chore: bump version to 2026.2.2, add changelog and update news (Task 7)

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to DeckyVault will be documented in this file.
 
+## [2026.2.2] - 2026-05-27
+
+### Added
+- **Sign-up domain restriction for deckyvault.xyz:** new account creation with `@deckyvault.xyz` email addresses is now blocked in production. This prevents unauthorized use of the brand domain. The restriction is lifted in development builds.
+- **Branded email placeholder:** all auth forms (sign-up, login, forgot password) on web and mobile now use `you@deckyvault.xyz` as the default placeholder instead of the generic `you@example.com`
+
+### Changed
+- Server-side domain enforcement ensures the `@deckyvault.xyz` block cannot be bypassed by direct API calls or social login flows
+- Existing `@deckyvault.xyz` account holders can still log in, use password reset, and receive OTPs
+
+### Technical
+- Added `lib/auth/domain-block.ts` shared domain validation helper
+- Added Elysia middleware in `lib/api/app.ts` for server-side sign-up domain enforcement
+- Added Zod `.refine()` on `signupSchema` for client-side domain validation
+
 ## [2026.2.1] - 2026-05-25
 
 ### Fixed

content/updates/2026-05-27-v2026.2.2.md

@@ -0,0 +1,20 @@
+---
+title: "Domain Restriction & Branded Placeholder — Sign-Up Protection"
+date: "2026-05-27"
+version: "2026.2.2"
+summary: "Blocked sign-ups using @deckyvault.xyz email addresses in production and updated all auth form email placeholders to use the DeckyVault domain."
+---
+
+### Domain Protection for Sign-Ups
+
+New accounts can no longer be created with `@deckyvault.xyz` email addresses in production. This prevents unauthorized use of the DeckyVault brand domain — the domain owner is the only one who should be creating accounts with those addresses.
+
+The restriction applies to all sign-up methods: email/password, one-time code (OTP), and social login via Google or Discord.
+
+**What's NOT affected:**
+- Existing `@deckyvault.xyz` accounts continue to work normally — login, password reset, and OTP sign-in are all functional
+- Development builds still allow `@deckyvault.xyz` sign-ups for testing
+
+### Branded Placeholder Text
+
+All email input fields across web and mobile now show `you@deckyvault.xyz` as the default placeholder, replacing the generic `you@example.com`. This appears in the sign-up, login, and forgot password forms.

lib/__tests__/version-bump.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect } from "vitest"
+import fs from "node:fs"
+import path from "node:path"
+
+describe("version bump to 2026.2.2", () => {
+  const cwd = process.cwd()
+
+  it("package.json version is 2026.2.2", () => {
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(cwd, "package.json"), "utf8"),
+    )
+    expect(pkg.version).toBe("2026.2.2")
+  })
+
+  it("OpenAPI spec version is 2026.2.2", () => {
+    const apiContent = fs.readFileSync(
+      path.join(cwd, "lib", "api", "app.ts"),
+      "utf8",
+    )
+    expect(apiContent).toContain('version: "2026.2.2"')
+  })
+
+  it("CHANGELOG.md contains [2026.2.2] entry", () => {
+    const changelog = fs.readFileSync(
+      path.join(cwd, "CHANGELOG.md"),
+      "utf8",
+    )
+    expect(changelog).toContain("## [2026.2.2]")
+    expect(changelog).toContain("### Added")
+    expect(changelog).toContain("@deckyvault.xyz")
+  })
+
+  it("content/updates/2026-05-27-v2026.2.2.md exists with valid frontmatter", () => {
+    const updatePath = path.join(
+      cwd,
+      "content",
+      "updates",
+      "2026-05-27-v2026.2.2.md",
+    )
+    expect(fs.existsSync(updatePath)).toBe(true)
+
+    const content = fs.readFileSync(updatePath, "utf8")
+    expect(content.startsWith("---")).toBe(true)
+    expect(content).toContain('title:')
+    expect(content).toContain('date: "2026-05-27"')
+    expect(content).toContain('version: "2026.2.2"')
+    expect(content).toContain('summary:')
+  })
+})

lib/api/__tests__/openapi-fixes.test.ts

@@ -4,7 +4,7 @@ describe("API version", () => {
   it("matches package.json version", () => {
     const pkg = require("../../../package.json")
     const expectedVersion = pkg.version
-    expect(expectedVersion).toBe("2026.2.1")
+    expect(expectedVersion).toBe("2026.2.2")
   })
 })
 

lib/api/app.ts

@@ -79,7 +79,7 @@ export const app = new Elysia({ prefix: "/api" })
       documentation: {
         info: {
           title: "DeckyVault API",
-          version: "2026.2.1",
+          version: "2026.2.2",
           description:
             "API for DeckyVault — Steam Deck game compatibility, performance reports, and community features.",
         },
@@ -275,7 +275,7 @@ export const app = new Elysia({ prefix: "/api" })
   .use(rateLimit("default"))
   .get("/", () => ({
     name: "DeckyVault API",
-    version: "2026.2.1",
+    version: "2026.2.2",
   }))
 
 export type App = typeof app

package.json

@@ -1,6 +1,6 @@
 {
   "name": "deckyvault",
-  "version": "2026.2.1",
+  "version": "2026.2.2",
   "private": true,
   "scripts": {
     "dev": "next dev --experimental-https --webpack",