Once it's created, open SQL Editor → New query, paste the contents of supabase-schema.sql (in this folder), and click Run. This creates all tables, security rules, and leaderboard views.
Also run storage-setup.sql the same way (New query → paste → Run) — this sets up the storage bucket avatar uploads need. Without this, avatar upload will fail with a "bucket not found" error.
If you're updating an existing project rather than starting fresh, also run comics-migration.sql, currency-migration.sql, achievements-migration.sql, collectibles-migration.sql, region-migration.sql, copytype-migration.sql, ebayprice-migration.sql, completeness-migration.sql, fullycompleted-migration.sql, valuesnapshots-migration.sql, showcase-migration.sql, activity-migration.sql, steam-connect-migration.sql, recommend-games-migration.sql, trophy-completion-migration.sql, halfstar-ratings-migration.sql, trophy-leaderboard-migration.sql, activity-trophies-migration.sql, consoles-migration.sql, publicprice-refresh-migration.sql, funko-migration.sql, valuable-leaderboard-migration.sql, friends-leaderboard-migration.sql, friends-leaderboard-expanded-migration.sql, currency-aware-valuable-leaderboard-migration.sql, security-definer-views-migration.sql, function-search-path-migration.sql, avatar-storage-policy-migration.sql, revoke-internal-function-access-migration.sql, handle-new-user-revoke-migration.sql, revoke-anon-authenticated-function-access-migration.sql, feedback-migration.sql, newsletter-optin-migration.sql, condition-photos-migration.sql, activity-reactions-migration.sql, trophy-rarity-migration.sql, comment-rate-limit-migration.sql, price-drop-alerts-migration.sql, completeness-split-migration.sql, vhs-migration.sql, article-submission-rate-limit-migration.sql, rls-performance-migration.sql, webauthn-rate-limit-migration.sql, feedback-rate-limit-migration.sql, notification-mute-migration.sql, wishlist-public-migration.sql, wishlist-priority-migration.sql, public-lists-migration.sql, recommend-collectors-migration.sql, forsale-migration.sql, collection-types-migration.sql, email-backup-migration.sql, master-set-cache-migration.sql, activity-digest-migration.sql, wantlist-matches-migration.sql, trophy-variety-migration.sql, api-tokens-migration.sql, item-reviews-migration.sql, upcoming-releases-migration.sql, upcoming-release-aliases-migration.sql, and discogs-import-migration.sql (same New query → paste → Run process). Also run item-photos-storage-migration.sql the same way as storage-setup.sql in step 3 — without it, uploading a condition photo fails with a "bucket not found" error. Brand new projects can skip all of these — supabase-schema.sql and storage-setup.sql already include everything. (One exception: supabase-schema.sql previously didn't actually include the trophy case tables/functions — that's now fixed, but if you set your project up before this fix, you'll still need to run achievements-migration.sql once for trophies to work.)
Go to Authentication → Sign In / Providers → Email and, for easy testing, turn off "Confirm email" (or leave it on and just check your inbox after signing up).
Go to Settings → API Keys and copy the Project URL and the publishable (or legacy anon public) key.
2. Configure the app
In this folder, copy .env.local.example to .env.local.
Paste in your Project URL and key from step 1.
Trading cards, Books, Consoles, Vinyl, CDs, DVDs/Blu-rays, and VHS all have a "Search" auto-fill button too, and none of them need any setup — trading cards use the free Pokémon TCG/Scryfall (Magic) APIs, books use the free Open Library search API, vinyl/CD use the free MusicBrainz API, DVD/VHS use Apple's free iTunes Search API (fills in director, studio, and genre — same source for both, since it's the same movie either way), and consoles match against a built-in list of common systems (no external API for consoles at all). LEGO sets also have a "Search" button, but it does need a free API key — see step 6 below. Funko Pops don't have auto-fill — see ROADMAP.md for why.
(Optional) Enable the "Search" auto-fill button for games by setting up a free IGDB app:
Go to dev.twitch.tv/console/apps. If your Twitch account doesn't have two-factor authentication turned on yet, it'll ask you to set that up first (phone number + code) — that's a Twitch requirement for registering any app, not specific to this project.
Click Register Your Application. Name it anything (e.g. "Shelf Life"), set OAuth Redirect URLs to https://localhost (required by the form, not actually used since this app never does a browser-based Twitch login), and pick Category: Application Integration.
Open the app you just created and copy the Client ID. Click New Secret to generate a Client Secret — copy that too (it's only shown once).
Paste both into .env.local as IGDB_CLIENT_ID and IGDB_CLIENT_SECRET. Unlike the Supabase keys, these are not prefixed with NEXT_PUBLIC_ — they're used only by a server-side route (app/api/igdb-search/route.js) and are never sent to the browser, since exposing the client secret would let anyone use your Twitch app's quota.
(Optional) Enable the "Search" auto-fill button and real per-series "See master set" for comics by setting up a free Comic Vine API key:
Go to comicvine.gamespot.com/api and sign in with (or create) a free Comic Vine/GameSpot account — your API key is shown right on that page once you're signed in.
Paste it into .env.local as COMICVINE_API_KEY. Not prefixed with — used only by server-side routes (, , , , and ) and never sent to the browser.
Go to vercel.com → sign up (GitHub login is easiest) → Add New Project → import your repo.
In the project's Environment Variables settings, add the same variables from your .env.local.
Click Deploy. Vercel gives you a live URL — you can add a custom domain later in Vercel's project settings.
5. Turn on ads (optional)
The site's already wired up for Google AdSense (a cookie-consent banner, the ad script, an ads.txt route, and a Privacy Policy page all exist — they just need your AdSense account's ID to switch on). Ads only start showing once you set the env var below and a visitor accepts the cookie banner.
Your site needs to be live at a real URL first (step 4 above) — AdSense reviews the deployed site, not localhost.
Go to adsense.google.com and sign up with a Google account. Add your site's URL when asked.
AdSense will give you a publisher ID that looks like ca-pub-XXXXXXXXXXXXXXXX. Add it to your Vercel project's Environment Variables as NEXT_PUBLIC_ADSENSE_CLIENT_ID, then redeploy (Vercel → Deployments → ⋯ → Redeploy) so it takes effect.
Back in AdSense, click through their site-verification step — it should detect the ad script automatically now that it's live (this is also what serves your ads.txt file at yoursite.com/ads.txt, which AdSense checks for).
Review takes time — anywhere from a day to a few weeks, and Google can reject new/low-traffic sites on the first pass and ask you to reapply later. This is normal, not a sign anything's broken; a friends-and-family collection tracker is a genuinely small site by ad-network standards, so don't be surprised if approval takes a few tries as real traffic builds up.
Once approved, turn on Auto ads in the AdSense dashboard (Ads → By site → toggle it on for your site). Auto ads means Google's own placement logic decides where ads go across the whole site — no per-page code to add here, which keeps this simple to maintain.
Payouts: AdSense pays out once your balance clears $100, via bank transfer — you'll need to add tax and payment info in the AdSense dashboard when you get close. Realistically, expect this to take a while at hobby-project traffic levels.
