openvibers/openvibe.food Commits
OpenVibe.Food: the product — food near you, the meal planner, the food list, the pantry
Changes
@@@ -24,5 +24,18 @@ OV_OAUTH_CLIENT_SECRET=# OV_OAUTH_REDIRECT_URI=https://openvibe.food/auth/callback# FOOD_AUDIENCE=openvibe.food++# OpenStreetMap, the two services "food near you" stands on (server/food/places.js). Both are open data under ODbL 1.0++# with published usage policies; server/food/upstream.js paces every call (one a second per host) and caches every++# answer for FOOD_GEO_CACHE_TTL_MS. Tests point these at a stand-in (test/helpers/osm.js); never at the public hosts.++#FOOD_NOMINATIM_URL=https://nominatim.openstreetmap.org++#FOOD_OVERPASS_URL=https://overpass-api.de/api/interpreter++# Identifies OpenVibe.Food to OSM, as both policies require. Defaults to OpenVibeFood/0.1 (+<BASE_URL>).++#FOOD_OSM_USER_AGENT=++# The pace between two requests to the same host, in ms (the policies ask for at least 1000).++#FOOD_OSM_MIN_INTERVAL_MS=1000++#FOOD_OSM_TIMEOUT_MS=25000++# How long a geocode or an area answer is kept, in ms (default 7 days).++#FOOD_GEO_CACHE_TTL_MS=604800000++# optional: defaults to true in production# COOKIE_SECURE=true@@@ -2,6 +2,45 @@What changed in OpenVibe.Food, newest first. Each site also publishes its patch notes at /updates.++## 0.2.0 — 2026-10-08++++The product: everything food, in one service. The food tools move here from OpenVibe.Tools, without the Walmart page++scraping that source also did.++++- **Find food near you** (`/near`, `GET /api/v1/places`): a place name (geocoded with Nominatim) or coordinates in,++ food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores out of OpenStreetMap++ (Overpass), with distance, address, opening hours, operator, phone, website and a link back to the object on OSM.++ Every result page carries the OpenStreetMap attribution and the ODbL link ODbL requires.++- **Inside the OSM usage policies** (`server/food/upstream.js`): we identify with `FOOD_OSM_USER_AGENT`, at most one++ request a second per host (calls to a host queue behind each other), every answer cached in `food_geo_cache` for++ 7 days, and only small `around:` radius queries — never a bulk download.++- **Meal planner** (`/plan`, `POST /api/v1/plans`): for one person, a couple or a group, 1–14 days, covering the six++ USDA MyPlate food groups from the ported food list, with a shopping list, the cheapest store per line, and an++ estimated cost. Deterministic; a budget is a hard cap. Signed-in people can save plans (`food_plans`).++- **Food database** (`/foods`, `/foods/:slug`, `GET /api/v1/foods[/:slug]`): the 42-item list ported from++ OpenVibe.Tools' grocery source, with nutrition per serving and per 100 g (derived from the pack size the item's own++ name states — and left out, not guessed, when it states no weight), the typical price band, and the chain-by-chain++ comparison. Server-rendered and in the sitemap.++- **Pantry** (`/pantry`, `GET`/`PUT /api/v1/pantry`): signed-in people keep what is in their cupboard (`food_pantry`)++ and get a deterministic "what can I make" against ten basic recipes written for this service — clearly labelled++ basic suggestions, no model call anywhere in this version.++- **Discovery**: the sitemap now carries every food page, `/near`, `/plan` and `/foods`; llms.txt and llms-full.txt++ list the same set; a pantry and a saved plan are never crawled.++- **Capabilities and limits**: `food.place.read`, `food.food.read`, `food.plan.read|write`, `food.pantry.read|write`;++ the place search has the tightest per-caller budget because it spends OpenStreetMap's shared request budget.++- **Tests**: a stand-in Nominatim + Overpass (`test/helpers/osm.js`) — the suite never calls the internet — covering++ the results and the attribution, the one-request-a-second queue, cache hits, the per-caller limit on the search, the++ meal-plan arithmetic, the pantry match, signed-in saves, anonymous refusals and the escaping of an OSM name.++++Also:++++- `test/skeleton.test.js` now skips itself inside a generated service. It asserts that the skeleton's generator++ rewrites its placeholders, which a generated service has none of; it was already failing before this change.++- `test/helpers/boot.js` points the two OSM hosts at a closed local port unless a test names a stand-in, so no test++ can reach the real Nominatim or Overpass.++- The home page's CSS budget was raised from 16.5 to 18 KB: the product's own pages brought their stylesheet with them++ (search and plan forms, place cards, the pantry tick list).++## 0.1.0 — 2026-10-08- **First release:** the service starts from the OpenVibe skeleton — sign-in with OpenVibe.Network (OAuth 2 + PKCE), server-rendered pages through the OpenVibe Frame, the `/api/v1` mount with per-caller limits, crawl artifacts, PostgreSQL migrations, the deploy files and the test suite.@@@ -2,48 +2,83 @@> What should we eat?--**Status:** skeleton. It runs, it is tested, and its pages and API are live — but the product itself is not written yet.++**Status:** the product works — food near you, a meal planner, the food database and the pantry are live and tested.++Delivery comparison and recipes from the network's AI (the manifests' other pillars) are not built yet.++**Domain:** `openvibe.food` · **Port:** 4970 · **Service id:** `food` · **Env prefix:** `FOOD`**License:** AGPL-3.0 (same as every OpenVibe service).--## What is already here++## What it does| Piece | Where | What it does ||---|---|---|--| Config | [server/config.js](server/config.js) | Every value from the environment; `load(env)` is pure so tests build a config without touching `process.env` |--| App | [server/app.js](server/app.js) | helmet (CSP, frame-ancestors none), the Network session middleware, `/auth`, the legal pages, static assets, the `/api/v1` mount, the 404 and the error handler |--| Sign-in | [server/auth/sso.js](server/auth/sso.js) | OAuth 2 authorization code with PKCE (S256) against OpenVibe.Network; httpOnly `food_at` / `food_rt` cookies; `/auth/me` for the shared navbar |--| Signing key | [server/auth/keys.js](server/auth/keys.js) | The Network JWKS through `openvibe-sdk/auth`, kept fresh, verified offline |--| Who is calling | [server/http/principal.js](server/http/principal.js) | `req.principal`: a person, an app/agent/service with a capability, or anonymous |--| API | [server/http/api.js](server/http/api.js) | `GET /api/v1/ping`; the router, the problem+json errors and the guards are wired for the product's routes |--| Pages | [server/http/pages.js](server/http/pages.js), [server/render/](server/render/) | The home page and `/updates`, server-rendered through `openvibe-shared/shell`, readable without JavaScript |--| Discovery | [server/http/discovery.js](server/http/discovery.js) | `robots.txt`, `sitemap.xml`, `llms.txt`, `llms-full.txt` and the home page's JSON-LD |--| Limits | [server/http/caller-limits.js](server/http/caller-limits.js), [deploy/nginx/](deploy/nginx/) | Per-caller limits at the API and per-address limits at nginx |--| Health | [server/observability.js](server/observability.js) | `/api/health`, a truthful `/api/ready` (the database is required) and Prometheus metrics on loopback only |--| Database | [server/db.js](server/db.js), [migrations/](migrations/) | PostgreSQL through `openvibe-sdk/db`; `NNNN_*.sql` applied at boot; PGlite in development |--| Process | [server/index.js](server/index.js) | Listens on `PORT`, and stops gracefully through `openvibe-sdk/service` |--| Deploy | [deploy/nginx/openvibe.food.conf](deploy/nginx/openvibe.food.conf), [deploy/systemd/openvibe-food.service](deploy/systemd/openvibe-food.service) | nginx vhost and systemd unit (port 4970, `/opt/openvibe.food`, `/etc/openvibe/food.env`) |--| Tests | [test/](test/) | `npm test`: every `test/*.test.js` in its own process, on a temp PGlite database with an in-process mock of OpenVibe.Network |++| Food near you | [/near](server/http/pages.js), [server/food/places.js](server/food/places.js) | A place name or coordinates → the food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores around it, from OpenStreetMap through Overpass, with distance, address, opening hours and a link back to the object |++| Meal planner | [/plan](server/http/pages.js), [server/food/planner.js](server/food/planner.js) | One person, a couple or a group, 1–14 days: one item from each of the six USDA MyPlate food groups, cheapest per gram first, then the best calories a dollar, with a shopping list, the cheapest store per line and an estimated cost. Deterministic, and a budget is a hard cap |++| Food database | [/foods, /foods/:slug](server/http/pages.js), [server/food/foods.js](server/food/foods.js) | 42 items with nutrition per serving and per 100 g, the typical price band and the chain-by-chain comparison; server-rendered and in the sitemap |++| Pantry | [/pantry](server/http/pages.js), [server/food/pantry-match.js](server/food/pantry-match.js) | Signed in, keep what is in your cupboard and see which basic recipes you can make now, and what one more item would unlock. Deterministic; no model call |++| The OpenStreetMap client | [server/food/upstream.js](server/food/upstream.js) | The only outbound calls this service makes: paced, cached, identified, bounded |++| Store | [server/food/store.js](server/food/store.js), [migrations/](migrations/) | `food_geo_cache`, `food_plans`, `food_pantry` |++| Platform | the skeleton | Sign-in with OpenVibe.Network, the OpenVibe Frame, limits, readiness, discovery, deploy files |++++Everything is server-rendered and works without JavaScript: the search is a GET form, saving a plan and a cupboard is++a plain POST, and every page is complete as it leaves the server.