release: v0.11.0 (#459)

Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.

## Headline changes since v0.10.0

- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)

Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).

## Verified

`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.

## After merge

Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

lib/__tests__/essay.test.ts

@@ -1,5 +1,11 @@
 import { describe, it, expect } from 'vitest';
-import { parseEssayMarkdown, parseFrontmatter, sanitizeHtml, renderInlineMarkdown, serializeEssayMarkdown } from '../essay';
+import {
+  parseEssayMarkdown,
+  parseFrontmatter,
+  sanitizeHtml,
+  renderInlineMarkdown,
+  serializeEssayMarkdown,
+} from '../essay';
 
 describe('Essay Parser', () => {
   it('sanitizes script tags to prevent XSS', () => {
@@ -20,7 +26,9 @@ describe('Essay Parser', () => {
     const rendered = renderInlineMarkdown(text);
     expect(rendered).toContain('<strong>bold</strong>');
     expect(rendered).toContain('<em>italic</em>');
-    expect(rendered).toContain('<a href="https://example.com" target="_blank" rel="noopener noreferrer">link</a>');
+    expect(rendered).toContain(
+      '<a href="https://example.com" target="_blank" rel="noopener noreferrer">link</a>',
+    );
   });
 
   it('parses frontmatter correctly', () => {
@@ -111,8 +119,17 @@ A closing paragraph with **bold** details.`;
         { type: 'heading' as const, level: 1, text: 'Chapter One' },
         { type: 'paragraph' as const, html: 'This is <strong>bold</strong> text.' },
         { type: 'quote' as const, text: 'A great quote', author: 'Person' },
-        { type: 'photo' as const, assetId: 'photo-1', caption: 'Caption', layout: 'fullbleed' as const },
-        { type: 'photo-pair' as const, assetIds: ['p1', 'p2'] as [string, string], caption: 'Pair caption' },
+        {
+          type: 'photo' as const,
+          assetId: 'photo-1',
+          caption: 'Caption',
+          layout: 'fullbleed' as const,
+        },
+        {
+          type: 'photo-pair' as const,
+          assetIds: ['p1', 'p2'] as [string, string],
+          caption: 'Pair caption',
+        },
       ],
       referencedAssetIds: ['photo-1', 'p1', 'p2'],
     };

lib/__tests__/journal.test.ts

@@ -4,8 +4,6 @@ import {
   serializeJournalMarkdown,
   sanitizeHtml,
   renderInlineMarkdown,
-  calculateReadingTime,
-  extractExcerpt,
   isValidSlug,
   sanitizeSlug,
 } from '../journal';
@@ -95,8 +93,15 @@ Es war ein stürmischer Tag am Fjord.
       expect(parsed.frontmatter.coverAssetId).toBe('cover-uuid-1');
 
       expect(parsed.blocks).toHaveLength(5);
-      expect(parsed.blocks[0]).toEqual({ type: 'heading', level: 1, text: 'Kapitel 1: Die Reise beginnt' });
-      expect(parsed.blocks[1]).toEqual({ type: 'paragraph', html: 'Es war ein stürmischer Tag am Fjord.' });
+      expect(parsed.blocks[0]).toEqual({
+        type: 'heading',
+        level: 1,
+        text: 'Kapitel 1: Die Reise beginnt',
+      });
+      expect(parsed.blocks[1]).toEqual({
+        type: 'paragraph',
+        html: 'Es war ein stürmischer Tag am Fjord.',
+      });
       expect(parsed.blocks[2]).toEqual({
         type: 'quote',
         text: 'Das Licht im Norden ist unvergleichlich.',

lib/__tests__/proofing-resolution.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect, vi } from 'vitest';
+
+// Mock env.ts so importing config.ts doesn't trigger validation
+vi.mock('@/lib/env', () => ({
+  env: {
+    IMMICH_API_URL: 'http://localhost:2283',
+    IMMICH_API_KEY: 'test-key',
+    SITE_TITLE: 'Test Gallery',
+    SITE_SUBTITLE: '',
+    CACHE_TTL: 300,
+    IMMICH_TIMEOUT_MS: 15000,
+    RATE_LIMIT_RPM: 120,
+    TRUSTED_PROXY_HOPS: 0,
+  },
+}));
+
+import { resolveProofing } from '@/lib/config';
+
+/**
+ * Client proofing hands a gallery to a client and takes their picks back, so
+ * whether it is on is a delivery decision, not a cosmetic one. The controls
+ * were previously mounted unconditionally and these settings were inert; these
+ * cover the precedence now that they are honoured.
+ */
+describe('resolveProofing', () => {
+  it('falls back to the global setting when the subpage says nothing', () => {
+    expect(resolveProofing(undefined, true)).toBe(true);
+    expect(resolveProofing(undefined, false)).toBe(false);
+    expect(resolveProofing({}, true)).toBe(true);
+    expect(resolveProofing({}, false)).toBe(false);
+  });
+
+  it('lets a subpage switch proofing on against a global off', () => {
+    // The client-handover case: proofing off across a public portfolio, on for
+    // the one subpage that is a delivery.
+    expect(resolveProofing({ proofing: true }, false)).toBe(true);
+  });
+
+  it('lets a subpage switch proofing off against a global on', () => {
+    // The regression guard: `||` instead of `??` would silently discard this,
+    // leaving hearts on a page that explicitly asked for none.
+    expect(resolveProofing({ proofing: false }, true)).toBe(false);
+  });
+
+  it('treats an explicit false as a decision, not as absence', () => {
+    // Same distinction stated directly — `proofing: false` must not read as
+    // "unset" and inherit the global default.
+    expect(resolveProofing({ proofing: false }, true)).not.toBe(resolveProofing(undefined, true));
+  });
+});

