feat: v0.15.0

.env.docker.example

@@ -65,7 +65,6 @@ NEXT_PUBLIC_GA_ID="your_google_analytics_id_here"
 NEXT_PUBLIC_APP_ENV=local
 NEXT_PUBLIC_LOCAL_STORAGE_PREFIX="@DockerEmuReady_"
 NEXT_PUBLIC_EMUREADY_BETA_URL="https://play.google.com/store/apps/details?id=com.producdevity.emureadyapp"
-NEXT_PUBLIC_VERCEL_ANALYTICS_ENABLED=false
 NEXT_PUBLIC_ENABLE_ANALYTICS=false
 NEXT_PUBLIC_ENABLE_KOFI_WIDGET=false
 NEXT_PUBLIC_ENABLE_SENTRY=false
@@ -77,8 +76,6 @@ NEXT_PUBLIC_GITHUB_URL="https://github.com/Producdevity/EmuReady"
 NEXT_PUBLIC_EMUREADY_LITE_GITHUB_URL="https://github.com/Producdevity/EmuReadyLite/releases"
 NEXT_PUBLIC_APP_URL="https://dev.emuready.com"
 NEXT_PUBLIC_ENABLE_SW=false
-NEXT_PUBLIC_ENABLE_ASYNC_LISTINGS_FILTERS=false
-NEXT_PUBLIC_ENABLE_V2_LISTINGS=false
 NEXT_TELEMETRY_DISABLED=1
 NEXT_IMAGE_UNOPTIMIZED=false
 

.env.example

@@ -39,7 +39,6 @@ NEXT_PUBLIC_APP_ENV=local
 NEXT_PUBLIC_GA_ID="Google-Analytics-ID"
 NEXT_PUBLIC_LOCAL_STORAGE_PREFIX="@LocalEmuReady_"
 NEXT_PUBLIC_EMUREADY_BETA_URL="https://play.google.com/store/apps/details?id=com.producdevity.emureadyapp"
-NEXT_PUBLIC_VERCEL_ANALYTICS_ENABLED=false
 NEXT_PUBLIC_ENABLE_ANALYTICS=false
 NEXT_PUBLIC_ENABLE_KOFI_WIDGET=false
 NEXT_PUBLIC_ENABLE_SENTRY=false
@@ -52,8 +51,6 @@ NEXT_PUBLIC_EMUREADY_LITE_GITHUB_URL="https://github.com/Producdevity/EmuReadyLi
 NEXT_PUBLIC_APP_URL="http://localhost:3000" # Make sure to change this if you are using a tunnel
 NEXT_PUBLIC_ENABLE_SW=false
 NEXT_PUBLIC_ENABLE_PATREON_VERIFICATION=true
-NEXT_PUBLIC_ENABLE_ASYNC_LISTINGS_FILTERS=false
-NEXT_PUBLIC_ENABLE_V2_LISTINGS=false
 NEXT_TELEMETRY_DISABLED=1
 NEXT_IMAGE_UNOPTIMIZED=false
 

.env.test.example

@@ -30,7 +30,6 @@ NEXT_PUBLIC_APP_ENV=test
 NEXT_PUBLIC_GA_ID=""
 NEXT_PUBLIC_LOCAL_STORAGE_PREFIX="@TestEmuReady_"
 NEXT_PUBLIC_EMUREADY_BETA_URL="https://play.google.com/store/apps/details?id=com.producdevity.emureadyapp"
-NEXT_PUBLIC_VERCEL_ANALYTICS_ENABLED=false
 NEXT_PUBLIC_ENABLE_ANALYTICS=false
 NEXT_PUBLIC_ENABLE_KOFI_WIDGET=false
 NEXT_PUBLIC_ENABLE_SENTRY=false
@@ -41,8 +40,6 @@ NEXT_PUBLIC_APP_URL="https://dev.emuready.com"
 NEXT_PUBLIC_ENABLE_PATREON_VERIFICATION=true
 NEXT_PUBLIC_ENABLE_SW=false
 NEXT_PUBLIC_DISABLE_COOKIE_BANNER=true
-NEXT_PUBLIC_ENABLE_ASYNC_LISTINGS_FILTERS=false
-NEXT_PUBLIC_ENABLE_V2_LISTINGS=false
 NEXT_TELEMETRY_DISABLED=1
 NEXT_IMAGE_UNOPTIMIZED=true
 