## API| Route | Who | ||---|---|---|| `GET /api/v1/ping` | anyone | `{ ok: true, service: "food" }` |----Everything else the site serves is a page. The product adds its routes in [server/http/api.js](server/http/api.js), naming--each route's capability in [server/http/principal.js](server/http/principal.js) (`CAPABILITIES`) and its numbers in--[server/http/caller-limits.js](server/http/caller-limits.js) (`BUDGETS`).----**Who can call it:** a person, with their Network token as a Bearer or this site's session; or an app, agent or service--with a Network token for audience `openvibe.food` that holds the route's capability. A write made with the session cookie--must come from `openvibe.food` itself. **Errors** are RFC 9457 `application/problem+json` with a stable `code`.++| `GET /api/v1/places?q=&kind=foodbank\|grocery\|both[&lat=&lon=&radius=&limit=]` | anyone | food near a place; every answer carries the ODbL attribution |++| `GET /api/v1/foods[?group=&q=]` | anyone | the food list |++| `GET /api/v1/foods/:slug` | anyone | one food, with the chain-by-chain prices |++| `POST /api/v1/plans` | signed in | plan and save: `{ people, days, budget?, title? }` → 201 with the plan |++| `GET /api/v1/plans`, `GET /api/v1/plans/:id` | signed in | your plans, newest first |++| `GET /api/v1/pantry` | signed in | your cupboard, with the "what can I make" suggestions |++| `PUT /api/v1/pantry` | signed in | replace it: `{ items: ["eggs-dozen", …] }` |++++Public reads need no token. A person's own data (a plan, a pantry) needs a signed-in caller; an app, agent or service++token needs the route's capability (`food.place.read`, `food.food.read`, `food.plan.read|write`,++`food.pantry.read|write` — [server/http/principal.js](server/http/principal.js)). A write made with the session cookie++must come from `openvibe.food` itself. Errors are RFC 9457 `application/problem+json` with a stable `code`.++++**Per-caller limits** ([server/http/caller-limits.js](server/http/caller-limits.js)): reads take `FOOD_LIMITS_MINUTE` /++`FOOD_LIMITS_HOUR`; the place search, which spends OpenStreetMap's shared request budget, has its own tighter numbers,++as do saving a plan and replacing a pantry.++++## Data sources and their terms++++**OpenStreetMap** (food banks, stores) — [openstreetmap.org](https://www.openstreetmap.org/) © OpenStreetMap++contributors, [ODbL 1.0](https://opendatacommons.org/licenses/odbl/1-0/). Read from++[Nominatim](https://nominatim.org/) (a place name → coordinates) and the [Overpass API](https://overpass-api.de/)++(the database). Both have published usage policies, and this service stays inside them:++++- it identifies itself with `FOOD_OSM_USER_AGENT` (`OpenVibeFood/0.1 (+https://openvibe.food)`), never a browser's;++- it makes **at most one request a second per host** — calls to the same host queue behind each other, so the service++ cannot burst at Nominatim however many visitors arrive at once;++- it **caches every answer** in `food_geo_cache` for 7 days (`FOOD_GEO_CACHE_TTL_MS`): a place is geocoded once and an++ area is queried once, not once per visitor;++- it only ever asks for a small radius around a point (`around:`), never a bulk download, and never fetches a URL a++ caller typed;++- the attribution and the ODbL link appear on every page that shows a result, and in every API answer.++++**The food list and its prices** — carried over unchanged from OpenVibe.Tools' grocery source++(`OpenVibe.Tools/apps/maps/server/sources/grocery.js`), where the food tools live today: typical 2025 US (Washington)++prices for five budget chains and the USDA MyPlate groups. They are a band to plan by, **never a live price**. The++Walmart page scraping that source also did is deliberately not ported: this service never scrapes a retail site.++++**Nutrition** — the same source's typical values per serving. "Per 100 g" is arithmetic on the pack size stated in an++item's own name divided by its servings (for example a 15 oz can with 3.5 servings is 121 g a serving). Where a name++states no weight — a dozen eggs, a 12-pack of ramen — no per-100 g figure is given rather than a density guessed.++The nutrition figures are the source's, not analysed here, and are not dietary advice.++++**Recipes** — ten simple combinations written for this service in plain words, using only items from the food list.++No copied recipe text. They are labelled "basic suggestions" wherever they appear.## ConfigurationSee [.env.example](.env.example). Required in production: `OV_OAUTH_CLIENT_SECRET` (the `food` OAuth client on the--Network), `BASE_URL`, `DATABASE_URL` and `DATABASE_DIRECT_URL`. The database is the only required readiness check; the--Network signing key, the OAuth client and Valkey are optional (the service says so, per check, on `/api/ready`).++Network), `BASE_URL`, `DATABASE_URL` and `DATABASE_DIRECT_URL`. `FOOD_NOMINATIM_URL` and `FOOD_OVERPASS_URL` default++to the public OSM hosts; tests point them at a stand-in and never reach the internet.## Development@@@ -72,8 +107,9 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md).- Session tokens are httpOnly cookies; a FedCM assertion or an app or service token is never a session.- Secrets live only in the env file; only environment variable names appear in code and docs, and no secret is logged.- Request bodies are never logged.--- Nothing in a request may decide a URL this service fetches: a caller's URL goes to OpenVibe.Tools, whose own guard-- decides what may be fetched.++- The only two hosts this service fetches are the OSM ones named in the configuration: a URL built from that base, and++ nothing a caller sends. A place name is data in a query string, never a URL.++- Nothing a person keeps here (a plan, a pantry) is public, cached or crawled.---@@@ -1,8 +1,8 @@{-- "stage": "skeleton",++ "stage": "product","code": true,"wave": "W20",-- "plan": "OpenVibe.Food starts from the OpenVibe service skeleton; the product's own plan is written here when it is",++ "plan": "The food tools move here from OpenVibe.Tools (apps/maps grocery source, the food proxy app), ported as clean modules without the Walmart page scraping. The manifests' other pillars — delivery comparison and meal kits, cupboard recipes with the network's AI — are still to come.","runtime": "node 22, express 4, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9","port": "4970","domain": "openvibe.food",@@@ -14,32 +14,40 @@"openvibe-sdk v0.35.2","openvibe-shared v2.14.0"],-- "summary": "OpenVibe.Food — What should we eat? A new OpenVibe service on the shared skeleton, not deployed yet: sign-in with OpenVibe.Network (OAuth 2 + PKCE, httpOnly session cookies), server-rendered pages through the OpenVibe Frame, the /api/v1 mount with per-caller limits, crawl artifacts, PostgreSQL migrations applied at boot, the nginx and systemd deploy files and a test suite on PGlite with a mock Network.",++ "summary": "OpenVibe.Food — What should we eat? Food near you (food banks, pantries and budget grocery stores from OpenStreetMap, paced and cached to stay inside the OSM usage policies), a deterministic meal planner with a shopping list and an estimated cost, a 42-item food database with nutrition per serving and per 100 g, and a pantry with a plain 'what can I make' against ten basic recipes. Server-rendered pages, an API at /api/v1, per-caller limits on the place search, and a test suite that never calls the internet.","works": [-- "Sign-in with OpenVibe.Network (PKCE S256, server-side code exchange, httpOnly session cookies)",-- "Server-rendered pages: the home page and /updates, through the OpenVibe Frame, complete without JavaScript",-- "Crawl artifacts: robots.txt, sitemap.xml, llms.txt, llms-full.txt and the home page's JSON-LD",-- "The API mount at /api/v1 with the problem+json error shape, the per-address limits and the per-caller limits",-- "Capability verification for app, agent and service tokens (audience openvibe.food) and for a person's own token",-- "Truthful readiness (/api/ready: the database is required) and Prometheus metrics on loopback",-- "PostgreSQL with migrations/NNNN_*.sql (openvibe-sdk/db); PGlite in development",-- "Deploy files: deploy/nginx/openvibe.food.conf and deploy/systemd/openvibe-food.service",-- "Tests on a temp PGlite database with an in-process mock of OpenVibe.Network"++ "Food near you: /near and GET /api/v1/places — a place name (Nominatim) or coordinates, food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores from Overpass, with distance, address, opening hours and operator",++ "The OpenStreetMap attribution and the ODbL link on every result page and in every place answer, as ODbL requires",++ "Inside the Nominatim and Overpass usage policies: the User-Agent identifies us, at most one request a second per host through an in-process queue, every answer cached in food_geo_cache for 7 days, only small around: radius queries, never a bulk download",++ "Meal planner: /plan and POST /api/v1/plans — one person, a couple or a group for 1–14 days, all six MyPlate groups, a shopping list, the cheapest store per line and an estimated cost; deterministic, with a budget as a hard cap",++ "Signed-in people save plans (food_plans) and keep a pantry (food_pantry)",++ "The food list at /foods and /foods/:slug (and GET /api/v1/foods[/:slug]): nutrition per serving and per 100 g, the typical price band and the chain-by-chain comparison, server-rendered",++ "Pantry matching: GET/PUT /api/v1/pantry and /pantry — a deterministic 'what can I make' against ten basic recipes, clearly labelled basic suggestions, no AI call",++ "Discovery: the sitemap carries every food page, /near, /plan and /foods; llms.txt and llms-full.txt list the same set; a