feat: enable SvelteKit CSP policy with hash-based inline script/style protection

* feat(mobile): add support for encoded image requests in local and remote image APIs

* fix(mobile): handle memory cleanup for cancelled image requests

* refactor(mobile): simplify memory management and response handling for encoded image requests

* fix(mobile): correct formatting in cancellation check for image requests

* Apply suggestion from @mertalev

Co-authored-by: Mert <101130780+mertalev@users.noreply.github.com>

* refactor(mobile): rename 'encoded' parameter to 'preferEncoded' for clarity in image request APIs

* fix(mobile): ensure proper resource cleanup for cancelled image requests

* refactor(mobile): streamline codec handling by removing unnecessary descriptor disposal in loadCodec request

---------

Co-authored-by: Mert <101130780+mertalev@users.noreply.github.com>

misc/update-csp-hashes.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+/**
+ * Computes SHA-256 hashes for inline <script> elements in app.html
+ * and updates the script-src CSP directive in svelte.config.js.
+ *
+ * SvelteKit's CSP hash mode only hashes inline content it generates itself,
+ * not the template content from app.html. This script fills that gap.
+ *
+ * Run this script whenever the inline scripts in app.html change.
+ *
+ * Usage: node misc/update-csp-hashes.mjs
+ */
+
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const scriptDirectory = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(scriptDirectory, '..');
+const appHtmlPath = join(repoRoot, 'web', 'src', 'app.html');
+const configPath = join(repoRoot, 'web', 'svelte.config.js');
+
+const appHtml = readFileSync(appHtmlPath, 'utf-8');
+const scriptRegex = /<script[^>]*>([\s\S]*?)<\/script>/g;
+
+const hashes = [];
+let match;
+while ((match = scriptRegex.exec(appHtml)) !== null) {
+  const content = match[1];
+  const hash = createHash('sha256').update(content).digest('base64');
+  hashes.push(`sha256-${hash}`);
+  const preview = content.trim().slice(0, 60).replaceAll('\n', ' ');
+  console.log(`Found: ${preview}...`);
+  console.log(`  Hash: sha256-${hash}`);
+  console.log();
+}
+
+if (hashes.length === 0) {
+  console.log('No inline <script> elements found in app.html');
+  process.exit(0);
+}
+
+let config = readFileSync(configPath, 'utf-8');
+
+const scriptSrcRegex = /'script-src':\s*\[[\s\S]*?\]/;
+const scriptSrcMatch = config.match(scriptSrcRegex);
+if (!scriptSrcMatch) {
+  console.error("Could not find 'script-src' directive in svelte.config.js");
+  process.exit(1);
+}
+
+const existingEntries = [];
+const entryRegex = /'([^']+)'/g;
+let entryMatch;
+while ((entryMatch = entryRegex.exec(scriptSrcMatch[0])) !== null) {
+  const value = entryMatch[1];
+  if (value === 'script-src' || value.startsWith('sha256-')) {
+    continue;
+  }
+  existingEntries.push(value);
+}
+
+const allEntries = [...existingEntries, ...hashes];
+const formatted = allEntries.map((entry) => `          '${entry}'`).join(',\n');
+const newScriptSrc = `'script-src': [\n${formatted},\n        ]`;
+
+config = config.replace(scriptSrcRegex, newScriptSrc);
+writeFileSync(configPath, config);
+
+console.log(`Updated svelte.config.js with ${hashes.length} script hash(es)`);

mobile/android/app/src/main/kotlin/app/alextran/immich/images/LocalImages.g.kt

@@ -59,7 +59,7 @@ private open class LocalImagesPigeonCodec : StandardMessageCodec() {
 
 /** Generated interface from Pigeon that represents a handler of messages from Flutter. */
 interface LocalImageApi {
-  fun requestImage(assetId: String, requestId: Long, width: Long, height: Long, isVideo: Boolean, callback: (Result<Map<String, Long>?>) -> Unit)
+  fun requestImage(assetId: String, requestId: Long, width: Long, height: Long, isVideo: Boolean, preferEncoded: Boolean, callback: (Result<Map<String, Long>?>) -> Unit)
   fun cancelRequest(requestId: Long)
   fun getThumbhash(thumbhash: String, callback: (Result<Map<String, Long>>) -> Unit)
 
@@ -82,7 +82,8 @@ interface LocalImageApi {
             val widthArg = args[2] as Long
             val heightArg = args[3] as Long
             val isVideoArg = args[4] as Boolean
-            api.requestImage(assetIdArg, requestIdArg, widthArg, heightArg, isVideoArg) { result: Result<Map<String, Long>?> ->
+            val preferEncodedArg = args[5] as Boolean
+            api.requestImage(assetIdArg, requestIdArg, widthArg, heightArg, isVideoArg, preferEncodedArg) { result: Result<Map<String, Long>?> ->
               val error = result.exceptionOrNull()
               if (error != null) {
                 reply.reply(LocalImagesPigeonUtils.wrapError(error))

mobile/android/app/src/main/kotlin/app/alextran/immich/images/LocalImagesImpl.kt

@@ -14,6 +14,7 @@ import android.util.Size
 import androidx.annotation.RequiresApi
 import app.alextran.immich.NativeBuffer
 import kotlin.math.*
+import java.io.IOException
 import java.util.concurrent.Executors
 import com.bumptech.glide.Glide
 import com.bumptech.glide.Priority
@@ -99,12 +100,17 @@ class LocalImagesImpl(context: Context) : LocalImageApi {
     width: Long,
     height: Long,
     isVideo: Boolean,
+    preferEncoded: Boolean,
     callback: (Result<Map<String, Long>?>) -> Unit
   ) {
     val signal = CancellationSignal()
     val task = threadPool.submit {
       try {
-        getThumbnailBufferInternal(assetId, width, height, isVideo, callback, signal)
+        if (preferEncoded) {
+          getEncodedImageInternal(assetId, callback, signal)
+        } else {
+          getThumbnailBufferInternal(assetId, width, height, isVideo, callback, signal)
+        }
       } catch (e: Exception) {
         when (e) {
           is OperationCanceledException -> callback(CANCELLED)
@@ -133,6 +139,35 @@ class LocalImagesImpl(context: Context) : LocalImageApi {
     }
   }
 
+  private fun getEncodedImageInternal(
+    assetId: String,
+    callback: (Result<Map<String, Long>?>) -> Unit,
+    signal: CancellationSignal
+  ) {
+    signal.throwIfCanceled()
+    val id = assetId.toLong()
+    val uri = ContentUris.withAppendedId(Images.Media.EXTERNAL_CONTENT_URI, id)
+
+    signal.throwIfCanceled()
+    val bytes = resolver.openInputStream(uri)?.use { it.readBytes() }
+      ?: throw IOException("Could not read image data for $assetId")
+
+    signal.throwIfCanceled()
+    val pointer = NativeBuffer.allocate(bytes.size)
+    try {
+      val buffer = NativeBuffer.wrap(pointer, bytes.size)
+      buffer.put(bytes)
+      signal.throwIfCanceled()
+      callback(Result.success(mapOf(
+        "pointer" to pointer,
+        "length" to bytes.size.toLong()
+      )))
+    } catch (e: Exception) {
+      NativeBuffer.free(pointer)
+      throw e
+    }
+  }
+
   private fun getThumbnailBufferInternal(
     assetId: String,
     width: Long,

mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImages.g.kt

@@ -47,7 +47,7 @@ private open class RemoteImagesPigeonCodec : StandardMessageCodec() {
 