AGENTS.md

@@ -33,15 +33,53 @@ This file is the source of working guidance for AI coding agents in this reposit
 - Feature folders should follow the project-structure guidance from Bulletproof React:
   https://github.com/alan2207/bulletproof-react/blob/master/docs/project-structure.md
 - Within `src/features/*`, prefer scoped subdirectories such as `components`, `hooks`, `utils`, `server`, and `shared` instead of flat feature folders.
-- Routers in `src/server/api/routers/` are thin orchestration layers. They handle auth context, schema-validated input, repository/service calls, and response formatting.
+- Feature-owned modules may colocate client, server, and shared code under
+  `src/features/<domain>/<module>/`.
+- Use this feature module structure for new or actively-refactored domain code:
+  - `shared/` contains Zod schemas, types, constants, and pure formatting helpers usable by client and server.
+  - `server/` contains repositories, services, policies, mappers, and feature-owned tRPC routers.
+  - `client/` contains hooks, reusable components, and workflow views. Add client API wrappers only when they remove real duplication or encode a stable UI contract.
+  - `client/admin/` is allowed for admin-only workflows.
+- Import direction matters more than folder names:
+  - `client/` may import from its feature `shared/` and app-wide client-safe utilities.
+  - `server/` may import from its feature `shared/`, server utilities, and repositories.
+  - `shared/` must not import from `client/`, `server/`, `src/app`, or server-only libraries.
+  - `src/app/**` routes/pages should compose feature modules; feature modules should not import from `src/app/**`.
+- tRPC routers are transport adapters. Feature-specific routers should live in the feature `server/` folder when that feature owns the full use case; `src/server/api/root.ts` should only compose them.
+- Legacy routers in `src/server/api/routers/` are thin orchestration layers. They handle auth context, schema-validated input, repository/service calls, and response formatting.
 - Do not put raw Prisma queries or business logic in routers.
-- Define Zod schemas in `src/schemas/*`; do not define inline schemas in router `.input(...)` calls.
-- All database access belongs in repository classes under `src/server/repositories/` extending `BaseRepository`.
+- Define Zod schemas in feature `shared/*.schemas.ts` for feature-owned code, or in `src/schemas/*` for legacy/shared code. Do not define inline schemas in router `.input(...)` calls.
+- Feature-owned tRPC procedures should declare `.output(...)` with Zod schemas. Compatibility transports that must keep legacy shapes should still have explicit legacy output schemas instead of returning raw Prisma payloads by convention.
+- All database access belongs in repository classes. Feature-owned repositories may live in feature `server/` folders; legacy/shared repositories may remain under `src/server/repositories/`.
+- New or actively-refactored feature-owned Prisma repositories should extend `PrismaRepository` or `PrismaWriteRepository` from `src/server/persistence/prisma.repository.ts` for Prisma client ownership and shared write handling. Do not extend the legacy `BaseRepository` unless the inherited behavior is deliberately required and documented.
+- Do not add generic CRUD methods to shared repository bases. Prisma already provides typed CRUD; feature repositories should expose domain/use-case persistence operations with named select contracts.
+- For feature-owned Prisma repositories, prefer a `server/persistence/` subfolder for named `select` contracts, query builders, and Prisma error translation. Derive repository record types from Prisma `GetPayload` plus those named `select` contracts instead of hand-maintaining structural copies.
+- Services should depend on the concrete feature repository by default. Do not add service-owned `Pick<Repository, ...>` contracts only for tests.
+- Add repository interfaces only for real boundaries: multiple implementations, external provider adapters, lifecycle concerns that route composition cannot handle directly, or domain/application layers that intentionally must not depend on infrastructure.
 - Repositories should use project error helpers and consistent database operation handling.
-- Multi-step business logic, external API orchestration, and complex calculations belong in services under `src/server/services/`.
+- Multi-step business logic, external API orchestration, and complex calculations belong in services under feature `server/` folders or legacy `src/server/services/`.
+- Use policy functions for reusable authorization/business access rules that must be shared across transports. Routers may still use broad auth procedures, but services should enforce feature-level capabilities when the use case can be called from multiple transports.
 - Use `AppError` and `ResourceError` helpers instead of raw `Error`, raw strings, or one-off `TRPCError` usage.
 - Use specialized procedures such as `protectedProcedure`, `adminProcedure`, and `permissionProcedure(...)` instead of ad hoc permission checks.
 