pantry and a saved plan are never crawled",++ "Capabilities (food.place.read, food.food.read, food.plan.read|write, food.pantry.read|write) and per-caller limits, with the tightest budget on the place search because it spends OpenStreetMap's shared request budget",++ "Tests with a stand-in Nominatim and Overpass: results and attribution, the one-request-a-second queue, cache hits, escaping of an OSM name, the search's per-caller limit, the plan's arithmetic, the pantry match, signed-in saves and anonymous refusals",++ "Sign-in with OpenVibe.Network (PKCE S256, httpOnly session cookies), the OpenVibe Frame, PostgreSQL migrations applied at boot, deploy files"],"notYet": [-- "The product itself: its tables and migrations, its capabilities, its routes in server/http/api.js and its pages in server/http/pages.js",-- "Its service and capability manifests in openvibe-contracts (contracts-service is food)",-- "A deployment: the service is not registered with OpenVibe.Services nor deployed by OpenVibe.Host"++ "Delivery-price comparison across delivery apps, and meal kits and boxes (the manifests' other pillars)",++ "Recipes from the cupboard with the network's AI: this version is deterministic matching against ten recipes written by hand",++ "A 'food near me' from the browser's location (only a place name or explicit coordinates today)",++ "Fresh/live grocery prices: the price bands are typical 2025 US prices carried over from OpenVibe.Tools, not a live price",++ "Its service and capability manifests in openvibe-contracts (contracts-service is food), and a deployment"],"capabilitiesRegistered": false,"serviceManifestRegistered": false,"deployed": false,"placeholderInSites": false,"features": [++ "food near you (OpenStreetMap: food banks, pantries, budget grocery stores)",++ "meal planner with a shopping list and estimated cost",++ "food database with nutrition per serving and per 100 g",++ "pantry and 'what can I make'",++ "signed-in saving of plans and pantries",++ "public API with per-caller limits",++ "server-rendered pages and crawl artifacts","Network sign-in",-- "server-rendered pages",-- "api mount",-- "limits and readiness","deploy files"],"updated": "2026-10-08"nnew file mode 100644@@@ -0,0 +1,34 @@++-- phase: expand++-- OpenVibe.Food: where the product's own data lives. Nothing here is ever a credential, a key or a token.++--++-- food_geo_cache every Nominatim geocode and Overpass answer, with its TTL (7 days), so the two OSM services are++-- asked once for a place and not once per visitor (their usage policies; server/food/upstream.js)++-- food_plans a saved meal plan, as the planner returned it (server/food/planner.js), with the spec beside it++-- food_pantry what one person says is in their cupboard, one row per food in the list (server/food/foods.js)++++CREATE TABLE food_geo_cache (++ key text COLLATE "C" PRIMARY KEY, -- 'nominatim:<query>' | 'overpass:<sha256 of the query>'++ body jsonb NOT NULL, -- the upstream answer, as it came++ fetched_at text COLLATE "C" NOT NULL, -- when it was fetched (ISO 8601, UTC)++ expires_at text COLLATE "C" NOT NULL -- ISO 8601, UTC: past it the row is ignored and replaced++);++CREATE INDEX food_geo_cache_expires ON food_geo_cache (expires_at);++++CREATE TABLE food_plans (++ id text COLLATE "C" PRIMARY KEY, -- pln_<ULID>++ owner text COLLATE "C" NOT NULL, -- user:usr_…++ title text,++ people integer NOT NULL,++ days integer NOT NULL,++ budget double precision, -- the caller's budget, when one was given++ plan jsonb NOT NULL, -- the plan the planner returned, unchanged++ created_at text COLLATE "C" NOT NULL++);++CREATE INDEX food_plans_by_owner ON food_plans (owner, id DESC);++++CREATE TABLE food_pantry (++ owner text COLLATE "C" NOT NULL, -- user:usr_…++ item text COLLATE "C" NOT NULL, -- the food's slug in server/food/foods.js++ added_at text COLLATE "C" NOT NULL,++ PRIMARY KEY (owner, item)++);@@@ -42,3 +42,19 @@ form.inline { display: inline; }.page .sc-ic .ov-icon { --ovi-size: 28px !important; }button.sc-btn { background: transparent; }button.sc-btn.sc-primary { border: 0; }++++/* The product's own pieces: search, results, plan, cupboard. Plain, and readable without JavaScript. */++.ov-form { display: flex; flex-wrap: wrap; gap: 8px 12px; align-items: end; margin: 14px 0; }++.ov-form label { display: block; font-size: .85rem; color: var(--text-secondary, #96a7c2); }++.ov-form input, .ov-form select { font: inherit; padding: 7px 9px; border-radius: 8px; border: 1px solid var(--border-light, #2c3d5c); background: var(--bg-secondary, #0f1729); color: inherit; }++.ov-form input[type=search] { min-width: 240px; }++.ov-form input[type=number] { width: 120px; }++.places { list-style: none; padding: 0; margin: 12px 0; display: grid; gap: 10px; grid-template-columns: repeat(auto-fill, minmax(300px, 1fr)); }++.place { border: 1px solid var(--border, #1f2d47); border-radius: 10px; padding: 10px 12px; background: var(--bg-card, #131c2e); }++.attribution { border-top: 1px solid var(--border, #1f2d47); padding-top: 8px; margin-top: 16px; }++.stats { list-style: none; padding: 0; display: flex; flex-wrap: wrap; gap: 10px; }++.stats li { border: 1px solid var(--border, #1f2d47); border-radius: 10px; padding: 8px 12px; background: var(--bg-card, #131c2e); }++.stats b { display: block; font-size: 1.15rem; }++.pantry-form fieldset { border: 1px solid var(--border, #1f2d47); border-radius: 10px; margin: 10px 0; }++.pantry-item { display: inline-block; min-width: 240px; margin: 2px 10px 2px 0; font-size: .92rem; }++.lede { color: var(--text-secondary, #96a7c2); max-width: 72ch; }@@@ -4,14 +4,15 @@* OpenVibe.Food — Express app factory; server/index.js listens, tests build their own instance with a temp database* and a mock Network.*-- * /, /updates the pages (http/pages.js)++ * /, /near, /plan, /foods, /foods/:slug, /pantry, /updates the pages (http/pages.js)* /api/v1/* the API (http/api.js)* /auth/* Network SSO with PKCE (auth/sso.js)* /api/health, /api/ready, /release.json, /metrics (loopback only)*-- * The product fills this in: its routes in http/api.js, its pages in http/pages.js, its capabilities in-- * http/principal.js and its budgets in http/caller-limits.js. The plumbing here (helmet, SSO, legal pages,-- * static assets, the API mount, the 404 and the error handler) stays.++ * The product's own logic lives in server/food/: the food list (foods.js), the meal planner (planner.js), the++ * OpenStreetMap place search and its paced, cached client (places.js, upstream.js), the pantry match and its recipes++ * (pantry-match.js, recipes.js) and the store for plans, pantry and the geocode cache (store.js). The plumbing here++ * (helmet, SSO, legal pages, static assets, the API mount, the 404 and the error handler) stays the skeleton's.*/const path = require('path');const express = require('express');@@@ -26,6 +27,8 @@ const { openStore } = require('./db');const { createKeyStore } = require('./auth/keys');const { createSso } = require('./auth/sso');const { createPrincipal } = require('./http/principal');++const { createUpstream } = require('./food/upstream');++const foodStore = require('./food/store');const { createApi } = require('./http/api');const { createPageRoutes } = require('./http/pages');const { createServiceReadiness } = require('./observability');@@@ -50,6 +53,12 @@ async function createApp(opts = {}) {const sso = createSso({ config, keys, fetchImpl, now: s.now, log });const principal = createPrincipal({ config, keys });const ctx = { config, s, keys, sso, principal, log };++ // The only outbound client this service has (Nominatim + Overpass, paced and cached); the pages and the API get++ // it from here, so every test points it at a stand-in through FOOD_NOMINATIM_URL / FOOD_OVERPASS_URL.++ // Its own wall clock, not the store's: the pace between two calls must not depend on an injected test clock.++ ctx.upstream = createUpstream({ config, s, fetchImpl, log });++ // Drop expired geocode/area answers; an expired row is ignored anyway, this only keeps the table small.++ Promise.resolve(foodStore.cachePrune(s)).catch((err) => log.warn('[OpenVibe.Food] geo cache prune:', err && err.message));const app = express();app.disable('x-powered-by');@@@ -38,6 +38,22 @@ function load(env = process.env) {db: { url: env.DATABASE_URL || '', directUrl: env.DATABASE_DIRECT_URL || '', pgliteDir: env.FOOD_PGLITE_DIR || '' },valkey: { url: env.VALKEY_URL || '', prefix: env.VALKEY_PREFIX || 'ov:food:' },++ // The two OpenStreetMap services "food near you" stands on (server/food/places.js). Both are open data with++ // published usage policies: Nominatim at most one request a second, Overpass small bounded area queries —++ // server/food/upstream.js paces every call to one host at a time and caches every answer for geoCacheTtlMs.++ osm: {++ nominatimUrl: trim(env.FOOD_NOMINATIM_URL || 'https://nominatim.openstreetmap.org'),++ overpassUrl: trim(env.FOOD_OVERPASS_URL || 'https://overpass-api.de/api/interpreter'),++ // Identify to OSM with a contact URL, as both policies require; never a browser User-Agent.++ userAgent: env.FOOD_OSM_USER_AGENT || `OpenVibeFood/0.1 (+${baseUrl})`,++ minIntervalMs: Math.max(0, int(env.FOOD_OSM_MIN_INTERVAL_MS, 1000)),++ timeoutMs: Math.max(1000, int(env.FOOD_OSM_TIMEOUT_MS, 25_000)),++ cacheTtlMs: Math.max(60_000, int(env.FOOD_GEO_CACHE_TTL_MS, 7 * 24 * 60 * 60 * 1000)),++ defaultRadiusKm: 8,++ maxRadiusKm: 50,++ maxResults: 60,++ },++// OpenVibe.Network: SSO (OAuth2 authorization server with PKCE) and its JWKS.networkUrl,networkInternalUrl: trim(env.OV_NETWORK_INTERNAL_URL || 'http://127.0.0.1:4000'),nnew file mode 100644@@@ -0,0 +1,245 @@++'use strict';++++/**++ * The food list: what a person can plan a week of meals from, with the nutrition and the typical price behind each++ * item. Every page and the meal planner read it here; nothing else in this service holds food data.