feat: cooking history/gallery, unit conversion, nutrition diary, pantry scan, digest cron, nutrition-targeted meal plans

Six M-sized items from HANDOFF.md's new-features backlog:

- Profile tabs: cooking-history stats (total cooked, last-cooked, streak)
  and a "cooked it" photo gallery, both owner-only
- Display-time unit conversion (metric<->imperial) for recipe ingredients,
  respecting each user's unitPref; original value always shown alongside
  the conversion
- Nutrition daily diary: per-day macro totals computed from cooking history
  x recipe nutritionData, compared against user goals
- Pantry scan: real barcode lookup (zxing + Open Food Facts, no API key)
  with an AI-vision fallback for unbarcoded items, always confirm-before-
  insert, both paths tier/rate-limited like other AI features
- Weekly digest email: new followers/comments/ratings + trending recipes,
  sent via a new `cron` Docker stage (alpine+crond+curl) and `digest-cron`
  compose service hitting a bearer-token-protected internal route
- Meal-plan generation can now target a user's nutrition goals as a
  prompt-level nudge (recipes are AI-invented, not DB-sourced, so this
  can't be a hard macro constraint)

Caught a real deploy-breaking issue while adding the cron stage: appending
it after `runner` silently changed the Dockerfile's default build target,
and `web`'s compose config didn't pin one — fixed by pinning `target:
runner` explicitly. Verified with typecheck, lint, and three separate
`docker build --target` runs (runner/cron/migrator) plus `docker compose
config` validation.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/api/internal/cron/weekly-digest/route.ts

@@ -0,0 +1,131 @@
+import { NextRequest, NextResponse } from "next/server";
+import crypto from "node:crypto";
+import {
+  db,
+  users,
+  recipes,
+  comments,
+  ratings,
+  userFollows,
+  favorites,
+  eq,
+  and,
+  gte,
+  desc,
+  count,
+  sql,
+} from "@epicure/db";
+import { sendEmail, weeklyDigestHtml } from "@/lib/email";
+
+// Internal cron endpoint — triggered by the `digest-cron` container on a weekly
+// schedule (see docker/compose.prod.yml). Not part of the public API surface;
+// protected by a shared secret rather than user auth.
+//
+// Computes, for every user: new followers / new comments / new ratings on
+// their recipes in the last 7 days, plus a site-wide top-3 trending list, and
+// emails a summary. Sends to all users (all users have a non-null email) —
+// there's no per-user opt-out preference yet; out of scope for this pass.
+
+const CHUNK_SIZE = 20;
+
+function isAuthorized(req: NextRequest): boolean {
+  const secret = process.env["CRON_SECRET"];
+  if (!secret) return false;
+
+  const header = req.headers.get("authorization");
+  if (!header?.startsWith("Bearer ")) return false;
+  const provided = header.slice("Bearer ".length);
+
+  const a = Buffer.from(provided);
+  const b = Buffer.from(secret);
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+
+function chunk<T>(arr: T[], size: number): T[][] {
+  const out: T[][] = [];
+  for (let i = 0; i < arr.length; i += size) out.push(arr.slice(i, i + size));
+  return out;
+}
+
+export async function POST(req: NextRequest) {
+  if (!isAuthorized(req)) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const weekAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+  const baseUrl = process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000";
+
+  const [allUsers, followerRows, commentRows, ratingRows, trending] = await Promise.all([
+    db.select({ id: users.id, email: users.email }).from(users),
+    db
+      .select({ userId: userFollows.followingId, n: count() })
+      .from(userFollows)
+      .where(gte(userFollows.createdAt, weekAgo))
+      .groupBy(userFollows.followingId),
+    db
+      .select({ userId: recipes.authorId, n: count() })
+      .from(comments)
+      .innerJoin(recipes, eq(comments.recipeId, recipes.id))
+      .where(gte(comments.createdAt, weekAgo))
+      .groupBy(recipes.authorId),
+    db
+      .select({ userId: recipes.authorId, n: count() })
+      .from(ratings)
+      .innerJoin(recipes, eq(ratings.recipeId, recipes.id))
+      .where(gte(ratings.createdAt, weekAgo))
+      .groupBy(recipes.authorId),
+    db
+      .select({
+        id: recipes.id,
+        title: recipes.title,
+        favoriteCount: sql<number>`cast(count(${favorites.recipeId}) as int)`,
+      })
+      .from(recipes)
+      .leftJoin(
+        favorites,
+        and(eq(favorites.recipeId, recipes.id), gte(favorites.createdAt, weekAgo))
+      )
+      .where(eq(recipes.visibility, "public"))
+      .groupBy(recipes.id)
+      .orderBy(desc(sql`count(${favorites.recipeId})`), desc(recipes.createdAt))
+      .limit(3),
+  ]);
+
+  const followerMap = new Map(followerRows.map((r) => [r.userId, r.n]));
+  const commentMap = new Map(commentRows.map((r) => [r.userId, r.n]));
+  const ratingMap = new Map(ratingRows.map((r) => [r.userId, r.n]));
+  const trendingList = trending.map((r) => ({ id: r.id, title: r.title }));
+
+  let sent = 0;
+  let failed = 0;
+
+  for (const batch of chunk(allUsers, CHUNK_SIZE)) {
+    const results = await Promise.allSettled(
+      batch.map((user) => {
+        const newFollowers = followerMap.get(user.id) ?? 0;
+        const newComments = commentMap.get(user.id) ?? 0;
+        const newRatings = ratingMap.get(user.id) ?? 0;
+
+        return sendEmail({
+          to: user.email,
+          subject: "Your weekly digest — Epicure",
+          html: weeklyDigestHtml({
+            newFollowers,
+            newComments,
+            newRatings,
+            trending: trendingList,
+            baseUrl,
+          }),
+        });
+      })
+    );
+
+    for (const r of results) {
+      if (r.status === "fulfilled") sent++;
+      else failed++;
+    }
+  }
+
+  return NextResponse.json({ ok: true, totalUsers: allUsers.length, sent, failed });
+}

