release: v0.19.0

Release v0.19.0. See the `## [0.19.0] — 2026-09-29` section of
[CHANGELOG.md](https://github.com/ralksta/immich-folio/blob/dev/CHANGELOG.md)
for the full list.

Highlights: client proofing links (#683), custom content pages (#738),
asset picker search (#740), concurrent-edit detection (#742), env-locked
settings (#739), an accessibility baseline (#741), three security fixes
with advisories (#737, #755, #759), and a pre-release quality pass
(#780–#797).

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>

app/api/proof/[token]/archive/route.ts

@@ -0,0 +1,72 @@
+/**
+ * GET /api/proof/:token/archive?scope=selection|album — the originals of a
+ * client proofing link as a ZIP.
+ *
+ * What may be downloaded is the session's to say (`download: selection` or
+ * `album`), every successful start counts against its `downloadLimit`, and
+ * the selection ZIP is built from the saved selection, never from the request.
+ * Streaming and the refusal page are shared with the album archive route.
+ */
+
+import { NextRequest } from 'next/server';
+import { resolveProofAccess } from '@/lib/proofAccess';
+import { claimDownload, ProofError } from '@/lib/proofSessions';
+import { refusal, withArchiveSlot, type ArchiveStreamer } from '@/lib/zipArchive';
+
+export const dynamic = 'force-dynamic';
+
+/** Same budget as the album archive: a whole album of originals per request. */
+const ARCHIVE_RPM = 5;
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ token: string }> },
+) {
+  const { token } = await params;
+  // One slot pool with the album archive route, taken before the first Immich
+  // request and before the download is counted against the link's limit.
+  return withArchiveSlot(request, (stream) => streamProofArchive(request, token, stream));
+}
+
+/** The handler's body, run inside the client's archive slot. */
+async function streamProofArchive(
+  request: NextRequest,
+  token: string,
+  stream: ArchiveStreamer,
+): Promise<Response> {
+  const access = await resolveProofAccess(request, token, 'proof-archive', ARCHIVE_RPM);
+  if ('error' in access) {
+    const status = access.error.status;
+    if (status === 429) {
+      const retry = Number(access.error.headers.get('Retry-After')) || undefined;
+      return refusal(request, 429, 'rateLimited', retry);
+    }
+    if (status === 503) return refusal(request, 503, 'immichUnavailable', 30);
+    if (status === 401) return access.error;
+    return refusal(request, 404, 'notAvailable');
+  }
+
+  const { session } = access;
+  const scope = request.nextUrl.searchParams.get('scope') === 'album' ? 'album' : 'selection';
+  if (session.download === 'none') return refusal(request, 404, 'notAvailable');
+  if (scope === 'album' && session.download !== 'album') {
+    return refusal(request, 404, 'notAvailable');
+  }
+
+  const chosen = new Set(session.selection);
+  const assets =
+    scope === 'album' ? access.assets : access.assets.filter((asset) => chosen.has(asset.id));
+  if (assets.length === 0) return refusal(request, 404, 'notAvailable');
+
+  try {
+    await claimDownload(token, scope);
+  } catch (err) {
+    if (err instanceof ProofError && err.code === 'limit') {
+      return refusal(request, 403, 'limitReached');
+    }
+    if (err instanceof ProofError) return refusal(request, 404, 'notAvailable');
+    throw err;
+  }
+
+  return stream(access.albumName, assets);
+}