalAsset) {
+        final remoteId = asset.remoteId;
+        if (remoteId != null) {
+          remoteIds.add(remoteId);
+        } else {
+          localToUpload.add(asset);
+        }
+      }
+    }
+    return AlbumAssetCandidates(remoteAssetIds: remoteIds, localAssetsToUpload: localToUpload);
+  }

  Stream<RemoteAlbum?> watchAlbum(String albumId) {
    return _repository.watchAlbum(albumId);
@@ -148,6 +183,122 @@ class RemoteAlbumService {
    return album.added.length;
  }

+  /// !TODO The name here is not clear as we have addAssets method above,
+  /// which is only add remote assets to album, for the next PR, we will allow
+  /// adding local assets from album from the timeline as well with this flow.
+  /// So saving that for the next refactor
+  Future<int> addAssetsToAlbum({
+    required String albumId,
+    required UserDto uploader,
+    required AlbumAssetCandidates candidates,
+    UploadCallbacks uploadCallbacks = const UploadCallbacks(),
+  }) async {
+    int addedCount = 0;
+    if (candidates.remoteAssetIds.isNotEmpty) {
+      addedCount += await addAssets(albumId: albumId, assetIds: candidates.remoteAssetIds);
+    }
+    if (candidates.localAssetsToUpload.isNotEmpty) {
+      addedCount += await _uploadAndAddLocals(albumId, uploader, candidates.localAssetsToUpload, uploadCallbacks);
+    }
+    return addedCount;
+  }
+
+  /// Creates an album, seeding it with already-remote asset IDs, then uploads
+  /// local-only assets and links each one as it finishes.
+  Future<RemoteAlbum> createAlbumWithAssets({
+    required String title,
+    required UserDto owner,
+    String? description,
+    AlbumAssetCandidates candidates = const AlbumAssetCandidates(remoteAssetIds: [], localAssetsToUpload: []),
+    UploadCallbacks uploadCallbacks = const UploadCallbacks(),
+  }) async {
+    final album = await createAlbum(
+      title: title,
+      owner: owner,
+      description: description,
+      assetIds: candidates.remoteAssetIds,
+    );
+    if (candidates.localAssetsToUpload.isNotEmpty) {
+      await _uploadAndAddLocals(album.id, owner, candidates.localAssetsToUpload, uploadCallbacks);
+    }
+    return album;
+  }
+
+  Future<int> _uploadAndAddLocals(
+    String albumId,
+    UserDto uploader,
+    List<LocalAsset> localAssets,
+    UploadCallbacks userCallbacks,
+  ) async {
+    int addedCount = 0;
+    final pendingAdds = <Future<void>>[];
+    final localById = {for (final a in localAssets) a.id: a};
+
+    final wrappedCallbacks = UploadCallbacks(
+      onProgress: (localId, filename, bytes, totalBytes) => _runUploadCallback(
+        'Upload progress callback failed for $localId',
+        () => userCallbacks.onProgress?.call(localId, filename, bytes, totalBytes),
+      ),
+      onICloudProgress: (localId, progress) => _runUploadCallback(
+        'iCloud progress callback failed for $localId',
+        () => userCallbacks.onICloudProgress?.call(localId, progress),
+      ),
+      onError: (localId, errorMessage) => _runUploadCallback(
+        'Upload error callback failed for $localId',
+        () => userCallbacks.onError?.call(localId, errorMessage),
+      ),
+      onSuccess: (localId, remoteId) {
+        _runUploadCallback(
+          'Upload success callback failed for $localId',
+          () => userCallbacks.onSuccess?.call(localId, remoteId),
+        );
+        final source = localById[localId];
+        if (source == null) {
+          _logger.warning('Upload success for $localId but source LocalAsset missing; skipping album link');
+          return;
+        }
+        pendingAdds.add(
+          _linkUploadedAssetToAlbum(albumId, remoteId, uploader, source)
+              .then<void>((added) {
+                addedCount += added;
+              })
+              .catchError((Object error, StackTrace stack) {
+                _logger.warning('Failed to add uploaded asset $remoteId to album $albumId', error, stack);
+              }),
+        );
+      },
+    );
+
+    await _uploadService.uploadManual(localAssets, callbacks: wrappedCallbacks);
+    await Future.wait(pendingAdds);
+    return addedCount;
+  }
+
+  void _runUploadCallback(String message, void Function() callback) {
+    try {
+      callback();
+    } catch (error, stack) {
+      _logger.warning(message, error, stack);
+    }
+  }
+
+  /// Links a freshly-uploaded asset to an album, ensuring the local DB
+  /// reflects the change without waiting for the next sync. We call the API
+  /// (server is the source of truth), then upsert a placeholder
+  /// `remote_asset_entity` row from the local source so the FK-protected
+  /// junction insert succeeds. Sync overwrites the placeholder later with
+  /// the authoritative server data.
+  Future<int> _linkUploadedAssetToAlbum(String albumId, String remoteId, UserDto uploader, LocalAsset source) async {
+    final result = await _albumApiRepository.addAssets(albumId, [remoteId]);
+    if (result.added.isEmpty) {
+      return 0;
+    }
+
+    await _repository.upsertRemoteAssetStub(remoteId: remoteId, ownerId: uploader.id, source: source);
+    await _repository.addAssets(albumId, result.added);
+    return result.added.length;
+  }
+
  Future<void> deleteAlbum(String albumId) async {
    await _albumApiRepository.deleteAlbum(albumId);

@@ -9,12 +9,12 @@ import 'package:immich_mobile/domain/models/sync_event.model.dart';
 import 'package:immich_mobile/entities/store.entity.dart';
 import 'package:immich_mobile/extensions/platform_extensions.dart';
 import 'package:immich_mobile/infrastructure/repositories/local_asset.repository.dart';
-import 'package:immich_mobile/infrastructure/repositories/storage.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_api.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_migration.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/sync_stream.repository.dart';
 import 'package:immich_mobile/infrastructure/repositories/trashed_local_asset.repository.dart';
-import 'package:immich_mobile/repositories/local_files_manager.repository.dart';
+import 'package:immich_mobile/repositories/asset_media.repository.dart';
+import 'package:immich_mobile/repositories/permission.repository.dart';
 import 'package:immich_mobile/services/api.service.dart';
 import 'package:immich_mobile/utils/semver.dart';
 import 'package:logging/logging.dart';
@@ -34,8 +34,8 @@ class SyncStreamService {
  final SyncStreamRepository _syncStreamRepository;
  final DriftLocalAssetRepository _localAssetRepository;
  final DriftTrashedLocalAssetRepository _trashedLocalAssetRepository;
-  final LocalFilesManagerRepository _localFilesManager;
-  final StorageRepository _storageRepository;
+  final AssetMediaRepository _assetMediaRepository;
+  final IPermissionRepository _permissionRepository;
  final SyncMigrationRepository _syncMigrationRepository;
  final ApiService _api;
  final bool Function()? _cancelChecker;
@@ -45,8 +45,8 @@ class SyncStreamService {
    required SyncStreamRepository syncStreamRepository,
    required DriftLocalAssetRepository localAssetRepository,
    required DriftTrashedLocalAssetRepository trashedLocalAssetRepository,
-    required LocalFilesManagerRepository localFilesManager,
-    required StorageRepository storageRepository,
+    required AssetMediaRepository assetMediaRepository,
+    required IPermissionRepository permissionRepository,
    required SyncMigrationRepository syncMigrationRepository,
    required ApiService api,
    bool Function()? cancelChecker,
@@ -54,8 +54,8 @@ class SyncStreamService {
       _syncStreamRepository = syncStreamRepository,
       _localAssetRepository = localAssetRepository,
       _trashedLocalAssetRepository = trashedLocalAssetRepository,
-       _localFilesManager = localFilesManager,
-       _storageRepository = storageRepository,
+       _assetMediaRepository = assetMediaRepository,
+       _permissionRepository = permissionRepository,
       _syncMigrationRepository = syncMigrationRepository,
       _api = api,
       _cancelChecker = cancelChecker;
@@ -500,22 +500,22 @@ class SyncStreamService {
  }

  Future<void> _trashLocalAssets(Map<String, List<LocalAsset>> localAssetsToTrash) async {
-    final mediaUrls = await Future.wait(
-      localAssetsToTrash.values
-          .expand((e) => e)
-          .map((localAsset) => _storageRepository.getAssetEntityForAsset(localAsset).then((e) => e?.getMediaUrl())),
-    );
-    _logger.info("Moving to trash ${mediaUrls.join(", ")} assets");
-    final result = await _localFilesManager.moveToTrash(mediaUrls.nonNulls.toList());
-    if (result) {
-      await _trashedLocalAssetRepository.trashLocalAsset(localAssetsToTrash);
+    final localIds = localAssetsToTrash.values.expand((assets) => assets).map((asset) => asset.id).toList();
+    _logger.info("Moving to trash ${localIds.join(", ")} assets");
+    final movedIds = await _assetMediaRepository.deleteAll(localIds);
+    if (movedIds.isNotEmpty) {
+      final movedAssetsByAlbum = localAssetsToTrash.map(
+        (albumId, assets) => MapEntry(albumId, assets.where((asset) => movedIds.contains(asset.id)).toList()),
+      )..removeWhere((_, assets) => assets.isEmpty);
+
+      await _trashedLocalAssetRepository.trashLocalAsset(movedAssetsByAlbum);
    }
  }

  Future<void> _applyRemoteRestoreToLocal() async {
    final assetsToRestore = await _trashedLocalAssetRepository.getToRestore();
    if (assetsToRestore.isNotEmpty) {
-      final restoredIds = await _localFilesManager.restoreAssetsFromTrash(assetsToRestore);
+      final restoredIds = await _assetMediaRepository.restoreAssetsFromTrash(assetsToRestore);
      await _trashedLocalAssetRepository.applyRestoredAssets(restoredIds);
    } else {
      _logger.info("No remote assets found for restoration");
@@ -523,7 +523,7 @@ class SyncStreamService {
  }

  Future<void> _syncAssetTrashStatus(List<String> remoteIds) async {
-    if (!(await _localFilesManager.hasManageMediaPermission())) {
+    if (!(await _permissionRepository.hasManageMediaPermission())) {
      _logger.warning("Syncing asset trash status cannot proceed because MANAGE_MEDIA permission is missing");
      return;
    }
@@ -533,7 +533,7 @@ class SyncStreamService {
  }