apps/web/app/api/v1/ai/meal-plan/generate/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { db, recipes, recipeIngredients, recipeSteps, mealPlans, mealPlanEntries, pantryItems, eq, and } from "@epicure/db";
+import { db, recipes, recipeIngredients, recipeSteps, mealPlans, mealPlanEntries, pantryItems, userNutritionGoals, eq, and } from "@epicure/db";
 import { requireSession } from "@/lib/api-auth";
 import { applyRateLimit } from "@/lib/rate-limit";
 import { getDefaultProviderWithKey } from "@/lib/ai/resolve-user-key";
@@ -19,6 +19,7 @@ const Schema = z.object({
   usePantry: z.boolean().default(false),
   pantryMode: z.boolean().default(false),
   difficulty: z.enum(["easy", "medium", "hard"]).optional(),
+  targetNutritionGoals: z.boolean().default(false),
 });
 
 export async function POST(req: NextRequest) {
@@ -56,6 +57,24 @@ export async function POST(req: NextRequest) {
     pantryItemNames = pantry.map((p) => p.rawName);
   }
 
+  // Optionally fetch the user's nutrition goals to nudge the AI toward them.
+  // Silently ignored (no-op) if the user hasn't set any goals — no need to
+  // fail the whole generation over a missing preference.
+  let nutritionGoals: { caloriesKcal?: number | null; proteinG?: number | null; carbsG?: number | null; fatG?: number | null } | undefined;
+  if (parsed.data.targetNutritionGoals) {
+    const goals = await db.query.userNutritionGoals.findFirst({
+      where: eq(userNutritionGoals.userId, userId),
+    });
+    if (goals && (goals.caloriesKcal || goals.proteinG || goals.carbsG || goals.fatG)) {
+      nutritionGoals = {
+        caloriesKcal: goals.caloriesKcal,
+        proteinG: goals.proteinG,
+        carbsG: goals.carbsG,
+        fatG: goals.fatG,
+      };
+    }
+  }
+
   const result = await withAiQuota(userId, session!.user.tier as "free" | "pro", () =>
     generateMealPlan(
       {
@@ -65,6 +84,7 @@ export async function POST(req: NextRequest) {
         days: parsed.data.days,
         pantryMode: parsed.data.pantryMode,
         difficulty: parsed.data.difficulty,
+        nutritionGoals,
       },
       { ...config, userContext: privateBio ?? undefined },
       locale