++ *++ * Ported from OpenVibe.Tools' grocery source (OpenVibe.Tools/apps/maps/server/sources/grocery.js), where the food++ * tools live today. The Walmart page scraping that source also did is deliberately *not* ported: this service never++ * scrapes a retail site. The prices are the same hand-kept typical 2025 US (Washington) prices, carried over++ * unchanged; they are a band to plan by, never a live price.++ *++ * "Per 100 g" is arithmetic on data we already have: the pack size stated in the item's own name divided by its++ * servings gives grams per serving (server/food/foods.js packGrams). Where the name states no weight (a dozen eggs,++ * a 12-pack of ramen) there is no per-100 g figure and the pages say so rather than guessing a density.++ */++++// id, name, group, servings, serving size, kcal, protein g, carbs g, fat g, fiber g, shelf stable, tags++const ROWS = [++ // protein++ ['eggs-dozen', 'Large Eggs (1 dozen)', 'protein', 12, '1 egg', 70, 6, 0.5, 5, 0, false, 'breakfast,versatile,complete-protein'],++ ['chicken-breast', 'Chicken Breasts (per lb)', 'protein', 3, '5 oz', 165, 31, 0, 3.6, 0, false, 'lean,high-protein'],++ ['canned-tuna', 'Canned Tuna (5 oz)', 'protein', 2.5, '2 oz', 60, 13, 0, 0.5, 0, true, 'shelf-stable,lightweight,omega-3'],++ ['peanut-butter', 'Peanut Butter (16 oz)', 'protein', 15, '2 tbsp', 190, 7, 7, 16, 2, true, 'shelf-stable,calorie-dense'],++ ['dried-beans', 'Dried Pinto Beans (1 lb)', 'protein', 12, '1/4 cup dry', 150, 10, 28, 0.5, 10, true, 'shelf-stable,fiber,cheap-protein'],++ ['canned-beans', 'Canned Black Beans (15 oz)', 'protein', 3.5, '1/2 cup', 110, 7, 20, 0.5, 8, true, 'shelf-stable,fiber,ready-to-eat'],++ ['hot-dogs', 'Hot Dogs (8 ct, 12 oz)', 'protein', 8, '1 frank', 150, 5, 2, 13, 0, false, 'easy-cook,budget-king'],++ ['ground-beef', 'Ground Beef 73/27 (1 lb)', 'protein', 4, '4 oz', 280, 19, 0, 23, 0, false, 'high-calorie,iron-rich'],++ ['canned-soup', 'Canned Soup, Chicken Noodle (10.5 oz)', 'protein', 2.5, '1/2 can', 60, 3, 8, 2, 1, true, 'shelf-stable,heat-and-eat'],++ ['canned-chili', 'Canned Chili with Beans (15 oz)', 'protein', 2, '1 cup', 240, 16, 25, 8, 7, true, 'shelf-stable,high-protein,complete-meal'],++ ['sardines', 'Sardines (3.75 oz tin)', 'protein', 2, '~3 fish', 120, 13, 0, 7, 0, true, 'shelf-stable,omega-3,no-cook'],++ // grains++ ['ramen-12pk', 'Ramen Noodles (12 pack)', 'grains', 12, '1 packet', 188, 4, 26, 7, 1, true, 'shelf-stable,just-add-water'],++ ['white-rice', 'Long Grain White Rice (2 lb)', 'grains', 20, '1/4 cup dry', 160, 3, 36, 0, 0, true, 'shelf-stable,bulk-calories,versatile'],++ ['spaghetti', 'Spaghetti (16 oz)', 'grains', 8, '2 oz dry', 200, 7, 41, 1, 2, true, 'shelf-stable,energy-dense'],++ ['bread-white', 'White Bread (20 oz)', 'grains', 20, '1 slice', 65, 2, 13, 1, 0.5, false, 'sandwich-base,breakfast'],++ ['oatmeal', 'Oats, Old Fashioned (42 oz)', 'grains', 30, '1/2 cup dry', 150, 5, 27, 3, 4, true, 'shelf-stable,fiber,breakfast'],++ ['tortillas', 'Flour Tortillas (10 ct)', 'grains', 10, '1 tortilla', 140, 4, 24, 3, 1, false, 'wraps,versatile,no-cook'],++ ['jiffy-mix', 'Corn Muffin Mix (8.5 oz)', 'grains', 6, '1 muffin', 180, 3, 28, 5, 1, true, 'shelf-stable,baking'],++ ['mac-cheese', 'Mac & Cheese Box (7.25 oz)', 'grains', 3, '1 cup prepared', 220, 8, 48, 2, 2, true, 'shelf-stable,kid-friendly'],++ ['granola-bars', 'Granola Bars (6 ct)', 'grains', 6, '1 bar', 100, 2, 19, 3, 1, true, 'shelf-stable,portable'],++ ['instant-coffee', 'Instant Coffee (8 oz jar)', 'grains', 120, '1 tsp', 0, 0, 0, 0, 0, true, 'shelf-stable,no-calories'],++ // vegetables++ ['potatoes-5lb', 'Russet Potatoes (5 lb)', 'vegetables', 10, '1 medium', 160, 4, 37, 0, 4, true, 'calorie-dense,versatile'],++ ['canned-corn', 'Canned Corn (15 oz)', 'vegetables', 3.5, '1/2 cup', 60, 2, 14, 0.5, 2, true, 'shelf-stable,ready-to-eat'],++ ['baby-carrots', 'Baby Carrots (1 lb)', 'vegetables', 6, '3 oz', 35, 1, 8, 0, 2, false, 'ready-to-eat,no-cook,vitamin-a'],++ ['canned-green-beans', 'Canned Green Beans (14.5 oz)', 'vegetables', 3.5, '1/2 cup', 20, 1, 4, 0, 1, true, 'shelf-stable,low-calorie'],++ ['frozen-mixed-veg', 'Frozen Mixed Vegetables (12 oz)', 'vegetables', 4, '3/4 cup', 50, 2, 10, 0, 3, false, 'needs-freezer,vitamin-rich'],++ ['onion-3lb', 'Yellow Onions (3 lb bag)', 'vegetables', 9, '1 medium', 45, 1, 11, 0, 1, true, 'flavor-base,long-lasting'],++ ['canned-tomatoes', 'Diced Tomatoes (14.5 oz can)', 'vegetables', 3.5, '1/2 cup', 25, 1, 5, 0, 1, true, 'shelf-stable,cooking-base,vitamin-c'],++ // fruits++ ['bananas', 'Bananas (per lb, ~3 bananas)', 'fruits', 3, '1 medium', 105, 1, 27, 0, 3, false, 'no-cook,potassium,energy'],++ ['apples-3lb', 'Gala Apples (3 lb bag)', 'fruits', 7, '1 medium', 95, 0.5, 25, 0, 4, false, 'no-cook,fiber,portable'],++ ['oranges-3lb', 'Oranges (3 lb bag)', 'fruits', 6, '1 medium', 65, 1, 16, 0, 3, false, 'no-cook,vitamin-c,portable'],++ ['canned-fruit', 'Canned Peaches (15 oz)', 'fruits', 3.5, '1/2 cup', 60, 0, 15, 0, 1, true, 'shelf-stable,ready-to-eat,sweet'],++ ['raisins', 'Raisins (6 oz box)', 'fruits', 4, '1/4 cup', 120, 1, 32, 0, 2, true, 'shelf-stable,energy-dense'],++ ['strawberries', 'Fresh Strawberries (1 lb)', 'fruits', 4, '1 cup', 50, 1, 12, 0, 3, false, 'vitamin-c,antioxidants'],++ // dairy++ ['whole-milk', 'Whole Milk (1 gallon)', 'dairy', 16, '1 cup', 150, 8, 12, 8, 0, false, 'calcium,complete-protein,vitamin-d'],++ ['cheese-block', 'Cheddar Cheese Block (8 oz)', 'dairy', 8, '1 oz', 110, 7, 1, 9, 0, false, 'calcium,protein,portable'],++ ['yogurt', 'Yogurt (32 oz tub)', 'dairy', 4, '1 cup', 130, 12, 17, 0, 0, false, 'probiotics,breakfast'],++ ['powdered-milk', 'Powdered Milk (25.6 oz)', 'dairy', 24, '1/3 cup powder', 80, 8, 12, 0, 0, true, 'shelf-stable,lightweight'],++ // fats and oils++ ['cooking-oil', 'Vegetable Oil (48 fl oz)', 'fats', 96, '1 tbsp', 120, 0, 0, 14, 0, true, 'cooking-essential,calorie-dense'],++ ['butter', 'Butter (16 oz / 4 sticks)', 'fats', 32, '1 tbsp', 100, 0, 0, 11, 0, false, 'cooking,flavor'],++ ['avocado', 'Fresh Avocado (each)', 'fats', 3, '1/3 avocado', 80, 1, 4, 7, 3, false, 'healthy-fats,potassium,no-cook'],++ ['trail-mix', 'Trail Mix (10 oz)', 'fats', 7, '3 tbsp', 160, 5, 15, 10, 2, true, 'shelf-stable,energy-dense'],++];++++// The same prices the Tools source kept: the five budget chains it compared, per pack. A null price (the chain does++// not carry the item) is simply absent. Only ever shown as a band and a comparison, never as a live price.++const PRICES = {++ 'eggs-dozen': { walmart: 3.24, fredmeyer: 3.49, safeway: 3.79, groceryoutlet: 2.99 },++ 'chicken-breast': { walmart: 2.57, fredmeyer: 2.99, safeway: 3.49, groceryoutlet: 1.99 },++ 'canned-tuna': { walmart: 1.08, fredmeyer: 1.25, safeway: 1.39, dollartree: 1.25, groceryoutlet: 0.99 },++ 'peanut-butter': { walmart: 2.14, fredmeyer: 2.49, safeway: 2.79, dollartree: 1.25, groceryoutlet: 1.99 },++ 'dried-beans': { walmart: 1.28, fredmeyer: 1.49, safeway: 1.69, dollartree: 1.25, groceryoutlet: 1.19 },++ 'canned-beans': { walmart: 0.78, fredmeyer: 0.99, safeway: 1.09, dollartree: 1.25, groceryoutlet: 0.79 },++ 'hot-dogs': { walmart: 1.00, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.99 },++ 'ground-beef': { walmart: 5.94, fredmeyer: 5.99, safeway: 6.49, groceryoutlet: 4.99 },++ 'canned-soup': { walmart: 0.98, fredmeyer: 1.09, safeway: 1.19, dollartree: 1.25, groceryoutlet: 0.89 },++ 'canned-chili': { walmart: 1.48, fredmeyer: 1.69, safeway: 1.89, dollartree: 1.25, groceryoutlet: 1.29 },++ 'sardines': { walmart: 1.08, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.89 },++ 'ramen-12pk': { walmart: 3.97, fredmeyer: 3.99, safeway: 4.29, dollartree: 1.25, groceryoutlet: 2.99 },++ 'white-rice': { walmart: 1.42, fredmeyer: 1.69, safeway: 1.89, dollartree: 1.25, groceryoutlet: 1.49 },++ 'spaghetti': { walmart: 0.98, fredmeyer: 1.15, safeway: 1.29, dollartree: 1.25, groceryoutlet: 0.89 },++ 'bread-white': { walmart: 1.18, fredmeyer: 1.39, safeway: 1.49, dollartree: 1.25, groceryoutlet: 1.29 },++ 'oatmeal': { walmart: 3.48, fredmeyer: 3.69, safeway: 3.99, dollartree: 1.25, groceryoutlet: 2.99 },++ 'tortillas': { walmart: 1.96, fredmeyer: 2.29, safeway: 2.49, dollartree: 1.25, groceryoutlet: 1.79 },++ 'jiffy-mix': { walmart: 0.67, fredmeyer: 0.79, safeway: 0.89, dollartree: 1.25, groceryoutlet: 0.69 },++ 'mac-cheese': { walmart: 0.52, fredmeyer: 0.79, safeway: 0.89, dollartree: 1.25, groceryoutlet: 0.59 },++ 'granola-bars': { walmart: 1.96, fredmeyer: 2.29, safeway: 2.79, dollartree: 1.25, groceryoutlet: 1.49 },++ 'instant-coffee': { walmart: 4.64, fredmeyer: 4.99, safeway: 5.49, dollartree: 1.25, groceryoutlet: 3.99 },++ 'potatoes-5lb': { walmart: 2.47, fredmeyer: 2.79, safeway: 2.99, groceryoutlet: 2.49 },++ 'canned-corn': { walmart: 0.76, fredmeyer: 0.89, safeway: 0.99, dollartree: 1.25, groceryoutlet: 0.69 },++ 'baby-carrots': { walmart: 1.17, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 1.09 },++ 'canned-green-beans': { walmart: 0.72, fredmeyer: 0.85, safeway: 0.99, dollartree: 1.25, groceryoutlet: 0.65 },++ 'frozen-mixed-veg': { walmart: 1.14, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.99 },++ 'onion-3lb': { walmart: 2.12, fredmeyer: 2.29, safeway: 2.49, groceryoutlet: 1.99 },++ 'canned-tomatoes': { walmart: 0.78, fredmeyer: 0.89, safeway: 0.99, dollartree: 1.25, groceryoutlet: 0.75 },++ 'bananas': { walmart: 0.50, fredmeyer: 0.59, safeway: 0.69, groceryoutlet: 0.49 },++ 'apples-3lb': { walmart: 3.47, fredmeyer: 3.69, safeway: 3.99, groceryoutlet: 