diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4dcee7b..6569c1e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together.
+## 0.77.0 — 2026-07-24 13:00
+
+### Added
+- New post-signup onboarding wizard: a quick 3-step flow (welcome, dietary preferences & allergens, notification opt-in) shown once for new accounts, skippable at every step. Existing accounts are unaffected — only new signups see it.
+
+### Fixed
+- Allergen preferences (the `user_allergens` table) had a GDPR-export read path but no way to actually set them — the onboarding wizard's dietary/allergen step is the first UI that writes to it.
+
## 0.76.0 — 2026-07-24 12:15
### Added
diff --git a/FEATURE_AUDIT.md b/FEATURE_AUDIT.md
index bdf7b1e..aa979b4 100644
--- a/FEATURE_AUDIT.md
+++ b/FEATURE_AUDIT.md
@@ -71,6 +71,7 @@ Status legend: **Exists** (fully working) · **Partial** (works but with a real
| Auto-deduct pantry on cook | Exists (closed 2026-07-24) | Both UI callers that previously hardcoded `deductFromPantry: false` (`batch-cook-dishes.tsx`, `meal-planner.tsx`) now pass `true`. The new general "Mark cooked" feature (see below) additionally exposes it as a per-cook checkbox, default checked, rather than a silent always-on. | `apps/web/app/api/v1/recipes/[id]/cooked/route.ts`, `apps/web/components/recipe/batch-cook-dishes.tsx`, `apps/web/components/meal-plan/meal-planner.tsx` |
| Mark recipe as cooked (any recipe, not just batch-cook) | Exists (new, 2026-07-24) | A recipe can be logged as cooked any number of times — each log is a new `cookingHistory` row, no unique constraint, this was already true at the schema level, just not exposed for plain (non-batch) recipes before. New dialog on the recipe page: date (defaults today, can backdate), servings, and a deduct-from-pantry toggle (default on). Shows a "cooked N times · last DATE" indicator once logged. | `apps/web/components/recipe/{mark-cooked-dialog,mark-cooked-section}.tsx`, `apps/web/app/api/v1/recipes/[id]/cooked/route.ts` (`cookedAt` field, new) |
| Billing/invoice details (full name, address, phone) | Exists (new, 2026-07-24) | New `userBillingDetails` table (1:1 with `users`), separate from the display `name` field. `fullName` is required by the form/API but nullable at the DB level (no backfill for existing users); address lines/city/postal code/country/phone are all optional. Lives under `Settings → Billing`, feeds future invoice generation — not wired into Stripe yet. | `packages/db/src/schema/billing.ts` (`userBillingDetails`), `apps/web/app/api/v1/users/me/billing-details/route.ts`, `apps/web/components/settings/billing-details-form.tsx` |
+| Post-signup onboarding wizard | Exists (new, 2026-07-24) | 3-step wizard (welcome → dietary/allergen prefs → notification opt-in) shown once per account, right after the app shell layout loads for a user with no `onboardingCompletedAt`. Skippable at every step; existing accounts were backfilled as already-onboarded so the wizard only appears for new signups. Also closes a real pre-existing gap: `userAllergens` had a table and a GDPR-export read, but **no write path at all** — this ships the first one. Dietary tags are a new `users.dietaryTags` jsonb column (mirrors `recipes.dietaryTags`'s 7-tag shape); neither is yet consumed by AI generation or recipe matching. | `apps/web/app/onboarding/page.tsx`, `apps/web/components/onboarding/onboarding-wizard.tsx`, `apps/web/app/api/v1/users/me/onboarding/route.ts`, `apps/web/app/(app)/layout.tsx` (redirect gate) |
