feat: anonymous read-only public link + QR code for meal plans (v0.68.0)

Mirrors shopping lists' isPublic pattern but read-only only -- no
publicEditable equivalent, since anonymous editing of someone's
weekly meal schedule isn't a real use case the way collaborative
shopping-list editing is. New PATCH /api/v1/meal-plans/{weekStart}
toggles it (lazily creates the week's plan row if missing, same
pattern as the existing POST). Public page at /m/[id] renders the
week grouped by day, linking through to public/unlisted recipes and
just showing the title otherwise.

ShareMealPlanButton gained the same public-link toggle UI as its
shopping-list sibling, plus a QR code (generated client-side via the
already-installed `qrcode` package) for the link once enabled --
handing someone a printed or screenshotted plan doesn't require
typing a URL.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together.
 
+## 0.68.0 — 2026-07-21 10:00
+
+### Added
+- Meal plans can now be shared with a read-only anonymous public link (Share → Public link), same idea as shopping lists' public link but view-only, plus a QR code you can screenshot or print to hand someone the week's plan.
+
 ## 0.67.0 — 2026-07-21 09:30
 
 ### Added

FEATURE_AUDIT.md

@@ -49,7 +49,7 @@ Status legend: **Exists** (fully working) · **Partial** (works but with a real
 |---|---|---|---|
 | Weekly calendar meal plan | Exists | Mon–Sun grid, manual CRUD + bulk-set-week | `apps/web/app/(app)/meal-plan`, `apps/web/app/api/v1/meal-plans/[weekStart]/**` |
 | AI weekly meal-plan generator | Exists | Pantry-aware, dietary-aware, nudged by nutrition goals; one real recipe per entry | `apps/web/app/api/v1/ai/meal-plan/generate` |
-| Meal plan sharing | Exists (collaborators only) | `meal_plan_members` viewer/editor roles; **no anonymous public link** (unlike shopping lists) | `apps/web/lib/meal-plan-access.ts` |
+| Meal plan sharing | Exists | `meal_plan_members` viewer/editor roles for collaborators, plus an anonymous read-only public link (`isPublic` flag, mirrors shopping lists' but view-only — no public-editable mode) at `/m/[id]`, with a QR code generated client-side for the link | `apps/web/lib/meal-plan-access.ts`, `apps/web/app/m/[id]/page.tsx`, `apps/web/components/meal-plan/share-meal-plan-button.tsx` |
 | **Calendar export (.ics)** | **Exists** | Real ICS builder with per-meal-type wall-clock times | `apps/web/app/api/v1/meal-plans/[weekStart]/export/ics` |
 | Weekly nutrition rollup | Exists | | `apps/web/app/api/v1/meal-plans/[weekStart]/nutrition` |
 | Multiple shopping lists | Exists | | `apps/web/app/api/v1/shopping-lists/**` |
@@ -146,7 +146,7 @@ Ranked roughly by likely value:
 4. **USDA/nutrition-database lookup** — all nutrition numbers are AI-estimated; barcode scan only gets product name, not nutrition facts.
 5. ~~OS Share Target~~ — closed 2026-07-21 (Chromium/Android only, no Safari equivalent exists).
 6. ~~Push click-through handling~~ — closed 2026-07-21 (`push`/`notificationclick` listeners added to `sw.js`).
-7. **Anonymous public link for meal plans** — shopping lists have this, meal plans don't.
+7. ~~Anonymous public link for meal plans~~ — closed 2026-07-21 (read-only, with a QR code).
 8. **Grocery delivery/live pricing** beyond the Instacart stub (which needs a partnership agreement to go live).
 9. **Offline coverage for shopping lists / meal plan** — currently recipe-viewing + mark-cooked only.
 10. ~~Moderator-scoped admin routes~~ — closed 2026-07-21 (reports + recipe-unpublish).