  Future<void> _syncAssetDeletion(List<String> remoteIds) async {
-    if (!(await _localFilesManager.hasManageMediaPermission())) {
+    if (!(await _permissionRepository.hasManageMediaPermission())) {
      _logger.warning("Syncing asset deletion cannot proceed because MANAGE_MEDIA permission is missing");
      return;
    }
@@ -0,0 +1,31 @@
+import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:immich_mobile/domain/models/tag.model.dart';
+import 'package:immich_mobile/infrastructure/repositories/tags_api.repository.dart';
+
+final tagServiceProvider = Provider<TagService>((ref) => TagService(ref.watch(tagsApiRepositoryProvider)));
+
+class TagService {
+  final TagsApiRepository _repository;
+
+  const TagService(this._repository);
+
+  Future<int> bulkTagAssets(List<String> assetIds, List<String> tagIds) async {
+    return _repository.bulkTagAssets(assetIds, tagIds);
+  }
+
+  Future<Set<Tag>> getAllTags() async {
+    final dtos = await _repository.getAllTags();
+    if (dtos == null) {
+      return {};
+    }
+    return dtos.map((dto) => Tag.fromDto(dto)).toSet();
+  }
+
+  Future<List<Tag>> upsertTags(List<String> tags) async {
+    final dtos = await _repository.upsertTags(tags);
+    if (dtos == null) {
+      return [];
+    }
+    return dtos.map((dto) => Tag.fromDto(dto)).toList();
+  }
+}
@@ -81,6 +81,10 @@ class BackgroundSyncManager {
    } on CanceledError {
      // Ignore cancellation errors
    }
+
+    // Stop the local-sync and hash slots too. The revert reconcile runs in the hash
+    // task and shouldn't outlive the session.
+    await cancelLocal();
  }

  Future<void> cancelLocal() async {
@@ -186,6 +190,22 @@ class BackgroundSyncManager {
        });
  }

+  /// Runs a remote sync guaranteed to observe changes up to now. [syncRemote]
+  /// joins an in-flight sync whose snapshot can pre-date a just-received change
+  /// (e.g. a stack update) and miss it, so wait for any in-flight sync to finish
+  /// first, then run a fresh one.
+  Future<void> runFreshRemoteSync() async {
+    final inflight = _syncTask;
+    if (inflight != null) {
+      try {
+        await inflight.future;
+      } catch (_) {
+        // The in-flight sync's outcome doesn't matter; we only need a fresh one after it.
+      }
+    }
+    await syncRemote();
+  }
+
  Future<void> syncWebsocketBatchV1(List<dynamic> batchData) {
    if (_syncWebsocketTask != null) {
      return _syncWebsocketTask!.future;
@@ -4,6 +4,8 @@ extension StringExtension on String {
  String capitalize() {
    return split(" ").map((str) => str.isEmpty ? str : str[0].toUpperCase() + str.substring(1)).join(" ");
  }
+
+  String? get nullIfEmpty => isEmpty ? null : this;
 }

 extension DurationExtension on String {
@@ -6,6 +6,7 @@ import 'package:immich_mobile/infrastructure/utils/drift_default.mixin.dart';

@TableIndex.sql('CREATE INDEX IF NOT EXISTS idx_local_asset_checksum ON local_asset_entity (checksum)')
@TableIndex.sql('CREATE INDEX IF NOT EXISTS idx_local_asset_cloud_id ON local_asset_entity (i_cloud_id)')
+@TableIndex.sql('CREATE INDEX IF NOT EXISTS idx_local_asset_prior_remote_id ON local_asset_entity (prior_remote_id)')
 class LocalAssetEntity extends Table with DriftDefaultsMixin, AssetEntityMixin {
  const LocalAssetEntity();

@@ -27,6 +28,14 @@ class LocalAssetEntity extends Table with DriftDefaultsMixin, AssetEntityMixin {

  IntColumn get playbackStyle => intEnum<AssetPlaybackStyle>().withDefault(const Constant(0))();

+  // remote id of the previous upload (iOS edit-pair stacking)
+  TextColumn get priorRemoteId => text().nullable()();
+
+  // local checksum at the last sync action. Lets the backup query skip a local
+  // whose current hash matches nothing remote but is still "handled": the iOS
+  // revert case, where the reverted render hashes fresh but is already reconciled.
+  TextColumn get syncedChecksum => text().nullable()();
+
  @override
  Set<Column> get primaryKey => {id};
 }
@@ -51,5 +60,7 @@ extension LocalAssetEntityDataDomainExtension on LocalAssetEntityData {
    longitude: longitude,
    cloudId: iCloudId,
    isEdited: false,
+    priorRemoteId: priorRemoteId,
+    syncedChecksum: syncedChecksum,
  );
 }
@@ -26,6 +26,8 @@ typedef $$LocalAssetEntityTableCreateCompanionBuilder =
      i0.Value<double?> latitude,
      i0.Value<double?> longitude,
      i0.Value<i2.AssetPlaybackStyle> playbackStyle,
+      i0.Value<String?> priorRemoteId,
+      i0.Value<String?> syncedChecksum,
    });
 typedef $$LocalAssetEntityTableUpdateCompanionBuilder =
    i1.LocalAssetEntityCompanion Function({
@@ -45,6 +47,8 @@ typedef $$LocalAssetEntityTableUpdateCompanionBuilder =
      i0.Value<double?> latitude,
      i0.Value<double?> longitude,
      i0.Value<i2.AssetPlaybackStyle> playbackStyle,
+      i0.Value<String?> priorRemoteId,
+      i0.Value<String?> syncedChecksum,
    });

 class $$LocalAssetEntityTableFilterComposer
@@ -141,6 +145,16 @@ class $$LocalAssetEntityTableFilterComposer
    column: $table.playbackStyle,
    builder: (column) => i0.ColumnWithTypeConverterFilters(column),
  );
+
+  i0.ColumnFilters<String> get priorRemoteId => $composableBuilder(
+    column: $table.priorRemoteId,
+    builder: (column) => i0.ColumnFilters(column),
+  );
+
+  i0.ColumnFilters<String> get syncedChecksum => $composableBuilder(
+    column: $table.syncedChecksum,
+    builder: (column) => i0.ColumnFilters(column),
+  );
 }

 class $$LocalAssetEntityTableOrderingComposer
@@ -231,6 +245,16 @@ class $$LocalAssetEntityTableOrderingComposer
    column: $table.playbackStyle,
    builder: (column) => i0.ColumnOrderings(column),
  );
+
+  i0.ColumnOrderings<String> get priorRemoteId => $composableBuilder(
+    column: $table.priorRemoteId,
+    builder: (column) => i0.ColumnOrderings(column),
+  );
+
+  i0.ColumnOrderings<String> get syncedChecksum => $composableBuilder(
+    column: $table.syncedChecksum,
+    builder: (column) => i0.ColumnOrderings(column),
+  );
 }

 class $$LocalAssetEntityTableAnnotationComposer
@@ -300,6 +324,16 @@ class $$LocalAssetEntityTableAnnotationComposer
    column: $table.playbackStyle,
    builder: (column) => column,
  );
+
+  i0.GeneratedColumn<String> get priorRemoteId => $composableBuilder(
+    column: $table.priorRemoteId,
+    builder: (column) => column,
+  );
+
+  i0.GeneratedColumn<String> get syncedChecksum => $composableBuilder(
+    column: $table.syncedChecksum,
+    builder: (column) => column,
+  );
 }

 class $$LocalAssetEntityTableTableManager
@@ -359,6 +393,8 @@ class $$LocalAssetEntityTableTableManager
                i0.Value<double?> longitude = const i0.Value.absent(),
                i0.Value<i2.AssetPlaybackStyle> playbackStyle =
                    const i0.Value.absent(),
+                i0.Value<String?> priorRemoteId = const i0.Value.absent(),
+                i0.Value<String?> syncedChecksum = const i0.Value.absent(),
              }) => i1.LocalAssetEntityCompanion(
                name: name,
                type: type,
@@ -376,6 +412,8 @@ class $$LocalAssetEntityTableTableManager
                latitude: latitude,
                longitude: longitude,
                playbackStyle: playbackStyle,
+                priorRemoteId: priorRemoteId,
+                syncedChecksum: syncedChecksum,
              ),
          createCompanionCallback:
              ({
@@ -396,6 +434,8 @@ class $$LocalAssetEntityTableTableManager
                i0.Value<double?> longitude = const i0.Value.absent(),
                i0.Value<i2.AssetPlaybackStyle> playbackStyle =
                    const i0.Value.absent(),
+                i0.Value<String?> priorRemoteId = const i0.Value.absent(),
+                i0.Value<String?> syncedChecksum = const i0.Value.absent(),
              }) => i1.LocalAssetEntityCompanion.insert(
                name: name,
                type: type,
@@ -413,6 +453,8 @@ class $$LocalAssetEntityTableTableManager
                latitude: latitude,
                longitude: longitude,
                playbackStyle: playbackStyle,
+                priorRemoteId: priorRemoteId,
+                syncedChecksum: syncedChecksum,
              ),
          withReferenceMapper: (p0) => p0
              .map((e) => (e.readTable(table), i0.BaseReferences(db, table, e)))
@@ -637,6 +679,28 @@ class $LocalAssetEntityTable extends i3.LocalAssetEntity
      ).withConverter<i2.AssetPlaybackStyle>(
        i1.$LocalAssetEntityTable.$converterplaybackStyle,
      );
+  static const i0.VerificationMeta _priorRemoteIdMeta =
+      const i0.VerificationMeta('priorRemoteId');
+  @override
+  late final i0.GeneratedColumn<String> priorRemoteId =
+      i0.GeneratedColumn<String>(
+        'prior_remote_id',
+        aliasedName,
+        true,
+        type: i0.DriftSqlType.string,
+        requiredDuringInsert: false,
+      );
+  static const i0.VerificationMeta _syncedChecksumMeta =
+      const i0.VerificationMeta('syncedChecksum');
+  @override
+  late final i0.GeneratedColumn<String> syncedChecksum =
+      i0.GeneratedColumn<String>(
+        'synced_checksum',
+        aliasedName,
+        true,
+        type: i0.DriftSqlType.string,
+        requiredDuringInsert: false,
+      );
  @override
  List<i0.GeneratedColumn> get $columns => [
    name,
@@ -655,6 +719,8 @@ class $LocalAssetEntityTable extends i3.LocalAssetEntity
    latitude,
    longitude,
    playbackStyle,
+    priorRemoteId,
+    syncedChecksum,
  ];
  @override
  String get aliasedName => _alias ?? actualTableName;
@@ -759,6 +825,24 @@ class $LocalAssetEntityTable extends i3.LocalAssetEntity
        longitude.isAcceptableOrUnknown(data['longitude']!, _longitudeMeta),
      );
    }
+    if (data.containsKey('prior_remote_id')) {
+      context.handle(
+        _priorRemoteIdMeta,
+        priorRemoteId.isAcceptableOrUnknown(
+          data['prior_remote_id']!,
+          _priorRemoteIdMeta,
+        ),
+      );
+    }
+    if (data.containsKey('synced_checksum')) {
+      context.handle(
+        _syncedChecksumMeta,
+        syncedChecksum.isAcceptableOrUnknown(
+          data['synced_checksum']!,
+          _syncedChecksumMeta,
+        ),
+      );
+    }
    return context;
  }

@@ -839,6 +923,14 @@ class $LocalAssetEntityTable extends i3.LocalAssetEntity
          data['${effectivePrefix}playback_style'],
        )!,
      ),
+      priorRemoteId: attachedDatabase.typeMapping.read(
+        i0.DriftSqlType.string,
+        data['${effectivePrefix}prior_remote_id'],
+      ),
+      syncedChecksum: attachedDatabase.typeMapping.read(
+        i0.DriftSqlType.string,
+        data['${effectivePrefix}synced_checksum'],
+      ),
    );
  }