| Expiring-soon tracking | Exists | With "use it up" recipe suggestions. The leftover-expiry push/email cron only covers batch-cook dishes — plain pantry items only get an in-app badge, no reminder. | `apps/web/components/pantry/expiring-soon-suggestions.tsx`, `apps/web/app/api/internal/cron/leftover-reminders/route.ts` |
| **Barcode scan (pantry)** | **Exists** | Real Open Food Facts API lookup by UPC/EAN | `apps/web/app/api/v1/pantry/scan/barcode` |
| Photo scan (pantry) | Exists | Vision-model based | `apps/web/app/api/v1/pantry/scan/photo` |
diff --git a/apps/web/app/(app)/layout.tsx b/apps/web/app/(app)/layout.tsx
index 4439a4f..d53b6c3 100644
--- a/apps/web/app/(app)/layout.tsx
+++ b/apps/web/app/(app)/layout.tsx
@@ -1,6 +1,19 @@
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
import { Nav } from "@/components/layout/nav";
+import { auth } from "@/lib/auth/server";
+import { db, users, eq } from "@epicure/db";
+
+export default async function AppLayout({ children }: { children: React.ReactNode }) {
+ const session = await auth.api.getSession({ headers: await headers() });
+ if (session) {
+ const dbUser = await db.query.users.findFirst({
+ where: eq(users.id, session.user.id),
+ columns: { onboardingCompletedAt: true },
+ });
+ if (!dbUser?.onboardingCompletedAt) redirect("/onboarding");
+ }
-export default function AppLayout({ children }: { children: React.ReactNode }) {
return (
<>
diff --git a/apps/web/app/api/v1/users/me/onboarding/route.ts b/apps/web/app/api/v1/users/me/onboarding/route.ts
new file mode 100644
index 0000000..00fc9f7
--- /dev/null
+++ b/apps/web/app/api/v1/users/me/onboarding/route.ts
@@ -0,0 +1,75 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, users, userAllergens, eq } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+import { z } from "zod";
+
+const ALLERGEN_TAGS = ["peanuts", "treeNuts", "dairy", "eggs", "shellfish", "fish", "soy", "gluten"] as const;
+
+const CompleteSchema = z.object({
+ dietaryTags: z
+ .object({
+ vegan: z.boolean().optional(),
+ vegetarian: z.boolean().optional(),
+ glutenFree: z.boolean().optional(),
+ dairyFree: z.boolean().optional(),
+ nutFree: z.boolean().optional(),
+ halal: z.boolean().optional(),
+ kosher: z.boolean().optional(),
+ })
+ .optional(),
+ allergens: z.array(z.enum(ALLERGEN_TAGS)).optional(),
+});
+
+export async function GET() {
+ const { session, response } = await requireSession();
+ if (response) return response;
+
+ const [dbUser, allergenRows] = await Promise.all([
+ db.query.users.findFirst({
+ where: eq(users.id, session!.user.id),
+ columns: { onboardingCompletedAt: true, dietaryTags: true },
+ }),
+ db.select().from(userAllergens).where(eq(userAllergens.userId, session!.user.id)),
+ ]);
+
+ return NextResponse.json({
+ data: {
+ completed: !!dbUser?.onboardingCompletedAt,
+ dietaryTags: dbUser?.dietaryTags ?? {},
+ allergens: allergenRows.map((r) => r.allergenTag),
+ },
+ });
+}
+
+// Marks onboarding done regardless of what (if anything) was filled in — a
+// user can skip every step and this still fires so the wizard never shows
+// again. dietaryTags/allergens are optional and only written if provided.