Worth knowing: the cookie banner defaults to not loading ads until a visitor clicks Accept, which is the honest baseline for EU/UK cookie-consent rules — it's a simple accept/decline banner, not a full certified consent platform. If this ever grows into something with real traffic/revenue, it'd be worth a proper look at compliance (and the Privacy Policy at /privacy) rather than relying on what's here.
6. Get found in search (optional but recommended)
The site already generates sitemap.xml and robots.txt automatically (home, Find Collectors, Leaderboard, and every public profile — private profiles are excluded), plus a branded image that shows up when a link gets shared on Discord/Reddit/iMessage/etc. It also carries real schema.org structured data (JSON-LD) — a SoftwareApplication block on the homepage, and FAQPage markup on each of the 4 SEO landing pages — giving Google a shot at an FAQ/app rich result for free, from content that's already written and shown either way. None of that requires any setup. What actually gets Google/Bing to crawl and index the site is submitting it to their tools directly:
Go to Google Search Console, add https://shelflife.site as a property, verify ownership (the easiest method is usually the DNS TXT record through whoever you registered the domain with), then under Sitemaps submit https://shelflife.site/sitemap.xml.
Same idea at Bing Webmaster Tools — Bing also actually lets you import directly from a verified Google Search Console property, which skips the separate verification step.
Indexing isn't instant — expect days to a couple of weeks before pages start showing up in search results, and a brand-new small site won't rank highly right away. This step is what makes ranking possible over time, not an instant traffic switch.
That's it — from then on, every git push redeploys automatically.
7. Feedback emails, the newsletter, and the admin tools (optional)
None of this is required for the site to work — without it, the Feedback page still saves every submission to the database (readable any time in Supabase's Table Editor, under feedback), it just won't also email you. Set this up when you want the email notification and the ability to send the opt-in newsletter.
Go to resend.com and sign up (free tier: 3,000 emails/month, 100/day — plenty for this). Add and verify a sending domain (or use their shared test domain while trying it out).
Create an API key and paste it into .env.local (and your Vercel project's env vars) as RESEND_API_KEY. Server-only, never sent to the browser.
Add RESEND_FROM_EMAIL — the "from" address for both the feedback notification and the newsletter, e.g. Shelf Life <[email protected]>. Has to be on a domain you verified with Resend in step 1.
Add ADMIN_EMAIL — the email address you sign into Shelf Life with. This gates /admin/newsletter (a private, unlinked page — only visible to whoever's signed in with this exact email) and controls where feedback-submission notifications get sent by default.
(Optional) Add FEEDBACK_NOTIFY_EMAIL if you want feedback notifications to go to a different address than ADMIN_EMAIL — otherwise they fall back to ADMIN_EMAIL automatically.
To actually send the newsletter, one more key is needed: go to your Supabase project's Settings → API Keys, copy the service_role key (⚠️ this bypasses every RLS rule — never put it in NEXT_PUBLIC_-prefixed anything, never commit it, and only ever use it server-side, which is exactly how lib/supabaseAdmin.js uses it here), and add it as SUPABASE_SERVICE_ROLE_KEY. It's needed because looking up opted-in collectors' actual email addresses means reading auth.users, which the normal app-wide Supabase client intentionally can't see.
Once all of the above are set (and redeployed), sign in as the admin account and visit /admin/newsletter to write and send an update to everyone who's checked "Email me when something new ships" in their Profile Settings. It's a manual send, not automatic — nothing goes out until you write it and hit Send.
8. Price-drop alerts (optional)
Lets you set "notify me if this drops below $X" on a wishlist item; a Vercel Cron job checks once a day and sends an in-app notification the first time it dips below that price. Without this set up, the field in the Add/Edit form still saves, it just never gets checked.
Generate a random secret — openssl rand -hex 32 on the command line, or any long random string — and add it as CRON_SECRET in both .env.local and your Vercel project's env vars.
Make sure SUPABASE_SERVICE_ROLE_KEY is also set (see step 6 under Feedback emails above) — the daily check has no signed-in user to run as, so it needs the same service-role client the newsletter uses.
vercel.json already schedules the job (/api/cron/price-drop-check, once daily) — Vercel picks this up automatically on deploy, nothing to configure in the dashboard. Needs price-drop-alerts-migration.sql on existing projects.
The same CRON_SECRET and SUPABASE_SERVICE_ROLE_KEY also cover the account-deletion cron (/api/cron/process-account-deletions), the weekly currency-rate refresh (/api/cron/refresh-currency-rates), the weekly stats digest (/api/cron/weekly-stats-digest, needs ADMIN_EMAIL and Resend set up too — see step 7), the opt-in monthly data-backup email (/api/cron/email-data-backup, needs Resend too, not ADMIN_EMAIL — it emails each opted-in collector their own backup, not you), the weekly Pokémon master-set variant cache refresh (/api/cron/refresh-master-sets, no third-party key needed — TCGdex is free/open), the opt-in weekly activity digest email (/api/cron/email-activity-digest, needs Resend too, same as the monthly backup), and the weekly Upcoming Releases cache refresh (/api/cron/refresh-upcoming-releases, needs IGDB_CLIENT_ID/IGDB_CLIENT_SECRET/COMICVINE_API_KEY too — the same keys game/comic search already require) below — nothing extra to set up for any of them once this step is done.
If a cron job actually fails (a query error, a fetch failure, missing config), it now emails ADMIN_EMAIL directly rather than only logging it — Vercel's runtime log retention on the current plan is 1 hour, too short to reliably catch an overnight failure. See lib/cronAlert.js.
None of the above catches a cron that stops firing entirely — a vercel.json misconfiguration, a broken build, a Vercel Cron outage — since nothing runs to report the silence. Closing that needs a free external dead-man's-switch service (healthchecks.io or Cronitor both work, no cost):
Sign up, then create one check per job below, using the exact cron expression shown (these come straight from vercel.json and are in UTC, same as Vercel Cron itself — both services default to UTC too, so paste them in as-is rather than converting to local time).
Each check gives you a ping URL (e.g. https://hc-ping.com/<uuid>). Collect all 8 into one JSON object, keyed by the job names above exactly as spelled — e.g. {"price-drop-check": "https://hc-ping.com/...", "process-account-deletions": "https://hc-ping.com/...", ...} — and add that whole object as a single Vercel env var, CRON_WATCHDOG_URLS. Doesn't need the NEXT_PUBLIC_ prefix (it's server-only), so add it as a Sensitive/Secret-type var, not Config.
Redeploy so the new env var takes effect. From then on, every cron run pings its check on success, or pings <url>/fail on a real failure (lib/cronWatchdog.js) — if a job ever goes silent instead, the watchdog service itself emails you once the check's grace period passes, the piece nothing inside Vercel can do on its own.
Safe to skip entirely — every cron already works and already emails ADMIN_EMAIL on a real failure via lib/cronAlert.js; this only adds coverage for the much rarer "didn't run at all" case.
9. Affiliate links on the gift list (optional)
The public gift list page (/u/[username]/wishlist) shows "Buy on eBay" / "Search Amazon" links under each item — real, working search links either way, with optional affiliate tracking on top so a purchase made through one earns a small commission.
eBay: sign up for eBay Partner Network at partnernetwork.ebay.com (free), create a campaign, and copy its Campaign ID into NEXT_PUBLIC_EBAY_EPN_CAMPAIGN_ID.