@@ -877,6 +969,8 @@ class LocalAssetEntityData extends i0.DataClass
  final double? latitude;
  final double? longitude;
  final i2.AssetPlaybackStyle playbackStyle;
+  final String? priorRemoteId;
+  final String? syncedChecksum;
  const LocalAssetEntityData({
    required this.name,
    required this.type,
@@ -894,6 +988,8 @@ class LocalAssetEntityData extends i0.DataClass
    this.latitude,
    this.longitude,
    required this.playbackStyle,
+    this.priorRemoteId,
+    this.syncedChecksum,
  });
  @override
  Map<String, i0.Expression> toColumns(bool nullToAbsent) {
@@ -938,6 +1034,12 @@ class LocalAssetEntityData extends i0.DataClass
        i1.$LocalAssetEntityTable.$converterplaybackStyle.toSql(playbackStyle),
      );
    }
+    if (!nullToAbsent || priorRemoteId != null) {
+      map['prior_remote_id'] = i0.Variable<String>(priorRemoteId);
+    }
+    if (!nullToAbsent || syncedChecksum != null) {
+      map['synced_checksum'] = i0.Variable<String>(syncedChecksum);
+    }
    return map;
  }

@@ -967,6 +1069,8 @@ class LocalAssetEntityData extends i0.DataClass
      playbackStyle: i1.$LocalAssetEntityTable.$converterplaybackStyle.fromJson(
        serializer.fromJson<int>(json['playbackStyle']),
      ),
+      priorRemoteId: serializer.fromJson<String?>(json['priorRemoteId']),
+      syncedChecksum: serializer.fromJson<String?>(json['syncedChecksum']),
    );
  }
  @override
@@ -993,6 +1097,8 @@ class LocalAssetEntityData extends i0.DataClass
      'playbackStyle': serializer.toJson<int>(
        i1.$LocalAssetEntityTable.$converterplaybackStyle.toJson(playbackStyle),
      ),
+      'priorRemoteId': serializer.toJson<String?>(priorRemoteId),
+      'syncedChecksum': serializer.toJson<String?>(syncedChecksum),
    };
  }

@@ -1013,6 +1119,8 @@ class LocalAssetEntityData extends i0.DataClass
    i0.Value<double?> latitude = const i0.Value.absent(),
    i0.Value<double?> longitude = const i0.Value.absent(),
    i2.AssetPlaybackStyle? playbackStyle,
+    i0.Value<String?> priorRemoteId = const i0.Value.absent(),
+    i0.Value<String?> syncedChecksum = const i0.Value.absent(),
  }) => i1.LocalAssetEntityData(
    name: name ?? this.name,
    type: type ?? this.type,
@@ -1032,6 +1140,12 @@ class LocalAssetEntityData extends i0.DataClass
    latitude: latitude.present ? latitude.value : this.latitude,
    longitude: longitude.present ? longitude.value : this.longitude,
    playbackStyle: playbackStyle ?? this.playbackStyle,
+    priorRemoteId: priorRemoteId.present
+        ? priorRemoteId.value
+        : this.priorRemoteId,
+    syncedChecksum: syncedChecksum.present
+        ? syncedChecksum.value
+        : this.syncedChecksum,
  );
  LocalAssetEntityData copyWithCompanion(i1.LocalAssetEntityCompanion data) {
    return LocalAssetEntityData(
@@ -1061,6 +1175,12 @@ class LocalAssetEntityData extends i0.DataClass
      playbackStyle: data.playbackStyle.present
          ? data.playbackStyle.value
          : this.playbackStyle,
+      priorRemoteId: data.priorRemoteId.present
+          ? data.priorRemoteId.value
+          : this.priorRemoteId,
+      syncedChecksum: data.syncedChecksum.present
+          ? data.syncedChecksum.value
+          : this.syncedChecksum,
    );
  }

@@ -1082,7 +1202,9 @@ class LocalAssetEntityData extends i0.DataClass
          ..write('adjustmentTime: $adjustmentTime, ')
          ..write('latitude: $latitude, ')
          ..write('longitude: $longitude, ')
-          ..write('playbackStyle: $playbackStyle')
+          ..write('playbackStyle: $playbackStyle, ')
+          ..write('priorRemoteId: $priorRemoteId, ')
+          ..write('syncedChecksum: $syncedChecksum')
          ..write(')'))
        .toString();
  }
@@ -1105,6 +1227,8 @@ class LocalAssetEntityData extends i0.DataClass
    latitude,
    longitude,
    playbackStyle,
+    priorRemoteId,
+    syncedChecksum,
  );
  @override
  bool operator ==(Object other) =>
@@ -1125,7 +1249,9 @@ class LocalAssetEntityData extends i0.DataClass
          other.adjustmentTime == this.adjustmentTime &&
          other.latitude == this.latitude &&
          other.longitude == this.longitude &&
-          other.playbackStyle == this.playbackStyle);
+          other.playbackStyle == this.playbackStyle &&
+          other.priorRemoteId == this.priorRemoteId &&
+          other.syncedChecksum == this.syncedChecksum);
 }

 class LocalAssetEntityCompanion
@@ -1146,6 +1272,8 @@ class LocalAssetEntityCompanion
  final i0.Value<double?> latitude;
  final i0.Value<double?> longitude;
  final i0.Value<i2.AssetPlaybackStyle> playbackStyle;
+  final i0.Value<String?> priorRemoteId;
+  final i0.Value<String?> syncedChecksum;
  const LocalAssetEntityCompanion({
    this.name = const i0.Value.absent(),
    this.type = const i0.Value.absent(),
@@ -1163,6 +1291,8 @@ class LocalAssetEntityCompanion
    this.latitude = const i0.Value.absent(),
    this.longitude = const i0.Value.absent(),
    this.playbackStyle = const i0.Value.absent(),
+    this.priorRemoteId = const i0.Value.absent(),
+    this.syncedChecksum = const i0.Value.absent(),
  });
  LocalAssetEntityCompanion.insert({
    required String name,
@@ -1181,6 +1311,8 @@ class LocalAssetEntityCompanion
    this.latitude = const i0.Value.absent(),
    this.longitude = const i0.Value.absent(),
    this.playbackStyle = const i0.Value.absent(),
+    this.priorRemoteId = const i0.Value.absent(),
+    this.syncedChecksum = const i0.Value.absent(),
  }) : name = i0.Value(name),
       type = i0.Value(type),
       id = i0.Value(id);
@@ -1201,6 +1333,8 @@ class LocalAssetEntityCompanion
    i0.Expression<double>? latitude,
    i0.Expression<double>? longitude,
    i0.Expression<int>? playbackStyle,
+    i0.Expression<String>? priorRemoteId,
+    i0.Expression<String>? syncedChecksum,
  }) {
    return i0.RawValuesInsertable({
      if (name != null) 'name': name,
@@ -1219,6 +1353,8 @@ class LocalAssetEntityCompanion
      if (latitude != null) 'latitude': latitude,
      if (longitude != null) 'longitude': longitude,
      if (playbackStyle != null) 'playback_style': playbackStyle,
+      if (priorRemoteId != null) 'prior_remote_id': priorRemoteId,
+      if (syncedChecksum != null) 'synced_checksum': syncedChecksum,
    });
  }

@@ -1239,6 +1375,8 @@ class LocalAssetEntityCompanion
    i0.Value<double?>? latitude,
    i0.Value<double?>? longitude,
    i0.Value<i2.AssetPlaybackStyle>? playbackStyle,
+    i0.Value<String?>? priorRemoteId,
+    i0.Value<String?>? syncedChecksum,
  }) {
    return i1.LocalAssetEntityCompanion(
      name: name ?? this.name,
@@ -1257,6 +1395,8 @@ class LocalAssetEntityCompanion
      latitude: latitude ?? this.latitude,
      longitude: longitude ?? this.longitude,
      playbackStyle: playbackStyle ?? this.playbackStyle,
+      priorRemoteId: priorRemoteId ?? this.priorRemoteId,
+      syncedChecksum: syncedChecksum ?? this.syncedChecksum,
    );
  }

@@ -1317,6 +1457,12 @@ class LocalAssetEntityCompanion
        ),
      );
    }
+    if (priorRemoteId.present) {
+      map['prior_remote_id'] = i0.Variable<String>(priorRemoteId.value);
+    }
+    if (syncedChecksum.present) {
+      map['synced_checksum'] = i0.Variable<String>(syncedChecksum.value);
+    }
    return map;
  }

@@ -1338,7 +1484,9 @@ class LocalAssetEntityCompanion
          ..write('adjustmentTime: $adjustmentTime, ')
          ..write('latitude: $latitude, ')
          ..write('longitude: $longitude, ')
-          ..write('playbackStyle: $playbackStyle')
+          ..write('playbackStyle: $playbackStyle, ')
+          ..write('priorRemoteId: $priorRemoteId, ')
+          ..write('syncedChecksum: $syncedChecksum')
          ..write(')'))
        .toString();
  }
@@ -1348,3 +1496,7 @@ i0.Index get idxLocalAssetCloudId => i0.Index(
  'idx_local_asset_cloud_id',
  'CREATE INDEX IF NOT EXISTS idx_local_asset_cloud_id ON local_asset_entity (i_cloud_id)',
 );
+i0.Index get idxLocalAssetPriorRemoteId => i0.Index(
+  'idx_local_asset_prior_remote_id',
+  'CREATE INDEX IF NOT EXISTS idx_local_asset_prior_remote_id ON local_asset_entity (prior_remote_id)',
+);
@@ -7,7 +7,13 @@ import 'local_album_asset.entity.dart';
 mergedAsset:
 SELECT
 	rae.id as remote_id,
-	(SELECT lae.id FROM local_asset_entity lae WHERE lae.checksum = rae.checksum LIMIT 1) as local_id,
+	-- local_id links a remote to its on-device copy, normally by checksum. A reverted iOS
+	-- edit re-encodes to fresh bytes so the checksum no longer matches, but its
+	-- prior_remote_id still points at this remote, so fall back to that.
+	COALESCE(
+		(SELECT lae.id FROM local_asset_entity lae WHERE lae.checksum = rae.checksum LIMIT 1),
+		(SELECT lae.id FROM local_asset_entity lae WHERE lae.prior_remote_id = rae.id LIMIT 1)
+	) as local_id,
 	rae.name,
 	rae."type",
 	rae.created_at as created_at,
@@ -83,6 +89,13 @@ AND NOT EXISTS (
    INNER JOIN local_album_entity la on laa.album_id = la.id
    WHERE laa.asset_id = lae.id AND la.backup_selection = 2 -- excluded
 )
+-- iOS edit-in-progress / revert: if this local was already uploaded (its
+-- prior_remote_id resolves to a live remote), hide the local tile so the remote
+-- (the edit, or the flipped-back original) is the single source of truth. Kills
+-- the transient 2-tile flicker and stops a reverted local from re-appearing.
+AND NOT EXISTS (
+	SELECT 1 FROM remote_asset_entity rae WHERE rae.id = lae.prior_remote_id AND rae.owner_id IN :user_ids AND rae.deleted_at IS NULL
+)
 ORDER BY created_at DESC
 LIMIT $limit;