apps/web/app/api/v1/pantry/scan/barcode/route.ts

@@ -0,0 +1,81 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+
+const Schema = z.object({
+  barcode: z.string().trim().min(4).max(32).regex(/^[0-9]+$/, "Barcode must be numeric"),
+});
+
+type OffProduct = {
+  product_name?: string;
+  product_name_en?: string;
+  generic_name?: string;
+  quantity?: string;
+  product_quantity?: string;
+  product_quantity_unit?: string;
+  brands?: string;
+};
+
+type OffResponse = {
+  status: number;
+  product?: OffProduct;
+};
+
+/** Very rough unit guess from Open Food Facts' free-text `quantity` field (e.g. "500 g", "1 L"). */
+function extractUnit(quantity: string | undefined): string | undefined {
+  if (!quantity) return undefined;
+  const match = /([a-zA-Z]+)\s*$/.exec(quantity.trim());
+  return match?.[1]?.toLowerCase();
+}
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });
+
+  const limited = await applyRateLimit(`rl:pantry-scan-barcode:${session!.user.id}`, 20, 60);
+  if (limited) return limited;
+
+  const { barcode } = parsed.data;
+
+  let offResponse: Response;
+  try {
+    offResponse = await fetch(
+      `https://world.openfoodfacts.org/api/v2/product/${encodeURIComponent(barcode)}.json`,
+      {
+        headers: { "User-Agent": "Epicure/1.0 (pantry-scan)" },
+        signal: AbortSignal.timeout(8000),
+      }
+    );
+  } catch {
+    return NextResponse.json({ error: "Barcode lookup service unavailable" }, { status: 502 });
+  }
+
+  if (!offResponse.ok) {
+    return NextResponse.json({ error: "Barcode lookup service unavailable" }, { status: 502 });
+  }
+
+  const data = await offResponse.json() as OffResponse;
+
+  if (data.status !== 1 || !data.product) {
+    return NextResponse.json({ found: false });
+  }
+
+  const product = data.product;
+  const rawName = product.product_name_en?.trim() || product.product_name?.trim() || product.generic_name?.trim();
+
+  if (!rawName) {
+    return NextResponse.json({ found: false });
+  }
+
+  return NextResponse.json({
+    found: true,
+    rawName: product.brands ? `${rawName} (${product.brands.split(",")[0]?.trim()})` : rawName,
+    quantity: product.product_quantity,
+    unit: extractUnit(product.product_quantity_unit) ?? extractUnit(product.quantity),
+  });
+}

apps/web/app/api/v1/pantry/scan/photo/route.ts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { requireSession } from "@/lib/api-auth";
+import { applyRateLimit } from "@/lib/rate-limit";
+import { withAiQuota, resolveAiConfigOrError } from "@/lib/ai/ai-error";
+import { getModelConfigForUseCase } from "@/lib/ai/resolve-user-key";
+import { scanPantryPhoto } from "@/lib/ai/features/scan-pantry-photo";
+
+const Schema = z.object({
+  imageBase64: z.string().max(14_000_000),
+  mimeType: z.enum(["image/jpeg", "image/png", "image/webp"]),
+});
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const body = await req.json() as unknown;
+  const parsed = Schema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  const userId = session!.user.id;
+
+  const limited = await applyRateLimit(`rl:ai:${userId}`, 10, 60);
+  if (limited) return limited;
+
+  const configResult = await resolveAiConfigOrError(() => getModelConfigForUseCase(userId, "vision"));
+  if (!configResult.ok) return configResult.response;
+  const aiConfig = configResult.data;
+
+  // Fall back to vision-capable defaults if no explicit model configured
+  if (!aiConfig.model) {
+    if (aiConfig.provider === "openai") aiConfig.model = "gpt-4o";
+    else if (aiConfig.provider === "anthropic") aiConfig.model = "claude-sonnet-4-6";
+  }
+
+  const result = await withAiQuota(userId, session!.user.tier as "free" | "pro", () =>
+    scanPantryPhoto(parsed.data.imageBase64, parsed.data.mimeType, aiConfig)
+  );
+  if (!result.ok) return result.response;
+
+  return NextResponse.json(result.data);
+}

