release: v0.16.0

See CHANGELOG.md for the full v0.16.0 entry.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>

lib/auth.ts

@@ -126,6 +126,22 @@ export function isAlbumReachable(
   return routes.some((sp) => isAuthenticated(sp.slug, getCookie, 'subpage'));
 }
 
+/**
+ * The albums this visitor may see the photographs of: every album without a
+ * password of its own, plus the ones already unlocked.
+ *
+ * For views that gather photographs from several albums onto one page — the
+ * essay layout — where there is no single album to put a password form in
+ * front of. A locked album is left out rather than gating the whole page: the
+ * visitor unlocks it at its own URL and finds it here afterwards.
+ */
+export function withoutLockedAlbums<T extends { id: string }>(
+  albums: T[],
+  getCookie: (name: string) => string | undefined,
+): T[] {
+  return albums.filter((a) => isAuthenticated(a.id, getCookie, 'album'));
+}
+
 /**
  * Find the SubpageConfig for a given slug.
  */