@@ -136,6 +149,10 @@ FROM
 		INNER JOIN local_album_entity la on laa.album_id = la.id
 		WHERE laa.asset_id = lae.id AND la.backup_selection = 2 -- excluded
 	)
+	-- iOS edit-in-progress / revert: hide a local already represented by a live remote.
+	AND NOT EXISTS (
+		SELECT 1 FROM remote_asset_entity rae WHERE rae.id = lae.prior_remote_id AND rae.owner_id IN :user_ids AND rae.deleted_at IS NULL
+	)
 )
 GROUP BY bucket_date
 ORDER BY bucket_date DESC;
@@ -29,7 +29,7 @@ class MergedAssetDrift extends i1.ModularAccessor {
    );
    $arrayStartIndex += generatedlimit.amountOfVariables;
    return customSelect(
-      'SELECT rae.id AS remote_id, (SELECT lae.id FROM local_asset_entity AS lae WHERE lae.checksum = rae.checksum LIMIT 1) AS local_id, rae.name, rae.type, rae.created_at AS created_at, rae.updated_at, rae.width, rae.height, rae.duration_ms, rae.is_favorite, rae.thumb_hash, rae.checksum, rae.owner_id, rae.live_photo_video_id, 0 AS orientation, rae.stack_id, NULL AS i_cloud_id, NULL AS latitude, NULL AS longitude, NULL AS adjustmentTime, rae.is_edited, 0 AS playback_style, rae.uploaded_at FROM remote_asset_entity AS rae LEFT JOIN stack_entity AS se ON rae.stack_id = se.id WHERE rae.deleted_at IS NULL AND rae.visibility = 0 AND rae.owner_id IN ($expandeduserIds) AND(rae.stack_id IS NULL OR rae.id = se.primary_asset_id)UNION ALL SELECT NULL AS remote_id, lae.id AS local_id, lae.name, lae.type, lae.created_at AS created_at, lae.updated_at, lae.width, lae.height, lae.duration_ms, lae.is_favorite, NULL AS thumb_hash, lae.checksum, NULL AS owner_id, NULL AS live_photo_video_id, lae.orientation, NULL AS stack_id, lae.i_cloud_id, lae.latitude, lae.longitude, lae.adjustment_time, 0 AS is_edited, lae.playback_style, NULL AS uploaded_at FROM local_asset_entity AS lae WHERE NOT EXISTS (SELECT 1 FROM remote_asset_entity AS rae WHERE rae.checksum = lae.checksum AND rae.owner_id IN ($expandeduserIds)) AND EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 0) AND NOT EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 2) ORDER BY created_at DESC ${generatedlimit.sql}',
+      'SELECT rae.id AS remote_id, COALESCE((SELECT lae.id FROM local_asset_entity AS lae WHERE lae.checksum = rae.checksum LIMIT 1), (SELECT lae.id FROM local_asset_entity AS lae WHERE lae.prior_remote_id = rae.id LIMIT 1)) AS local_id, rae.name, rae.type, rae.created_at AS created_at, rae.updated_at, rae.width, rae.height, rae.duration_ms, rae.is_favorite, rae.thumb_hash, rae.checksum, rae.owner_id, rae.live_photo_video_id, 0 AS orientation, rae.stack_id, NULL AS i_cloud_id, NULL AS latitude, NULL AS longitude, NULL AS adjustmentTime, rae.is_edited, 0 AS playback_style, rae.uploaded_at FROM remote_asset_entity AS rae LEFT JOIN stack_entity AS se ON rae.stack_id = se.id WHERE rae.deleted_at IS NULL AND rae.visibility = 0 AND rae.owner_id IN ($expandeduserIds) AND(rae.stack_id IS NULL OR rae.id = se.primary_asset_id)UNION ALL SELECT NULL AS remote_id, lae.id AS local_id, lae.name, lae.type, lae.created_at AS created_at, lae.updated_at, lae.width, lae.height, lae.duration_ms, lae.is_favorite, NULL AS thumb_hash, lae.checksum, NULL AS owner_id, NULL AS live_photo_video_id, lae.orientation, NULL AS stack_id, lae.i_cloud_id, lae.latitude, lae.longitude, lae.adjustment_time, 0 AS is_edited, lae.playback_style, NULL AS uploaded_at FROM local_asset_entity AS lae WHERE NOT EXISTS (SELECT 1 FROM remote_asset_entity AS rae WHERE rae.checksum = lae.checksum AND rae.owner_id IN ($expandeduserIds)) AND EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 0) AND NOT EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 2) AND NOT EXISTS (SELECT 1 FROM remote_asset_entity AS rae WHERE rae.id = lae.prior_remote_id AND rae.owner_id IN ($expandeduserIds) AND rae.deleted_at IS NULL) ORDER BY created_at DESC ${generatedlimit.sql}',
      variables: [
        for (var $ in userIds) i0.Variable<String>($),
        ...generatedlimit.introducedVariables,
@@ -81,7 +81,7 @@ class MergedAssetDrift extends i1.ModularAccessor {
    final expandeduserIds = $expandVar($arrayStartIndex, userIds.length);
    $arrayStartIndex += userIds.length;
    return customSelect(
-      'SELECT COUNT(*) AS asset_count, bucket_date FROM (SELECT CASE WHEN ?1 = 0 THEN COALESCE(STRFTIME(\'%Y-%m-%d\', rae.local_date_time), STRFTIME(\'%Y-%m-%d\', rae.created_at, \'localtime\')) WHEN ?1 = 1 THEN COALESCE(STRFTIME(\'%Y-%m\', rae.local_date_time), STRFTIME(\'%Y-%m\', rae.created_at, \'localtime\')) END AS bucket_date FROM remote_asset_entity AS rae LEFT JOIN stack_entity AS se ON rae.stack_id = se.id WHERE rae.deleted_at IS NULL AND rae.visibility = 0 AND rae.owner_id IN ($expandeduserIds) AND(rae.stack_id IS NULL OR rae.id = se.primary_asset_id)UNION ALL SELECT CASE WHEN ?1 = 0 THEN STRFTIME(\'%Y-%m-%d\', lae.created_at, \'localtime\') WHEN ?1 = 1 THEN STRFTIME(\'%Y-%m\', lae.created_at, \'localtime\') END AS bucket_date FROM local_asset_entity AS lae WHERE NOT EXISTS (SELECT 1 FROM remote_asset_entity AS rae WHERE rae.checksum = lae.checksum AND rae.owner_id IN ($expandeduserIds)) AND EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 0) AND NOT EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 2)) GROUP BY bucket_date ORDER BY bucket_date DESC',
+      'SELECT COUNT(*) AS asset_count, bucket_date FROM (SELECT CASE WHEN ?1 = 0 THEN COALESCE(STRFTIME(\'%Y-%m-%d\', rae.local_date_time), STRFTIME(\'%Y-%m-%d\', rae.created_at, \'localtime\')) WHEN ?1 = 1 THEN COALESCE(STRFTIME(\'%Y-%m\', rae.local_date_time), STRFTIME(\'%Y-%m\', rae.created_at, \'localtime\')) END AS bucket_date FROM remote_asset_entity AS rae LEFT JOIN stack_entity AS se ON rae.stack_id = se.id WHERE rae.deleted_at IS NULL AND rae.visibility = 0 AND rae.owner_id IN ($expandeduserIds) AND(rae.stack_id IS NULL OR rae.id = se.primary_asset_id)UNION ALL SELECT CASE WHEN ?1 = 0 THEN STRFTIME(\'%Y-%m-%d\', lae.created_at, \'localtime\') WHEN ?1 = 1 THEN STRFTIME(\'%Y-%m\', lae.created_at, \'localtime\') END AS bucket_date FROM local_asset_entity AS lae WHERE NOT EXISTS (SELECT 1 FROM remote_asset_entity AS rae WHERE rae.checksum = lae.checksum AND rae.owner_id IN ($expandeduserIds)) AND EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 0) AND NOT EXISTS (SELECT 1 FROM local_album_asset_entity AS laa INNER JOIN local_album_entity AS la ON laa.album_id = la.id WHERE laa.asset_id = lae.id AND la.backup_selection = 2) AND NOT EXISTS (SELECT 1 FROM remote_asset_entity AS rae WHERE rae.id = lae.prior_remote_id AND rae.owner_id IN ($expandeduserIds) AND rae.deleted_at IS NULL)) GROUP BY bucket_date ORDER BY bucket_date DESC',
      variables: [
        i0.Variable<int>(groupBy),
        for (var $ in userIds) i0.Variable<String>($),
@@ -74,5 +74,6 @@ extension RemoteAssetEntityDataDomainEx on RemoteAssetEntityData {
    localId: localId,
    stackId: stackId,
    isEdited: isEdited,
+    deletedAt: deletedAt,
  );
 }
@@ -58,7 +58,8 @@ class DriftBackupRepository extends DriftDatabaseRepository {
            INNER JOIN main.local_album_entity la on laa.album_id = la.id
            WHERE laa.asset_id = lae.id
                AND la.backup_selection = ?3
-        );
+        )
+        AND (lae.synced_checksum IS NULL OR lae.synced_checksum != lae.checksum);
      ''';

    final row = await _db
@@ -104,6 +105,10 @@ class DriftBackupRepository extends DriftDatabaseRepository {
                  _db.remoteAssetEntity.checksum.equalsExp(lae.checksum) & _db.remoteAssetEntity.ownerId.equals(userId),
                ),
            ) &
+            // iOS revert: a reverted local hashes fresh (matches nothing remote),
+            // but if it was already reconciled (syncedChecksum == current checksum)
+            // it's handled, so don't re-queue it as a fresh upload.
+            (lae.syncedChecksum.isNull() | lae.syncedChecksum.equalsExp(lae.checksum).not()) &
            lae.id.isNotInQuery(_getExcludedSubquery()),
      )
      ..orderBy([(localAsset) => OrderingTerm.desc(localAsset.createdAt)]);
@@ -98,7 +98,7 @@ class Drift extends $Drift {
  }

  @override
-  int get schemaVersion => 26;
+  int get schemaVersion => 27;

  @override
  MigrationStrategy get migration => MigrationStrategy(
@@ -276,6 +276,11 @@ class Drift extends $Drift {
          from25To26: (m, v26) async {
            await m.addColumn(v26.remoteAssetEntity, v26.remoteAssetEntity.uploadedAt);
          },
+          from26To27: (m, v27) async {
+            await m.addColumn(v27.localAssetEntity, v27.localAssetEntity.priorRemoteId);
+            await m.addColumn(v27.localAssetEntity, v27.localAssetEntity.syncedChecksum);
+            await m.createIndex(v27.idxLocalAssetPriorRemoteId);
+          },
        ),
      );