apps/web/app/api/v1/users/me/nutrition-diary/route.ts

@@ -0,0 +1,103 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, cookingHistory, recipes, userNutritionGoals, eq, and, gte, lt } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+function isValidDate(value: string): boolean {
+  return /^\d{4}-\d{2}-\d{2}$/.test(value) && !isNaN(new Date(`${value}T00:00:00.000Z`).getTime());
+}
+
+export async function GET(req: NextRequest) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+  const userId = session!.user.id;
+
+  const dateParam = req.nextUrl.searchParams.get("date");
+  const date = dateParam && isValidDate(dateParam) ? dateParam : new Date().toISOString().slice(0, 10);
+
+  const dayStart = new Date(`${date}T00:00:00.000Z`);
+  const dayEnd = new Date(dayStart.getTime() + 24 * 60 * 60 * 1000);
+
+  const rows = await db
+    .select({
+      id: cookingHistory.id,
+      recipeId: cookingHistory.recipeId,
+      servings: cookingHistory.servings,
+      cookedAt: cookingHistory.cookedAt,
+      recipeTitle: recipes.title,
+      baseServings: recipes.baseServings,
+      nutritionData: recipes.nutritionData,
+    })
+    .from(cookingHistory)
+    .leftJoin(recipes, eq(cookingHistory.recipeId, recipes.id))
+    .where(
+      and(
+        eq(cookingHistory.userId, userId),
+        gte(cookingHistory.cookedAt, dayStart),
+        lt(cookingHistory.cookedAt, dayEnd)
+      )
+    )
+    .orderBy(cookingHistory.cookedAt);
+
+  const totals = { calories: 0, proteinG: 0, carbsG: 0, fatG: 0, fiberG: 0, sodiumMg: 0 };
+  const entries: {
+    id: string;
+    recipeId: string;
+    title: string;
+    servings: number;
+    cookedAt: string;
+    nutritionKnown: boolean;
+  }[] = [];
+  let unknownCount = 0;
+
+  for (const row of rows) {
+    const servings = row.servings ?? row.baseServings ?? 1;
+    const perServing = row.nutritionData?.perServing;
+    const nutritionKnown = !!perServing;
+
+    if (perServing) {
+      totals.calories += perServing.calories * servings;
+      totals.proteinG += perServing.proteinG * servings;
+      totals.carbsG += perServing.carbsG * servings;
+      totals.fatG += perServing.fatG * servings;
+      totals.fiberG += perServing.fiberG * servings;
+      totals.sodiumMg += perServing.sodiumMg * servings;
+    } else {
+      unknownCount += 1;
+    }
+
+    entries.push({
+      id: row.id,
+      recipeId: row.recipeId,
+      title: row.recipeTitle ?? "Unknown recipe",
+      servings,
+      cookedAt: row.cookedAt.toISOString(),
+      nutritionKnown,
+    });
+  }
+
+  for (const key of Object.keys(totals) as (keyof typeof totals)[]) {
+    totals[key] = Math.round(totals[key]);
+  }
+
+  const goalsRow = await db.query.userNutritionGoals.findFirst({
+    where: eq(userNutritionGoals.userId, userId),
+  });
+
+  const goals = goalsRow
+    ? {
+        caloriesKcal: goalsRow.caloriesKcal,
+        proteinG: goalsRow.proteinG,
+        carbsG: goalsRow.carbsG,
+        fatG: goalsRow.fatG,
+      }
+    : null;
+
+  const coverage = {
+    calories: goals?.caloriesKcal ? Math.round((totals.calories / goals.caloriesKcal) * 100) : 0,
+    protein: goals?.proteinG ? Math.round((totals.proteinG / goals.proteinG) * 100) : 0,
+    carbs: goals?.carbsG ? Math.round((totals.carbsG / goals.carbsG) * 100) : 0,
+    fat: goals?.fatG ? Math.round((totals.fatG / goals.fatG) * 100) : 0,
+  };
+
+  return NextResponse.json({ date, totals, goals, coverage, entries, unknownCount });
+}