+export async function POST(req: NextRequest) {
+ const { session, response } = await requireSession();
+ if (response) return response;
+
+ const parsed = CompleteSchema.safeParse(await req.json().catch(() => ({})));
+ if (!parsed.success) {
+ return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 });
+ }
+
+ const { dietaryTags, allergens } = parsed.data;
+ const userId = session!.user.id;
+
+ await db
+ .update(users)
+ .set({
+ onboardingCompletedAt: new Date(),
+ ...(dietaryTags ? { dietaryTags } : {}),
+ })
+ .where(eq(users.id, userId));
+
+ if (allergens) {
+ await db.delete(userAllergens).where(eq(userAllergens.userId, userId));
+ if (allergens.length > 0) {
+ await db.insert(userAllergens).values(allergens.map((allergenTag) => ({ userId, allergenTag })));
+ }
+ }
+
+ return NextResponse.json({ ok: true });
+}
diff --git a/apps/web/app/onboarding/page.tsx b/apps/web/app/onboarding/page.tsx
new file mode 100644
index 0000000..9238fb3
--- /dev/null
+++ b/apps/web/app/onboarding/page.tsx
@@ -0,0 +1,22 @@
+import { redirect } from "next/navigation";
+import { headers } from "next/headers";
+import { auth } from "@/lib/auth/server";
+import { db, users, eq } from "@epicure/db";
+import { OnboardingWizard } from "@/components/onboarding/onboarding-wizard";
+
+export default async function OnboardingPage() {
+ const session = await auth.api.getSession({ headers: await headers() });
+ if (!session) redirect("/login");
+
+ const dbUser = await db.query.users.findFirst({
+ where: eq(users.id, session.user.id),
+ columns: { onboardingCompletedAt: true },
+ });
+ if (dbUser?.onboardingCompletedAt) redirect("/recipes");
+
+ return (
+
+
+
+ );
+}
diff --git a/apps/web/components/onboarding/onboarding-wizard.tsx b/apps/web/components/onboarding/onboarding-wizard.tsx
new file mode 100644
index 0000000..5e5b36f
--- /dev/null
+++ b/apps/web/components/onboarding/onboarding-wizard.tsx
@@ -0,0 +1,161 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { useTranslations } from "next-intl";
+import { Sparkles } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardHeader, CardTitle, CardDescription, CardFooter } from "@/components/ui/card";
+import { Checkbox } from "@/components/ui/checkbox";
+import { Label } from "@/components/ui/label";
+import { PushSubscribeButton } from "@/components/pwa/push-subscribe-button";
+
+const DIETARY_TAGS = ["vegan", "vegetarian", "glutenFree", "dairyFree", "nutFree", "halal", "kosher"] as const;
+const ALLERGEN_TAGS = ["peanuts", "treeNuts", "dairy", "eggs", "shellfish", "fish", "soy", "gluten"] as const;
+
+type DietaryTag = (typeof DIETARY_TAGS)[number];
+type AllergenTag = (typeof ALLERGEN_TAGS)[number];
+
+const DIET_LABEL_KEYS: Record = {
+ vegan: "dietVegan", vegetarian: "dietVegetarian", glutenFree: "dietGlutenFree", dairyFree: "dietDairyFree",
+ nutFree: "dietNutFree", halal: "dietHalal", kosher: "dietKosher",
+};
+const ALLERGEN_LABEL_KEYS: Record = {
+ peanuts: "allergenPeanuts", treeNuts: "allergenTreeNuts", dairy: "allergenDairy", eggs: "allergenEggs",
+ shellfish: "allergenShellfish", fish: "allergenFish", soy: "allergenSoy", gluten: "allergenGluten",
+};
+
+const TOTAL_STEPS = 3;
+
+export function OnboardingWizard() {
+ const t = useTranslations("onboarding");
+ const tCommon = useTranslations("common");
+ const router = useRouter();
+ const [step, setStep] = useState(1);
+ const [dietaryTags, setDietaryTags] = useState>>({});
+ const [allergens, setAllergens] = useState>(new Set());
+ const [finishing, setFinishing] = useState(false);
+
+ function toggleDietaryTag(tag: DietaryTag, checked: boolean) {
+ setDietaryTags((prev) => ({ ...prev, [tag]: checked }));
+ }
+
+ function toggleAllergen(tag: AllergenTag, checked: boolean) {
+ setAllergens((prev) => {
+ const next = new Set(prev);
+ if (checked) next.add(tag);
+ else next.delete(tag);
+ return next;
+ });
+ }
+
+ async function finish(withData: boolean) {
+ setFinishing(true);
+ try {
+ await fetch("/api/v1/users/me/onboarding", {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ body: JSON.stringify(withData ? { dietaryTags, allergens: Array.from(allergens) } : {}),
+ });
+ } catch {
+ // Onboarding completion isn't critical-path — if it fails, the user
+ // just sees the wizard once more next time. Not worth blocking or
+ // erroring loudly for a best-effort save.
+ } finally {
+ router.push("/recipes");
+ }
+ }
+
+ return (
+