2.99 },++ 'oranges-3lb': { walmart: 3.57, fredmeyer: 3.79, safeway: 3.99, groceryoutlet: 2.99 },++ 'canned-fruit': { walmart: 1.18, fredmeyer: 1.39, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.99 },++ 'raisins': { walmart: 1.98, fredmeyer: 2.19, safeway: 2.39, dollartree: 1.25, groceryoutlet: 1.49 },++ 'strawberries': { walmart: 2.82, fredmeyer: 2.99, safeway: 3.29, groceryoutlet: 2.49 },++ 'whole-milk': { walmart: 2.92, fredmeyer: 3.19, safeway: 3.49, groceryoutlet: 2.99 },++ 'cheese-block': { walmart: 1.87, fredmeyer: 2.19, safeway: 2.49, groceryoutlet: 1.79 },++ 'yogurt': { walmart: 2.68, fredmeyer: 2.89, safeway: 3.19, groceryoutlet: 2.49 },++ 'powdered-milk': { walmart: 5.97, fredmeyer: 6.49, safeway: 6.99, groceryoutlet: 4.99 },++ 'cooking-oil': { walmart: 3.74, fredmeyer: 3.99, safeway: 4.49, dollartree: 1.25, groceryoutlet: 3.49 },++ 'butter': { walmart: 3.48, fredmeyer: 3.79, safeway: 3.99, groceryoutlet: 2.99 },++ 'avocado': { walmart: 0.55, fredmeyer: 0.79, safeway: 0.99, groceryoutlet: 0.50 },++ 'trail-mix': { walmart: 2.98, fredmeyer: 3.49, safeway: 3.99, dollartree: 1.25, groceryoutlet: 2.49 },++};++++const STORES = {++ walmart: 'Walmart',++ fredmeyer: 'Fred Meyer',++ safeway: 'Safeway',++ dollartree: 'Dollar Tree',++ groceryoutlet: 'Grocery Outlet',++};++++// USDA MyPlate groups, as the Tools source carried them; dailyMin is grams a day (dairy, as millilitres of milk,++// which is close enough per gram to treat the same).++const GROUPS = {++ protein: { name: 'Protein', dailyMin: 50, examples: 'Chicken, eggs, beans, peanut butter, canned tuna' },++ grains: { name: 'Grains', dailyMin: 170, examples: 'Rice, bread, pasta, oatmeal, tortillas' },++ vegetables: { name: 'Vegetables', dailyMin: 300, examples: 'Carrots, potatoes, canned corn, frozen mixed vegetables' },++ fruits: { name: 'Fruits', dailyMin: 200, examples: 'Bananas, apples, oranges, canned fruit' },++ dairy: { name: 'Dairy', dailyMin: 720, examples: 'Milk, cheese, yogurt' },++ fats: { name: 'Fats & Oils', dailyMin: 25, examples: 'Cooking oil, butter, peanut butter, avocado' },++};++++// Which meals an item suits (ported); used to lay a plan out over breakfast, lunch, dinner and snacks.++const MEALS = {++ 'eggs-dozen': 'breakfast', 'chicken-breast': 'lunch,dinner', 'canned-tuna': 'lunch,snack',++ 'peanut-butter': 'breakfast,snack', 'dried-beans': 'lunch,dinner', 'canned-beans': 'lunch,dinner',++ 'hot-dogs': 'lunch,dinner', 'ground-beef': 'dinner', 'ramen-12pk': 'lunch,dinner',++ 'white-rice': 'lunch,dinner', 'spaghetti': 'dinner', 'bread-white': 'breakfast,lunch,snack',++ 'oatmeal': 'breakfast', 'tortillas': 'lunch,dinner', 'jiffy-mix': 'breakfast,snack',++ 'potatoes-5lb': 'lunch,dinner', 'canned-corn': 'lunch,dinner', 'baby-carrots': 'lunch,snack',++ 'canned-green-beans': 'lunch,dinner', 'frozen-mixed-veg': 'dinner', 'onion-3lb': 'lunch,dinner',++ 'canned-tomatoes': 'lunch,dinner', 'bananas': 'breakfast,snack', 'apples-3lb': 'breakfast,snack',++ 'oranges-3lb': 'breakfast,snack', 'canned-fruit': 'breakfast,snack', 'raisins': 'breakfast,snack',++ 'strawberries': 'breakfast,snack', 'whole-milk': 'breakfast', 'cheese-block': 'lunch,snack',++ 'yogurt': 'breakfast,snack', 'powdered-milk': 'breakfast', 'cooking-oil': 'lunch,dinner',++ 'butter': 'breakfast,lunch,dinner', 'avocado': 'lunch,snack', 'mac-cheese': 'lunch,dinner',++ 'canned-soup': 'lunch,dinner', 'canned-chili': 'lunch,dinner', 'trail-mix': 'snack',++ 'granola-bars': 'breakfast,snack', 'sardines': 'lunch,snack', 'instant-coffee': 'breakfast',++};++++// A pack size stated in an item's own name → grams. Volume (fl oz) is deliberately absent: converting it would mean++// assuming a density. A dozen eggs and a 12-pack of ramen state no weight, so they get no per-100 g figure.++const UNIT_G = { oz: 28.3495, lb: 453.592, lbs: 453.592, pound: 453.592, pounds: 453.592, g: 1, gram: 1, grams: 1, kg: 1000, kilogram: 1000, gallon: 3785.41, gal: 3785.41, l: 1000, litre: 1000, liter: 1000, ml: 1 };++function packGrams(name) {++ const str = String(name);++ const m = str.match(/(\d+(?:\.\d+)?)\s*(fl\.?\s*oz|oz|lbs?|pounds?|kgs?|kilograms?|grams?|kg|g|gallons?|gal|l|litres?|liters?|ml)\b/i);++ // "Chicken Breasts (per lb)" and "Bananas (per lb)" state a unit with no number: that is one of it.++ const bare = m ? null : str.match(/\bper\s+(fl\.?\s*oz|oz|lbs?|pounds?|kgs?|kg|g|gallons?|gal|litres?|liters?|l|ml)\b/i);++ const unitText = m ? m[2] : bare && bare[1];++ if (!unitText) return null;++ const unit = unitText.toLowerCase().replace(/[.\s]/g, '');++ if (/^(floz|foz)$/.test(unit)) return null; // a volume: no density known, so no grams++ const g = UNIT_G[unit];++ return g ? (m ? Number(m[1]) : 1) * g : null;++}++++const round = (n, d = 0) => { const p = 10 ** d; return Math.round((Number(n) + Number.EPSILON) * p) / p; };++const nullPrice = (v) => (v === null || v === undefined || v === '' ? null : Number(v));++++function band(min) {++ if (min <= 2) return 'low';++ if (min <= 4) return 'medium';++ if (min <= 8) return 'higher';++ return 'high';++}++const BAND_LABEL = { low: 'under $2 a pack', medium: '$2–4 a pack', higher: '$4–8 a pack', high: 'over $8 a pack' };++++/** One row plus its prices → what the pages, the planner and the pantry match read. */++function build([id, name, group, servings, servingSize, kcal, proteinG, carbsG, fatG, fiberG, shelfStable, tags]) {++ const prices = PRICES[id] || {};++ const known = Object.entries(prices).map(([store, price]) => ({ store, store_name: STORES[store], price: nullPrice(price) }))++ .filter((p) => p.price != null).sort((a, b) => a.price - b.price || (a.store < b.store ? -1 : 1));++ const price = known.length ? known[0].price : null;++ const priceMax = known.length ? known[known.length - 1].price : null;++ const grams = packGrams(name);++ const servingGrams = grams && servings ? round(grams / servings, 1) : null;++ const per100 = servingGrams ? {++ kcal: round(kcal * 100 / servingGrams),++ protein_g: round(proteinG * 100 / servingGrams, 1),++ carbs_g: round(carbsG * 100 / servingGrams, 1),++ fat_g: round(fatG * 100 / servingGrams, 1),++ fiber_g: round(fiberG * 100 / servingGrams, 1),++ } : null;++ return {++ id, slug: id, name, group,++ group_name: GROUPS[group].name,++ servings, serving_size: servingSize,++ nutrition: { kcal, protein_g: proteinG, carbs_g: carbsG, fat_g: fatG, fiber_g: fiberG },++ serving_grams: servingGrams,++ pack_grams: grams ? round(grams) : null,++ per_100g: per100,++ package_kcal: round(kcal * servings),++ package_protein_g: round(proteinG * servings),++ price, price_max: priceMax,++ cheapest_store: known.length ? known[0].store : null,++ cheapest_store_name: known.length ? known[0].store_name : null,++ prices: known,++ band: price == null ? null : band(price),++ band_label: price == null ? null : BAND_LABEL[band(price)],++ cost_per_serving: price == null ? null : round(price / servings, 2),++ cost_per_gram: price == null || !grams ? null : round(price / grams, 4),++ kcal_per_dollar: price == null ? null : round(kcal * servings / price),++ shelf_stable: !!shelfStable,++ meals: (MEALS[id] || 'lunch,dinner').split(','),++ tags: String(tags).split(','),++ };++}++++const FOODS = ROWS.map(build).sort((a, b) => (a.group === b.group ? (a.name < b.name ? -1 : 1) : (Object.keys(GROUPS).indexOf(a.group) - Object.keys(GROUPS).indexOf(b.group))));++const BY_SLUG = new Map(FOODS.map((f) => [f.slug, f]));++++const listFoods = ({ group = null, q = null } = {}) => {++ let foods = FOODS;++ if (group && GROUPS[group]) foods = foods.filter((f) => f.group === group);++ if (q) {++ const needle = String(q).toLowerCase();++ foods = foods.filter((f) => f.name.toLowerCase().includes(needle) || f.tags.some((t) => t.includes(needle)));++ }++ return foods;++};++const getFood = (slug) => BY_SLUG.get(String(slug)) || null;++++/** The list as the API hands it out (no store-by-store table: that is the food page's job). */++const toWire = (f) => ({++ slug: f.slug, name: f.name, group: f.group, group_name: f.group_name,++ servings: f.servings, serving_size: f.serving_size, serving_grams: f.serving_grams,++ nutrition_per_serving: f.nutrition, nutrition_per_100g: f.per_100g,++ price: f.price, price_max: f.price_max, price_band: f.band, price_band_label: f.band_label,++ cheapest_store: f.cheapest_store, cost_per_serving: f.cost_per_serving, kcal_per_dollar: f.kcal_per_dollar,++ shelf_stable: f.shelf_stable, tags: f.tags, meals: f.meals, url: `/foods/${f.slug}`,++});++++module.exports = { FOODS, GROUPS, STORES, MEALS, BY_SLUG, listFoods, getFood, toWire, band, BAND_LABEL, packGrams, round };nnew file mode 100644@@@ -0,0 +1,50 @@++'use strict';++++/**++ * "What can I make?": match what a person says is in their cupboard against the basic recipes (server/food/recipes.js).++ *++ * Deterministic and offline — no model call, no ranking magic. A recipe can be made when every ingredient it needs is++ * in the pantry; the rest are listed with what is missing, so the answer is useful even when nothing is complete.++ * Everything the pantry holds is a food from the list, so an unknown item can never reach this function.