@@ -112,6 +112,7 @@ abstract class $Drift extends i0.GeneratedDatabase {
    i7.idxLocalAlbumAssetAlbumAsset,
    i4.idxLocalAssetChecksum,
    i4.idxLocalAssetCloudId,
+    i4.idxLocalAssetPriorRemoteId,
    i3.idxStackPrimaryAssetId,
    i2.uQRemoteAssetsOwnerChecksum,
    i2.uQRemoteAssetsOwnerLibraryChecksum,
@@ -13539,6 +13539,613 @@ i1.GeneratedColumn<String> _column_212(String aliasedName) =>
      type: i1.DriftSqlType.string,
      $customConstraints: 'NULL',
    );
+
+final class Schema27 extends i0.VersionedSchema {
+  Schema27({required super.database}) : super(version: 27);
+  @override
+  late final List<i1.DatabaseSchemaEntity> entities = [
+    userEntity,
+    remoteAssetEntity,
+    stackEntity,
+    localAssetEntity,
+    remoteAlbumEntity,
+    localAlbumEntity,
+    localAlbumAssetEntity,
+    idxLocalAlbumAssetAlbumAsset,
+    idxLocalAssetChecksum,
+    idxLocalAssetCloudId,
+    idxLocalAssetPriorRemoteId,
+    idxStackPrimaryAssetId,
+    uQRemoteAssetsOwnerChecksum,
+    uQRemoteAssetsOwnerLibraryChecksum,
+    idxRemoteAssetChecksum,
+    idxRemoteAssetStackId,
+    idxRemoteAssetOwnerVisibilityDeletedCreated,
+    authUserEntity,
+    userMetadataEntity,
+    partnerEntity,
+    remoteExifEntity,
+    remoteAlbumAssetEntity,
+    remoteAlbumUserEntity,
+    remoteAssetCloudIdEntity,
+    memoryEntity,
+    memoryAssetEntity,
+    personEntity,
+    assetFaceEntity,
+    storeEntity,
+    trashedLocalAssetEntity,
+    assetEditEntity,
+    metadata,
+    idxPartnerSharedWithId,
+    idxLatLng,
+    idxRemoteExifCity,
+    idxRemoteAlbumAssetAlbumAsset,
+    idxRemoteAssetCloudId,
+    idxPersonOwnerId,
+    idxAssetFacePersonId,
+    idxAssetFaceAssetId,
+    idxAssetFaceVisiblePerson,
+    idxTrashedLocalAssetChecksum,
+    idxTrashedLocalAssetAlbum,
+    idxAssetEditAssetId,
+  ];
+  late final Shape33 userEntity = Shape33(
+    source: i0.VersionedTable(
+      entityName: 'user_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_108,
+        _column_109,
+        _column_110,
+        _column_111,
+        _column_112,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape50 remoteAssetEntity = Shape50(
+    source: i0.VersionedTable(
+      entityName: 'remote_asset_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_108,
+        _column_113,
+        _column_114,
+        _column_115,
+        _column_116,
+        _column_117,
+        _column_118,
+        _column_107,
+        _column_119,
+        _column_120,
+        _column_121,
+        _column_122,
+        _column_123,
+        _column_124,
+        _column_212,
+        _column_125,
+        _column_126,
+        _column_127,
+        _column_128,
+        _column_129,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape35 stackEntity = Shape35(
+    source: i0.VersionedTable(
+      entityName: 'stack_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_114,
+        _column_115,
+        _column_121,
+        _column_130,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape51 localAssetEntity = Shape51(
+    source: i0.VersionedTable(
+      entityName: 'local_asset_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_108,
+        _column_113,
+        _column_114,
+        _column_115,
+        _column_116,
+        _column_117,
+        _column_118,
+        _column_107,
+        _column_131,
+        _column_120,
+        _column_132,
+        _column_133,
+        _column_134,
+        _column_135,
+        _column_136,
+        _column_137,
+        _column_213,
+        _column_214,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape48 remoteAlbumEntity = Shape48(
+    source: i0.VersionedTable(
+      entityName: 'remote_album_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_108,
+        _column_138,
+        _column_114,
+        _column_115,
+        _column_139,
+        _column_140,
+        _column_141,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape38 localAlbumEntity = Shape38(
+    source: i0.VersionedTable(
+      entityName: 'local_album_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_108,
+        _column_115,
+        _column_142,
+        _column_143,
+        _column_144,
+        _column_145,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape39 localAlbumAssetEntity = Shape39(
+    source: i0.VersionedTable(
+      entityName: 'local_album_asset_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(asset_id, album_id)'],
+      columns: [_column_146, _column_147, _column_145],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  final i1.Index idxLocalAlbumAssetAlbumAsset = i1.Index(
+    'idx_local_album_asset_album_asset',
+    'CREATE INDEX IF NOT EXISTS idx_local_album_asset_album_asset ON local_album_asset_entity (album_id, asset_id)',
+  );
+  final i1.Index idxLocalAssetChecksum = i1.Index(
+    'idx_local_asset_checksum',
+    'CREATE INDEX IF NOT EXISTS idx_local_asset_checksum ON local_asset_entity (checksum)',
+  );
+  final i1.Index idxLocalAssetCloudId = i1.Index(
+    'idx_local_asset_cloud_id',
+    'CREATE INDEX IF NOT EXISTS idx_local_asset_cloud_id ON local_asset_entity (i_cloud_id)',
+  );
+  final i1.Index idxLocalAssetPriorRemoteId = i1.Index(
+    'idx_local_asset_prior_remote_id',
+    'CREATE INDEX IF NOT EXISTS idx_local_asset_prior_remote_id ON local_asset_entity (prior_remote_id)',
+  );
+  final i1.Index idxStackPrimaryAssetId = i1.Index(
+    'idx_stack_primary_asset_id',
+    'CREATE INDEX IF NOT EXISTS idx_stack_primary_asset_id ON stack_entity (primary_asset_id)',
+  );
+  final i1.Index uQRemoteAssetsOwnerChecksum = i1.Index(
+    'UQ_remote_assets_owner_checksum',
+    'CREATE UNIQUE INDEX IF NOT EXISTS UQ_remote_assets_owner_checksum ON remote_asset_entity (owner_id, checksum) WHERE(library_id IS NULL)',
+  );
+  final i1.Index uQRemoteAssetsOwnerLibraryChecksum = i1.Index(
+    'UQ_remote_assets_owner_library_checksum',
+    'CREATE UNIQUE INDEX IF NOT EXISTS UQ_remote_assets_owner_library_checksum ON remote_asset_entity (owner_id, library_id, checksum) WHERE(library_id IS NOT NULL)',
+  );
+  final i1.Index idxRemoteAssetChecksum = i1.Index(
+    'idx_remote_asset_checksum',
+    'CREATE INDEX IF NOT EXISTS idx_remote_asset_checksum ON remote_asset_entity (checksum)',
+  );
+  final i1.Index idxRemoteAssetStackId = i1.Index(
+    'idx_remote_asset_stack_id',
+    'CREATE INDEX IF NOT EXISTS idx_remote_asset_stack_id ON remote_asset_entity (stack_id)',
+  );
+  final i1.Index idxRemoteAssetOwnerVisibilityDeletedCreated = i1.Index(
+    'idx_remote_asset_owner_visibility_deleted_created',
+    'CREATE INDEX IF NOT EXISTS idx_remote_asset_owner_visibility_deleted_created ON remote_asset_entity (owner_id, visibility, deleted_at, created_at DESC)',
+  );
+  late final Shape40 authUserEntity = Shape40(
+    source: i0.VersionedTable(
+      entityName: 'auth_user_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_108,
+        _column_109,
+        _column_148,
+        _column_110,
+        _column_111,
+        _column_149,
+        _column_150,
+        _column_151,
+        _column_152,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape4 userMetadataEntity = Shape4(
+    source: i0.VersionedTable(
+      entityName: 'user_metadata_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(user_id, "key")'],
+      columns: [_column_153, _column_154, _column_155],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape41 partnerEntity = Shape41(
+    source: i0.VersionedTable(
+      entityName: 'partner_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(shared_by_id, shared_with_id)'],
+      columns: [_column_156, _column_157, _column_158],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape42 remoteExifEntity = Shape42(
+    source: i0.VersionedTable(
+      entityName: 'remote_exif_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(asset_id)'],
+      columns: [
+        _column_159,
+        _column_160,
+        _column_161,
+        _column_162,
+        _column_163,
+        _column_164,
+        _column_117,
+        _column_116,
+        _column_165,
+        _column_166,
+        _column_167,
+        _column_168,
+        _column_135,
+        _column_136,
+        _column_169,
+        _column_170,
+        _column_171,
+        _column_172,
+        _column_173,
+        _column_174,
+        _column_175,
+        _column_176,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape7 remoteAlbumAssetEntity = Shape7(
+    source: i0.VersionedTable(
+      entityName: 'remote_album_asset_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(asset_id, album_id)'],
+      columns: [_column_159, _column_177],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape10 remoteAlbumUserEntity = Shape10(
+    source: i0.VersionedTable(
+      entityName: 'remote_album_user_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(album_id, user_id)'],
+      columns: [_column_177, _column_153, _column_178],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape43 remoteAssetCloudIdEntity = Shape43(
+    source: i0.VersionedTable(
+      entityName: 'remote_asset_cloud_id_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(asset_id)'],
+      columns: [
+        _column_159,
+        _column_179,
+        _column_180,
+        _column_134,
+        _column_135,
+        _column_136,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape44 memoryEntity = Shape44(
+    source: i0.VersionedTable(
+      entityName: 'memory_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_114,
+        _column_115,
+        _column_124,
+        _column_121,
+        _column_113,
+        _column_181,
+        _column_182,
+        _column_183,
+        _column_184,
+        _column_185,
+        _column_186,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape12 memoryAssetEntity = Shape12(
+    source: i0.VersionedTable(
+      entityName: 'memory_asset_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(asset_id, memory_id)'],
+      columns: [_column_159, _column_187],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape45 personEntity = Shape45(
+    source: i0.VersionedTable(
+      entityName: 'person_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_114,
+        _column_115,
+        _column_121,
+        _column_108,
+        _column_188,
+        _column_189,
+        _column_190,
+        _column_191,
+        _column_192,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape46 assetFaceEntity = Shape46(
+    source: i0.VersionedTable(
+      entityName: 'asset_face_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_159,
+        _column_193,
+        _column_194,
+        _column_195,
+        _column_196,
+        _column_197,
+        _column_198,
+        _column_199,
+        _column_200,
+        _column_201,
+        _column_124,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape18 storeEntity = Shape18(
+    source: i0.VersionedTable(
+      entityName: 'store_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [_column_202, _column_203, _column_204],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape47 trashedLocalAssetEntity = Shape47(
+    source: i0.VersionedTable(
+      entityName: 'trashed_local_asset_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id, album_id)'],
+      columns: [
+        _column_108,
+        _column_113,
+        _column_114,
+        _column_115,
+        _column_116,
+        _column_117,
+        _column_118,
+        _column_107,
+        _column_205,
+        _column_131,
+        _column_120,
+        _column_132,
+        _column_206,
+        _column_137,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape32 assetEditEntity = Shape32(
+    source: i0.VersionedTable(
+      entityName: 'asset_edit_entity',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY(id)'],
+      columns: [
+        _column_107,
+        _column_159,
+        _column_207,
+        _column_208,
+        _column_209,
+      ],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  late final Shape49 metadata = Shape49(
+    source: i0.VersionedTable(
+      entityName: 'metadata',
+      withoutRowId: true,
+      isStrict: true,
+      tableConstraints: ['PRIMARY KEY("key")'],
+      columns: [_column_210, _column_211, _column_115],
+      attachedDatabase: database,
+    ),
+    alias: null,
+  );
+  final i1.Index idxPartnerSharedWithId = i1.Index(
+    'idx_partner_shared_with_id',
+    'CREATE INDEX IF NOT EXISTS idx_partner_shared_with_id ON partner_entity (shared_with_id)',
+  );
+  final i1.Index idxLatLng = i1.Index(
+    'idx_lat_lng',
+    'CREATE INDEX IF NOT EXISTS idx_lat_lng ON remote_exif_entity (latitude, longitude)',
+  );
+  final i1.Index idxRemoteExifCity = i1.Index(
+    'idx_remote_exif_city',
+    'CREATE INDEX IF NOT EXISTS idx_remote_exif_city ON remote_exif_entity (city) WHERE city IS NOT NULL',
+  );
+  final i1.Index idxRemoteAlbumAssetAlbumAsset = i1.Index(
+    'idx_remote_album_asset_album_asset',
+    'CREATE INDEX IF NOT EXISTS idx_remote_album_asset_album_asset ON remote_album_asset_entity (album_id, asset_id)',
+  );
+  final i1.Index idxRemoteAssetCloudId = i1.Index(
+    'idx_remote_asset_cloud_id',
+    'CREATE INDEX IF NOT EXISTS idx_remote_asset_cloud_id ON remote_asset_cloud_id_entity (cloud_id)',
+  );
+  final i1.Index idxPersonOwnerId = i1.Index(
+    'idx_person_owner_id',
+    'CREATE INDEX IF NOT EXISTS idx_person_owner_id ON person_entity (owner_id)',
+  );
+  final i1.Index idxAssetFacePersonId = i1.Index(
+    'idx_asset_face_person_id',
+    'CREATE INDEX IF NOT EXISTS idx_asset_face_person_id ON asset_face_entity (person_id)',
+  );
+  final i1.Index idxAssetFaceAssetId = i1.Index(
+    'idx_asset_face_asset_id',
+    'CREATE INDEX IF NOT EXISTS idx_asset_face_asset_id ON asset_face_entity (asset_id)',
+  );
+  final i1.Index idxAssetFaceVisiblePerson = i1.Index(
+    'idx_asset_face_visible_person',
+    'CREATE INDEX IF NOT EXISTS idx_asset_face_visible_person ON asset_face_entity (person_id, asset_id) WHERE is_visible = 1 AND deleted_at IS NULL',
+  );
+  final i1.Index idxTrashedLocalAssetChecksum = i1.Index(
+    'idx_trashed_local_asset_checksum',
+    'CREATE INDEX IF NOT EXISTS idx_trashed_local_asset_checksum ON trashed_local_asset_entity (checksum)',
+  );
+  final i1.Index idxTrashedLocalAssetAlbum = i1.Index(
+    'idx_trashed_local_asset_album',
+    'CREATE INDEX IF NOT EXISTS idx_trashed_local_asset_album ON trashed_local_asset_entity (album_id)',
+  );
+  final i1.Index idxAssetEditAssetId = i1.Index(
+    'idx_asset_edit_asset_id',
+    'CREATE INDEX IF NOT EXISTS idx_asset_edit_asset_id ON asset_edit_entity (asset_id)',
+  );
+}
+
+class Shape51 extends i0.VersionedTable {
+  Shape51({required super.source, required super.alias}) : super.aliased();
+  i1.GeneratedColumn<String> get name =>
+      columnsByName['name']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<int> get type =>
+      columnsByName['type']! as i1.GeneratedColumn<int>;
+  i1.GeneratedColumn<String> get createdAt =>
+      columnsByName['created_at']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<String> get updatedAt =>
+      columnsByName['updated_at']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<int> get width =>
+      columnsByName['width']! as i1.GeneratedColumn<int>;
+  i1.GeneratedColumn<int> get height =>
+      columnsByName['height']! as i1.GeneratedColumn<int>;
+  i1.GeneratedColumn<int> get durationMs =>
+      columnsByName['duration_ms']! as i1.GeneratedColumn<int>;
+  i1.GeneratedColumn<String> get id =>
+      columnsByName['id']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<String> get checksum =>
+      columnsByName['checksum']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<int> get isFavorite =>
+      columnsByName['is_favorite']! as i1.GeneratedColumn<int>;
+  i1.GeneratedColumn<int> get orientation =>
+      columnsByName['orientation']! as i1.GeneratedColumn<int>;
+  i1.GeneratedColumn<String> get iCloudId =>
+      columnsByName['i_cloud_id']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<String> get adjustmentTime =>
+      columnsByName['adjustment_time']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<double> get latitude =>
+      columnsByName['latitude']! as i1.GeneratedColumn<double>;
+  i1.GeneratedColumn<double> get longitude =>
+      columnsByName['longitude']! as i1.GeneratedColumn<double>;
+  i1.GeneratedColumn<int> get playbackStyle =>
+      columnsByName['playback_style']! as i1.GeneratedColumn<int>;
+  i1.GeneratedColumn<String> get priorRemoteId =>
+      columnsByName['prior_remote_id']! as i1.GeneratedColumn<String>;
+  i1.GeneratedColumn<String> get syncedChecksum =>
+      columnsByName['synced_checksum']! as i1.GeneratedColumn<String>;
+}
+
+i1.GeneratedColumn<String> _column_213(String aliasedName) =>
+    i1.GeneratedColumn<String>(
+      'prior_remote_id',
+      aliasedName,
+      true,
+      type: i1.DriftSqlType.string,
+      $customConstraints: 'NULL',
+    );
+i1.GeneratedColumn<String> _column_214(String aliasedName) =>
+    i1.GeneratedColumn<String>(
+      'synced_checksum',
+      aliasedName,
+      true,
+      type: i1.DriftSqlType.string,
+      $customConstraints: 'NULL',
+    );
 i0.MigrationStepWithVersion migrationSteps({
  required Future<void> Function(i1.Migrator m, Schema2 schema) from1To2,
  required Future<void> Function(i1.Migrator m, Schema3 schema) from2To3,
@@ -13565,6 +14172,7 @@ i0.MigrationStepWithVersion migrationSteps({
  required Future<void> Function(i1.Migrator m, Schema24 schema) from23To24,
  required Future<void> Function(i1.Migrator m, Schema25 schema) from24To25,
  required Future<void> Function(i1.Migrator m, Schema26 schema) from25To26,
+  required Future<void> Function(i1.Migrator m, Schema27 schema) from26To27,
 }) {
  return (currentVersion, database) async {
    switch (currentVersion) {
@@ -13693,6 +14301,11 @@ i0.MigrationStepWithVersion migrationSteps({
        final migrator = i1.Migrator(database, schema);
        await from25To26(migrator, schema);
        return 26;
+      case 26:
+        final schema = Schema27(database: database);
+        final migrator = i1.Migrator(database, schema);
+        await from26To27(migrator, schema);
+        return 27;
      default:
        throw ArgumentError.value('Unknown migration from $currentVersion');
    }
@@ -13725,6 +14338,7 @@ i1.OnUpgrade stepByStep({
  required Future<void> Function(i1.Migrator m, Schema24 schema) from23To24,
  required Future<void> Function(i1.Migrator m, Schema25 schema) from24To25,
  required Future<void> Function(i1.Migrator m, Schema26 schema) from25To26,
+  required Future<void> Function(i1.Migrator m, Schema27 schema) from26To27,
 }) => i0.VersionedSchema.stepByStepHelper(
  step: migrationSteps(
    from1To2: from1To2,
@@ -13752,5 +14366,6 @@ i1.OnUpgrade stepByStep({
    from23To24: from23To24,
    from24To25: from24To25,
    from25To26: from25To26,
+    from26To27: from26To27,
  ),
 );
@@ -64,6 +64,12 @@ class DriftLocalAssetRepository extends DriftDatabaseRepository {
    });
  }