 /** Generated interface from Pigeon that represents a handler of messages from Flutter. */
 interface RemoteImageApi {
-  fun requestImage(url: String, headers: Map<String, String>, requestId: Long, callback: (Result<Map<String, Long>?>) -> Unit)
+  fun requestImage(url: String, headers: Map<String, String>, requestId: Long, preferEncoded: Boolean, callback: (Result<Map<String, Long>?>) -> Unit)
   fun cancelRequest(requestId: Long)
   fun clearCache(callback: (Result<Long>) -> Unit)
 
@@ -68,7 +68,8 @@ interface RemoteImageApi {
             val urlArg = args[0] as String
             val headersArg = args[1] as Map<String, String>
             val requestIdArg = args[2] as Long
-            api.requestImage(urlArg, headersArg, requestIdArg) { result: Result<Map<String, Long>?> ->
+            val preferEncodedArg = args[3] as Boolean
+            api.requestImage(urlArg, headersArg, requestIdArg, preferEncodedArg) { result: Result<Map<String, Long>?> ->
               val error = result.exceptionOrNull()
               if (error != null) {
                 reply.reply(RemoteImagesPigeonUtils.wrapError(error))

mobile/android/app/src/main/kotlin/app/alextran/immich/images/RemoteImagesImpl.kt

@@ -51,6 +51,7 @@ class RemoteImagesImpl(context: Context) : RemoteImageApi {
     url: String,
     headers: Map<String, String>,
     requestId: Long,
+    @Suppress("UNUSED_PARAMETER") preferEncoded: Boolean, // always returns encoded; setting has no effect on Android
     callback: (Result<Map<String, Long>?>) -> Unit
   ) {
     val signal = CancellationSignal()

mobile/android/app/src/main/kotlin/app/alextran/immich/sync/Messages.g.kt

@@ -78,6 +78,21 @@ class FlutterError (
   val details: Any? = null
 ) : Throwable()
 
+enum class PlatformAssetPlaybackStyle(val raw: Int) {
+  UNKNOWN(0),
+  IMAGE(1),
+  VIDEO(2),
+  IMAGE_ANIMATED(3),
+  LIVE_PHOTO(4),
+  VIDEO_LOOPING(5);
+
+  companion object {
+    fun ofRaw(raw: Int): PlatformAssetPlaybackStyle? {
+      return values().firstOrNull { it.raw == raw }
+    }
+  }
+}
+
 /** Generated class from Pigeon that represents data sent in messages. */
 data class PlatformAsset (
   val id: String,
@@ -92,7 +107,8 @@ data class PlatformAsset (
   val isFavorite: Boolean,
   val adjustmentTime: Long? = null,
   val latitude: Double? = null,
-  val longitude: Double? = null
+  val longitude: Double? = null,
+  val playbackStyle: PlatformAssetPlaybackStyle
 )
  {
   companion object {
@@ -110,7 +126,8 @@ data class PlatformAsset (
       val adjustmentTime = pigeonVar_list[10] as Long?
       val latitude = pigeonVar_list[11] as Double?
       val longitude = pigeonVar_list[12] as Double?
-      return PlatformAsset(id, name, type, createdAt, updatedAt, width, height, durationInSeconds, orientation, isFavorite, adjustmentTime, latitude, longitude)
+      val playbackStyle = pigeonVar_list[13] as PlatformAssetPlaybackStyle
+      return PlatformAsset(id, name, type, createdAt, updatedAt, width, height, durationInSeconds, orientation, isFavorite, adjustmentTime, latitude, longitude, playbackStyle)
     }
   }
   fun toList(): List<Any?> {
@@ -128,6 +145,7 @@ data class PlatformAsset (
       adjustmentTime,
       latitude,
       longitude,
+      playbackStyle,
     )
   }
   override fun equals(other: Any?): Boolean {
@@ -290,26 +308,31 @@ private open class MessagesPigeonCodec : StandardMessageCodec() {
   override fun readValueOfType(type: Byte, buffer: ByteBuffer): Any? {
     return when (type) {
       129.toByte() -> {
-        return (readValue(buffer) as? List<Any?>)?.let {
-          PlatformAsset.fromList(it)
+        return (readValue(buffer) as Long?)?.let {
+          PlatformAssetPlaybackStyle.ofRaw(it.toInt())
         }
       }
       130.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
-          PlatformAlbum.fromList(it)
+          PlatformAsset.fromList(it)
         }
       }
       131.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
-          SyncDelta.fromList(it)
+          PlatformAlbum.fromList(it)
         }
       }
       132.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
-          HashResult.fromList(it)
+          SyncDelta.fromList(it)
         }
       }
       133.toByte() -> {
+        return (readValue(buffer) as? List<Any?>)?.let {
+          HashResult.fromList(it)
+        }
+      }
+      134.toByte() -> {
         return (readValue(buffer) as? List<Any?>)?.let {
           CloudIdResult.fromList(it)
         }
@@ -319,26 +342,30 @@ private open class MessagesPigeonCodec : StandardMessageCodec() {
   }
   override fun writeValue(stream: ByteArrayOutputStream, value: Any?)   {
     when (value) {
-      is PlatformAsset -> {
+      is PlatformAssetPlaybackStyle -> {
         stream.write(129)
-        writeValue(stream, value.toList())
+        writeValue(stream, value.raw)
       }
-      is PlatformAlbum -> {
+      is PlatformAsset -> {
         stream.write(130)
         writeValue(stream, value.toList())
       }
-      is SyncDelta -> {
+      is PlatformAlbum -> {
         stream.write(131)
         writeValue(stream, value.toList())
       }
-      is HashResult -> {
+      is SyncDelta -> {
         stream.write(132)
         writeValue(stream, value.toList())
       }
-      is CloudIdResult -> {
+      is HashResult -> {
         stream.write(133)
         writeValue(stream, value.toList())
       }
+      is CloudIdResult -> {
+        stream.write(134)
+        writeValue(stream, value.toList())
+      }
       else -> super.writeValue(stream, value)
     }
   }

mobile/android/app/src/main/kotlin/app/alextran/immich/sync/MessagesImplBase.kt

@@ -4,11 +4,17 @@ import android.annotation.SuppressLint
 import android.content.ContentUris
 import android.content.Context
 import android.database.Cursor
+import androidx.exifinterface.media.ExifInterface
+import android.os.Build
 import android.os.Bundle
 import android.provider.MediaStore
 import android.util.Base64
+import android.util.Log
 import androidx.core.database.getStringOrNull
 import app.alextran.immich.core.ImmichPlugin
+import com.bumptech.glide.Glide
+import com.bumptech.glide.load.ImageHeaderParser
+import com.bumptech.glide.load.ImageHeaderParserUtils
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.Job
@@ -28,6 +34,8 @@ sealed class AssetResult {
   data class InvalidAsset(val assetId: String) : AssetResult()
 }
 
+private const val TAG = "NativeSyncApiImplBase"
+
 @SuppressLint("InlinedApi")
 open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
   private val ctx: Context = context.applicationContext
@@ -39,6 +47,13 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
     private val hashSemaphore = Semaphore(MAX_CONCURRENT_HASH_OPERATIONS)
     private const val HASHING_CANCELLED_CODE = "HASH_CANCELLED"
 