++ */++++const { RECIPES } = require('./recipes');++const { getFood } = require('./foods');++++const nameOf = (slug) => { const f = getFood(slug); return f ? f.name : slug; };++++/** One recipe vs one set of pantry slugs. */++function score(recipe, pantry) {++ const has = (slug) => pantry.has(slug);++ const ingredientList = recipe.ingredients.map((slug) => ({ slug, name: nameOf(slug), have: has(slug), optional: false }));++ const optionalList = (recipe.optional || []).map((slug) => ({ slug, name: nameOf(slug), have: has(slug), optional: true }));++ const missing = ingredientList.filter((i) => !i.have);++ return {++ slug: recipe.slug, name: recipe.name, serves: recipe.serves, minutes: recipe.minutes, steps: recipe.steps,++ ingredients: ingredientList, optional: optionalList,++ have: ingredientList.filter((i) => i.have),++ missing,++ optional_have: optionalList.filter((i) => i.have),++ optional_missing: optionalList.filter((i) => !i.have),++ can_make: missing.length === 0,++ missing_count: missing.length,++ coverage: ingredientList.length ? Number(((ingredientList.length - missing.length) / ingredientList.length).toFixed(2)) : 1,++ };++}++++/**++ * Every recipe against what the pantry holds, best first: what can be made, then what is closest, then by name.++ * `pantry` is an array of food slugs.++ */++function matchPantry(pantrySlugs = []) {++ const pantry = new Set(pantrySlugs);++ const all = RECIPES.map((r) => score(r, pantry)).sort((a, b) => (Number(b.can_make) - Number(a.can_make)) || (a.missing_count - b.missing_count) || (a.name < b.name ? -1 : 1));++ return {++ can_make: all.filter((r) => r.can_make),++ almost: all.filter((r) => !r.can_make && r.missing_count <= 1),++ rest: all.filter((r) => !r.can_make && r.missing_count > 1),++ all,++ };++}++++module.exports = { matchPantry, score };nnew file mode 100644@@@ -0,0 +1,187 @@++'use strict';++++/**++ * "Find food near you": food banks, pantries, soup kitchens and community fridges, and budget grocery stores, from++ * OpenStreetMap through Overpass. The tag shapes and the classification are ported from OpenVibe.Tools' grocery++ * source (apps/maps/server/sources/grocery.js); the queries here are bounded to one radius around one point and one++ * kind of tag, and server/food/upstream.js paces and caches every one of them.++ *++ * Everything this module returns is © OpenStreetMap contributors, under ODbL. Callers must show the attribution and++ * link it back — the pages do (server/http/pages.js), and the API returns it with every answer.++ */++++const { UpstreamError } = require('./upstream');++++const ATTRIBUTION = {++ text: '© OpenStreetMap contributors',++ url: 'https://www.openstreetmap.org/copyright',++ license: 'ODbL 1.0',++ license_url: 'https://opendatacommons.org/licenses/odbl/1-0/',++};++const SOURCE = {++ name: 'OpenStreetMap',++ url: 'https://www.openstreetmap.org/',++ via: 'Overpass API',++ license: 'ODbL 1.0',++ fetched_note: 'fetched by OpenVibe.Food and cached for 7 days',++};++++// The four kinds of free food OpenStreetMap tags, as the Tools source classified them.++const FOOD_BANK_TYPES = {++ food_bank: { label: 'Food bank', offers: 'Pre-packaged food' },++ soup_kitchen: { label: 'Soup kitchen', offers: 'Hot prepared meals' },++ food_sharing: { label: 'Community fridge', offers: 'Drop off or pick up food' },++ give_box: { label: 'Free pantry box', offers: 'Free pantry items' },++};++++// Chains OpenStreetMap tags as a discount grocer. Anything else is still listed, without the budget mark.++const BUDGET_BRANDS = [/aldi/i, /lidl/i, /netto/i, /penny markt/i, /dollar tree/i, /dollar general/i, /family dollar/i, /grocery outlet/i, /save ?a ?lot/i, /winco/i, /food ?4 ?less/i, /foods ?co/i, /price ?rite/i, /action\b/i, /biedronka/i, /żabka/i];++++const KINDS = ['foodbank', 'grocery'];++++function haversineKm(aLat, aLon, bLat, bLon) {++ const R = 6371.0088;++ const toRad = (d) => d * Math.PI / 180;++ const dLat = toRad(bLat - aLat);++ const dLon = toRad(bLon - aLon);++ const h = Math.sin(dLat / 2) ** 2 + Math.cos(toRad(aLat)) * Math.cos(toRad(bLat)) * Math.sin(dLon / 2) ** 2;++ return 2 * R * Math.asin(Math.min(1, Math.sqrt(h)));++}++++function formatAddress(tags) {++ const parts = [tags['addr:housenumber'], tags['addr:street'], tags['addr:city'], tags['addr:state'], tags['addr:postcode']]++ .map((p) => (p == null ? '' : String(p).trim())).filter(Boolean);++ return parts.join(', ');++}++++const isBudgetStore = (tags) => {++ if (tags.shop === 'variety_store') return true; // a dollar store is a budget store by definition++ const brand = `${tags.brand || ''} ${tags.name || ''} ${tags.operator || ''}`;++ return BUDGET_BRANDS.some((re) => re.test(brand));++};++++/** The Overpass query for one kind, bounded to `radiusM` metres around one point. Never a bulk download. */++function queryFor(kind, lat, lon, radiusM) {++ const around = `(around:${radiusM},${lat},${lon})`;++ if (kind === 'foodbank') {++ return `[out:json][timeout:25];(++nwr["amenity"="social_facility"]["social_facility"="food_bank"]${around};++nwr["amenity"="social_facility"]["social_facility"="soup_kitchen"]${around};++nwr["amenity"="food_bank"]${around};++nwr["amenity"="food_sharing"]${around};++nwr["amenity"="give_box"]${around};++);out center tags;`;++ }++ return `[out:json][timeout:25];(++nwr["shop"~"^(supermarket|convenience|grocery|greengrocer|variety_store|wholesale|frozen_food)$"]${around};++);out center tags;`;++}++++/** One Overpass element → one result, or null when it carries no usable position. */++function toResult(el, kind, origin) {++ const lat = el.lat != null ? el.lat : (el.center && el.center.lat);++ const lon = el.lon != null ? el.lon : (el.center && el.center.lon);++ if (lat == null || lon == null) return null;++ const tags = el.tags || {};++ const fbType = tags.social_facility === 'soup_kitchen' ? 'soup_kitchen'++ : tags.amenity === 'food_sharing' ? 'food_sharing'++ : tags.amenity === 'give_box' ? 'give_box' : 'food_bank';++ const type = kind === 'grocery' ? (tags.shop || 'supermarket') : fbType;++ const label = kind === 'grocery'++ ? type.replace(/_/g, ' ').replace(/^\w/, (c) => c.toUpperCase())++ : FOOD_BANK_TYPES[fbType].label;++ return {++ id: `osm-${el.type}-${el.id}`,++ osm_type: el.type, osm_id: el.id,++ osm_url: `https://www.openstreetmap.org/${el.type}/${el.id}`,++ kind, type, type_label: label,++ name: tags.name || tags.operator || label,++ lat, lon,++ distance_km: Math.round(haversineKm(origin.lat, origin.lon, lat, lon) * 10) / 10,++ address: formatAddress(tags) || null,++ opening_hours: tags.opening_hours || null,++ operator: tags.operator || null,++ phone: tags.phone || tags['contact:phone'] || null,++ website: tags.website || tags['contact:website'] || null,++ wheelchair: tags.wheelchair === 'yes' ? true : tags.wheelchair === 'no' ? false : null,++ budget: kind === 'grocery' ? isBudgetStore(tags) : (tags.fee === 'yes' ? false : null),++ };++}++++/** Elements → results, deduplicated by where they are, nearest first. */++function elementsToResults(elements, kind, origin, limit) {++ const seen = new Set();++ const out = [];++ for (const el of elements || []) {++ const r = toResult(el, kind, origin);++ if (!r) continue;++ const key = `${r.name.toLowerCase()}@${r.lat.toFixed(4)},${r.lon.toFixed(4)}`;++ if (seen.has(key)) continue;++ seen.add(key);++ out.push(r);++ }++ out.sort((a, b) => a.distance_km - b.distance_km || (a.name < b.name ? -1 : 1));++ return limit ? out.slice(0, limit) : out;++}++++const clamp = (n, lo, hi) => Math.min(Math.max(n, lo), hi);++++/**++ * The place search behind both the API and the pages.++ *++ * { kind: 'foodbank' | 'grocery' | 'both', q, lat, lon, radiusKm, limit }++ *++ * A name (q) is geocoded with Nominatim, once, and cached; the area query is cached too. Throws UpstreamError++ * (food.place.invalid on bad input, food.place.upstream when OSM cannot be reached).++ */++async function searchPlaces(upstream, { kind = 'foodbank', q = null, lat = null, lon = null, radiusKm = null, limit = null } = {}, config) {++ const kinds = kind === 'both' ? KINDS : [kind];++ if (!kinds.every((k) => KINDS.includes(k))) throw new UpstreamError('food.place.invalid', 'kind: foodbank, grocery or both', { status: 422 });++++ let place = null;++ if (Number.isFinite(lat) && Number.isFinite(lon)) {++ place = { name: null, lat: Number(lat), lon: Number(lon), from: 'coordinates' };++ } else if (q && String(q).trim()) {++ const g = await upstream.geocode(q, { limit: 1 });++ const hit = Array.isArray(g.body) ? g.body[0] : null;++ if (!hit) throw new UpstreamError('food.place.not_found', `no place called “${String(q).slice(0, 80)}”; try a town and state, or a postcode`, { status: 404 });++ const la = Number(hit.lat); const lo = Number(hit.lon);++ if (!Number.isFinite(la) || !Number.isFinite(lo)) throw new UpstreamError('food.place.upstream', 'the place service gave no coordinates for that place');++ place = { name: hit.display_name || String(q), lat: la, lon: lo, from: 'geocode', geocoded_at: g.fetched_at };++ } else {++ throw new UpstreamError('food.place.invalid', 'q: a place to search for (or lat and lon)', { status: 422 });++ }++++ const maxRadius = (config && config.osm.maxRadiusKm) || 50;++ const rad = clamp(Number(radiusKm) || (config && config.osm.defaultRadiusKm) || 8, 0.5, maxRadius);++ const cap = clamp(Number(limit) || (config && config.osm.maxResults) || 60, 1, (config && config.osm.maxResults) || 60);++ const radiusM = Math.round(rad * 1000);++++ const perKind = {};++ let fetchedAt = null;++ let cached = true;++ for (const k of kinds) {++ const r = await upstream.overpass(queryFor(k, place.lat, place.lon, radiusM));++ perKind[k] = elementsToResults(r.body && r.body.elements, k, place, cap);++ if (!r.cached) cached = false;++ if (!fetchedAt || r.fetched_at > fetchedAt) fetchedAt = r.fetched_at;++ }++++ const results = kinds.flatMap((k) => perKind[k]).sort((a, b) => a.distance_km - b.distance_km || a.kind.localeCompare(b.kind) || (a.name < b.name ? -1 : 1));++ const counts = { total: results.length, foodbank: (perKind.foodbank || []).length, grocery: (perKind.grocery || []).length, budget_grocery: (perKind.grocery || []).filter((r) => r.budget).length };++++ return {++ location: place,++ kind: kind === 'both' ? 