Amazon: sign up for Amazon Associates at affiliate-program.amazon.com (free), and copy your associate tag (e.g. yoursite-20) into NEXT_PUBLIC_AMAZON_ASSOCIATE_TAG.
Add both to .env.local and your Vercel project's env vars, and redeploy. Leave either blank to skip tracking for that one — the links themselves still work.
What's included
Accounts: email/password signup & login (Supabase Auth), auto-creates a public profile with a chosen username. Includes a "Forgot password?" flow (/forgot-password, /reset-password) using Supabase's own reset-password email, self-service account deletion with a 48-hour grace period (a "Danger zone" section in Profile Settings, with a confirmation email so there's a real record of the request beyond the in-app banner), and an "Account security" section next to it with a "Sign out of all other devices" button — also fires automatically right after a password reset, so recovering a compromised password actually closes out whatever session had it.
Collection dashboard (/dashboard): add/edit/delete/filter/search across nine collectible types in one shelf, each with tailored fields — platforms for games, series/issue/publisher/writer/artist/grade/variant for comics, set/card number/player/grade for trading cards, artist/label/format/edition for vinyl, author/publisher/format/edition for books (director/studio for DVDs, artist/label for CDs), manufacturer/storage-variant/special-edition/region/grade for consoles, and series-line/Pop!-number/character/exclusive-to/grade/chase-variant for Funko Pops — plus shared tags, barcodes, and Search auto-fill for games (IGDB), trading cards (Pokémon TCG/Scryfall), books (Open Library), and consoles (a built-in common-systems list — no external API). An "Import CSV" button bulk-adds items from a spreadsheet at once, using a downloadable template with the right columns, and flags rows that look like something already in your collection (same title-matching rule as the single-item duplicate warning) so you can skip them instead of importing silent duplicates; "Export CSV" downloads your whole collection back out at any time, in the same column layout, as a backup. "Log in with Steam" (in Profile Settings) plus "Import from Steam" bulk-adds someone's owned PC games automatically. Consoles and Funko Pops both reuse existing fields rather than adding new columns (manufacturer/storage-variant/edition/grade, and series-line/Pop!-number/character/exclusive-to double up on the same publisher/format/edition/grade/card_set/card_number/player_name fields comics, cards, and vinyl already use) — needs consoles-migration.sql and funko-migration.sql on existing projects.
"What should I play next?": a dashboard widget picks something from your backlog (or wishlist, if the backlog's empty) to suggest playing next, weighted toward genres/platforms you've already rated highly.
Xbox/PlayStation trophy & achievement tracking: per-game fields (Platinum'd checkbox + completion %) for tracking your real console trophies/achievements — separate from Shelf Life's own collection-milestone trophy case. Shown on the game's card, filterable and sortable on the dashboard, and rolled up into a "Trophy completion" stat on . Manual entry only — neither platform offers a way to pull this in automatically for a personal site.
Notes
Row Level Security is on for every table — users can only edit their own data, and private profiles' items are hidden from everyone but the owner.
The leaderboard views only include profiles marked public.
Trophy definitions live in the achievement_defs table and can be edited/extended directly in Supabase; the awarding logic lives in the check_and_award_achievements SQL function (in supabase-schema.sql for new projects, achievements-migration.sql for existing ones).
See ROADMAP.md in this folder for a running list of ideas for what to build next.
Search fills in series, issue number, and cover from the initial search, then writer/artist/publisher from a second lookup once you actually click a result (those live one level deeper in Comic Vine's data, so they're only fetched for the issue you actually picked, not every row in the list). "See master set" pulls a comic's real per-series issue list the same way the Pokémon trading-card side already does with TCGdex, instead of only knowing about issues someone here has already logged. Free tier is generous (roughly 200 requests/hour) — far more than a personal collection site needs.
(Optional) Enable the "Search" auto-fill button for LEGO sets by setting up a free Rebrickable API key:
Go to rebrickable.com and sign up for a free account, then open rebrickable.com/api/v3/docs/ and click Request key (or find your key under your account's API settings once signed in).
Paste it into .env.local as REBRICKABLE_API_KEY. Not prefixed with NEXT_PUBLIC_ — used only by a server-side route (app/api/lego-search/route.js) and never sent to the browser.
Search fills in the theme (e.g. Star Wars, City, Creator Expert), set number, and Minifigures included from Rebrickable's live set database — the last of those from a second, on-demand lookup once you actually pick a result, same as comics fetch writer/artist/publisher. "See master set" on a LEGO set also pulls a real, live list of every set Rebrickable has for that Theme, instead of only knowing about sets already logged on the site — falls back to Shelf Life's own crowdsourced view for a theme Rebrickable doesn't recognize. Rebrickable's terms allow this kind of use for free, including commercially, with a courtesy (not required) credit — which the search result's own "Filled from Rebrickable" hint already gives it. Its free tier averages about 1 request/second, far more than a personal collection site needs.
(Optional) Enable the "Check eBay price" button (shows current active eBay US listing prices for an item) by setting up a free eBay developer account:
Once logged in, go to Application Keysets (top-right menu after signing in, or developer.ebay.com/my/keys) and create a Production keyset (name it anything, e.g. "Shelf Life").
Copy the App ID (Client ID) and Cert ID (Client Secret) it gives you.
Paste both into .env.local as EBAY_CLIENT_ID and EBAY_CLIENT_SECRET. Same as the IGDB keys, these are server-only and never sent to the browser (app/api/ebay-price/route.js).
Note: this only sees eBay's current active listings (mostly "Buy It Now" asking prices), not confirmed sale prices — eBay stopped offering free public access to sold-listing data a while back. It's still a useful "what's it going for right now" signal, just not a guaranteed resale value. Free tier covers 5,000 lookups/day across the whole site, which is far more than a personal collection site needs.
(Optional) Enable "Log in with Steam" / "Import from Steam" (pulls someone's owned PC games in automatically):
Go to steamcommunity.com/dev/apikey (sign in with any Steam account) and request a Web API key — it asks for a Domain Name, use your live site's domain (e.g. shelflife.site).
Paste it into .env.local (and your Vercel project's env vars) as STEAM_API_KEY. Server-only, never sent to the browser (app/api/steam-games/route.js).
Important: Steam's login only works on your real deployed URL, not localhost — it's hardcoded to the domain in lib/siteUrl.js (SITE_URL), since Steam's login flow requires a fixed callback address. If you ever change domains, update that file.
Also worth telling people (or just knowing yourself): Steam's game-list API only works if the account's Game details privacy setting is set to Public (Steam app/site → your profile → Edit Profile → Privacy Settings). Logging in with Steam proves who you are but doesn't bypass that setting — Steam doesn't have a way to grant per-app access to a private game list. The import screen explains this if someone's list comes back empty.
The same STEAM_API_KEY also powers "Sync achievements from Steam" on the dashboard (pulls per-game achievement completion % for Steam-imported games) — nothing extra to set up once the key above is in place.