+  Future<void> markSynced(String localId, {required String priorRemoteId, required String syncedChecksum}) {
+    return (_db.localAssetEntity.update()..where((e) => e.id.equals(localId))).write(
+      LocalAssetEntityCompanion(priorRemoteId: Value(priorRemoteId), syncedChecksum: Value(syncedChecksum)),
+    );
+  }
+
  Future<void> delete(List<String> ids) {
    if (ids.isEmpty) {
      return Future.value();
@@ -2,6 +2,7 @@ import 'package:drift/drift.dart';
 import 'package:immich_mobile/domain/models/config/app_config.dart';
 import 'package:immich_mobile/domain/models/config/system_config.dart';
 import 'package:immich_mobile/domain/models/metadata_key.dart';
+import 'package:immich_mobile/extensions/string_extensions.dart';
 import 'package:immich_mobile/infrastructure/entities/metadata.entity.drift.dart';
 import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';

@@ -132,9 +133,45 @@ extension<T extends Object> on MetadataDomain<T> {
            groupAssetsBy: repo._read(.timelineGroupAssetsBy),
            storageIndicator: repo._read(.timelineStorageIndicator),
          ),
+          image: .new(preferRemote: repo._read(.imagePreferRemote), loadOriginal: repo._read(.imageLoadOriginal)),
+          viewer: .new(
+            loopVideo: repo._read(.viewerLoopVideo),
+            loadOriginalVideo: repo._read(.viewerLoadOriginalVideo),
+            autoPlayVideo: repo._read(.viewerAutoPlayVideo),
+            tapToNavigate: repo._read(.viewerTapToNavigate),
+          ),
+          slideshow: .new(
+            transition: repo._read(.slideshowTransition),
+            repeat: repo._read(.slideshowRepeat),
+            duration: repo._read(.slideshowDuration),
+            look: repo._read(.slideshowLook),
+            direction: repo._read(.slideshowDirection),
+          ),
+          album: .new(
+            sortMode: repo._read(.albumSortMode),
+            isReverse: repo._read(.albumIsReverse),
+            isGrid: repo._read(.albumIsGrid),
+          ),
+          backup: .new(
+            enabled: repo._read(.backupEnabled),
+            useCellularForVideos: repo._read(.backupUseCellularForVideos),
+            useCellularForPhotos: repo._read(.backupUseCellularForPhotos),
+            requireCharging: repo._read(.backupRequireCharging),
+            triggerDelay: repo._read(.backupTriggerDelay),
+            syncAlbums: repo._read(.backupSyncAlbums),
+          ),
        );
      case .systemConfig:
-        repo._systemConfig = .new(logLevel: repo._read(.logLevel));
+        repo._systemConfig = .new(
+          logLevel: repo._read(.logLevel),
+          network: .new(
+            autoEndpointSwitching: repo._read(.networkAutoEndpointSwitching),
+            preferredWifiName: repo._read(.networkPreferredWifiName).nullIfEmpty,
+            localEndpoint: repo._read(.networkLocalEndpoint).nullIfEmpty,
+            externalEndpointList: repo._read(.networkExternalEndpointList),
+            customHeaders: repo._read(.networkCustomHeaders),
+          ),
+        );
    }
  }
 }
@@ -10,6 +10,7 @@ import 'package:immich_mobile/infrastructure/entities/remote_album.entity.drift.
 import 'package:immich_mobile/infrastructure/entities/remote_album_asset.entity.drift.dart';
 import 'package:immich_mobile/infrastructure/entities/remote_album_user.entity.drift.dart';
 import 'package:immich_mobile/infrastructure/entities/remote_asset.entity.dart';
+import 'package:immich_mobile/infrastructure/entities/remote_asset.entity.drift.dart';
 import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';

 enum SortRemoteAlbumsBy { id, updatedAt }
@@ -159,7 +160,7 @@ class DriftRemoteAlbumRepository extends DriftDatabaseRepository {
        createdAt: Value(album.createdAt),
        updatedAt: Value(album.updatedAt),
        description: Value(album.description),
-        thumbnailAssetId: Value(album.thumbnailAssetId),
+        thumbnailAssetId: Value(album.thumbnailAssetId ?? (assetIds.isNotEmpty ? assetIds.first : null)),
        isActivityEnabled: Value(album.isActivityEnabled),
        order: Value(album.order),
      );
@@ -274,17 +275,59 @@ class DriftRemoteAlbumRepository extends DriftDatabaseRepository {
  }