'both' : kinds[0],++ radius_km: rad,++ results,++ counts,++ per_kind: perKind,++ fetched_at: fetchedAt,++ cached,++ attribution: ATTRIBUTION,++ source: SOURCE,++ };++}++++module.exports = { searchPlaces, haversineKm, formatAddress, isBudgetStore, queryFor, elementsToResults, ATTRIBUTION, SOURCE, FOOD_BANK_TYPES, KINDS };nnew file mode 100644@@@ -0,0 +1,146 @@++'use strict';++++/**++ * The meal planner: a shopping list and an estimated cost for one person, a couple or a group over N days, built++ * from the food list (server/food/foods.js). Deterministic — the same spec always gives the same plan — so a saved++ * plan and the page that shows it agree, and a test can check the arithmetic.++ *++ * How it plans, plainly:++ * 1. coverage one item from each of the six food groups, cheapest per serving first, enough packs to reach the++ * group's daily minimum (USDA MyPlate, as the food list carries it) for everyone for every day++ * 2. energy the rest of the packs, best calories per dollar first, until the calorie target is met++ * 3. layout the items are spread over breakfast, lunch, dinner and snacks, rotating day by day++ *++ * It is an estimate to shop by: prices are typical, not live, and "serves" is what the pack says.++ */++++const { FOODS, GROUPS, round } = require('./foods');++++const KCAL_PER_PERSON_DAY = 2000;++const LIMITS = { people: [1, 12], days: [1, 14], budget: [1, 5000] };++++class PlanError extends Error {++ constructor(code, detail) { super(detail); this.code = code; }++}++++const whole = (v) => (Number.isFinite(Number(v)) ? Math.trunc(Number(v)) : NaN);++++/** Parse and check a spec; throws PlanError (the API turns it into 422 problem+json, a page into a notice). */++function spec(input = {}) {++ const people = whole(input.people == null || input.people === '' ? 1 : input.people);++ const days = whole(input.days == null || input.days === '' ? 3 : input.days);++ if (!(people >= LIMITS.people[0] && people <= LIMITS.people[1])) throw new PlanError('food.plan.invalid', `people: a whole number from ${LIMITS.people[0]} to ${LIMITS.people[1]}`);++ if (!(days >= LIMITS.days[0] && days <= LIMITS.days[1])) throw new PlanError('food.plan.invalid', `days: a whole number from ${LIMITS.days[0]} to ${LIMITS.days[1]}`);++ let budget = null;++ if (input.budget != null && input.budget !== '') {++ budget = Number(input.budget);++ if (!(budget >= LIMITS.budget[0] && budget <= LIMITS.budget[1])) throw new PlanError('food.plan.invalid', `budget: a number from ${LIMITS.budget[0]} to ${LIMITS.budget[1]}, or leave it out`);++ budget = round(budget, 2);++ }++ return { people, days, budget };++}++++// Cheapest way to put a gram of the group on the table (the group minimum is in grams), then most energy a dollar.++const byCost = (a, b) => ((a.cost_per_gram == null ? a.cost_per_serving : a.cost_per_gram) - (b.cost_per_gram == null ? b.cost_per_serving : b.cost_per_gram)) || (b.kcal_per_dollar - a.kcal_per_dollar) || (a.id < b.id ? -1 : 1);++const byEnergy = (a, b) => (b.kcal_per_dollar - a.kcal_per_dollar) || (a.price - b.price) || (a.id < b.id ? -1 : 1);++++function planMeals(input = {}) {++ const s = spec(input);++ const targetKcal = s.people * s.days * KCAL_PER_PERSON_DAY;++ const picks = new Map(); // id → { food, packs }++ const add = (food, n) => { const cur = picks.get(food.id); picks.set(food.id, { food, packs: (cur ? cur.packs : 0) + n }); };++ const costOf = () => round([...picks.values()].reduce((n, p) => n + p.food.price * p.packs, 0), 2);++ const kcalOf = () => [...picks.values()].reduce((n, p) => n + p.food.package_kcal * p.packs, 0);++++ // 1. Coverage. Prefer items whose pack states a weight, so the daily minimum can be met by arithmetic.++ const coverage = [];++ for (const [group, def] of Object.entries(GROUPS)) {++ const inGroup = FOODS.filter((f) => f.group === group && f.price != null);++ const withGrams = inGroup.filter((f) => f.serving_grams);++ const pick = (withGrams.length ? withGrams : inGroup).sort(byCost)[0];++ if (!pick) continue;++ const servingsNeeded = pick.serving_grams ? Math.ceil(s.people * s.days * def.dailyMin / pick.serving_grams) : s.people * s.days;++ coverage.push({ food: pick, packs: Math.max(1, Math.ceil(servingsNeeded / pick.servings)) });++ }++ for (const { food, packs } of coverage.sort((a, b) => a.food.price - b.food.price || (a.food.id < b.food.id ? -1 : 1))) {++ if (s.budget != null && round(costOf() + food.price * packs, 2) > s.budget) continue;++ add(food, packs);++ }++++ // 2. Energy. One pack at a time, best calories per dollar first; a bound so an impossible target stops.++ const energyOrder = FOODS.filter((f) => f.price != null).sort(byEnergy);++ for (let guard = 0; guard < 80 && kcalOf() < targetKcal; guard++) {++ const food = energyOrder[guard % energyOrder.length];++ if (s.budget != null && round(costOf() + food.price, 2) > s.budget) break;++ add(food, 1);++ }++++ // 3. The list, the shopping order (by cheapest store, then name) and the per-group coverage.++ const items = [...picks.values()].map(({ food, packs }) => ({++ slug: food.slug, name: food.name, group: food.group, group_name: food.group_name,++ packs, unit_cost: food.price, cost: round(food.price * packs, 2),++ kcal: food.package_kcal * packs, protein_g: round(food.package_protein_g * packs),++ store: food.cheapest_store, store_name: food.cheapest_store_name,++ meals: food.meals,++ })).sort((a, b) => (a.store < b.store ? -1 : a.store > b.store ? 1 : 0) || (a.name < b.name ? -1 : 1));++++ const totalCost = round(items.reduce((n, i) => n + i.cost, 0), 2);++ const totalKcal = items.reduce((n, i) => n + i.kcal, 0);++ const totalProtein = items.reduce((n, i) => n + i.protein_g, 0);++ const personDays = s.people * s.days;++++ const groupCoverage = Object.entries(GROUPS).map(([group, def]) => {++ const mine = items.filter((i) => i.group === group);++ return { group, name: def.name, daily_min_g: def.dailyMin, covered: mine.length > 0, items: mine.length, packs: mine.reduce((n, i) => n + i.packs, 0), cost: round(mine.reduce((n, i) => n + i.cost, 0), 2) };++ });++++ // One menu a day, rotating each item through the meals it suits, so the days are not all identical.++ const menuItems = items.slice().sort((a, b) => (a.group < b.group ? -1 : a.group > b.group ? 1 : (a.name < b.name ? -1 : 1)));++ const days = [];++ for (let d = 0; d < s.days; d++) {++ const day = { day: d + 1, breakfast: [], lunch: [], dinner: [], snack: [] };++ for (const item of menuItems) {++ const slot = item.meals[(d % item.meals.length + item.meals.length) % item.meals.length] || 'dinner';++ day[slot].push(item.name);++ }++ days.push(day);++ }++++ const byStore = [...new Set(items.map((i) => i.store))].filter(Boolean).map((store) => ({++ store, store_name: items.find((i) => i.store === store).store_name,++ items: items.filter((i) => i.store === store).length,++ cost: round(items.filter((i) => i.store === store).reduce((n, i) => n + i.cost, 0), 2),++ })).sort((a, b) => a.store < b.store ? -1 : 1);++++ const coveredGroups = groupCoverage.filter((g) => g.covered).length;++ return {++ spec: { people: s.people, days: s.days, budget: s.budget },++ items, shopping_list: items, by_store: byStore, days: s.days, menu: days,++ group_coverage: groupCoverage,++ totals: {++ cost: totalCost,++ cost_per_person_day: round(totalCost / personDays, 2),++ kcal: totalKcal,++ kcal_per_person_day: Math.round(totalKcal / personDays),++ protein_g: Math.round(totalProtein),++ protein_g_per_person_day: Math.round(totalProtein / personDays),++ target_kcal_per_person_day: KCAL_PER_PERSON_DAY,++ items: items.length,++ packs: items.reduce((n, i) => n + i.packs, 0),++ },++ covers_all_groups: coveredGroups === groupCoverage.length,++ groups_covered: coveredGroups,++ groups_total: groupCoverage.length,++ remaining_budget: s.budget == null ? null : round(s.budget - totalCost, 2),++ notes: [++ 'Cost is an estimate from typical 2025 US (Washington) prices carried over from OpenVibe.Tools, not a live price.',++ ...(s.budget != null && coveredGroups < groupCoverage.length ? ['The budget did not stretch to every food group; the plan buys the cheapest items first.'] : []),++ ...(kcalOf() < targetKcal ? [`The plan is under the ${KCAL_PER_PERSON_DAY} kcal a person a day target (it stays inside the budget).`] : []),++ // Shops are whole packs, so a short plan supplies more than its own days; saying so is clearer than a++ // calories-a-day figure that looks absurd next to the target.++ ...(kcalOf() > targetKcal * 1.15 ? [`The shops are whole packs: this basket supplies about ${Math.round(kcalOf() / (s.people * KCAL_PER_PERSON_DAY))} days of energy at ${KCAL_PER_PERSON_DAY} kcal a person, whatever the plan length.`] : []),++ ],++ };++}++++module.exports = { planMeals, spec, PlanError, KCAL_PER_PERSON_DAY, LIMITS };nnew file mode 100644@@@ -0,0 +1,76 @@++'use strict';++++/**++ * A small set of basic recipes, written for this service in plain words (no copied recipe text, nothing++ * copyrighted), each naming only items from the food list (server/food/foods.js). They exist so the pantry can answer++ * "what can I make?" without an AI call: server/food/pantry-match.js matches a person's cupboard against them.++ *++ * These are deliberately simple combinations and the pantry page labels them as such. They are not dietary advice.