(Optional) Enable "Import from Discogs" (pulls someone's public Vinyl/CD collection in automatically):
Go to discogs.com/settings/developers (sign in with any Discogs account) and click Generate new token — unlike Steam, there's no separate app-registration step, it just gives you a personal token directly.
Paste it into .env.local (and your Vercel project's env vars) as DISCOGS_API_TOKEN. Server-only, never sent to the browser (app/api/discogs-collection/route.js).
Unlike Steam import, there's no login flow to wire up — anyone using the site can type in any Discogs username and pull that member's public collection, the same as browsing discogs.com/user/<name> in a regular browser. Whoever's collection you're importing needs their Discogs privacy setting (Settings → Privacy on discogs.com) set to Public first, or Discogs returns it as empty.
Only Vinyl and CD formats are imported — Shelf Life doesn't have a place for Cassette, digital files, box sets, etc. today.
/dashboard/insights
Public profiles (/u/username): view a collector's shelf, follow them, leave comments. Shows a "Collection value" stat (same purchase-price/eBay blend as the dashboard) and each item's last-checked market price right on its card. A signed-in visitor can also hit "Refresh prices" to re-check eBay for that collector's whole shelf — writes through a narrow refresh_item_market_price database function rather than opening up full edit access, so a visitor can only ever touch those three price columns, never anything else on someone else's items. Users can toggle their profile private in Profile Settings. The Collection tab opens with the same segmented-shelf hero the dashboard has (real cover art, one row per type the collector owns and has enabled, each in its own color/icon) — click a row to filter the grid below to that type, or a cover to jump straight to it (games/comics/trading cards/Funko Pops open the item directly; other types filter to that row). Needs publicprice-refresh-migration.sql on existing projects.
Profile settings: display name, bio, public/private toggle, preferred currency (for price display only — no live conversion), and avatar image upload (stored in Supabase Storage).
Collection value over time: a mini chart on the dashboard tracks your estimated collection value across snapshots — recorded automatically after "Refresh all prices," or manually via "Record snapshot."
Recommended for you: a panel on the dashboard suggests titles you don't own yet, based on what other public collectors who rated the same things highly as you also rated well. Click one to add it, pre-filled. No recommendations show until there's enough shared rating data — needs recommend-games-migration.sql on existing projects.
Leaderboard (/leaderboard): tabs for most-owned items, trending titles (last 14 days), biggest public collections, most valuable public collections, a trophy case ranking, and a Friends tab (just the public collectors you follow, with its own row of pills for the same 5 categories), each with a gold/silver/bronze podium for the top 3 (cover art or avatar sized up, colored glow per medal) — computed from public collections only. "Most valuable" converts every collector's total to USD behind the scenes to decide ranking order (a weekly cron keeps the underlying rates current — see step 8), and now shows a converted figure alongside each collector's own-currency total on the podium too — in whichever currency the viewer has picked in their own Settings, not a fixed USD, whenever it's different from the collector's own. Needs trophy-leaderboard-migration.sql, valuable-leaderboard-migration.sql, friends-leaderboard-migration.sql, friends-leaderboard-expanded-migration.sql, and currency-aware-valuable-leaderboard-migration.sql on existing projects.
Trophies (shown on /u/username): a PlayStation-style trophy case — bronze/silver/gold/platinum badges earned for collection milestones (first item, 10 items, 100 items, 25 completed, follower counts, etc.). Trophies are computed and awarded by a trusted database function, not by the browser, so they can't be faked. Earning one also shows up in your followers' /feed. Requires activity-trophies-migration.sql on existing projects for the feed part.
Half-star ratings: personal ratings go in 0.5 steps (e.g. 3.5, 4.5) — click the left half of a star for a half rating. Requires halfstar-ratings-migration.sql on existing projects.
Bulk edit (dashboard "Select" toggle): checkbox-select several items at once, then bulk-change ownership status or platform, add a tag to all of them, set gift priority across whichever selected items are on the wishlist, or delete them together — instead of opening each item individually.
Collection Insights (/dashboard/insights): breakdowns of your owned items by type, platform, and genre, value by type, spending by month, and which calendar month you tend to add the most items in — all derived from data already in your collection, no new fields to fill in. A second "Made for what you collect" section below adds type-specific panels that only show up for types you actually own: backlog health + trophy completion for games, raw-vs-graded + top card sets for trading cards, top series for comics and books, record labels + format for vinyl/CD, manufacturer for consoles, studio for DVD/VHS, character for Funko Pops. No new env vars or migration.
Condition photos: attach up to 4 real photos to a physical item (separate from cover art) for high-value collectibles where actual condition or grading matters. Needs condition-photos-migration.sql and item-photos-storage-migration.sql on existing projects.
Feedback (/feedback, linked from the footer): a bug/issue/feature-suggestion form anyone can use, no account required. Every submission saves to the feedback table; see step 7 below to also get an email notification. Needs feedback-migration.sql on existing projects.
New-feature newsletter: an opt-in checkbox in Profile Settings ("Email me when something new ships") plus a private admin page (/admin/newsletter) to manually write and send an update to everyone opted in. See step 7 below for setup — needs newsletter-optin-migration.sql on existing projects.
Vinyl/CD auto-search: a "Search" button next to Title for Vinyl and CD, same pattern as games/cards/books — backed by MusicBrainz (free, no signup) and fills in artist, label, and format. Doesn't fill in cover art (MusicBrainz's Cover Art Archive only has it for a fraction of releases), so cover stays a manual paste for these two types, same as consoles.
Reactions on the feed: a 👍 button on each /feed entry, one per person per event. Reacting to someone else's activity notifies them (via the bell). Needs activity-reactions-migration.sql on existing projects.
Trophy rarity: each trophy in your Trophy Case now shows "X% of collectors have this," computed live from real site-wide data. Needs trophy-rarity-migration.sql on existing projects.
SEO landing pages: four dedicated pages (/video-game-collection-tracker, /comic-collection-app, /collectible-database, /retro-game-inventory) each targeting a different real search term with genuinely different content for that audience, cross-linked from the footer and each other. Content lives in lib/landingPages.js; add a new entry there plus a matching app/<slug>/page.js to add more.
Collector level: trophies are also worth points (10/25/50/200 for bronze/silver/gold/platinum) that roll up into an overall "Level" badge shown above your Trophy Case — PSN-style, purely derived from trophies you already have, no new data to enter.
Comment rate limiting: a server-side cap (5 comments per 5 minutes per person) on profile comments, enforced by a database trigger so it can't be bypassed by calling the API directly. Needs comment-rate-limit-migration.sql on existing projects.
Tag and custom-list filtering on the dashboard: click any tag badge on a card (or pick one from the Filters panel) to filter the grid down to just that tag, same spirit as the existing "Browse by system" platform tiles. Custom lists (components/CustomListsModal.jsx, managed from your public profile's "Manage lists") also show up as a Filters-panel dropdown now, so a list you built for profile browsing (Favorites, For sale, etc.) doubles as a saved view on the dashboard where you're actually managing the collection — previously lists were profile-display only.
Feedback rate limiting: a server-side cap (5 submissions per 10 minutes per IP) on the public feedback form — the last of the site's write endpoints (comments, articles, WebAuthn already had one) with no cap at all, and the only one open to anyone with no sign-in required. Needs feedback-rate-limit-migration.sql on existing projects.