lib/__tests__/theme-default.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from 'vitest';
+import { resolveTheme, DEFAULT_PRESET, THEME_PRESETS } from '@/lib/config/theme';
+
+/**
+ * The preset a site gets when it never picked one. Three separate code paths
+ * fall back to it — no settings.yaml at all, a settings.yaml with no `theme`
+ * key, and a `theme` object that overrides properties without naming a preset
+ * — and each used to carry its own hard-coded literal. These lock the three to
+ * one constant so a future change cannot move some of them and leave the rest.
+ */
+describe('default theme preset', () => {
+  it('names a preset that exists', () => {
+    expect(THEME_PRESETS[DEFAULT_PRESET]).toBeDefined();
+    expect(THEME_PRESETS[DEFAULT_PRESET].preset).toBe(DEFAULT_PRESET);
+  });
+
+  it('applies when no theme is configured at all', () => {
+    expect(resolveTheme(undefined).preset).toBe(DEFAULT_PRESET);
+  });
+
+  it('applies when a theme object omits the preset', () => {
+    // Overriding a property must not silently switch the base preset.
+    const theme = resolveTheme({ accent: '#123456' });
+    expect(theme.preset).toBe(DEFAULT_PRESET);
+    expect(theme.accent).toBe('#123456');
+    expect(theme.fonts.heading).toBe(THEME_PRESETS[DEFAULT_PRESET].fonts.heading);
+  });
+
+  it('is still overridable by an explicit preset', () => {
+    expect(resolveTheme('noir').preset).toBe('noir');
+    expect(resolveTheme({ preset: 'studio' }).preset).toBe('studio');
+  });
+
+  it('keeps every documented preset resolvable', () => {
+    for (const name of [
+      'studio-modern',
+      'studio',
+      'minimal',
+      'editorial',
+      'classic',
+      'noir',
+      'monograph',
+    ]) {
+      expect(resolveTheme(name).preset).toBe(name);
+    }
+  });
+});

lib/auth.ts

@@ -80,7 +80,10 @@ function findPassword(key: string, type: 'subpage' | 'album' | 'journal'): strin
 /**
  * Check if a subpage slug, album ID, or journal entry is password-protected.
  */
-export function isProtected(key: string, type: 'subpage' | 'album' | 'journal' = 'subpage'): boolean {
+export function isProtected(
+  key: string,
+  type: 'subpage' | 'album' | 'journal' = 'subpage',
+): boolean {
   return !!findPassword(key, type);
 }
 

lib/config/index.ts

@@ -2,7 +2,7 @@ import { env } from '../env';
 import { resolveAuthSecret } from '../secret';
 import { getInstallCredentials } from '../install';
 import { loadYaml, clearYamlCache, validateUuid } from './parser';
-import { resolveTheme, VALID_LAYOUTS } from './theme';
+import { resolveTheme, VALID_LAYOUTS, DEFAULT_PRESET } from './theme';
 import { ALBUM_SORT_MODES, isAlbumSortMode, type AlbumSortMode } from '../albumSort';
 import {
   slugify,
@@ -76,6 +76,26 @@ export function buildSubpageGrid(raw?: {
   };
 }
 