apps/web/app/(app)/meal-plan/page.tsx

@@ -136,7 +136,7 @@ export default async function MealPlanPage({
           </div>
         </div>
         <div className="flex flex-wrap items-center gap-2">
-          <ShareMealPlanButton weekStart={weekStart} />
+          <ShareMealPlanButton weekStart={weekStart} mealPlanId={plan?.id} initialIsPublic={plan?.isPublic ?? false} />
           <NewShoppingListButton
             defaultWeekStart={weekStart}
             defaultName={formatMessage(msgs.mealPlan.shoppingListWeekName, { week: label })}

apps/web/app/api/v1/ai/meal-plan/generate/route.ts

@@ -101,7 +101,7 @@ export async function POST(req: NextRequest) {
   if (!mealPlan) {
     const planId = crypto.randomUUID();
     await db.insert(mealPlans).values({ id: planId, userId, weekStart: parsed.data.weekStart });
-    mealPlan = { id: planId, userId, weekStart: parsed.data.weekStart, createdAt: new Date() };
+    mealPlan = { id: planId, userId, weekStart: parsed.data.weekStart, isPublic: false, createdAt: new Date() };
   }
 
   const createdEntries: Array<{ id: string; day: string; mealType: string; recipeId: string; recipeTitle: string }> = [];

apps/web/app/api/v1/meal-plans/[weekStart]/route.ts

@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
 import { db, mealPlans, eq, and } from "@epicure/db";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
 
@@ -41,3 +42,31 @@ export async function POST(req: NextRequest, { params }: Params) {
   await db.insert(mealPlans).values({ id, userId: session!.user.id, weekStart });
   return NextResponse.json({ id, weekStart }, { status: 201 });
 }
+
+const PatchSchema = z.object({
+  isPublic: z.boolean(),
+});
+
+export async function PATCH(req: NextRequest, { params }: Params) {
+  const { session, response } = await requireSessionOrApiKey(req);
+  if (response) return response;
+  const { weekStart } = await params;
+
+  const parsed = PatchSchema.safeParse(await req.json());
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  const existing = await db.query.mealPlans.findFirst({
+    where: and(eq(mealPlans.userId, session!.user.id), eq(mealPlans.weekStart, weekStart)),
+  });
+
+  const id = existing?.id ?? crypto.randomUUID();
+  if (!existing) {
+    await db.insert(mealPlans).values({ id, userId: session!.user.id, weekStart, isPublic: parsed.data.isPublic });
+  } else {
+    await db.update(mealPlans).set({ isPublic: parsed.data.isPublic }).where(eq(mealPlans.id, id));
+  }
+
+  return NextResponse.json({ id, weekStart, isPublic: parsed.data.isPublic });
+}