Installable app: Shelf Life can be added to your phone or desktop's home screen/app list like a native app (app/manifest.js), with a minimal offline fallback page if you open it with no connection. Deliberately doesn't cache your actual collection data for offline browsing — that's still fetched fresh from Supabase every time, so you're never looking at stale prices or a friend's already-changed collection.
Price-drop alerts: set a target price on a wishlist item and get notified (via the bell) the first time eBay's current listings dip at or below it — checked once a day by a Vercel Cron job. See step 8 below for setup — needs price-drop-alerts-migration.sql on existing projects.
VHS + DVD/Blu-ray auto-search: a new VHS item type (same fields as DVD — Director, Studio, Format, Edition), and both now have a "Search" button backed by Apple's free iTunes Search API (no signup) — fills in director, studio, and genre. Needs vhs-migration.sql on existing projects.
Passkey sign-in (Face ID / Touch ID): add a passkey from Profile Settings, then sign in with it from the login page instead of typing your password — real WebAuthn, verified server-side, with a server-side rate limit (by IP) across all four WebAuthn API routes so the sign-in/registration ceremony can't be hammered for cheap challenge generation or credential probing. Needs passkey-migration.sql and webauthn-rate-limit-migration.sql on existing projects; no new env vars (reuses SUPABASE_SERVICE_ROLE_KEY, already required for the newsletter feature).
Collection cards: view first, edit as its own action: clicking a card in your dashboard grid opens a read-only detail view (notes, purchase price/date, condition photos — the fields that only ever lived inside the edit form before) rather than jumping straight into editing; an explicit Edit button, both on the card itself and inside the detail view, is the separate path into the actual edit form.
Site stats (/admin/stats, private/unlinked — only visible to ADMIN_EMAIL): total users, new signups this week/month, items logged site-wide, the most active public collectors over the last 30 days, and a "Cron jobs" section showing each scheduled job's last run time and status (or "Never run yet") — pulled from data that already exists in every table involved, no new fields to fill in. Needs cron-heartbeat-migration.sql on existing projects.
Currency rates auto-refresh: the "Most valuable" leaderboard's USD conversion table used to be a one-time hand-typed snapshot with no way to know it had gone stale; a weekly Vercel Cron job now refreshes it from a free, no-key rates API (frankfurter.app). See step 8 for setup (reuses the same CRON_SECRET/SUPABASE_SERVICE_ROLE_KEY the price-drop cron already needs).
Weekly stats digest: the same numbers /admin/stats shows on demand now also land in ADMIN_EMAIL's inbox automatically every Sunday morning, via a Vercel Cron job — turns it from something you have to remember to check into something that just shows up. See step 8 for setup.
Cron failure alerts: every scheduled job (price-drop checks, account deletions, currency refresh, the stats digest) now emails ADMIN_EMAIL if it actually fails, instead of the failure only existing in Vercel's 1-hour runtime logs. See step 8.
External cron watchdog (optional): every cron job can also ping a free outside dead-man's-switch service (healthchecks.io or Cronitor) after each run, closing the one gap the cron heartbeat and failure-alert features above can't — a job that stops firing entirely instead of running and failing. See step 8 for setup.
Public trust stats: the logged-out home page's stat strip ("X items catalogued," "Y public collectors") now also shows a live count of trophies earned site-wide, once there are enough to be worth showing — a little more social proof for a first-time visitor deciding whether to sign up.
Report a comment or a profile: a "Report" link on every comment and a "Report profile" option (in the "More actions" menu) on public profiles, for signed-in users. Files into a private moderation queue (/admin/reports, only visible to ADMIN_EMAIL) and emails a notification the same way feedback does. Rate-limited server-side (5 per 5 minutes per person), same shape as comments. Needs report-migration.sql on existing projects; no new env vars.
"Download my data": a "Download my data" button next to Export CSV in Profile settings downloads a full JSON export of everything about your account beyond the collection itself — profile, comments written and received, follows, activity feed entries, and trophies. Runs entirely through your own signed-in session (no admin access involved), so there's nothing new to configure.
"What's new" on the logged-out home page: the newest few entries from /whats-new now show right on the home page for signed-out visitors too, not just behind a small footer link — the same section the logged-in home page already had.
Accessibility improvements: a skip-to-content link for keyboard users, toast notifications now announced to screen readers (aria-live), and a fixed missing focus indicator on tag/chip input fields — first slice of a larger accessibility pass, see ROADMAP.md for what's still open.
"See master set" for trading cards, Pokémon and Magic both: editing a trading card and hitting "See master set" shows every real card in that set as its own checkable tile — pulled live from TCGdex for Pokémon (every print variant: Normal, Reverse Holo, Holo, 1st Edition, W Promo) or Scryfall for Magic (every finish: Nonfoil, Foil, Etched Foil) — instead of only knowing about cards already logged on the site. Works best when the card was added via the trading-card Search button, so the set name matches exactly; falls back to Shelf Life's own crowdsourced series view if neither recognizes the set at all. A background weekly cron (refresh-master-sets, no setup needed) now also pre-fetches every card's real variant data for Pokémon sets people have actually logged cards from, so the grid can show prints you don't own yet, not just confirm the ones you do — Magic doesn't need this, since Scryfall returns full variant data for a whole set in one request already.
Comic "See master set": comics get the same real per-series checklist trading cards already have, now pulled live from Comic Vine instead of only knowing about issues someone here has logged — a genuine "here's every issue this run had" list, fetched against a real time budget rather than a fixed page count so even 1000+-issue ongoing titles get their complete list as long as the lookup itself finishes quickly enough. Needs COMICVINE_API_KEY (see step 5) — same key comic search/auto-fill already use.
Bulk edit and custom lists, both directions: dashboard Select mode can now add selected items to a custom list or remove them from one, using the same list-picker dropdown in the bulk bar.
Notification mute: a "Notifications" section in Profile Settings lets you turn off any of the 5 notification types (followers, comments, trophies, reactions, wishlist price drops) individually — the bell just stops surfacing whatever you uncheck. Needs notification-mute-migration.sql on existing projects.
Gift list link (/u/<username>/wishlist): a lightweight, shareable page showing just your wishlist — meant for sending to family/friends around gift-giving occasions instead of handing them the whole collection to dig through. Reachable from "More actions" on your public profile, with its own share button. A second, separate "Share my gift list even when my profile is private" toggle in Profile Settings lets you share just this page without making the rest of your collection public — needs wishlist-public-migration.sql on existing projects.
Old notification rows now get cleaned up automatically: notifications older than 180 days (read or not — a muted type's rows never get marked read at all) are purged daily as part of the existing account-deletions cron job, instead of accumulating in the database forever with no cleanup path.
Full notification history (/notifications, linked from the bottom of the bell dropdown): the bell itself only ever shows your most recent 30 — this page shows everything still in the database, 50 at a time, with a filter row to narrow it down to just one notification type. Same per-category mute settings apply here too. No new env vars or migration.
SeriesGrid pagination: any "See master set"/"See full series" grid (Pokémon, comics, or the crowdsourced fallback) now shows the first 100 entries with a "Show more" button for the rest, instead of rendering a very large set all at once.