+/**
+ * Whether client proofing is on for a page.
+ *
+ * Precedence is subpage → global, the same shape `buildSubpageGrid` gives the
+ * grid: a subpage's own `proofing:` wins in either direction, and a page
+ * reached without one follows `proofing.enabled` from settings.yaml. `??`
+ * rather than `||` is load-bearing — `proofing: false` on a subpage has to
+ * override a global `true`, which `||` would discard.
+ *
+ * Photo essays deliberately do not use this: a published story is not an album
+ * handover, so it requires an explicit `proofing: true` and ignores the global
+ * default. That exception lives at its call site in app/[...path]/page.tsx.
+ */
+export function resolveProofing(
+  subpage: { proofing?: boolean } | undefined,
+  globalEnabled: boolean,
+): boolean {
+  return subpage?.proofing ?? globalEnabled;
+}
+
 /**
  * EXPERIMENTAL: keep only nav links that are safe to render as header <a>
  * tags. Non-http(s) schemes (javascript:, data:) and incomplete entries are
@@ -359,7 +379,7 @@ export function getConfig(): AppConfig {
       heroImages: [],
       exifOnHover: true,
       grid: { columns: 3, gap: 12, aspectRatio: '1', layout: 'masonry' },
-      theme: resolveTheme('studio'),
+      theme: resolveTheme(DEFAULT_PRESET),
       footer: null,
       legal: { enabled: false, name: '', address: '', zipCity: '', country: '' },
       map: false,

lib/config/schema.ts

@@ -88,13 +88,7 @@ export interface GridConfig {
   gap: number;
   aspectRatio: string;
   layout:
-    | 'masonry'
-    | 'uniform'
-    | 'showcase'
-    | 'filmstrip'
-    | 'editorial-flow'
-    | 'essay'
-    | 'justified';
+    'masonry' | 'uniform' | 'showcase' | 'filmstrip' | 'editorial-flow' | 'essay' | 'justified';
 }
 
 export interface AppConfig {

lib/config/theme.ts

@@ -1,16 +1,9 @@
 import type { ThemeConfig, SettingsYaml } from './schema';
 
+/** The preset used when none is configured. */
+export const DEFAULT_PRESET = 'studio-modern';
+
 export const THEME_PRESETS: Record<string, ThemeConfig> = {
-  studio: {
-    preset: 'studio',
-    accent: '#e60012',
-    fonts: { heading: 'Playfair Display', body: 'DM Sans', caption: 'EB Garamond' },
-    radius: 0,
-    photoFrame: 'passepartout',
-    grain: true,
-    headerDot: true,
-    heroStyle: 'split',
-  },
   'studio-modern': {
     preset: 'studio-modern',
     accent: '#e60012',
@@ -21,6 +14,16 @@ export const THEME_PRESETS: Record<string, ThemeConfig> = {
     headerDot: true,
     heroStyle: 'split',
   },
+  studio: {
+    preset: 'studio',
+    accent: '#e60012',
+    fonts: { heading: 'Playfair Display', body: 'DM Sans', caption: 'EB Garamond' },
+    radius: 0,
+    photoFrame: 'passepartout',
+    grain: true,
+    headerDot: true,
+    heroStyle: 'split',
+  },
   minimal: {
     preset: 'minimal',
     accent: '#000000',
@@ -94,7 +97,7 @@ export const VALID_LAYOUTS = [
 ];
 
 export function resolveTheme(raw?: SettingsYaml['theme']): ThemeConfig {
-  if (!raw) return { ...THEME_PRESETS.studio };
+  if (!raw) return { ...THEME_PRESETS[DEFAULT_PRESET] };
 
   if (typeof raw === 'string') {
     const preset = THEME_PRESETS[raw];
@@ -106,7 +109,7 @@ export function resolveTheme(raw?: SettingsYaml['theme']): ThemeConfig {
     return { ...preset };
   }
 
-  const baseName = raw.preset ?? 'studio';
+  const baseName = raw.preset ?? DEFAULT_PRESET;
   const base = THEME_PRESETS[baseName];
   if (!base) {
     throw new Error(

lib/env.ts

@@ -21,8 +21,6 @@ export interface Env {
 }
 
 function parseEnv(): Env {
-  const errors: string[] = [];
-
   const urlRaw = process.env.IMMICH_API_URL;
   let apiUrl = '';
   if (urlRaw) {

lib/install.ts

@@ -24,6 +24,7 @@ import yaml from 'js-yaml';
 import { env } from './env';
 import { generateScryptHash } from './password';
 import type { GalleryYaml, SettingsYaml } from './config/schema';
+import { DEFAULT_PRESET } from './config/theme';
 
 /** The directory user content is written into. Overridable for tests. */
 function installContentDir(): string {
@@ -251,7 +252,7 @@ export async function completeInstall(input: InstallInput): Promise<void> {
   const settings: SettingsYaml = {
     title: input.siteTitle?.trim() || 'Gallery',
     subtitle: input.siteSubtitle?.trim() || '',
-    theme: { preset: input.theme || 'studio' },
+    theme: { preset: input.theme || DEFAULT_PRESET },
   };
 
   const data: InstallFileData = {

lib/proofing.ts

@@ -27,10 +27,7 @@ export function encodeProofBitmask(indices: number[]): string {
     binary += String.fromCharCode(bytes[i]);
   }
 
-  return btoa(binary)
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/, '');
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
 
 /**