+    // MediaStore.Files.FileColumns.SPECIAL_FORMAT — S Extensions 21+
+    // https://developer.android.com/reference/android/provider/MediaStore.Files.FileColumns#SPECIAL_FORMAT
+    private const val SPECIAL_FORMAT_COLUMN = "_special_format"
+    private const val SPECIAL_FORMAT_GIF = 1
+    private const val SPECIAL_FORMAT_MOTION_PHOTO = 2
+    private const val SPECIAL_FORMAT_ANIMATED_WEBP = 3
+
     const val MEDIA_SELECTION =
       "(${MediaStore.Files.FileColumns.MEDIA_TYPE} = ? OR ${MediaStore.Files.FileColumns.MEDIA_TYPE} = ?)"
     val MEDIA_SELECTION_ARGS = arrayOf(
@@ -60,9 +75,15 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
       add(MediaStore.MediaColumns.DURATION)
       add(MediaStore.MediaColumns.ORIENTATION)
       // IS_FAVORITE is only available on Android 11 and above
-      if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.R) {
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
         add(MediaStore.MediaColumns.IS_FAVORITE)
       }
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+        add(SPECIAL_FORMAT_COLUMN)
+      } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+        // Fallback: read XMP from MediaStore to detect Motion Photos
+        add(MediaStore.MediaColumns.XMP)
+      }
     }.toTypedArray()
 
     const val HASH_BUFFER_SIZE = 2 * 1024 * 1024
@@ -109,9 +130,12 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
         val orientationColumn =
           c.getColumnIndexOrThrow(MediaStore.MediaColumns.ORIENTATION)
         val favoriteColumn = c.getColumnIndex(MediaStore.MediaColumns.IS_FAVORITE)
+        val specialFormatColumn = c.getColumnIndex(SPECIAL_FORMAT_COLUMN)
+        val xmpColumn = c.getColumnIndex(MediaStore.MediaColumns.XMP)
 
         while (c.moveToNext()) {
-          val id = c.getLong(idColumn).toString()
+          val numericId = c.getLong(idColumn)
+          val id = numericId.toString()
           val name = c.getStringOrNull(nameColumn)
           val bucketId = c.getStringOrNull(bucketIdColumn)
           val path = c.getStringOrNull(dataColumn)
@@ -125,10 +149,11 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
             continue
           }
 
-          val mediaType = when (c.getInt(mediaTypeColumn)) {
-            MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE -> 1
-            MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO -> 2
-            else -> 0
+          val rawMediaType = c.getInt(mediaTypeColumn)
+          val assetType: Long = when (rawMediaType) {
+            MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE -> 1L
+            MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO -> 2L
+            else -> 0L
           }
           // Date taken is milliseconds since epoch, Date added is seconds since epoch
           val createdAt = (c.getLong(dateTakenColumn).takeIf { it > 0 }?.div(1000))
@@ -138,15 +163,19 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
           val width = c.getInt(widthColumn).toLong()
           val height = c.getInt(heightColumn).toLong()
           // Duration is milliseconds
-          val duration = if (mediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE) 0
+          val duration = if (rawMediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE) 0L
           else c.getLong(durationColumn) / 1000
           val orientation = c.getInt(orientationColumn)
           val isFavorite = if (favoriteColumn == -1) false else c.getInt(favoriteColumn) != 0
 
+          val playbackStyle = detectPlaybackStyle(
+            numericId, rawMediaType, specialFormatColumn, xmpColumn, c
+          )
+
           val asset = PlatformAsset(
             id,
             name,
-            mediaType.toLong(),
+            assetType,
             createdAt,
             modifiedAt,
             width,
@@ -154,6 +183,7 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
             duration,
             orientation.toLong(),
             isFavorite,
+            playbackStyle = playbackStyle,
           )
           yield(AssetResult.ValidAsset(asset, bucketId))
         }
@@ -161,6 +191,81 @@ open class NativeSyncApiImplBase(context: Context) : ImmichPlugin() {
     }
   }
 
+  /**
+   * Detects the playback style for an asset using _special_format (API 33+)
+   * or XMP / MIME / RIFF header fallbacks (pre-33).
+   */
+  @SuppressLint("NewApi")
+  private fun detectPlaybackStyle(
+    assetId: Long,
+    rawMediaType: Int,
+    specialFormatColumn: Int,
+    xmpColumn: Int,
+    cursor: Cursor
+  ): PlatformAssetPlaybackStyle {
+    // video currently has no special formats, so we can short circuit and avoid unnecessary work
+    if (rawMediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_VIDEO) {
+      return PlatformAssetPlaybackStyle.VIDEO
+    }
+
+    // API 33+: use _special_format from cursor
+    if (specialFormatColumn != -1) {
+      val specialFormat = cursor.getInt(specialFormatColumn)
+      return when {
+        specialFormat == SPECIAL_FORMAT_MOTION_PHOTO -> PlatformAssetPlaybackStyle.LIVE_PHOTO
+        specialFormat == SPECIAL_FORMAT_GIF || specialFormat == SPECIAL_FORMAT_ANIMATED_WEBP -> PlatformAssetPlaybackStyle.IMAGE_ANIMATED
+        rawMediaType == MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE -> PlatformAssetPlaybackStyle.IMAGE
+        else -> PlatformAssetPlaybackStyle.UNKNOWN
+      }
+    }
+
+    if (rawMediaType != MediaStore.Files.FileColumns.MEDIA_TYPE_IMAGE) {
+      return PlatformAssetPlaybackStyle.UNKNOWN
+    }
+
+    // Pre-API 33 fallback
+    val uri = ContentUris.withAppendedId(
+      MediaStore.Files.getContentUri(MediaStore.VOLUME_EXTERNAL),
+      assetId
+    )
+
+    // Read XMP from cursor (API 30+) or ExifInterface stream (pre-30)
+    val xmp: String? = if (xmpColumn != -1) {
+      cursor.getBlob(xmpColumn)?.toString(Charsets.UTF_8)
+    } else {
+      try {
+        ctx.contentResolver.openInputStream(uri)?.use { stream ->
+          ExifInterface(stream).getAttribute(ExifInterface.TAG_XMP)
+        }
+      } catch (e: Exception) {
+        Log.w(TAG, "Failed to read XMP for asset $assetId", e)
+        null
+      }
+    }
+
+    if (xmp != null && "Camera:MotionPhoto" in xmp) {
+      return PlatformAssetPlaybackStyle.LIVE_PHOTO
+    }
+
+    try {
+      ctx.contentResolver.openInputStream(uri)?.use { stream ->
+        val glide = Glide.get(ctx)
+        val type = ImageHeaderParserUtils.getType(
+          glide.registry.imageHeaderParsers,
+          stream,
+          glide.arrayPool
+        )
+        if (type == ImageHeaderParser.ImageType.GIF || type == ImageHeaderParser.ImageType.ANIMATED_WEBP) {
+          return PlatformAssetPlaybackStyle.IMAGE_ANIMATED
+        }
+      }
+    } catch (e: Exception) {
+      Log.w(TAG, "Failed to parse image header for asset $assetId", e)
+    }
+
+    return PlatformAssetPlaybackStyle.IMAGE
+  }
+
   fun getAlbums(): List<PlatformAlbum> {
     val albums = mutableListOf<PlatformAlbum>()
     val albumsCount = mutableMapOf<String, Int>()

mobile/ios/Runner/Images/LocalImages.g.swift

@@ -70,7 +70,7 @@ class LocalImagesPigeonCodec: FlutterStandardMessageCodec, @unchecked Sendable {
 