+## API Compatibility And Legacy Contracts
+
+- Before introducing any `legacy` select, repository method, route, endpoint,
+  schema, type, mapper, compatibility branch, or response shape, audit known
+  consumers first. For mobile/public API work, this includes
+  `/Volumes/T9/Coding/personal/2026/Emulation/EmuReadyApp` when it is available,
+  or a temporary clone of `Producdevity/EmuReadyApp` on the `master` branch when
+  the local app checkout is unavailable or not production-synced.
+- Record which fields consumers actually read. Do not preserve fields only
+  because they existed in an old Prisma payload, old inferred type, or old API
+  response.
+- Decide compatibility case by case: remove unused old fields, migrate the
+  consumer, keep one standardized endpoint with a small low-cost superset, or
+  keep a separate legacy contract only when the audited consumer behavior truly
+  requires it.
+- Legacy contracts must have an owner, a reason, and an expected removal path.
+  Remove legacy code as soon as audited consumers do not need it.
+
 ## Database And Prisma
 
 - Treat database changes as high risk.
@@ -60,11 +98,20 @@ This file is the source of working guidance for AI coding agents in this reposit
 - Do not use casts to hide type problems. Fix the underlying type issue.
 - Handle null and undefined explicitly.
 - Use generated Prisma types where appropriate.
+- Prefer deriving types from existing contracts instead of hand-maintaining
+  structural copies. Use Prisma `GetPayload`, Zod `z.input`/`z.output`, tRPC
+  `RouterInput`/`RouterOutput`, `ReturnType`, and `typeof` on const contracts
+  before adding a new interface or structural type alias. Add new manual
+  interfaces/types only for genuinely new UI/application state or external
+  boundaries that cannot be inferred, and keep them narrow and local.
 - Do not add unused functions, exports, or speculative helpers.
 - Remove dead code when refactoring.
 - Do not remove or rewrite existing TODO comments unless the user explicitly
   asks, or unless the TODO is directly made obsolete by the code change.
 - Prefer function declarations for top-level functions/components.
+- Avoid object destructuring when values are used only once or when it makes
+  ownership less clear. Prefer `object.property` access unless destructuring
+  materially improves readability.
 - Component props interfaces should be named `Props`.
 - Do not destructure component props in function parameters; use `props.foo`.
 - Keep `useEffect` dependencies correct.

