release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/admin/proofing/[id]/export/route.ts

@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { withAdmin } from '@/lib/admin/withAdmin';
+import { picksFor } from '@/lib/admin/proofing-view';
+import { immich } from '@/lib/immich';
+import { getSessionById } from '@/lib/proofSessions';
+import {
+  exportContentType,
+  exportExtension,
+  formatExport,
+  type ExportFormat,
+} from '@/lib/proofExport';
+import { contentDisposition, safeDownloadName } from '@/lib/downloadName';
+
+const FORMATS: ExportFormat[] = ['lightroom', 'txt', 'csv'];
+
+/** GET ?format=lightroom|txt|csv — the selection as a file. */
+export const GET = withAdmin(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const { id } = await params;
+    const requested = request.nextUrl.searchParams.get('format') as ExportFormat | null;
+    const format = requested && FORMATS.includes(requested) ? requested : 'lightroom';
+
+    const session = await getSessionById(id);
+    if (!session) return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    const album = await immich.getProofingAlbum(session.albumId).catch(() => null);
+    if (!album) {
+      return NextResponse.json({ error: 'The album is not available in Immich' }, { status: 502 });
+    }
+
+    const body = formatExport(picksFor(session, album), format);
+    const name = `${safeDownloadName(`${session.clientName} ${album.albumName}`, 'selection')}.${exportExtension(format)}`;
+    return new NextResponse(body, {
+      headers: {
+        'Content-Type': exportContentType(format),
+        'Content-Disposition': contentDisposition(name),
+        'Cache-Control': 'private, no-store',
+      },
+    });
+  },
+);

app/api/admin/proofing/[id]/route.ts

@@ -0,0 +1,59 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { withAdmin } from '@/lib/admin/withAdmin';
+import { picksFor, toAdminSession } from '@/lib/admin/proofing-view';
+import { immich } from '@/lib/immich';
+import {
+  deleteSession,
+  getSessionById,
+  ProofError,
+  sessionPatchSchema,
+  updateSession,
+} from '@/lib/proofSessions';
+
+type Context = { params: Promise<{ id: string }> };
+
+/** GET: one link with its selected photos. */
+export const GET = withAdmin(async (_request: NextRequest, { params }: Context) => {
+  const { id } = await params;
+  const session = await getSessionById(id);
+  if (!session) return NextResponse.json({ error: 'Not found' }, { status: 404 });
+  const album = await immich.getProofingAlbum(session.albumId).catch(() => null);
+  return NextResponse.json({
+    session: toAdminSession(session, album),
+    picks: picksFor(session, album),
+  });
+});
+
+/** PATCH: rename, change expiry or downloads, reopen, reset the download count. */
+export const PATCH = withAdmin(async (request: NextRequest, { params }: Context) => {
+  const { id } = await params;
+  const parsed = sessionPatchSchema.safeParse(await request.json().catch(() => null));
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: parsed.error.issues[0]?.message ?? 'Invalid input' },
+      { status: 400 },
+    );
+  }
+  try {
+    const session = await updateSession(id, parsed.data);
+    const album = await immich.getProofingAlbum(session.albumId).catch(() => null);
+    return NextResponse.json({ session: toAdminSession(session, album) });
+  } catch (err) {
+    if (err instanceof ProofError)
+      return NextResponse.json({ error: err.message }, { status: 404 });
+    throw err;
+  }
+});
+
+/** DELETE: revoke the link. The client URL stops working immediately. */
+export const DELETE = withAdmin(async (_request: NextRequest, { params }: Context) => {
+  const { id } = await params;
+  try {
+    await deleteSession(id);
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    if (err instanceof ProofError)
+      return NextResponse.json({ error: err.message }, { status: 404 });
+    throw err;
+  }
+});

app/api/admin/proofing/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { withAdmin } from '@/lib/admin/withAdmin';
+import { loadAlbums, toAdminSession } from '@/lib/admin/proofing-view';
+import { immich } from '@/lib/immich';
+import { createSession, listSessions, ProofError, sessionInputSchema } from '@/lib/proofSessions';
+import { webhookUrl } from '@/lib/proofWebhook';
+
+/** GET: every proofing link, newest first. */
+export const GET = withAdmin(async () => {
+  const sessions = await listSessions();
+  const albums = await loadAlbums(sessions.map((s) => s.albumId));
+  const list = sessions
+    .map((s) => toAdminSession(s, albums.get(s.albumId) ?? null))
+    .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+  return NextResponse.json({ sessions: list, webhookConfigured: webhookUrl() !== null });
+});
+
+/** POST: create a proofing link for one client and one album. */
+export const POST = withAdmin(async (request: NextRequest) => {
+  const parsed = sessionInputSchema.safeParse(await request.json().catch(() => null));
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: parsed.error.issues[0]?.message ?? 'Invalid input' },
+      { status: 400 },
+    );
+  }
+
+  // Refuse a link to an album Immich does not have, rather than hand out a 404.
+  const album = await immich.getProofingAlbum(parsed.data.albumId).catch(() => null);
+  if (!album) {
+    return NextResponse.json({ error: 'Immich has no album with that ID' }, { status: 400 });
+  }
+
+  try {
+    const session = await createSession(parsed.data);
+    return NextResponse.json({ session: toAdminSession(session, album) }, { status: 201 });
+  } catch (err) {
+    if (err instanceof ProofError) {
+      return NextResponse.json({ error: err.message }, { status: 409 });
+    }
+    throw err;
+  }
+});