 /// Generated protocol from Pigeon that represents a handler of messages from Flutter.
 protocol LocalImageApi {
-  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
+  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, preferEncoded: Bool, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
   func cancelRequest(requestId: Int64) throws
   func getThumbhash(thumbhash: String, completion: @escaping (Result<[String: Int64], Error>) -> Void)
 }
@@ -90,7 +90,8 @@ class LocalImageApiSetup {
         let widthArg = args[2] as! Int64
         let heightArg = args[3] as! Int64
         let isVideoArg = args[4] as! Bool
-        api.requestImage(assetId: assetIdArg, requestId: requestIdArg, width: widthArg, height: heightArg, isVideo: isVideoArg) { result in
+        let preferEncodedArg = args[5] as! Bool
+        api.requestImage(assetId: assetIdArg, requestId: requestIdArg, width: widthArg, height: heightArg, isVideo: isVideoArg, preferEncoded: preferEncodedArg) { result in
           switch result {
           case .success(let res):
             reply(wrapResult(res))

mobile/ios/Runner/Images/LocalImagesImpl.swift

@@ -7,7 +7,7 @@ class LocalImageRequest {
   weak var workItem: DispatchWorkItem?
   var isCancelled = false
   let callback: (Result<[String: Int64]?, any Error>) -> Void
-  
+
   init(callback: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
     self.callback = callback
   }
@@ -30,11 +30,11 @@ class LocalImageApiImpl: LocalImageApi {
     requestOptions.version = .current
     return requestOptions
   }()
-  
+
   private static let assetQueue = DispatchQueue(label: "thumbnail.assets", qos: .userInitiated)
   private static let requestQueue = DispatchQueue(label: "thumbnail.requests", qos: .userInitiated)
   private static let cancelQueue = DispatchQueue(label: "thumbnail.cancellation", qos: .default)
-  
+
   private static var rgbaFormat = vImage_CGImageFormat(
     bitsPerComponent: 8,
     bitsPerPixel: 32,
@@ -48,12 +48,12 @@ class LocalImageApiImpl: LocalImageApi {
     assetCache.countLimit = 10000
     return assetCache
   }()
-  
+
   func getThumbhash(thumbhash: String, completion: @escaping (Result<[String : Int64], any Error>) -> Void) {
     ImageProcessing.queue.async {
       guard let data = Data(base64Encoded: thumbhash)
       else { return completion(.failure(PigeonError(code: "", message: "Invalid base64 string: \(thumbhash)", details: nil)))}
-      
+
       let (width, height, pointer) = thumbHashToRGBA(hash: data)
       completion(.success([
         "pointer": Int64(Int(bitPattern: pointer.baseAddress)),
@@ -63,34 +63,77 @@ class LocalImageApiImpl: LocalImageApi {
       ]))
     }
   }
-  
-  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, completion: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
+
+  func requestImage(assetId: String, requestId: Int64, width: Int64, height: Int64, isVideo: Bool, preferEncoded: Bool, completion: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
     let request = LocalImageRequest(callback: completion)
     let item = DispatchWorkItem {
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       ImageProcessing.semaphore.wait()
       defer {
         ImageProcessing.semaphore.signal()
       }
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       guard let asset = Self.requestAsset(assetId: assetId)
       else {
         Self.remove(requestId: requestId)
         completion(.failure(PigeonError(code: "", message: "Could not get asset data for \(assetId)", details: nil)))
         return
       }
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
+      if preferEncoded {
+        let dataOptions = PHImageRequestOptions()
+        dataOptions.isNetworkAccessAllowed = true
+        dataOptions.isSynchronous = true
+        dataOptions.version = .current
+
+        var imageData: Data?
+        Self.imageManager.requestImageDataAndOrientation(
+          for: asset,
+          options: dataOptions,
+          resultHandler: { (data, _, _, _) in
+            imageData = data
+          }
+        )
+
+        if request.isCancelled {
+          Self.remove(requestId: requestId)
+          return completion(ImageProcessing.cancelledResult)
+        }
+
+        guard let data = imageData else {
+          Self.remove(requestId: requestId)
+          return completion(.failure(PigeonError(code: "", message: "Could not get image data for \(assetId)", details: nil)))
+        }
+
+        let length = data.count
+        let pointer = malloc(length)!
+        data.copyBytes(to: pointer.assumingMemoryBound(to: UInt8.self), count: length)
+
+        if request.isCancelled {
+          free(pointer)
+          Self.remove(requestId: requestId)
+          return completion(ImageProcessing.cancelledResult)
+        }
+
+        request.callback(.success([
+          "pointer": Int64(Int(bitPattern: pointer)),
+          "length": Int64(length),
+        ]))
+        Self.remove(requestId: requestId)
+        return
+      }
+
       var image: UIImage?
       Self.imageManager.requestImage(
         for: asset,
@@ -101,29 +144,29 @@ class LocalImageApiImpl: LocalImageApi {
           image = _image
         }
       )
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       guard let image = image,
             let cgImage = image.cgImage else {
         Self.remove(requestId: requestId)
         return completion(.failure(PigeonError(code: "", message: "Could not get pixel data for \(assetId)", details: nil)))
       }
-      
+
       if request.isCancelled {
         return completion(ImageProcessing.cancelledResult)
       }
-      
+
       do {
         let buffer = try vImage_Buffer(cgImage: cgImage, format: Self.rgbaFormat)
-        
+
         if request.isCancelled {
           buffer.free()
           return completion(ImageProcessing.cancelledResult)
         }
-        
+
         request.callback(.success([
           "pointer": Int64(Int(bitPattern: buffer.data)),
           "width": Int64(buffer.width),
@@ -136,24 +179,24 @@ class LocalImageApiImpl: LocalImageApi {
         return completion(.failure(PigeonError(code: "", message: "Failed to convert image for \(assetId): \(error)", details: nil)))
       }
     }
-    
+
     request.workItem = item
     Self.add(requestId: requestId, request: request)
     ImageProcessing.queue.async(execute: item)
   }
-  
+
   func cancelRequest(requestId: Int64) {
     Self.cancel(requestId: requestId)
   }
-  
+
   private static func add(requestId: Int64, request: LocalImageRequest) -> Void {
     requestQueue.sync { requests[requestId] = request }
   }
-  
+
   private static func remove(requestId: Int64) -> Void {
     requestQueue.sync { requests[requestId] = nil }
   }
-  
+
   private static func cancel(requestId: Int64) -> Void {
     requestQueue.async {
       guard let request = requests.removeValue(forKey: requestId) else { return }
@@ -164,12 +207,12 @@ class LocalImageApiImpl: LocalImageApi {
       }
     }
   }
-  
+
   private static func requestAsset(assetId: String) -> PHAsset? {
     var asset: PHAsset?
     assetQueue.sync { asset = assetCache.object(forKey: assetId as NSString) }
     if asset != nil { return asset }
-    
+
     guard let asset = PHAsset.fetchAssets(withLocalIdentifiers: [assetId], options: Self.fetchOptions).firstObject
     else { return nil }
     assetQueue.async { assetCache.setObject(asset, forKey: assetId as NSString) }

mobile/ios/Runner/Images/RemoteImages.g.swift

@@ -70,7 +70,7 @@ class RemoteImagesPigeonCodec: FlutterStandardMessageCodec, @unchecked Sendable
 