Dashboard "Tools" panel: Filters, Select, Views, and the Play Next/Recommended/value-chart/Browse-by-system panels now live behind one "Tools" button next to Search and Sort, instead of several separate toggles and panels stacked above the grid by default. No new env vars or migration.
Settings tabs (renamed from "Profile settings," since most of it isn't really about the profile): the settings panel is five tabs (Profile, Notifications, Collecting, Security, Data & danger zone) instead of one long scroll — same fields, same behavior, just organized.
Notifications empty state explains a mute, and links straight to it: filtering /notifications to a type you've muted now says so directly, with a link straight to the Notifications tab of Settings instead of leaving you to guess why nothing's showing up.
Gift priority: wishlist items can be marked High/Medium/Low priority, right in the Add/Edit form — shows as a badge on the card and sorts your gift list (/u/<username>/wishlist) so "get this one first" items land at the top. Needs wishlist-priority-migration.sql on existing projects.
"On this day": a dashboard panel surfaces what you added, finished, or rated on today's date in a previous year, when there's anything to show. No new env vars or migration.
Lists directory (/lists, linked from the navbar): browse every public custom list site-wide — not just the ones a particular collector made, everyone's. Click one to see its full contents on its own page. Needs public-lists-migration.sql on existing projects.
Aggregate rating on search tiles: the Search page's collectible results now show the average rating right on the tile (e.g. "4.5★"), not just after you open the detail page. No new env vars or migration.
"Collectors you might like": a dashboard panel next to "Recommended for you" suggests public collectors who rated the same titles highly as you did, with a Follow button right on the tile. Needs recommend-collectors-migration.sql on existing projects.
"Wishlist matches": a dashboard panel (inside Tools > Insights) shows which public collectors you follow already own something on your wishlist, and flags when they own more than one copy — a hint they might have a spare worth asking about. No in-app trading/messaging yet — click through to their profile. Needs wantlist-matches-migration.sql on existing projects.
"For sale" flag: mark any owned item for sale with an asking price, right in the Add/Edit form — shows as a green badge on the card everywhere it renders, including your public profile. Needs forsale-migration.sql on existing projects.
Your Wrapped (/dashboard/wrapped, linked from the dashboard sidebar): a shareable, end-of-year recap card — items added, busiest month, completions, ratings, and estimated value change, built entirely from data already tracked. No new env vars or migration.
Mobile fix: search-result tiles: the Search page's collectible tiles now truncate their meta text on mobile instead of wrapping and stretching their whole grid row uneven with neighboring cards. No new env vars or migration.
Collection appraisal export (/dashboard/appraisal, linked from the dashboard sidebar): a print-optimized, itemized document of your owned items and their current value, grouped by type with subtotals and a grand total — use your browser's "Save as PDF" for insurance documentation. No new env vars or migration.
Accessibility pass: arrow-key support for the star rating, a screen-reader announcement for trophy-earned popups, a pausable Undo-delete countdown (hover or focus stops the clock), site-wide prefers-reduced-motion support, and a new /accessibility page (linked in the footer) documenting what's covered and what's still open. No new env vars or migration.
Affiliate "buy it" links on the gift list: "Buy on eBay" / "Search Amazon" links under each item on /u/[username]/wishlist — real search links either way, with optional eBay Partner Network / Amazon Associates tracking on top. See step 9 for setup.
"Quick add (search)" (dashboard "+ Add Item" ▾, alongside "Add one item"): bulk-add items with no spreadsheet and no barcode — search a title using the same auto-fill each item type already has, pick the right result, repeat, then add the whole batch at once. Each queued item gets its own small Ownership/Condition controls before you commit, plus Completeness for games/consoles or Price for everything else, since search never returns those — everything else (purchase date, rating, tags) is still set afterward by editing the item. Newest pick shows at the top of the queue.
"+ Add Item" is now a chooser: click it to pick "Add one item" (the single-item form) or "Quick add (search)," instead of the latter being buried a menu-click deep in "More actions."
Barcode scanning removed: the camera-based barcode scanner and "Scan multiple" are gone — per-type Search auto-fill covers more titles more reliably than a UPC lookup did (including older/import releases with no barcode DB entry at all). The Barcode / UPC field itself, and any barcode data already saved, are untouched — it's the camera-scanning UI/API that's gone, not the field. If you're on an older checkout, run npm install after pulling to drop the now-unused @zxing/browser dependency.
Game search results show platforms, and multi-platform results ask which one you mean: searching a game (Add Item or Quick add) shows up to a few platform names next to each result; clicking a result released on more than one platform now pauses on a quick "which platform is this copy for?" picker instead of tagging the item with every platform it lists. A single-platform result still applies immediately, same as before.
Fixed: closing Quick add (search) could silently discard the whole queue: clicking the overlay backdrop, or pressing Escape (now handled at all — this modal previously had no keyboard/focus-trap support like the app's other modals), used to close the window instantly with no warning even with items queued. Every close path now asks first ("Discard N queued items?") whenever there's anything queued and nothing has been saved yet; committing the batch still closes immediately, no prompt.
Console search now tolerates typos: lib/consoleList.js's built-in console list (the one search backend not backed by a live third-party API) now falls back to edit-distance fuzzy matching when a plain substring search comes up empty, so a dropped or swapped letter ("nintendo swithc", "xbox seris x") still finds the right console. Substring/prefix matches still always rank first. Games, cards, books, VHS/DVD/CD/vinyl, and comics search already go through APIs (IGDB/Scryfall/TCGdex/Open Library/iTunes/MusicBrainz/Comic Vine) with their own fuzzy matching, so they weren't touched.
"What do you collect?" preferences: a new signup (and any existing account that hasn't answered yet) is asked which of the 10 item types they actually collect — everything else hides from the dashboard Filters panel and the shelf hero below. Add Item and Quick add (search) always let you add any type regardless of this setting; doing so automatically checks that type back on, since disabling a type was never meant to make it impossible to start tracking. Existing accounts get a one-time "Welcome back" version of the same prompt, pre-checked to whatever types they already own. Skippable with zero effect (nothing hides until you actually narrow it down), and always changeable afterward from Settings > Collecting. Nothing already logged is ever hidden or deleted — this only controls what shows in a couple of specific spots. Needs collection-types-migration.sql on existing projects.
Dashboard shelf hero: the dashboard now opens with a real shelf of your own cover art, one row per collectible type you own and have enabled, each in its own accent color and icon — a comic-heavy collection and a vinyl-heavy one genuinely look different. Click a row to filter the grid to that type, or a cover to open it. Shows once you've added at least one item; no new env vars or migration.
Type-aware microcopy and trophy flavor: empty states and a handful of trophies now speak a collector's own language once you've narrowed down what you collect (or logged enough of one type) — "your long box" for comics, "your binder" for trading cards, "your crate" for vinyl, "your backlog" for games, "your setup" for consoles — instead of one generic voice for every account. No new env vars or migration.