apps/web/app/m/[id]/page.tsx

@@ -0,0 +1,101 @@
+import type { Metadata } from "next";
+import { notFound } from "next/navigation";
+import { headers } from "next/headers";
+import Link from "next/link";
+import { Globe } from "lucide-react";
+import { auth } from "@/lib/auth/server";
+import { db, mealPlans, eq, and } from "@epicure/db";
+import { buttonVariants } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
+import { getMessages, formatMessage } from "@/lib/i18n/server";
+
+type Params = { params: Promise<{ id: string }> };
+
+const DAY_ORDER = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"] as const;
+const MEAL_ORDER = ["breakfast", "lunch", "dinner", "snack"] as const;
+
+export async function generateMetadata({ params }: Params): Promise<Metadata> {
+  const { id } = await params;
+  const plan = await db.query.mealPlans.findFirst({
+    where: and(eq(mealPlans.id, id), eq(mealPlans.isPublic, true)),
+  });
+  if (!plan) return {};
+  return { title: `Week of ${plan.weekStart}` };
+}
+
+export default async function PublicMealPlanPage({ params }: Params) {
+  const { id } = await params;
+  const session = await auth.api.getSession({ headers: await headers() }).catch(() => null);
+  const m = getMessages((session?.user as { locale?: string } | undefined)?.locale);
+
+  const plan = await db.query.mealPlans.findFirst({
+    where: and(eq(mealPlans.id, id), eq(mealPlans.isPublic, true)),
+    with: {
+      entries: {
+        with: { recipe: { columns: { id: true, title: true, visibility: true } } },
+      },
+    },
+  });
+
+  if (!plan) notFound();
+
+  const byDay = plan.entries.reduce<Record<string, typeof plan.entries>>((acc, entry) => {
+    (acc[entry.day] ??= []).push(entry);
+    return acc;
+  }, {});
+
+  return (
+    <div className="container mx-auto max-w-2xl px-4 py-8 space-y-6">
+      <div className="flex items-center gap-2 text-sm text-muted-foreground">
+        <Globe className="h-3.5 w-3.5" />
+        <span>{m.mealPlan.publicLinkReadOnlyDescription}</span>
+        {!session && (
+          <div className="ml-auto flex items-center gap-2">
+            <Link href="/signup" className={cn(buttonVariants({ size: "sm" }))}>{m.publicRecipe.signUpFree}</Link>
+            <Link href="/login" className={cn(buttonVariants({ variant: "outline", size: "sm" }))}>{m.publicRecipe.logIn}</Link>
+          </div>
+        )}
+      </div>
+
+      <div>
+        <h1 className="text-3xl font-bold tracking-tight">{formatMessage(m.mealPlan.weekOf, { date: plan.weekStart })}</h1>
+      </div>
+
+      <div className="space-y-5">
+        {DAY_ORDER.filter((day) => byDay[day]?.length).map((day) => (
+          <div key={day} className="space-y-2">
+            <h2 className="text-xs font-semibold uppercase tracking-wide text-muted-foreground border-b pb-1">
+              {m.mealPlan.days[day]}
+            </h2>
+            <ul className="space-y-1.5">
+              {[...byDay[day]!]
+                .sort((a, b) => MEAL_ORDER.indexOf(a.mealType) - MEAL_ORDER.indexOf(b.mealType))
+                .map((entry) => (
+                  <li key={entry.id} className="flex items-baseline gap-2 text-sm">
+                    <span className="text-muted-foreground min-w-[5.5rem] shrink-0">{m.mealPlan.meals[entry.mealType]}</span>
+                    {entry.recipe && (entry.recipe.visibility === "public" || entry.recipe.visibility === "unlisted") ? (
+                      <Link href={`/r/${entry.recipe.id}`} className="hover:underline underline-offset-4">
+                        {entry.recipe.title}
+                      </Link>
+                    ) : (
+                      <span>{entry.recipe?.title ?? entry.note ?? "—"}</span>
+                    )}
+                  </li>
+                ))}
+            </ul>
+          </div>
+        ))}
+        {plan.entries.length === 0 && (
+          <p className="text-sm text-muted-foreground">{m.mealPlan.noEntriesPublic}</p>
+        )}
+      </div>
+
+      {!session && (
+        <div className="rounded-xl border bg-muted/40 p-6 text-center space-y-3">
+          <p className="font-semibold">{m.publicRecipe.wantToSaveDescription}</p>
+          <Link href="/signup" className={cn(buttonVariants())}>{m.publicRecipe.getStartedFree}</Link>
+        </div>
+      )}
+    </div>
+  );
+}

apps/web/components/meal-plan/share-meal-plan-button.tsx

@@ -1,9 +1,10 @@
 "use client";
 
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { useTranslations } from "next-intl";
-import { UserPlus, X } from "lucide-react";
+import { UserPlus, X, Link2, Copy, Check } from "lucide-react";
 import { toast } from "sonner";
+import QRCode from "qrcode";
 import {
   Dialog,
   DialogContent,
@@ -13,6 +14,7 @@ import {
 } from "@/components/ui/dialog";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
+import { Switch } from "@/components/ui/switch";
 import {
   Select,
   SelectContent,
@@ -21,6 +23,7 @@ import {
   SelectValue,
 } from "@/components/ui/select";
 import { Badge } from "@/components/ui/badge";
+import { Separator } from "@/components/ui/separator";
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
 
 type Role = "viewer" | "editor";
@@ -39,9 +42,11 @@ interface Member {
 
 interface Props {
   weekStart: string;
+  mealPlanId?: string;
+  initialIsPublic?: boolean;
 }
 