 /// Generated protocol from Pigeon that represents a handler of messages from Flutter.
 protocol RemoteImageApi {
-  func requestImage(url: String, headers: [String: String], requestId: Int64, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
+  func requestImage(url: String, headers: [String: String], requestId: Int64, preferEncoded: Bool, completion: @escaping (Result<[String: Int64]?, Error>) -> Void)
   func cancelRequest(requestId: Int64) throws
   func clearCache(completion: @escaping (Result<Int64, Error>) -> Void)
 }
@@ -88,7 +88,8 @@ class RemoteImageApiSetup {
         let urlArg = args[0] as! String
         let headersArg = args[1] as! [String: String]
         let requestIdArg = args[2] as! Int64
-        api.requestImage(url: urlArg, headers: headersArg, requestId: requestIdArg) { result in
+        let preferEncodedArg = args[3] as! Bool
+        api.requestImage(url: urlArg, headers: headersArg, requestId: requestIdArg, preferEncoded: preferEncodedArg) { result in
           switch result {
           case .success(let res):
             reply(wrapResult(res))

mobile/ios/Runner/Images/RemoteImagesImpl.swift

@@ -8,7 +8,7 @@ class RemoteImageRequest {
   let id: Int64
   var isCancelled = false
   let completion: (Result<[String: Int64]?, any Error>) -> Void
-  
+
   init(id: Int64, task: URLSessionDataTask, completion: @escaping (Result<[String: Int64]?, any Error>) -> Void) {
     self.id = id
     self.task = task
@@ -32,75 +32,93 @@ class RemoteImageApiImpl: NSObject, RemoteImageApi {
     kCGImageSourceCreateThumbnailWithTransform: true,
     kCGImageSourceCreateThumbnailFromImageAlways: true
   ] as CFDictionary
-  
-  func requestImage(url: String, headers: [String : String], requestId: Int64, completion: @escaping (Result<[String : Int64]?, any Error>) -> Void) {
+
+  func requestImage(url: String, headers: [String : String], requestId: Int64, preferEncoded: Bool, completion: @escaping (Result<[String : Int64]?, any Error>) -> Void) {
     var urlRequest = URLRequest(url: URL(string: url)!)
     urlRequest.cachePolicy = .returnCacheDataElseLoad
     for (key, value) in headers {
       urlRequest.setValue(value, forHTTPHeaderField: key)
     }
-    
+
     let task = URLSessionManager.shared.session.dataTask(with: urlRequest) { data, response, error in
-      Self.handleCompletion(requestId: requestId, data: data, response: response, error: error)
+      Self.handleCompletion(requestId: requestId, encoded: preferEncoded, data: data, response: response, error: error)
     }
-    
+
     let request = RemoteImageRequest(id: requestId, task: task, completion: completion)
-    
+
     os_unfair_lock_lock(&Self.lock)
     Self.requests[requestId] = request
     os_unfair_lock_unlock(&Self.lock)
-    
+
     task.resume()
   }
-  
-  private static func handleCompletion(requestId: Int64, data: Data?, response: URLResponse?, error: Error?) {
+
+  private static func handleCompletion(requestId: Int64, encoded: Bool, data: Data?, response: URLResponse?, error: Error?) {
     os_unfair_lock_lock(&Self.lock)
     guard let request = requests[requestId] else {
       return os_unfair_lock_unlock(&Self.lock)
     }
     requests[requestId] = nil
     os_unfair_lock_unlock(&Self.lock)
-    
+
     if let error = error {
       if request.isCancelled || (error as NSError).code == NSURLErrorCancelled {
         return request.completion(ImageProcessing.cancelledResult)
       }
       return request.completion(.failure(error))
     }
-    
+
     if request.isCancelled {
       return request.completion(ImageProcessing.cancelledResult)
     }
-    
+
     guard let data = data else {
       return request.completion(.failure(PigeonError(code: "", message: "No data received", details: nil)))
     }
-    
+
     ImageProcessing.queue.async {
       ImageProcessing.semaphore.wait()
       defer { ImageProcessing.semaphore.signal() }
-      
+
       if request.isCancelled {
         return request.completion(ImageProcessing.cancelledResult)
       }
-      
+
+      // Return raw encoded bytes when requested (for animated images)
+      if encoded {
+        let length = data.count
+        let pointer = malloc(length)!
+        data.copyBytes(to: pointer.assumingMemoryBound(to: UInt8.self), count: length)
+
+        if request.isCancelled {
+          free(pointer)
+          return request.completion(ImageProcessing.cancelledResult)
+        }
+
+        return request.completion(
+          .success([
+            "pointer": Int64(Int(bitPattern: pointer)),
+            "length": Int64(length),
+          ]))
+      }
+
       guard let imageSource = CGImageSourceCreateWithData(data as CFData, nil),
             let cgImage = CGImageSourceCreateThumbnailAtIndex(imageSource, 0, decodeOptions) else {
         return request.completion(.failure(PigeonError(code: "", message: "Failed to decode image for request", details: nil)))
       }
-      
+
       if request.isCancelled {
         return request.completion(ImageProcessing.cancelledResult)
       }
-      
+
       do {
         let buffer = try vImage_Buffer(cgImage: cgImage, format: rgbaFormat)
-        
+
         if request.isCancelled {
           buffer.free()
           return request.completion(ImageProcessing.cancelledResult)
         }
-        
+
         request.completion(
           .success([
             "pointer": Int64(Int(bitPattern: buffer.data)),
@@ -113,17 +131,17 @@ class RemoteImageApiImpl: NSObject, RemoteImageApi {
       }
     }
   }
-  
+
   func cancelRequest(requestId: Int64) {
     os_unfair_lock_lock(&Self.lock)
     let request = Self.requests[requestId]
     os_unfair_lock_unlock(&Self.lock)
-    
+
     guard let request = request else { return }
     request.isCancelled = true
     request.task?.cancel()
   }
-  
+
   func clearCache(completion: @escaping (Result<Int64, any Error>) -> Void) {
     Task {
       let cache = URLSessionManager.shared.session.configuration.urlCache!

mobile/ios/Runner/Sync/Messages.g.swift

@@ -128,6 +128,15 @@ func deepHashMessages(value: Any?, hasher: inout Hasher) {
 
     
 
+enum PlatformAssetPlaybackStyle: Int {
+  case unknown = 0
+  case image = 1
+  case video = 2
+  case imageAnimated = 3
+  case livePhoto = 4
+  case videoLooping = 5
+}
+
 /// Generated class from Pigeon that represents data sent in messages.
 struct PlatformAsset: Hashable {
   var id: String
@@ -143,6 +152,7 @@ struct PlatformAsset: Hashable {
   var adjustmentTime: Int64? = nil
   var latitude: Double? = nil
   var longitude: Double? = nil
+  var playbackStyle: PlatformAssetPlaybackStyle
 