No emoji anywhere on the site or in the app: the one place an emoji was ever used — the small icon next to each row on the shelf hero — was first swapped for a colored two-letter monogram badge, then removed outright per direct feedback. Each shelf row now identifies its type with its label text and accent color alone (row label, underline, and plank all already carry the color) — no icon, letters, or emoji. No new env vars or migration.
Accessibility: light-mode contrast fixed for status/tier colors: "Owned"/"Sold" badges, the leaderboard's gold/silver/bronze podium text, and toast success messages all fell as low as ~1.6:1 against a white background in light mode, well under WCAG AA's 4.5:1 minimum for text — light mode never overrode these color tokens, so they were silently inheriting values tuned for the dark background instead. Now explicitly overridden with darker, same-hue versions that clear 4.5:1. Dark mode is unaffected. No new env vars or migration.
Accessibility: leaderboard podium's keyboard Tab order fixed: the top-3 podium is laid out 2nd/1st/3rd left to right, but Tab used to visit them in 1st/2nd/3rd order — landing on the visually-middle card before the visually-left one. Tab order now matches the visual layout. Full keyboard tab-order check across the dashboard grid, leaderboard, and search results — this was the only real issue found, closing out the accessibility checklist down to one remaining item (a manual text-size control). No new env vars or migration.
Automated tests: npm test (or npm run test:watch) now runs a real Vitest suite covering the site's pure-logic modules — title/card-number normalization and duplicate matching, currency formatting, the shelf-mosaic grouping/packing logic, and the series/master-set matching keys. Deliberately scoped to logic that needs no test environment at all (no React components, no Supabase/API calls) as a starting point, not full coverage. Needs one npm install to pull in the new vitest dev dependency; nothing else to configure.
Broken cover images now fall back gracefully everywhere, not just in most places: an audit found several spots — the Collectible Database search result and detail pages, the item detail modal, "See full series"/master-set grids, public list tiles, and Quick add (search)'s result/queue thumbnails — that showed the browser's default broken-image icon instead of a placeholder when a cover URL was dead (an expired image host, a removed listing). Now consistent with how collection cards already handled it: a graceful placeholder (or, for the small search-result thumbnails, the image just disappears rather than showing a broken-image icon) instead. Downloading and re-hosting cover art instead of trusting external URLs long-term is still a bigger, separate call — see ROADMAP.md. No new env vars or migration.
Opt-in monthly email backup: a new "Email me a monthly backup" checkbox in Settings > Data sends the same two files "Export CSV" and "Download my data" already produce on demand — collection CSV plus a JSON export of everything else about the account — as email attachments on the 1st of every month, for anyone who turns it on. Off by default. A new cron job, /api/cron/email-data-backup (see step 6 for cron setup) — needs email-backup-migration.sql on existing projects.
Opt-in weekly activity digest email: a new "Email me a weekly activity digest" checkbox in Settings > Data sends a Sunday-morning email summarizing your own week (items added/completed/rated, trophies earned) plus what the public collectors you follow have been up to — the same activity /feed shows, condensed into one email instead of something you have to remember to check. Off by default, and skips itself entirely on a quiet week with nothing to report. A new cron job, /api/cron/email-activity-digest (see step 6 for cron setup) — needs activity-digest-migration.sql on existing projects.
Dependency security patches: @supabase/ssr and @supabase/supabase-js bumped to the minimum patched versions above a set of known advisories, tested against the full build and test suite first.
Next.js 14 → 16 / React 18 → 19 upgrade: fixes 2 high-severity npm audit issues that only resolved on next@16. Requires Node 20.9+ (declared in package.json's engines field) — run npm install after pulling to pick up the new versions. See CHANGELOG.md for the full technical writeup.
Real master sets for Magic: The Gathering: "See master set" on a trading card now tries Scryfall for Magic sets (every finish — Nonfoil, Foil, Etched Foil — as its own checkable tile), in addition to the existing TCGdex-backed Pokémon support, before falling back to Shelf Life's own crowdsourced series view. No API key needed, no setup required.
Pokémon master sets now show variants you don't own yet: a new weekly cron (/api/cron/refresh-master-sets, see step 6) pre-fetches every card's real print-variant data for Pokémon sets people have actually logged trading cards from, so the master-set grid can show a print you've never touched as a real, unowned tile — not just confirm variants you already have. Needs master-set-cache-migration.sql on existing projects.
Chat-style quick add: a new "Quick add (type it)" option in the dashboard's "+ Add Item" menu parses a typed line like "fifa 06 on ps2 CIB $8 today" into a title/price/date/platform/completeness, live as you type, then hands it to the normal Add form pre-filled so every field is still visible and editable before saving. Plain regex heuristics, no AI/language API involved. No new env vars or migration.
Visual design pass: same dark theme, new warm gold/mint accent colors (replacing the old purple/teal), rounder cards and pills, a category-filter rail above the dashboard's shelf hero, a real "velvet panel and medallions" Trophy Case redesign with a lock icon on unearned trophies, elegant category-icon cover placeholders anywhere art is missing or fails to load, a faint mosaic of your own real cover art behind your public profile header, and a small illustration on the empty-collection welcome screen. Also pads the navbar for a device's top safe-area inset so it clears a notch/status bar when installed as an app. No new env vars or migration — CSS/component restyle only.
"See full series" for Vinyl, CDs, DVDs, VHS, and Books: these five now get the same "See full series" button games/comics/trading cards/Funko Pops already had — grouped by the same artist (Vinyl) or director/author/artist (CD/DVD/VHS/Book), pulled from what other Shelf Life collectors have logged, same crowdsourced approach Funko Pops already use since there's no free public discography/filmography/bibliography API for any of these. Consoles intentionally don't get this — there's no per-item "creator" field that forms a real completable series the way artist/director/author do. No new env vars or migration.
Full release catalogue (/dashboard/catalogue, linked from the dashboard sidebar and from an active "Browse by system" tile): pick a platform and see every game IGDB has on file for it as its own checkable tile, greyed out except what you've already logged for that system — not just a checklist of what's already in your own collection, the real thing. Click any not-owned tile to check eBay for it (CeX if eBay has nothing), same click-through every other missing-entry grid on the site already has. Real server-side pagination and a title-search box, since a major platform's catalog can run into the thousands, and the grid uses the full page width on desktop. (Originally restricted to IGDB's "main game" category to keep DLC/bundles/ports out, but that filter turned out to be broken — see CHANGELOG.md — and was removed, so a system's occasional DLC/bundle/port entry can show up alongside the real releases now.) Uses the same IGDB_CLIENT_ID/IGDB_CLIENT_SECRET env vars game search/auto-fill already needs — no new setup. No migration needed.
Print labels (/dashboard/labels, linked from the dashboard sidebar): pick which owned items to include and print a small QR sticker per item, sized for Avery 5160 (or compatible) address label sheets — 30 per sheet. Scanning a label opens that item's own page here, signed in on your phone — a fast way to look a boxed item back up if you actually store a physical collection. Adds a new qrcode npm dependency — run npm install after pulling. No new env vars or migration.
API access (/dashboard/api-tokens, linked from the dashboard sidebar): generate a personal access token and pull your own collection as JSON — GET /api/v1/me and GET /api/v1/collection (optional ?type=/?ownership= filters), authenticated via Authorization: Bearer sl_live_... instead of a signed-in session. Free, rate-limited to 60 requests/minute per token; only a hash of each token is ever stored, so the raw value is shown once, at creation. Needs api-tokens-migration.sql on existing projects — no new env vars.
