feat: collections visibility enum (matches recipes) + QR on collection PDF (v0.54.0)

Replaces collections.isPublic (boolean) with collections.visibility
(private/unlisted/public/followers — same enum recipes use). Two-step
migration (0050 adds+backfills, 0051 drops isPublic) since drizzle-kit's
add+drop-in-one-diff rename heuristic needs an interactive prompt we
can't satisfy here.

New collectionVisibleToViewer(viewerId) in lib/visibility.ts mirrors the
existing recipe helper (author always sees own; public/unlisted visible
to anyone; followers-only via the same user_follows EXISTS pattern) —
used by the collection detail page, its print view, fork, and favorite,
replacing their old `or(isPublic, own)` checks.

Create/edit collection dialogs get the same 4-option visibility select
as the recipe form instead of a public/private checkbox.

Collection PDF export now generates a QR code (qrcode, same as the
recipe PDF) linking to /collections/{id}, shown only when visibility is
public/unlisted — same "would an anonymous scanner actually resolve
this" rule as the recipe QR.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/changelog.ts

@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.53.1";
+export const APP_VERSION = "0.54.0";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,14 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.54.0",
+    date: "2026-07-19 17:05",
+    added: [
+      "Collections now have the same visibility options as recipes — private, followers-only, unlisted, or public — replacing the old public/private toggle. Fork, favorite, and viewing a collection all respect the new followers-only option the same way recipes do.",
+      "Collection PDF exports now include a QR code linking back to the collection, same as recipe PDFs (only for unlisted/public collections, matching the recipe QR's own rule about what an anonymous scanner could actually open).",
+    ],
+  },
   {
     version: "0.53.1",
     date: "2026-07-19 16:10",

apps/web/lib/openapi.ts

@@ -189,7 +189,8 @@ export function generateOpenApiSpec(): object {
   }));
   const CollectionRef = registry.register("Collection", z.object({
     id: z.string(), userId: z.string(), name: z.string(),
-    description: z.string().nullable(), notes: z.string().nullable(), tags: z.array(z.string()), isPublic: z.boolean(),
+    description: z.string().nullable(), notes: z.string().nullable(), tags: z.array(z.string()),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]),
     createdAt: z.string().datetime(), updatedAt: z.string().datetime(),
     recipes: z.array(CollectionRecipeEntryRef),
   }));
@@ -356,7 +357,8 @@ export function generateOpenApiSpec(): object {
   registry.registerPath({ method: "get", path: "/api/v1/feed", summary: "Activity feed (pull-based) — recent recipes from users you follow", security, request: { query: z.object({ limit: z.coerce.number().int().min(1).max(50).default(20), offset: z.coerce.number().int().min(0).default(0) }) }, responses: { 200: { description: "Paginated", content: { "application/json": { schema: z.object({ data: z.array(FeedRecipeRef), total: z.number(), limit: z.number(), offset: z.number(), message: z.string().optional() }) } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "get", path: "/api/v1/collections", summary: "List collections", security, request: { query: LimitOffset }, responses: { 200: { description: "Paginated collections", content: { "application/json": { schema: PaginatedCollections } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
   const CreateCollectionRef = registry.register("CreateCollection", z.object({
-    name: z.string().min(1).max(100), description: z.string().max(500).optional(), isPublic: z.boolean().default(false),
+    name: z.string().min(1).max(100), description: z.string().max(500).optional(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).default("private"),
   }));
   registry.registerPath({ method: "post", path: "/api/v1/collections", summary: "Create a collection", security, request: { body: { content: { "application/json": { schema: CreateCollectionRef } }, required: true } }, responses: { 201: { description: "Created", content: { "application/json": { schema: z.object({ id: z.string() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } } } });
 
@@ -368,7 +370,7 @@ export function generateOpenApiSpec(): object {
   const UpdateCollectionRef = registry.register("UpdateCollection", z.object({
     name: z.string().min(1).max(100).optional(), description: z.string().max(500).nullable().optional(),
     notes: z.string().max(2000).nullable().optional(), tags: z.array(z.string().min(1).max(50)).max(20).optional(),
-    isPublic: z.boolean().optional(),
+    visibility: z.enum(["private", "unlisted", "public", "followers"]).optional(),
     addRecipeId: z.string().optional(), addRecipeIds: z.array(z.string()).max(200).optional(),
     removeRecipeId: z.string().optional(), removeRecipeIds: z.array(z.string()).max(200).optional(),
   }));

apps/web/lib/visibility.ts

@@ -1,4 +1,4 @@
-import { recipes, eq, or, and, inArray, sql } from "@epicure/db";
+import { recipes, collections, eq, or, and, inArray, sql } from "@epicure/db";
 
 /**
  * Drizzle condition: true when `viewerId` may view a given recipe row — the
@@ -25,3 +25,15 @@ export function visibleToViewer(viewerId: string) {
     )
   );
 }
+
+/** Same rationale/pattern as visibleToViewer(), for collections. */
+export function collectionVisibleToViewer(viewerId: string) {
+  return or(
+    eq(collections.userId, viewerId),
+    inArray(collections.visibility, ["public", "unlisted"]),
+    and(
+      eq(collections.visibility, "followers"),
+      sql`exists (select 1 from user_follows where user_follows.follower_id = ${viewerId} and user_follows.following_id = ${collections.userId})`
+    )
+  );
+}