 
   // swift-format-ignore: AlwaysUseLowerCamelCase
@@ -160,6 +170,7 @@ struct PlatformAsset: Hashable {
     let adjustmentTime: Int64? = nilOrValue(pigeonVar_list[10])
     let latitude: Double? = nilOrValue(pigeonVar_list[11])
     let longitude: Double? = nilOrValue(pigeonVar_list[12])
+    let playbackStyle = pigeonVar_list[13] as! PlatformAssetPlaybackStyle
 
     return PlatformAsset(
       id: id,
@@ -174,7 +185,8 @@ struct PlatformAsset: Hashable {
       isFavorite: isFavorite,
       adjustmentTime: adjustmentTime,
       latitude: latitude,
-      longitude: longitude
+      longitude: longitude,
+      playbackStyle: playbackStyle
     )
   }
   func toList() -> [Any?] {
@@ -192,6 +204,7 @@ struct PlatformAsset: Hashable {
       adjustmentTime,
       latitude,
       longitude,
+      playbackStyle,
     ]
   }
   static func == (lhs: PlatformAsset, rhs: PlatformAsset) -> Bool {
@@ -349,14 +362,20 @@ private class MessagesPigeonCodecReader: FlutterStandardReader {
   override func readValue(ofType type: UInt8) -> Any? {
     switch type {
     case 129:
-      return PlatformAsset.fromList(self.readValue() as! [Any?])
+      let enumResultAsInt: Int? = nilOrValue(self.readValue() as! Int?)
+      if let enumResultAsInt = enumResultAsInt {
+        return PlatformAssetPlaybackStyle(rawValue: enumResultAsInt)
+      }
+      return nil
     case 130:
-      return PlatformAlbum.fromList(self.readValue() as! [Any?])
+      return PlatformAsset.fromList(self.readValue() as! [Any?])
     case 131:
-      return SyncDelta.fromList(self.readValue() as! [Any?])
+      return PlatformAlbum.fromList(self.readValue() as! [Any?])
     case 132:
-      return HashResult.fromList(self.readValue() as! [Any?])
+      return SyncDelta.fromList(self.readValue() as! [Any?])
     case 133:
+      return HashResult.fromList(self.readValue() as! [Any?])
+    case 134:
       return CloudIdResult.fromList(self.readValue() as! [Any?])
     default:
       return super.readValue(ofType: type)
@@ -366,21 +385,24 @@ private class MessagesPigeonCodecReader: FlutterStandardReader {
 
 private class MessagesPigeonCodecWriter: FlutterStandardWriter {
   override func writeValue(_ value: Any) {
-    if let value = value as? PlatformAsset {
+    if let value = value as? PlatformAssetPlaybackStyle {
       super.writeByte(129)
-      super.writeValue(value.toList())
-    } else if let value = value as? PlatformAlbum {
+      super.writeValue(value.rawValue)
+    } else if let value = value as? PlatformAsset {
       super.writeByte(130)
       super.writeValue(value.toList())
-    } else if let value = value as? SyncDelta {
+    } else if let value = value as? PlatformAlbum {
       super.writeByte(131)
       super.writeValue(value.toList())
-    } else if let value = value as? HashResult {
+    } else if let value = value as? SyncDelta {
       super.writeByte(132)
       super.writeValue(value.toList())
-    } else if let value = value as? CloudIdResult {
+    } else if let value = value as? HashResult {
       super.writeByte(133)
       super.writeValue(value.toList())
+    } else if let value = value as? CloudIdResult {
+      super.writeByte(134)
+      super.writeValue(value.toList())
     } else {
       super.writeValue(value)
     }

mobile/ios/Runner/Sync/MessagesImpl.swift

@@ -173,7 +173,8 @@ class NativeSyncApiImpl: ImmichPlugin, NativeSyncApi, FlutterPlugin {
             type: 0,
             durationInSeconds: 0,
             orientation: 0,
-            isFavorite: false
+            isFavorite: false,
+            playbackStyle: .unknown
           )
           if (updatedAssets.contains(AssetWrapper(with: predicate))) {
             continue

mobile/ios/Runner/Sync/PHAssetExtensions.swift

@@ -1,6 +1,17 @@
 import Photos
 
 extension PHAsset {
+  var platformPlaybackStyle: PlatformAssetPlaybackStyle {
+    switch playbackStyle {
+    case .image: return .image
+    case .imageAnimated: return .imageAnimated
+    case .livePhoto: return .livePhoto
+    case .video: return .video
+    case .videoLooping: return .videoLooping
+    @unknown default: return .unknown
+    }
+  }
+
   func toPlatformAsset() -> PlatformAsset {
     return PlatformAsset(
       id: localIdentifier,
@@ -15,7 +26,8 @@ extension PHAsset {
       isFavorite: isFavorite,
       adjustmentTime: adjustmentTimestamp,
       latitude: location?.coordinate.latitude,
-      longitude: location?.coordinate.longitude
+      longitude: location?.coordinate.longitude,
+      playbackStyle: platformPlaybackStyle
     )
   }
 
@@ -26,7 +38,7 @@ extension PHAsset {
   var filename: String? {
     return value(forKey: "filename") as? String
   }
-  
+
   var adjustmentTimestamp: Int64? {
     if let date = value(forKey: "adjustmentTimestamp") as? Date {
       return Int64(date.timeIntervalSince1970)

mobile/lib/infrastructure/loaders/image_request.dart

@@ -24,6 +24,8 @@ abstract class ImageRequest {
 
   Future<ImageInfo?> load(ImageDecoderCallback decode, {double scale = 1.0});
 
+  Future<ui.Codec?> loadCodec();
+
   void cancel() {
     if (_isCancelled) {
       return;
@@ -34,7 +36,7 @@ abstract class ImageRequest {
 
   void _onCancelled();
 
-  Future<ui.FrameInfo?> _fromEncodedPlatformImage(int address, int length) async {
+  Future<(ui.Codec, ui.ImageDescriptor)?> _codecFromEncodedPlatformImage(int address, int length) async {
     final pointer = Pointer<Uint8>.fromAddress(address);
     if (_isCancelled) {
       malloc.free(pointer);
@@ -67,6 +69,20 @@ abstract class ImageRequest {
       return null;
     }
 
+    return (codec, descriptor);
+  }
+
+  Future<ui.FrameInfo?> _fromEncodedPlatformImage(int address, int length) async {
+    final result = await _codecFromEncodedPlatformImage(address, length);
+    if (result == null) return null;
+
+    final (codec, descriptor) = result;
+    if (_isCancelled) {
+      descriptor.dispose();
+      codec.dispose();
+      return null;
+    }
+
     final frame = await codec.getNextFrame();
     descriptor.dispose();
     codec.dispose();

mobile/lib/infrastructure/loaders/local_image_request.dart

@@ -22,6 +22,7 @@ class LocalImageRequest extends ImageRequest {
       width: width,
       height: height,
       isVideo: assetType == AssetType.video,
+      preferEncoded: false,
     );
     if (info == null) {
       return null;
@@ -31,6 +32,26 @@ class LocalImageRequest extends ImageRequest {
     return frame == null ? null : ImageInfo(image: frame.image, scale: scale);
   }
 
+  @override
+  Future<ui.Codec?> loadCodec() async {
+    if (_isCancelled) {
+      return null;
+    }
+
+    final info = await localImageApi.requestImage(
+      localId,
+      requestId: requestId,
+      width: width,
+      height: height,
+      isVideo: assetType == AssetType.video,
+      preferEncoded: true,
+    );
+    if (info == null) return null;
+
+    final (codec, _) = await _codecFromEncodedPlatformImage(info['pointer']!, info['length']!) ?? (null, null);
+    return codec;
+  }
+
   @override
   Future<void> _onCancelled() {
     return localImageApi.cancelRequest(requestId);

mobile/lib/infrastructure/loaders/remote_image_request.dart

@@ -12,7 +12,8 @@ class RemoteImageRequest extends ImageRequest {
       return null;
     }
 