Per-item reviews: any item's page (/collectible?type=&title=) now has a Reviews section — a star rating plus written text, one per reviewer, aggregated across everyone who's reviewed that exact item, separate from the existing personal (per-copy, private-by-default) rating field. Posting one requires actually owning the item, enforced at the database level. Same visibility rule as comments and lists elsewhere on the site — visible to anyone if your profile is public, otherwise just to you. Needs item-reviews-migration.sql on existing projects — no new env vars.
Manual text-size control: a "Text" dropdown next to the navbar's Dark/Light toggle offers Normal/Large/Larger, scaling the whole page (not just body text) via CSS zoom — works for signed-out visitors too, and matters most in the wrapped iOS app, where the system-level "Larger Text" setting doesn't reach web content. Remembered per device (localStorage), not tied to your account. No new env vars or migration.
Upcoming releases (/dashboard/upcoming-releases, linked from the dashboard sidebar): a calendar of upcoming releases — grouped by month — plus a running "this week"/"this month" spend total from expected prices you type in yourself (neither IGDB nor Comic Vine exposes real price data for something that hasn't released yet). Games and comics are matched differently (redesigned Sep 2026, see CHANGELOG.md): a game shows up if it's an upcoming, currently-hyped release (by IGDB's own pre-release "hype" signal, not just anything technically unreleased) in a genre or on a platform your own collection already touches — not tied to any specific franchise you own — while a comic issue still has to belong to an exact series you already own something from (Comic Vine has no clean genre-equivalent to broaden against). A weekly cron (/api/cron/refresh-upcoming-releases, see step 6) keeps a cache of real upcoming dates warm for every platform/genre/series someone here actually tracks, so the page never hits IGDB/Comic Vine live. Uses the same IGDB_CLIENT_ID/IGDB_CLIENT_SECRET/COMICVINE_API_KEY env vars game/comic search already need — no new setup. Needs upcoming-releases-migration.sql and upcoming-release-aliases-migration.sql on existing projects (the second one fixes a real bug — see CHANGELOG.md — where a cached franchise almost never matched what a title was actually stored as; the same alias table now also resolves platform/genre lookups, no further migration needed for that). The page will show nothing until the cron has actually run once — on a brand-new deploy (or right after adding this feature to an existing project), don't wait for the weekly schedule: run vercel crons run /api/cron/refresh-upcoming-releases from the project directory a few times a couple minutes apart to backfill an existing collection faster (each run picks up a fresh batch it hasn't cached yet, up to MAX_SERIES_PER_RUN).
Persistent dashboard sidebar: flagged directly — Collection insights, Your Wrapped, Collection appraisal, Upcoming releases, Full release catalogue, Print labels, and API access had all ended up buried a click deep inside a "More actions" dropdown that had grown to 7 page links plus Refresh all prices and Settings, with nothing on any of those pages linking back to it once you navigated away. Replaced with a real sidebar (app/dashboard/layout.js + components/DashboardSidebar.jsx) that's visible on every /dashboard/* route — a sticky left column on desktop, a slide-in drawer from the left on mobile (same off-screen-transform pattern the navbar's own mobile menu already used) — grouped into My Collection, Insights & reports, Utilities, and Account, with the current page highlighted. The old "More actions" dropdown on the main dashboard toolbar is gone; Refresh all prices and Settings are now plain buttons in the toolbar instead. No new env vars or migration — layout/component/CSS only.
Phone bottom tab bar: on a phone (under 640px wide), a persistent bottom bar takes over primary navigation instead of needing the hamburger menu open — My Collection, Search, Feed, and My Profile, each one tap away, the current page highlighted. Desktop is unchanged, and the rest of the site's links (Leaderboard, Lists, Articles) still live in the hamburger menu. No new env vars or migration — layout/component/CSS only.
Import from Discogs (dashboard's Collection tools, next to Import CSV): type any public Discogs username and bulk-add their Vinyl and CD releases, the same idea as the existing "Import from Steam" but without a login step — Discogs collections are readable by username alone, same as visiting discogs.com/user/<name> in a browser. Only Vinyl and CD formats are imported (no Cassette/digital/box sets). Re-running it, or running it against a second username, skips anything already in the collection instead of creating duplicates. Goodreads' half of this idea (book import) turned out not to be buildable — Goodreads stopped issuing new developer API keys in Dec 2020. Needs DISCOGS_API_TOKEN (see step 8 of "Configure the app" above) and discogs-import-migration.sql on existing projects.
Creator pages (linked from the footer): search by creator name and browse their whole body of work in one grid, greyed out except what you already own, same "own it or don't" look SeriesGrid uses everywhere else on the site. Public — works signed out, same as the SEO landing pages — with ownership-highlighting and click-to-price-check on missing entries once you're signed in. Four now ship: /creator/comics (writer/artist, via Comic Vine — uses the same COMICVINE_API_KEY game/comic search already needs), /creator/books (author, via Open Library — no key needed), /creator/games (developer/publisher, via IGDB — uses the same IGDB_CLIENT_ID/IGDB_CLIENT_SECRET game search already needs), and /creator/cards (illustrator, via Scryfall for Magic and TCGdex for Pokémon — both fully free and keyless). No new setup or migration for any of the four — each reuses an API this project's other search/auto-fill features already rely on, or needs none at all.
LEGO set tracking: a new LEGO Set item type — Theme, Set number, Minifigures included, Exclusive to, Grading, and a special/exclusive-variant checkbox, reusing the same fields Funko Pops already use (card_set/card_number/player_name/publisher/grade/is_variant/variant_notes) rather than adding new columns. Unlike Funko Pops, LEGO sets get a real "Search" auto-fill button (see step 6 of "Configure the app" above) backed by Rebrickable's free, live set database — fills in Theme and Set number from an actual search instead of typing every set in by hand. Always treated as a physical item (no digital LEGO sets), same as consoles/Funko Pops/VHS. Shows up in Collection Insights' "Made for what you collect" section (a "By theme" breakdown) once you own at least one. Needs lego-migration.sql on existing projects.
LEGO: Minifigures auto-fill, and a real "See master set" by Theme: LEGO Search now also fills in Minifigures included from Rebrickable's real per-set data, the same "instant fields first, one extra lookup right after" pattern comic search already uses for writer/artist/publisher. "See master set" on a LEGO set now pulls a genuine, live list of every set Rebrickable has for that Theme — the same real-per-set upgrade trading cards (TCGdex/Scryfall) and comics (Comic Vine) already have — instead of only knowing about sets already logged on the site, with the same crowdsourced fallback for a theme Rebrickable doesn't recognize. Uses the same REBRICKABLE_API_KEY the original LEGO Search button already needs (see step 6) — no new setup, no migration.
LEGO: "Built" checkbox: mark a LEGO set as actually assembled, separate from the existing "100% Complete" flag (which is about having every piece/box/manual, not whether it's been put together). Shows as a badge on the card and in the item's detail view. Needs legobuilt-migration.sql on existing projects.