RELEASE_NOTES.md

@@ -1,3 +1,43 @@
+# 🚀 EmuReady Release Notes – 22 August 2026 (v0.15.0)
+
+v0.15.0 brings the PC moderation workflow up to parity with handheld reports, hardens the web and mobile API paths, and cuts unnecessary server traffic. It also includes a set of smaller fixes across report browsing, comments, notifications, admin tools, and GameNative configuration.
+
+## Users
+
+- Handheld report search now combines the search term with approval and ownership rules correctly. Signed-out users see matching approved reports, signed-in users also see their own matching pending reports, and unrelated reports no longer leak into the results.
+- Comments and replies can now be submitted with Cmd+Enter or Ctrl+Enter without bypassing validation or human-verification checks.
+- Oversized cover art no longer pushes handheld or PC report detail cards outside their containers.
+- Translation language detection now loads only when translated content is near the viewport, and cached translated text is reset when the source content changes.
+- Notification lists load only while the notification menu is open. The unread badge refreshes less often in the background and refreshes again when the menu is opened.
+- Handheld and PC report filters now use the async selectors consistently instead of depending on feature flags.
+- New GameNative configurations now default `startup_selection` to Essential, matching the generated configuration.
+
+## Moderators and admins
+
+- Added a processed PC reports page with status filtering, search, sorting, pagination, status overrides, and reset-to-pending actions.
+- Handheld and PC processed-report actions now share the same admin UI and keep trust changes, notifications, and cache invalidation aligned.
+- Moderator-role users and above now receive notifications when handheld or PC reports are submitted through the web or mobile API.
+- Report submission and moderation paths now share more of their validation and persistence logic, including description sanitization for PC and mobile submissions.
+- Custom field template search now matches template names, descriptions, field names, and field labels, with a separate empty state when no filtered results match.
+- CPU and GPU admin pages now request the correct brand category from the server instead of maintaining client-side brand allowlists.
+- IGDB image selection is available to moderators while the normal author flow keeps its existing RAWG and TheGamesDB choices.
+- Admin pages use more of the shared layout, error, statistics, and empty-state components. Deleting an in-use performance scale now completes its replacement step before removal.
+
+## Developers and contributors
+
+- Anonymous public GET lookups can use shared-cache headers. Authenticated requests, errors, batches, mutations, and requests carrying credentials remain `private, no-store`.
+- Mobile CORS and origin handling were standardized. Browser requests with untrusted origin metadata are rejected, while native clients without browser origin headers continue to work.
+- Explicit invalid `Authorization: ApiKey ...` credentials are rejected. The legacy `x-api-key` fallback remains temporarily permissive for shipped mobile clients that also use Bearer authentication.
+- Steam batch lookup now uses one shared service for the mobile API and admin tools, preserves the requested App ID order, and returns explicit not-found results.
+- CPU and GPU code now lives in feature-owned modules with shared contracts, repositories, services, policies, mappers, routers, and admin components.
+- Mobile API documentation and generated OpenAPI output were refreshed for the current authentication, validation, hardware lookup, report, and Steam batch contracts.
+- Game image handling now uses provider-aware validation and rendering, and the deprecated image proxy path was removed.
+- Removed unused realtime notification/SSE code, Vercel Analytics integration, old popup code, and the experimental v2 listings implementation.
+- Session analytics now derive sign-in method, page views, and interaction counts from actual client activity instead of placeholder values.
+- Test coverage was expanded for mobile authentication, proxy origin handling, CORS, tRPC cache policy, Steam batch lookups, CPU/GPU modules, PC moderation, notifications, session tracking, admin search, report layout, and search visibility across user roles.
+
+---
+
 # 🚀 EmuReady Release Notes – 4 June 2026 (v0.14.0)
 
 This update is smaller than the v0.13.0 catch-up release, but it touches some important day-to-day workflows. The main themes are safer moderation, better spam protection, faster report browsing, and fewer stale-cache issues. Routine cleanup, small dependency churn, and test-only refactors are omitted unless they affect users, moderators, or maintenance.

config/image-hosts.ts

@@ -0,0 +1,25 @@
+export const GAME_IMAGE_PROVIDER_HOST_PATTERNS = [
+  'media.rawg.io',
+  'cdn.thegamesdb.net',
+  'images.igdb.com',
+  'assets.nintendo.com',
+  'shared.akamai.steamstatic.com',
+  'cdn1.epicgames.com',
+  'cdn2.unrealengine.com',
+  'images.gog-statics.com',
+] as const
+
+export const NEXT_IMAGE_REMOTE_HOST_PATTERNS = [
+  'placehold.co',
+  '*.clerk.com',
+  '*.clerk.accounts.dev',
+  'storage.ko-fi.com',
+  'ko-fi.com',
+  ...GAME_IMAGE_PROVIDER_HOST_PATTERNS,
+] as const
+
+export const NEXT_IMAGE_REMOTE_PATTERNS = NEXT_IMAGE_REMOTE_HOST_PATTERNS.map((hostname) => ({
+  protocol: 'https' as const,
+  hostname,
+  pathname: '/**',
+}))