-    final info = await remoteImageApi.requestImage(uri, headers: headers, requestId: requestId);
+    final info = await remoteImageApi.requestImage(uri, headers: headers, requestId: requestId, preferEncoded: false);
+    // Android always returns encoded data, so we need to check for both shapes of the response.
     final frame = switch (info) {
       {'pointer': int pointer, 'length': int length} => await _fromEncodedPlatformImage(pointer, length),
       {'pointer': int pointer, 'width': int width, 'height': int height, 'rowBytes': int rowBytes} =>
@@ -22,6 +23,19 @@ class RemoteImageRequest extends ImageRequest {
     return frame == null ? null : ImageInfo(image: frame.image, scale: scale);
   }
 
+  @override
+  Future<ui.Codec?> loadCodec() async {
+    if (_isCancelled) {
+      return null;
+    }
+
+    final info = await remoteImageApi.requestImage(uri, headers: headers, requestId: requestId, preferEncoded: true);
+    if (info == null) return null;
+
+    final (codec, _) = await _codecFromEncodedPlatformImage(info['pointer']!, info['length']!) ?? (null, null);
+    return codec;
+  }
+
   @override
   Future<void> _onCancelled() {
     return remoteImageApi.cancelRequest(requestId);

mobile/lib/infrastructure/loaders/thumbhash_image_request.dart

@@ -16,6 +16,9 @@ class ThumbhashImageRequest extends ImageRequest {
     return frame == null ? null : ImageInfo(image: frame.image, scale: scale);
   }
 
+  @override
+  Future<ui.Codec?> loadCodec() => throw UnsupportedError('Thumbhash does not support codec loading');
+
   @override
   void _onCancelled() {}
 }

mobile/lib/platform/local_image_api.g.dart

@@ -55,6 +55,7 @@ class LocalImageApi {
     required int width,
     required int height,
     required bool isVideo,
+    required bool preferEncoded,
   }) async {
     final String pigeonVar_channelName =
         'dev.flutter.pigeon.immich_mobile.LocalImageApi.requestImage$pigeonVar_messageChannelSuffix';
@@ -69,6 +70,7 @@ class LocalImageApi {
       width,
       height,
       isVideo,
+      preferEncoded,
     ]);
     final List<Object?>? pigeonVar_replyList = await pigeonVar_sendFuture as List<Object?>?;
     if (pigeonVar_replyList == null) {

mobile/lib/platform/native_sync_api.g.dart

@@ -29,6 +29,8 @@ bool _deepEquals(Object? a, Object? b) {
   return a == b;
 }
 
+enum PlatformAssetPlaybackStyle { unknown, image, video, imageAnimated, livePhoto, videoLooping }
+
 class PlatformAsset {
   PlatformAsset({
     required this.id,
@@ -44,6 +46,7 @@ class PlatformAsset {
     this.adjustmentTime,
     this.latitude,
     this.longitude,
+    required this.playbackStyle,
   });
 
   String id;
@@ -72,6 +75,8 @@ class PlatformAsset {
 
   double? longitude;
 
+  PlatformAssetPlaybackStyle playbackStyle;
+
   List<Object?> _toList() {
     return <Object?>[
       id,
@@ -87,6 +92,7 @@ class PlatformAsset {
       adjustmentTime,
       latitude,
       longitude,
+      playbackStyle,
     ];
   }
 
@@ -110,6 +116,7 @@ class PlatformAsset {
       adjustmentTime: result[10] as int?,
       latitude: result[11] as double?,
       longitude: result[12] as double?,
+      playbackStyle: result[13]! as PlatformAssetPlaybackStyle,
     );
   }
 
@@ -316,21 +323,24 @@ class _PigeonCodec extends StandardMessageCodec {
     if (value is int) {
       buffer.putUint8(4);
       buffer.putInt64(value);
-    } else if (value is PlatformAsset) {
+    } else if (value is PlatformAssetPlaybackStyle) {
       buffer.putUint8(129);
-      writeValue(buffer, value.encode());
-    } else if (value is PlatformAlbum) {
+      writeValue(buffer, value.index);
+    } else if (value is PlatformAsset) {
       buffer.putUint8(130);
       writeValue(buffer, value.encode());
-    } else if (value is SyncDelta) {
+    } else if (value is PlatformAlbum) {
       buffer.putUint8(131);
       writeValue(buffer, value.encode());
-    } else if (value is HashResult) {
+    } else if (value is SyncDelta) {
       buffer.putUint8(132);
       writeValue(buffer, value.encode());
-    } else if (value is CloudIdResult) {
+    } else if (value is HashResult) {
       buffer.putUint8(133);
       writeValue(buffer, value.encode());
+    } else if (value is CloudIdResult) {
+      buffer.putUint8(134);
+      writeValue(buffer, value.encode());
     } else {
       super.writeValue(buffer, value);
     }
@@ -340,14 +350,17 @@ class _PigeonCodec extends StandardMessageCodec {
   Object? readValueOfType(int type, ReadBuffer buffer) {
     switch (type) {
       case 129:
-        return PlatformAsset.decode(readValue(buffer)!);
+        final int? value = readValue(buffer) as int?;
+        return value == null ? null : PlatformAssetPlaybackStyle.values[value];
       case 130:
-        return PlatformAlbum.decode(readValue(buffer)!);
+        return PlatformAsset.decode(readValue(buffer)!);
       case 131:
-        return SyncDelta.decode(readValue(buffer)!);
+        return PlatformAlbum.decode(readValue(buffer)!);
       case 132:
-        return HashResult.decode(readValue(buffer)!);
+        return SyncDelta.decode(readValue(buffer)!);
       case 133:
+        return HashResult.decode(readValue(buffer)!);
+      case 134:
         return CloudIdResult.decode(readValue(buffer)!);
       default:
         return super.readValueOfType(type, buffer);

mobile/lib/platform/remote_image_api.g.dart

@@ -53,6 +53,7 @@ class RemoteImageApi {
     String url, {
     required Map<String, String> headers,
     required int requestId,
+    required bool preferEncoded,
   }) async {
     final String pigeonVar_channelName =
         'dev.flutter.pigeon.immich_mobile.RemoteImageApi.requestImage$pigeonVar_messageChannelSuffix';
@@ -61,7 +62,12 @@ class RemoteImageApi {
       pigeonChannelCodec,
       binaryMessenger: pigeonVar_binaryMessenger,
     );
-    final Future<Object?> pigeonVar_sendFuture = pigeonVar_channel.send(<Object?>[url, headers, requestId]);
+    final Future<Object?> pigeonVar_sendFuture = pigeonVar_channel.send(<Object?>[
+      url,
+      headers,
+      requestId,
+      preferEncoded,
+    ]);
     final List<Object?>? pigeonVar_replyList = await pigeonVar_sendFuture as List<Object?>?;
     if (pigeonVar_replyList == null) {
       throw _createConnectionError(pigeonVar_channelName);

mobile/lib/presentation/widgets/images/image_provider.dart

@@ -1,3 +1,5 @@
+import 'dart:ui' as ui;
+
 import 'package:async/async.dart';
 import 'package:flutter/widgets.dart';
 import 'package:immich_mobile/domain/models/asset/base_asset.model.dart';
@@ -75,6 +77,29 @@ mixin CancellableImageProviderMixin<T extends Object> on CancellableImageProvide
     }
   }
 