  Future<int> addAssets(String albumId, List<String> assetIds) async {
+    if (assetIds.isEmpty) {
+      return 0;
+    }
+
    final albumAssets = assetIds.map(
      (assetId) => RemoteAlbumAssetEntityCompanion(albumId: Value(albumId), assetId: Value(assetId)),
    );

-    await _db.batch((batch) {
-      batch.insertAll(_db.remoteAlbumAssetEntity, albumAssets);
+    await _db.transaction(() async {
+      await _db.batch((batch) {
+        batch.insertAll(_db.remoteAlbumAssetEntity, albumAssets);
+      });
+
+      final album = _db.update(_db.remoteAlbumEntity)
+        ..where((row) => row.id.equals(albumId) & row.thumbnailAssetId.isNull());
+
+      await album.write(RemoteAlbumEntityCompanion(thumbnailAssetId: Value(assetIds.first)));
    });

    return assetIds.length;
  }

+  /// Inserts a placeholder `remote_asset_entity` row from a freshly-uploaded
+  /// local asset. Skips silently if a row with the same id or
+  /// (owner_id, checksum) already exists — sync will overwrite with the
+  /// authoritative server data once the AssetUploadReadyV1 event is processed.
+  Future<void> upsertRemoteAssetStub({
+    required String remoteId,
+    required String ownerId,
+    required LocalAsset source,
+  }) async {
+    await _db
+        .into(_db.remoteAssetEntity)
+        .insert(
+          RemoteAssetEntityCompanion(
+            id: Value(remoteId),
+            ownerId: Value(ownerId),
+            checksum: Value(source.checksum ?? remoteId),
+            name: Value(source.name),
+            type: Value(source.type),
+            createdAt: Value(source.createdAt),
+            updatedAt: Value(source.updatedAt),
+            width: Value(source.width),
+            height: Value(source.height),
+            durationMs: Value(source.durationMs),
+            isFavorite: Value(source.isFavorite),
+            visibility: const Value(AssetVisibility.timeline),
+            isEdited: Value(source.isEdited),
+          ),
+          mode: InsertMode.insertOrIgnore,
+        );
+  }
+
  Future<void> addUsers(String albumId, List<String> userIds) {
    final albumUsers = userIds.map(
      (assetId) => RemoteAlbumUserEntityCompanion(
@@ -1,8 +1,24 @@
+import 'package:collection/collection.dart';
 import 'package:drift/drift.dart';
+import 'package:immich_mobile/constants/constants.dart';
 import 'package:immich_mobile/domain/models/stack.model.dart';
 import 'package:immich_mobile/infrastructure/entities/stack.entity.drift.dart';
 import 'package:immich_mobile/infrastructure/repositories/db.repository.dart';

+class StackReconcileTarget {
+  final String stackId;
+  final String newPrimaryId;
+  final String localAssetId;
+  final String localAssetChecksum;
+
+  const StackReconcileTarget({
+    required this.stackId,
+    required this.newPrimaryId,
+    required this.localAssetId,
+    required this.localAssetChecksum,
+  });
+}
+
 class DriftStackRepository extends DriftDatabaseRepository {
  final Drift _db;
  const DriftStackRepository(this._db) : super(_db);
@@ -14,6 +30,95 @@ class DriftStackRepository extends DriftDatabaseRepository {
      return stack.toDto();
    }).get();
  }
+
+  // Per local id, find a stack member whose checksum matches the local's current
+  // checksum but isn't the stack primary. That's the revert case: the local hashed
+  // back to the base while the primary still points at the edit.
+  Future<List<StackReconcileTarget>> findRevertReconcileTargets(Iterable<String> localAssetIds) async {
+    final ids = localAssetIds.toSet();
+    if (ids.isEmpty) {
+      return const [];
+    }
+
+    final targets = <StackReconcileTarget>[];
+    for (final slice in ids.slices(kDriftMaxChunk)) {
+      final placeholders = List.filled(slice.length, '?').join(',');
+      final rows = await _db
+          .customSelect(
+            '''
+        SELECT
+          s.id AS stack_id,
+          member.id AS new_primary,
+          local.id AS local_id,
+          local.checksum AS local_checksum
+        FROM local_asset_entity local
+        INNER JOIN remote_asset_entity prior ON prior.id = local.prior_remote_id AND prior.deleted_at IS NULL
+        INNER JOIN stack_entity s ON s.id = prior.stack_id
+        INNER JOIN remote_asset_entity member
+          ON member.stack_id = s.id
+          AND member.checksum = local.checksum
+          AND member.deleted_at IS NULL
+        WHERE local.id IN ($placeholders)
+          AND s.primary_asset_id != member.id
+        ''',
+            variables: slice.map((id) => Variable<String>(id)).toList(),
+            readsFrom: {_db.localAssetEntity, _db.remoteAssetEntity, _db.stackEntity},
+          )
+          .get();
+
+      for (final row in rows) {
+        targets.add(
+          StackReconcileTarget(
+            stackId: row.read<String>('stack_id'),
+            newPrimaryId: row.read<String>('new_primary'),
+            localAssetId: row.read<String>('local_id'),
+            localAssetChecksum: row.read<String>('local_checksum'),
+          ),
+        );
+      }
+    }
+    return targets;
+  }
+
+  // The stack a remote asset belongs to, if any. Used by the revert path to find
+  // the stack from prior_remote_id when the reverted bytes can't be checksum-matched.
+  Future<String?> findStackIdByRemoteId(String remoteId) async {
+    final row = await _db
+        .customSelect(
+          'SELECT stack_id FROM remote_asset_entity WHERE id = ? AND stack_id IS NOT NULL AND deleted_at IS NULL',
+          variables: [Variable<String>(remoteId)],
+          readsFrom: {_db.remoteAssetEntity},
+        )
+        .getSingleOrNull();
+    return row?.read<String?>('stack_id');
+  }
+
+  // The stack's original base member to flip back to on revert: the earliest-
+  // uploaded member that isn't the (latest-edit) prior. The base is uploaded
+  // before its edits, so oldest uploaded_at = the original.
+  Future<String?> findStackBaseId(String stackId, {required String excludeId}) async {
+    final row = await _db
+        .customSelect(
+          '''
+          SELECT id FROM remote_asset_entity
+          WHERE stack_id = ? AND id != ? AND deleted_at IS NULL
+          ORDER BY uploaded_at IS NULL, uploaded_at ASC, id ASC
+          LIMIT 1
+          ''',
+          variables: [Variable<String>(stackId), Variable<String>(excludeId)],
+          readsFrom: {_db.remoteAssetEntity},
+        )
+        .getSingleOrNull();
+    return row?.read<String?>('id');
+  }
+
+  // Optimistic local primary flip so the timeline updates immediately; the
+  // server's stack-update websocket rewrites it shortly after.
+  Future<void> setPrimary(String stackId, String primaryAssetId) {
+    return (_db.stackEntity.update()..where((e) => e.id.equals(stackId))).write(
+      StackEntityCompanion(primaryAssetId: Value(primaryAssetId)),
+    );
+  }
 }