-export function ShareMealPlanButton({ weekStart }: Props) {
+export function ShareMealPlanButton({ weekStart, mealPlanId, initialIsPublic = false }: Props) {
   const t = useTranslations("mealPlan");
   const ts = useTranslations("shareDialog");
   const tCommon = useTranslations("common");
@@ -51,6 +56,61 @@ export function ShareMealPlanButton({ weekStart }: Props) {
   const [members, setMembers] = useState<Member[]>([]);
   const [loading, setLoading] = useState(false);
   const [inviting, setInviting] = useState(false);
+  const [isPublic, setIsPublic] = useState(initialIsPublic);
+  const [planId, setPlanId] = useState(mealPlanId);
+  const [savingPublic, setSavingPublic] = useState(false);
+  const [copied, setCopied] = useState(false);
+  const [qrDataUrl, setQrDataUrl] = useState<string | null>(null);
+
+  function shareUrl(id: string): string {
+    return `${window.location.origin}/m/${id}`;
+  }
+
+  useEffect(() => {
+    if (initialIsPublic && mealPlanId) {
+      QRCode.toDataURL(shareUrl(mealPlanId), { margin: 1, width: 160 }).then(setQrDataUrl).catch(() => {});
+    }
+    // Only needs to run once per mount with the plan's already-saved state —
+    // subsequent changes are handled by togglePublic itself.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
+  async function togglePublic(checked: boolean) {
+    setSavingPublic(true);
+    const previous = isPublic;
+    setIsPublic(checked);
+    try {
+      const res = await fetch(`/api/v1/meal-plans/${weekStart}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ isPublic: checked }),
+      });
+      if (!res.ok) throw new Error();
+      const data = (await res.json()) as { id: string; isPublic: boolean };
+      setPlanId(data.id);
+      if (checked) {
+        setQrDataUrl(await QRCode.toDataURL(shareUrl(data.id), { margin: 1, width: 160 }));
+      } else {
+        setQrDataUrl(null);
+      }
+    } catch {
+      setIsPublic(previous);
+      toast.error(ts("publicLinkToggleFailed"));
+    } finally {
+      setSavingPublic(false);
+    }
+  }
+
+  async function copyLink() {
+    if (!planId) return;
+    try {
+      await navigator.clipboard.writeText(shareUrl(planId));
+      setCopied(true);
+      setTimeout(() => setCopied(false), 2000);
+    } catch {
+      toast.error(ts("copyLinkFailed"));
+    }
+  }
 
   async function fetchMembers() {
     setLoading(true);
@@ -137,6 +197,31 @@ export function ShareMealPlanButton({ weekStart }: Props) {
             </DialogDescription>
           </DialogHeader>
 
+          <div className="flex items-center justify-between gap-3 rounded-lg border p-3">
+            <div className="flex items-center gap-2 min-w-0">
+              <Link2 className="h-4 w-4 text-muted-foreground shrink-0" />
+              <div className="min-w-0">
+                <p className="text-sm font-medium">{ts("publicLinkTitle")}</p>
+                <p className="text-xs text-muted-foreground">{t("publicLinkReadOnlyDescription")}</p>
+              </div>
+            </div>
+            <Switch checked={isPublic} disabled={savingPublic} onCheckedChange={(v) => { void togglePublic(v); }} />
+          </div>
+          {isPublic && planId && (
+            <div className="flex items-center gap-3 rounded-lg border p-3">
+              {qrDataUrl && (
+                // eslint-disable-next-line @next/next/no-img-element -- a data: URL generated client-side, not an optimizable remote image
+                <img src={qrDataUrl} alt={t("qrCodeAlt")} className="h-16 w-16 shrink-0" />
+              )}
+              <Button type="button" variant="outline" size="sm" className="flex-1" onClick={() => void copyLink()}>
+                {copied ? <Check className="h-4 w-4" /> : <Copy className="h-4 w-4" />}
+                {copied ? ts("linkCopied") : ts("copyLink")}
+              </Button>
+            </div>
+          )}
+
+          <Separator />
+
           <div className="flex gap-2 mt-2">
             <Input
               type="email"

apps/web/lib/changelog.ts

@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.67.0";
+export const APP_VERSION = "0.68.0";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,13 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.68.0",
+    date: "2026-07-21 10:00",
+    added: [
+      "Meal plans can now be shared with a read-only anonymous public link (Share -> Public link), same idea as shopping lists' public link but view-only, plus a QR code you can screenshot or print to hand someone the week's plan.",
+    ],
+  },
   {
     version: "0.67.0",
     date: "2026-07-21 09:30",

apps/web/lib/openapi.ts

@@ -207,7 +207,7 @@ export function generateOpenApiSpec(): object {
   }));
   const MealPlanRef = registry.register("MealPlan", z.object({
     id: z.string().optional(), userId: z.string().optional(), weekStart: z.string(),
-    createdAt: z.string().datetime().optional(),
+    isPublic: z.boolean().optional(), createdAt: z.string().datetime().optional(),
     entries: z.array(MealPlanFullEntryRef),
   }));
 