+  Future<ui.Codec?> loadCodecRequest(ImageRequest request) async {
+    if (isCancelled) {
+      this.request = null;
+      PaintingBinding.instance.imageCache.evict(this);
+      return null;
+    }
+
+    try {
+      final codec = await request.loadCodec();
+      if (codec == null || isCancelled) {
+        codec?.dispose();
+        PaintingBinding.instance.imageCache.evict(this);
+        return null;
+      }
+      return codec;
+    } catch (e) {
+      PaintingBinding.instance.imageCache.evict(this);
+      rethrow;
+    } finally {
+      this.request = null;
+    }
+  }
+
   Stream<ImageInfo> initialImageStream() async* {
     final cachedOperation = this.cachedOperation;
     if (cachedOperation == null) {

mobile/pigeon/local_image_api.dart

@@ -21,6 +21,7 @@ abstract class LocalImageApi {
     required int width,
     required int height,
     required bool isVideo,
+    required bool preferEncoded,
   });
 
   void cancelRequest(int requestId);

mobile/pigeon/native_sync_api.dart

@@ -11,6 +11,15 @@ import 'package:pigeon/pigeon.dart';
     dartPackageName: 'immich_mobile',
   ),
 )
+enum PlatformAssetPlaybackStyle {
+  unknown,
+  image,
+  video,
+  imageAnimated,
+  livePhoto,
+  videoLooping,
+}
+
 class PlatformAsset {
   final String id;
   final String name;
@@ -31,6 +40,8 @@ class PlatformAsset {
   final double? latitude;
   final double? longitude;
 
+  final PlatformAssetPlaybackStyle playbackStyle;
+
   const PlatformAsset({
     required this.id,
     required this.name,
@@ -45,6 +56,7 @@ class PlatformAsset {
     this.adjustmentTime,
     this.latitude,
     this.longitude,
+    this.playbackStyle = PlatformAssetPlaybackStyle.unknown,
   });
 }
 

mobile/pigeon/remote_image_api.dart

@@ -19,6 +19,7 @@ abstract class RemoteImageApi {
     String url, {
     required Map<String, String> headers,
     required int requestId,
+    required bool preferEncoded,
   });
 
   void cancelRequest(int requestId);

mobile/test/domain/services/local_sync_service_test.dart

@@ -131,6 +131,7 @@ void main() {
         durationInSeconds: 0,
         orientation: 0,
         isFavorite: false,
+        playbackStyle: PlatformAssetPlaybackStyle.image
       );
 
       final assetsToRestore = [LocalAssetStub.image1];
@@ -214,6 +215,7 @@ void main() {
         isFavorite: false,
         createdAt: 1700000000,
         updatedAt: 1732000000,
+        playbackStyle: PlatformAssetPlaybackStyle.image
       );
 
       final localAsset = platformAsset.toLocalAsset();

server/src/maintenance/maintenance-worker.service.ts

@@ -30,6 +30,7 @@ import { type ServerService as _ServerService } from 'src/services/server.servic
 import { type VersionService as _VersionService } from 'src/services/version.service';
 import { MaintenanceModeState } from 'src/types';
 import { getConfig } from 'src/utils/config';
+import { extractCsp } from 'src/utils/csp';
 import { createMaintenanceLoginUrl, detectPriorInstall } from 'src/utils/maintenance';
 import { getExternalDomain } from 'src/utils/misc';
 
@@ -134,6 +135,9 @@ export class MaintenanceWorkerService {
       this.logger.warn(`Unable to open ${resourcePaths.web.indexHtml}, skipping SSR.`);
     }
 
+    const { csp, html: indexWithoutCspMeta } = extractCsp(index);
+    index = indexWithoutCspMeta;
+
     return (request: Request, res: Response, next: NextFunction) => {
       if (
         request.url.startsWith('/api') ||
@@ -150,6 +154,9 @@ export class MaintenanceWorkerService {
         return res.redirect(`${maintenancePath}?${params}`);
       }
 
+      if (csp) {
+        res.header('Content-Security-Policy', csp);
+      }
       res.status(200).type('text/html').header('Cache-Control', 'no-store').send(index);
     };
   }

server/src/services/api.service.ts

@@ -9,6 +9,7 @@ import { LoggingRepository } from 'src/repositories/logging.repository';
 import { AuthService } from 'src/services/auth.service';
 import { SharedLinkService } from 'src/services/shared-link.service';
 import { VersionService } from 'src/services/version.service';
+import { augmentCsp, extractCsp } from 'src/utils/csp';
 import { OpenGraphTags } from 'src/utils/misc';
 
 export const render = (index: string, meta: OpenGraphTags) => {
@@ -62,6 +63,12 @@ export class ApiService {
       this.logger.warn(`Unable to open ${resourcePaths.web.indexHtml}, skipping SSR.`);
     }
 
+    const { csp: baseCsp, html: indexWithoutCspMeta } = extractCsp(index);
+    index = indexWithoutCspMeta;
+    const csp = augmentCsp(baseCsp, {
+      'connect-src': ['wss:', 'https://pay.futo.org', 'https://buy.immich.app'],
+    });
+
     return async (request: Request, res: Response, next: NextFunction) => {
       const method = request.method.toLowerCase();
       if (
@@ -105,6 +112,9 @@ export class ApiService {
         html = render(index, meta);
       }
 
+      if (csp) {
+        res.header('Content-Security-Policy', csp);
+      }
       res.status(status).type('text/html').header('Cache-Control', 'no-store').send(html);
     };
   }

server/src/utils/csp.ts

@@ -0,0 +1,41 @@
+const CSP_META_REGEX = /<meta\s+http-equiv="content-security-policy"\s+content="([^"]+)"\s*\/?>/i;
+
+export function extractCsp(html: string): { csp: string; html: string } {
+  const match = html.match(CSP_META_REGEX);
+  if (!match) {
+    return { csp: '', html };
+  }
+
+  return {
+    csp: match[1],
+    html: html.replace(match[0], ''),
+  };
+}
+
+export function augmentCsp(baseCsp: string, additions: Record<string, string[]>): string {
+  if (!baseCsp) {
+    return '';
+  }
+
+  const directives = new Map<string, Set<string>>();
+
+  for (const part of baseCsp.split(';')) {
+    const trimmed = part.trim();
+    if (!trimmed) {
+      continue;
+    }
+
+    const [directive, ...values] = trimmed.split(/\s+/);
+    directives.set(directive, new Set(values));
+  }
+
+  for (const [directive, values] of Object.entries(additions)) {
+    const existing = directives.get(directive) ?? new Set<string>();
+    for (const value of values) {
+      existing.add(value);
+    }
+    directives.set(directive, existing);
+  }
+
+  return [...directives.entries()].map(([directive, values]) => `${directive} ${[...values].join(' ')}`).join('; ');
+}

web/svelte.config.js

@@ -22,6 +22,26 @@ const config = {
       fallback: 'index.html',
       precompress: true,
     }),
+    csp: {
+      mode: 'hash',
+      directives: {
+        'default-src': ['self'],
+        'script-src': [
+          'self',
+          'https://www.gstatic.com',
+          'wasm-unsafe-eval',
+          'sha256-h5wSYKWbmHcoYTdkHNNguMswVNCphpvwW+uxooXhF/Y=',
+        ],
+        'style-src': ['self', 'unsafe-inline'],
+        'img-src': ['self', 'data:', 'blob:', 'https:'],
+        'font-src': ['self'],
+        'connect-src': ['self', 'https:'],
+        'worker-src': ['self'],
+        'frame-src': ['none'],
+        'object-src': ['none'],
+        'base-uri': ['self'],
+      },
+    },
     alias: {
       $lib: 'src/lib',
       '$lib/*': 'src/lib/*',