feat: 6 new per-tier feature flags (off by default) + flag-icon locale switcher + hide BYOK when disabled (v0.74.0)

Extends the existing feature-flags system (previously 3 keys, all
default-enabled) with 6 more: recipe_import_url, recipe_import_photo,
nutrition_estimation, markdown_export, weekly_nutrition,
grocery_delivery. Each FEATURE_DEFINITIONS entry now carries its own
defaultEnabled -- the new 6 default to false, the original 3 stay
true -- so no migration/seed was needed for the "off by default"
requirement, just a per-key fallback instead of a blanket true.

Gated server-side (requireFeatureEnabledResponse, a new shared
helper avoiding six copies of the same try/catch) on: import-url,
import-photo, nutrition POST estimate, bulk markdown export, weekly
meal-plan nutrition GET, Instacart export. Gated client-side by
hiding the trigger entirely (not just disabling) on every page that
renders one: recipe detail (meal/drink pairing buttons, nutrition
panel's estimate button, markdown export), recipes list (import-URL
button, including the OS Share Target auto-import path), new-recipe
page (photo import), meal-plan page (markdown export, weekly
nutrition bar), shopping-list/collection/pantry pages (markdown
export), shopping-list page (Instacart button, now gated by both the
existing env-var check AND the tier flag).

Also: BYOK section on Settings -> AI now hidden entirely for
non-BYOK users (previously showed a locked-and-teased notice, same
inconsistency the Model Prefs fix closed yesterday). Language
switcher shows a flag icon (FlagGB/FlagFR, moved from
components/marketing to components/shared so both the logged-in
settings switcher and the logged-out marketing one can use it)
instead of plain "English"/"Français" text-only options.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/v1/ai/import-photo/route.ts

@@ -7,6 +7,7 @@ import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
 import { importFromPhoto } from "@/lib/ai/features/import-photo";
 import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
 import { checkTierLimitInTransaction, TierLimitError } from "@/lib/tiers";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 const Schema = z.object({
   imageBase64: z.string().max(14_000_000),
@@ -17,6 +18,9 @@ export async function POST(req: NextRequest) {
   const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "recipe_import_photo");
+  if (featureDenied) return featureDenied;
+
   const body = await req.json() as unknown;
   const parsed = Schema.safeParse(body);
   if (!parsed.success) {

apps/web/app/api/v1/ai/import-url/route.ts

@@ -6,6 +6,7 @@ import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
 import { importFromUrl } from "@/lib/ai/features/import-url";
 import { validateWebhookUrl } from "@/lib/validate-webhook-url";
 import { withUserKey } from "@/lib/ai/resolve-user-key";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 const Schema = z.object({
   url: z.string().url(),
@@ -17,6 +18,9 @@ export async function POST(req: NextRequest) {
   const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "recipe_import_url");
+  if (featureDenied) return featureDenied;
+
   const body = await req.json() as unknown;
   const parsed = Schema.safeParse(body);
   if (!parsed.success) {

apps/web/app/api/v1/meal-plans/[weekStart]/nutrition/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { db, mealPlans, mealPlanEntries, userNutritionGoals, eq, and } from "@epicure/db";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 type Params = { params: Promise<{ weekStart: string }> };
 
@@ -16,6 +17,9 @@ export async function GET(req: NextRequest, { params }: Params) {
   const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "weekly_nutrition");
+  if (featureDenied) return featureDenied;
+
   const { weekStart } = await params;
   const userId = session!.user.id;
 

apps/web/app/api/v1/recipes/[id]/nutrition/route.ts

@@ -5,6 +5,7 @@ import { requireSessionOrApiKey } from "@/lib/api-auth";
 import { applyRateLimit } from "@/lib/rate-limit";
 import { withAiQuota } from "@/lib/ai/ai-error";
 import { estimateNutrition } from "@/lib/ai/features/estimate-nutrition";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 type Params = { params: Promise<{ id: string }> };
 
@@ -33,6 +34,9 @@ export async function POST(req: NextRequest, { params }: Params) {
   if (response) return response;
   const { id } = await params;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "nutrition_estimation");
+  if (featureDenied) return featureDenied;
+
   const limited = await applyRateLimit(`rl:ai:${session!.user.id}`, 10, 60);
   if (limited) return limited;
 

apps/web/app/api/v1/recipes/bulk/export/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { requireSessionOrApiKey } from "@/lib/api-auth";
 import { db, recipes, eq, and, inArray } from "@epicure/db";
 import { recipeToMarkdown } from "@/lib/markdown/recipe";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 const ExportSchema = z.object({
   ids: z.array(z.string()).min(1).max(100),
@@ -12,6 +13,9 @@ export async function POST(req: NextRequest) {
   const { session, response } = await requireSessionOrApiKey(req);
   if (response) return response;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "markdown_export");
+  if (featureDenied) return featureDenied;
+
   const body = ExportSchema.safeParse(await req.json());
   if (!body.success) return NextResponse.json({ error: "Invalid request" }, { status: 400 });
 

apps/web/app/api/v1/shopping-lists/[id]/export/instacart/route.ts

@@ -4,6 +4,7 @@ import { requireSessionOrApiKey } from "@/lib/api-auth";
 import { getShoppingListAccess } from "@/lib/shopping-list-access";
 import { buildGroceryExportPayload } from "@/lib/grocery-export";
 import { createInstacartShoppingListLink } from "@/lib/grocery-providers/instacart";
+import { requireFeatureEnabledResponse } from "@/lib/feature-flags";
 
 type Params = { params: Promise<{ id: string }> };
 
@@ -12,6 +13,9 @@ export async function POST(req: NextRequest, { params }: Params) {
   if (response) return response;
   const { id } = await params;
 
+  const featureDenied = await requireFeatureEnabledResponse(session!.user.id, "grocery_delivery");
+  if (featureDenied) return featureDenied;
+
   const access = await getShoppingListAccess(id, session!.user.id);
   if (!access) return NextResponse.json({ error: "Not found" }, { status: 404 });