@@ -395,6 +395,7 @@ export function generateOpenApiSpec(): object {
   registry.registerPath({ method: "delete", path: "/api/v1/collections/{id}/members", summary: "Remove a member (owner or the member themselves)", security, request: { params: idParam, query: z.object({ memberId: z.string() }) }, responses: { 204: { description: "Removed" }, 400: { description: "memberId required", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "get", path: "/api/v1/meal-plans/{weekStart}", summary: "Get your own meal plan for a week", security, request: { params: weekStartParam }, responses: { 200: { description: "Meal plan with entries", content: { "application/json": { schema: MealPlanRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "post", path: "/api/v1/meal-plans/{weekStart}", summary: "Create the meal plan for a week (idempotent)", security, request: { params: weekStartParam }, responses: { 200: { description: "Already existed", content: { "application/json": { schema: z.object({ id: z.string(), weekStart: z.string() }) } } }, 201: { description: "Created", content: { "application/json": { schema: z.object({ id: z.string(), weekStart: z.string() }) } } } } });
+  registry.registerPath({ method: "patch", path: "/api/v1/meal-plans/{weekStart}", summary: "Set whether a week's plan has a public read-only link", description: "Creates the week's plan if it doesn't exist yet. The link is /m/{id} — read-only, unlike shopping lists' public link which can also be made editable.", security, request: { params: weekStartParam, body: { content: { "application/json": { schema: z.object({ isPublic: z.boolean() }) } }, required: true } }, responses: { 200: { description: "Updated", content: { "application/json": { schema: z.object({ id: z.string(), weekStart: z.string(), isPublic: z.boolean() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
 
   // --- Meal-plan entries, bulk clear, members, nutrition, .ics export, shared plans ---
   const CreateMealPlanEntryRef = registry.register("CreateMealPlanEntry", z.object({

apps/web/messages/en.json

@@ -982,6 +982,9 @@
     "print": "Print",
     "shareTitle": "Share this week's plan",
     "shareDescription": "Invite household members to view or edit this week's meal plan.",
+    "publicLinkReadOnlyDescription": "Anyone with the link can view this week's plan (read-only) — no account needed.",
+    "qrCodeAlt": "QR code linking to this week's public meal plan",
+    "noEntriesPublic": "Nothing planned for this week yet.",
     "sharedWithYou": "Shared with you",
     "sharedPlanOf": "{name}'s plan",
     "weekOf": "Week of {date}",

apps/web/messages/fr.json

@@ -973,6 +973,9 @@
     "print": "Imprimer",
     "shareTitle": "Partager le planning de cette semaine",
     "shareDescription": "Invitez des membres du foyer à voir ou modifier le planning repas de cette semaine.",
+    "publicLinkReadOnlyDescription": "Toute personne ayant le lien peut voir le planning de cette semaine (lecture seule) — aucun compte requis.",
+    "qrCodeAlt": "Code QR menant au planning repas public de cette semaine",
+    "noEntriesPublic": "Rien de prévu pour cette semaine pour l'instant.",
     "sharedWithYou": "Partagé avec vous",
     "sharedPlanOf": "Planning de {name}",
     "weekOf": "Semaine du {date}",

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epicure/web",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "private": true,
   "scripts": {
     "dev": "next dev",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "epicure",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "private": true,
   "scripts": {
     "dev": "pnpm --filter web dev",

packages/db/src/migrations/0059_pink_doctor_faustus.sql

@@ -0,0 +1 @@
+ALTER TABLE "meal_plans" ADD COLUMN "is_public" boolean DEFAULT false NOT NULL;

packages/db/src/migrations/meta/_journal.json

@@ -414,6 +414,13 @@
       "when": 1784583059359,
       "tag": "0058_quiet_triton",
       "breakpoints": true
+    },
+    {
+      "idx": 59,
+      "version": "7",
+      "when": 1784670176130,
+      "tag": "0059_pink_doctor_faustus",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/meal-planning.ts

@@ -23,6 +23,10 @@ export const mealPlans = pgTable("meal_plans", {
   id: text("id").primaryKey(),
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   weekStart: date("week_start").notNull(),
+  // Anyone with the link can view (read-only, unlike shopping lists' public
+  // link which can also be made editable) — the unguessable id is the sole
+  // credential, no separate anonymous-visitor identity.
+  isPublic: boolean("is_public").notNull().default(false),
   createdAt: timestamp("created_at").notNull().defaultNow(),
 }, (t) => [
   index("meal_plans_user_idx").on(t.userId),