 extension on StackEntityData {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Santo Shakil	2d9183ab44	feat(mobile): stack original + edited photo on ios Detect an iOS edit, upload the unedited original, and stack the edited version on top of it. Reverting in Photos flips the stack cover back to the original and keeps the edits. Adds an optional stackParentId field to the asset upload on the server.	2026-05-23 03:47:26 +06:00
Alex	fd7ddfef54	fix: plugin prod build typo (#28566 )	2026-05-22 11:01:18 -05:00
Daniel Dietzler	0975b1599c	fix: remove stray migration (#28565 )	2026-05-22 15:20:47 +00:00
Peter Ombodi	78ac0ade01	feat(mobile): add manage media APIs to NativeSyncApi (#28441 ) * feat(mobile): add manage media APIs to NativeSyncApi * fix(mobile): remove legacy local file manager from trash sync * refactor(mobile): move media permission methods to PermissionApi * cleanup --------- Co-authored-by: Peter Ombodi <peter.ombodi@gmail.com> Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-22 17:40:11 +05:30
Mert	7b9dab872b	fix(mobile): separate group ids for separate app installs (#28448 ) * separate group ids * remove pigeon method * Revert "remove pigeon method" This reverts commit `d699ff2094`.	2026-05-21 12:25:20 -05:00
Daniel Dietzler	6413495fb8	fix: mise lockfile (#28541 )	2026-05-21 13:13:37 +02:00
Caltsic	b414b3d32b	fix: improve form control focus visibility (#28512 ) * Improve form control focus visibility * fix: align form input focus styles	2026-05-20 15:33:56 -05:00
renovate[bot]	20da7c4267	chore(deps): lock file maintenance (terragrunt) (#28488 )	2026-05-20 17:20:50 +02:00
renovate[bot]	92b6778d2d	fix(deps): update typescript-projects (#28371 ) Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>	2026-05-20 16:56:27 +02:00
Daniel Dietzler	5a61e589e8	chore: always run ci when mise.toml changes and install flutter from aqua (#28521 )	2026-05-20 14:43:30 +00:00
renovate[bot]	85192bb110	chore(deps): update ghcr.io/jdx/mise docker tag to v2026.5.11 (#28522 )	2026-05-20 14:29:17 +00:00
Timon	c7ae97fa2b	chore: handle docusaurus deprecation warning (#28516 )	2026-05-20 15:27:33 +02:00
Timon	8d02f3625d	chore: update mobile makefile command usage instructions (#28514 )	2026-05-20 15:26:24 +02:00
bo0tzz	a5a7380a26	feat: use lockfile for mise tools (#28503 )	2026-05-20 11:37:33 +00:00
renovate[bot]	d9ce3d2046	chore(deps): update dependency @types/node to ^24.12.4 (#28490 )	2026-05-20 12:41:17 +02:00
renovate[bot]	815ff677fc	chore(deps): update github-actions (#28493 )	2026-05-19 22:22:44 +00:00
bo0tzz	915d865ce2	chore: use custom sticky-comment action (#28505 )	2026-05-19 20:25:46 +00:00
immich-tofu[bot]	c28e5f90b6	chore: modify .github/workflows/org-zizmor.yml	2026-05-19 10:45:23 +00:00
Timon	4383473ed6	fix: cleanup nestjs-zod properties (#28447 ) * fix: cleanup nestjs-zod properties * lint	2026-05-18 15:31:08 -04:00
shenlong	77701dd5a3	refactor: migrate backup config (#28483 )	2026-05-19 00:40:10 +05:30
shenlong	d4808fdc4d	refactor: migrate album config (#28482 ) Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-18 23:28:59 +05:30
renovate[bot]	7fa967a98e	chore(deps): update dependency svelte to v5.55.7 [security] (#28434 ) Co-authored-by: Daniel Dietzler <mail@ddietzler.dev>	2026-05-18 17:42:01 +00:00
shenlong	9cffcc9f4e	refactor: migrate network config (#28471 )	2026-05-18 16:22:42 +00:00
shenlong	40925f0a06	refactor: immich form and text input (#28479 ) refacotr: immich form Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-18 16:21:36 +00:00
Oliver Roed Schøler	0544d22902	feat: Selectable metadata in duplicates utility with diffing (#26328 )	2026-05-18 17:49:51 +02:00
Jason Rasmussen	3d075f2bf8	feat: workflows & plugins (#26727 ) feat: plugins chore: better types feat: plugins	2026-05-18 11:09:33 -04:00
Luis Nachtigall	7384799f19	fix(mobile): asset viewer stuck on spinner after rotation (#28019 )	2026-05-18 20:32:51 +05:30
Alex	4a7f06e8fd	feat: upload and add local asset directly to album (#28123 ) * feat: manually upload local assets to album * feat: manually upload local assets to album * refactor * Upload status * pr feedback	2026-05-18 20:31:22 +05:30
Lauritz Tieste	8f662fc459	refactor: enhance shared link UI and functionality (#26464 ) * feat(shared-link): enhance shared link UI and functionality with new expiry options and improved layout * rebase & cleanup --------- Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-18 20:29:56 +05:30
Benjamin Nguyen	24b1dae9f2	feat(mobile): "Add Tags" asset multiselect option (#26269 ) * add bulk_tag_assets_action_button to general_bottom_sheet.widget include create tag tile in 'Add Tags' action modal * follow provider -> svc -> repo pattern for tags * rebase and cleanup --------- Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-18 20:29:09 +05:30
Lauritz Tieste	3a3469a5f9	feat(ui): add ImmichURLInput (#27105 ) feat(ui): implement shared URL input configuration and update input fields	2026-05-18 20:28:57 +05:30
Adam Gastineau	7993619ed2	fix(ios): respect status bar scroll to top in timeline views (#28469 ) * fix(ios): respect status bar scroll to top in library views * Make sure to wrap all loading states in Scaffold	2026-05-18 20:28:01 +05:30
shenlong	4d1f6f869b	chore: cleanup mobile mise config (#28473 ) Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-18 19:18:52 +05:30
Yaros	3eb03f7934	chore: update readmes to match main (#28458 )	2026-05-17 13:08:27 -05:00
Alex	03ed3daa31	chore: improve mobile slideshow (#28460 )	2026-05-17 10:54:21 -05:00
Min Idzelis	02581e81a7	fix(web): work around Chrome HDR image seam lines during zoom (#27715 ) Change-Id: Ic5a5b1a476c2af93b465ef23dabc601a6a6a6964 Co-authored-by: Alex <alex.tran1502@gmail.com>	2026-05-16 02:15:24 +00:00
Santo Shakil	3ab3d5cf43	fix(mobile): don't force-unwrap nil localizedTitle in ios getAlbums (#28452 ) crashes on ios 26 when a PHAssetCollection returns nil for localizedTitle. fall back to localIdentifier. ref #28428	2026-05-15 18:12:28 -05:00
Ben Beckford	0ef04d9baa	feat(mobile): slideshow view (#28421 ) * feat(mobile): slideshow view * move slideshow settings to metadata store * remove watch in initState * wrap progress bar in safearea * show slideshow button on remote albums * fix crash on unknown assets * always show slideshow option * add zoom effect * add padding to slideshow settings * chore: styling tweak --------- Co-authored-by: Alex <alex.tran1502@gmail.com>	2026-05-15 18:12:04 -05:00
Santo Shakil	df016f9228	fix(mobile): mounted check in ThumbnailTile hero flight listener (#28451 ) When the user pops back from the asset viewer mid-flight, the hero animation can fire its status listener after _ThumbnailTileState has been disposed. setState then throws a null check on State._element. Guard the listener with `if (!mounted) return;` — same pattern as #28300 in the album sync action.	2026-05-15 21:41:04 +00:00
Santo Shakil	17779c1e74	fix(mobile): cronet thumbnail buffer overflow regression from #28439 (#28450 ) The hybrid added in onReadCompleted reuses Cronet's ByteBuffer between reads to save a JNI wrap call when no grow is needed. That reuse breaks advance() — Cronet's position() is cumulative across reads, so the same K bytes get counted on every subsequent iteration. b.offset overshoots b.capacity, the reuse branch keeps firing on a now-empty buffer, and request.read() throws the original IllegalArgumentException again. Always pass a fresh wrap from wrapRemaining() so byteBuffer.position() reflects only this iteration's bytes. Same shape as the original PR had before the broken optimization was layered on top.	2026-05-15 17:25:31 -04:00
Santo Shakil	01d6a244d8	fix(mobile): cronet buffer overflow on compressed thumbnails (#28439 ) CronetImageFetcher sized the response buffer from Content-Length, which is the compressed wire size. Cronet auto-decompresses gzip/br responses and writes decompressed bytes into the buffer, exceeding it and throwing IllegalArgumentException: ByteBuffer is already full on the next read. Use the growable path; Content-Length becomes an initial alloc hint only, capped at 128 MB so an untrusted server can't overflow Int.MAX_VALUE or OOM us upfront. Reuse Cronet's ByteBuffer between reads when no grow is needed.	2026-05-15 14:48:23 -04:00
Ben Beckford	21d6755f39	fix(web): recently added ux (#28435 )	2026-05-14 22:22:23 -05:00
Robert Deaton	e91c017dd0	fix(server): dedupe database backup jobs (#28341 ) * fix(server): dedupe database backup jobs via jobId #27268 shows backup jobs piling up in the queue across upgrades; one pending backup is always enough. * fix(tests): Avoid stale backup files from previous test runs being erroneously returned from createBackup * fix(jobs): Use bullmq's deduplication over jobId to avoid failed jobs from blocking future executions. --------- Co-authored-by: Robert Deaton <immich@rdeaton.space>	2026-05-14 20:59:15 -04:00
Alex	43687cd8b4	fix: kebab menu icon colors and actions (#28433 )	2026-05-14 22:23:50 +00:00
shenlong	06729ee5a5	chore: cleanup unused store keys (#28415 ) cleanup unused store keys Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-14 16:21:06 -05:00
Nojus Gudinavičius	b0c9743d9a	feat(server): allow subpaths for machine learning URL (#28427 ) This allows to use a machine learning server URL under a subpath, such as "http://example.com/ml-server/".	2026-05-14 12:46:31 +00:00
Marius	37cc028868	fix(mobile): use correct delete action (#26575 ) fix(mobile): use correct delete for trashed assets When viewing a trashed asset, the viewer bottom bar now shows the permanent delete button instead of the trash button, which had no effect on already-trashed assets.	2026-05-14 11:57:19 +00:00
Inês Costa	84a2b7a3c8	fix(mobile): add restore option to trashed assets (#27442 )	2026-05-14 07:19:00 +00:00
racehd	89b3433346	feat(docs): add fixed subnet guide for Synology to prevent firewall issues (#26554 ) * - Add Set Fixed Subnet section - Add newline after details summary to properly render summary with mdx * pnpm run format --write --------- Co-authored-by: Jason Rasmussen <jason@rasm.me>	2026-05-13 23:54:13 +00:00
shenlong	3ff0d47ee3	chore: do not cache dart_tool (#28409 ) Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-13 19:46:24 -04:00
shenlong	aeaf846482	chore: cleanup unused store keys (#28415 ) cleanup unused store keys Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-13 18:03:57 -05:00
Santo Shakil	b031548791	fix(mobile): don't block app open on slow validateAccessToken (#28405 ) * fix(mobile): don't block app open on slow validateAccessToken AuthGuard.onNavigation was async so auto_route awaited the body through validateAccessToken's OS timeout. now it's sync and the validate runs in bg. kicks to login on 401. * fix(mobile): handle re-login race in AuthGuard validate if user logs out + logs back in during a slow validate, the old 401 was logging them out again. now we check the token hasn't changed before redirecting, and dedupe in-flight calls. --------- Co-authored-by: Alex <alex.tran1502@gmail.com>	2026-05-13 11:52:43 -05:00
Jason Rasmussen	fcea617313	fix: ignore icc profile make and model (#28412 )	2026-05-13 12:07:35 -04:00
Mees Frensel	024f20ea26	chore(web): use DatePicker component from UI lib (#28406 )	2026-05-13 09:37:07 -05:00
shenlong	0a4ed6fd71	refactor: migrate viewer config to metadata table (#28396 ) * refactor: app metadata * refactor to per row store * cleanup * more test * review changes * more refactor * refactor * migrate primary color * migrate dynamic theme * migrate colorfulInterface * cleanup providers * migrate cleanup * migrate mapconfig * remove unused keys * migrate timeline config * migrate image config * migrate viewer config --------- Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-13 09:36:19 -05:00
Alex	b6e2ce1f35	fix(mobile): revert drop deprecated deviceAssetId / deviceId from upload fields (#28384 ) (#28400 ) * Revert "chore(mobile): drop deprecated deviceAssetId / deviceId from upload fields (#28384)" This reverts commit `571e6a8560`. * chore(mobile): add note on kept deprecated upload fields --------- Co-authored-by: Santo Shakil <shakil.mezbah@gmail.com>	2026-05-13 09:36:16 -05:00
bo0tzz	e323e778cd	fix: update server-commands subcommand list (#28402 )	2026-05-13 09:27:25 -04:00
renovate[bot]	6a87797649	chore(deps): update terraform cloudflare to v4.52.7 (#28370 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-12 23:50:23 -04:00
renovate[bot]	f4a4649bbc	chore(deps): update dependency canvas to v3 (#28376 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-12 23:49:22 -04:00
Alex	6ca54ee722	feat: display more info in asset viewer (#24630 ) * feat(mobile): more info for asset viewer * feat(mobile): more info for asset viewer	2026-05-13 02:07:23 +00:00
shenlong	8e3035f783	chore: run mobile tests in parallel (#28393 ) Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-12 17:17:07 -05:00
shenlong	79801595db	refactor: move image config to metadata table (#28228 ) * migrate image config --------- Co-authored-by: shenlong-tanwen <139912620+shalong-tanwen@users.noreply.github.com>	2026-05-13 03:20:35 +05:30