++ */++++const RECIPES = [++ {++ slug: 'beans-and-rice', name: 'Beans and rice', serves: 2, minutes: 25,++ ingredients: ['white-rice', 'canned-beans', 'onion-3lb'], optional: ['cooking-oil', 'canned-tomatoes', 'cheese-block'],++ steps: [++ 'Cook the rice as the packet says.',++ 'Chop the onion and soften it in a little oil in a pan.',++ 'Add the beans (and the tomatoes, if you have them) and heat through.',++ 'Spoon the beans over the rice. Cheese on top if you like.',++ ],++ },++ {++ slug: 'tuna-pasta', name: 'Tuna pasta', serves: 2, minutes: 20,++ ingredients: ['spaghetti', 'canned-tuna', 'canned-tomatoes'], optional: ['cooking-oil', 'onion-3lb'],++ steps: [++ 'Boil the spaghetti until tender, then drain it.',++ 'Warm the tomatoes in the same pan with a little oil and, if you have one, a chopped onion.',++ 'Stir in the drained tuna, then the spaghetti.',++ ],++ },++ {++ slug: 'tuna-sandwich', name: 'Tuna sandwich', serves: 1, minutes: 5,++ ingredients: ['bread-white', 'canned-tuna'], optional: ['cooking-oil', 'onion-3lb', 'avocado'],++ steps: ['Drain the tuna and mash it with a little oil.', 'Spread it between two slices of bread.'],++ },++ {++ slug: 'eggs-on-toast', name: 'Eggs on toast', serves: 1, minutes: 10,++ ingredients: ['eggs-dozen', 'bread-white'], optional: ['butter', 'cheese-block'],++ steps: ['Toast two slices of bread.', 'Scramble or fry two eggs.', 'Put the eggs on the toast.'],++ },++ {++ slug: 'oatmeal-with-fruit', name: 'Oatmeal with fruit', serves: 1, minutes: 8,++ ingredients: ['oatmeal', 'bananas'], optional: ['whole-milk', 'raisins', 'canned-fruit', 'peanut-butter'],++ steps: ['Simmer the oats in water or milk for about five minutes.', 'Slice the fruit over the top.'],++ },++ {++ slug: 'quesadilla', name: 'Cheese quesadilla', serves: 1, minutes: 10,++ ingredients: ['tortillas', 'cheese-block'], optional: ['canned-beans', 'avocado', 'canned-corn'],++ steps: ['Put grated cheese on half a tortilla and fold it over.', 'Cook in a dry pan until the cheese melts, turning once.'],++ },++ {++ slug: 'vegetable-rice-bowl', name: 'Vegetable rice bowl', serves: 2, minutes: 25,++ ingredients: ['white-rice', 'frozen-mixed-veg', 'onion-3lb'], optional: ['cooking-oil', 'canned-corn', 'canned-green-beans', 'canned-beans'],++ steps: ['Cook the rice.', 'Fry the chopped onion in oil, add the vegetables and cook until hot through.', 'Serve the vegetables over the rice.'],++ },++ {++ slug: 'chili-rice-bowl', name: 'Chili and rice bowl', serves: 1, minutes: 15,++ ingredients: ['canned-chili', 'white-rice'], optional: ['cheese-block', 'canned-corn', 'yogurt'],++ steps: ['Cook the rice.', 'Warm the chili in a pan.', 'Spoon the chili over the rice.'],++ },++ {++ slug: 'peanut-butter-banana-sandwich', name: 'Peanut butter and banana sandwich', serves: 1, minutes: 5,++ ingredients: ['bread-white', 'peanut-butter', 'bananas'],++ optional: [],++ steps: ['Spread peanut butter on a slice of bread.', 'Slice the banana over it and close the sandwich.'],++ },++ {++ slug: 'potato-egg-hash', name: 'Potato and egg hash', serves: 2, minutes: 30,++ ingredients: ['potatoes-5lb', 'eggs-dozen', 'onion-3lb'], optional: ['cooking-oil', 'cheese-block', 'canned-green-beans'],++ steps: ['Dice the potatoes and onion and fry them in oil until soft and browned, about twenty minutes.', 'Make gaps in the pan, break in the eggs and cook until set.', 'Season and serve.'],++ },++];++++const bySlug = new Map(RECIPES.map((r) => [r.slug, r]));++++module.exports = { RECIPES, RECIPE_BY_SLUG: bySlug };nnew file mode 100644@@@ -0,0 +1,67 @@++'use strict';++++/**++ * What OpenVibe.Food keeps in its own database (migrations/0002_food.sql): the cache in front of the two OpenStreetMap++ * services, saved meal plans and a person's pantry list. Every function takes the store (server/db.js createStore)++ * first; nothing here is a secret, and the cache body is only ever an upstream answer, never a person's data.++ */++++const PLAN_LIST_LIMIT = 50;++++const parse = (v) => (v == null ? null : typeof v === 'string' ? JSON.parse(v) : v);++++// ── food_geo_cache ───────────────────────────────────────────++/** A cached upstream answer that has not expired, or null. */++async function cacheGet(s, key) {++ const row = await s.db.maybe('SELECT body, fetched_at, expires_at FROM food_geo_cache WHERE key = $1', [key]);++ if (!row || row.expires_at <= s.iso()) return null;++ return { body: parse(row.body), fetched_at: row.fetched_at, expires_at: row.expires_at };++}++async function cachePut(s, key, body, ttlMs) {++ const fetchedAt = s.iso();++ const expiresAt = new Date(s.now() + ttlMs).toISOString();++ await s.db.query(++ `INSERT INTO food_geo_cache (key, body, fetched_at, expires_at) VALUES ($1, $2::jsonb, $3, $4)++ ON CONFLICT (key) DO UPDATE SET body = EXCLUDED.body, fetched_at = EXCLUDED.fetched_at, expires_at = EXCLUDED.expires_at`,++ [key, JSON.stringify(body), fetchedAt, expiresAt]);++ return { fetched_at: fetchedAt, expires_at: expiresAt };++}++/** Drop expired rows (called at boot; the table stays small because every answer is bounded). */++const cachePrune = (s) => s.db.exec('DELETE FROM food_geo_cache WHERE expires_at <= $1', [s.iso()]);++++// ── food_plans ───────────────────────────────────────────────++async function insertPlan(s, p) {++ await s.db.query(++ 'INSERT INTO food_plans (id, owner, title, people, days, budget, plan, created_at) VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8)',++ [p.id, p.owner, p.title || null, p.people, p.days, p.budget, JSON.stringify(p.plan), p.created_at]);++ return planRow(s, p.owner, p.id);++}++const planRow = (s, owner, id) => s.db.maybe('SELECT * FROM food_plans WHERE owner = $1 AND id = $2', [owner, id]);++async function listPlans(s, owner, { limit = 20 } = {}) {++ return s.db.many('SELECT * FROM food_plans WHERE owner = $1 ORDER BY id DESC LIMIT $2', [owner, Math.min(limit, PLAN_LIST_LIMIT)]);++}++const deletePlan = (s, owner, id) => s.db.exec('DELETE FROM food_plans WHERE owner = $1 AND id = $2', [owner, id]);++++const planToWire = (row) => ({++ id: row.id, title: row.title || null, people: Number(row.people), days: Number(row.days),++ budget: row.budget == null ? null : Number(row.budget), created_at: row.created_at, plan: parse(row.plan),++});++++// ── food_pantry ──────────────────────────────────────────────++const getPantry = async (s, owner) => (await s.db.many('SELECT item, added_at FROM food_pantry WHERE owner = $1 ORDER BY item', [owner])).map((r) => r.item);++const pantryRows = (s, owner) => s.db.many('SELECT item, added_at FROM food_pantry WHERE owner = $1 ORDER BY item', [owner]);++/** Replace a person's pantry with exactly this list, in one transaction (what PUT means). */++async function setPantry(s, owner, items) {++ const addedAt = s.iso();++ await s.tx(async () => {++ await s.db.query('DELETE FROM food_pantry WHERE owner = $1', [owner]);++ for (const item of items) await s.db.query('INSERT INTO food_pantry (owner, item, added_at) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING', [owner, item, addedAt]);++ });++ return items.slice().sort();++}++++module.exports = {++ cacheGet, cachePut, cachePrune,++ insertPlan, planRow, listPlans, deletePlan, planToWire,++ getPantry, pantryRows, setPantry,++};nnew file mode 100644@@@ -0,0 +1,102 @@++'use strict';++++/**++ * The only two hosts OpenVibe.Food fetches from: Nominatim (a place name → coordinates) and Overpass (the++ * OpenStreetMap database, for food banks and grocery stores). Both are community services with published usage++ * policies, and this module is what keeps us inside them:++ *++ * - identify every request carries FOOD_OSM_USER_AGENT (an OpenVibe.Food contact URL), never a browser's++ * - pace one request a second to a host, at most: calls to the same host queue behind each other, so the++ * service as a whole cannot burst at Nominatim however many visitors arrive at once++ * - cache every answer is kept in food_geo_cache for FOOD_GEO_CACHE_TTL_MS (7 days): a place is geocoded once,++ * an area is queried once, not once per visitor++ * - bound area queries are a small `around:` radius and a single kind of tag, never a bulk download++ *++ * Only a URL built from the configured base is ever fetched; nothing a caller sends becomes a URL. There are no++ * other outbound calls in this service.++ */++++const crypto = require('crypto');++const geo = require('./store');++++class UpstreamError extends Error {++ constructor(code, detail, { status = 502 } = {}) { super(detail); this.code = code; this.status = status; }++}++++/** Serialises calls to one host and keeps at least `minIntervalMs` between the moments they start. */++function createPacer({ minIntervalMs, now = () => Date.now() }) {++ let chain = Promise.resolve();++ let last = -Infinity;++ return {++ run(fn) {++ const p = chain.then(async () => {++ const wait = last + minIntervalMs - now();++ if (wait > 0) await new Promise((r) => setTimeout(r, wait));++ last = now();++ return fn();++ });++ chain = p.then(() => undefined, () => undefined);++ return p;++ },++ };++}++++const keyOf = (q) => String(q).trim().toLowerCase().replace(/\s+/g, ' ');++++function createUpstream({ config, s, fetchImpl = globalThis.fetch, now = () => Date.now(), log = console } = {}) {++ const osm = config.osm;++ const pacers = new Map();++ const pacerFor = (rawUrl) => {++ const host = new URL(rawUrl).host;++ if (!pacers.has(host)) pacers.set(host, createPacer({ minIntervalMs: osm.minIntervalMs, now }));++ return pacers.get(host);++ };++++ /** Fetch a URL built from `base` (never from caller input), with the OSM User-Agent and a hard timeout. */++ async function fetchJson(url, init = {}) {++ let res;++ try {++ res = await fetchImpl(url.toString(), {++ ...init,++ headers: { 'User-Agent': osm.userAgent, Accept: 'application/json', ...(init.headers || {}) },++ signal: AbortSignal.timeout(osm.timeoutMs),++ });++ } catch (err) {++ throw new UpstreamError('food.place.upstream', `the place service could not be reached (${err && err.name === 'TimeoutError' ? 'timed out' : 'network error'})`);++ }++ if (!res.ok) throw new UpstreamError('food.place.upstream', `the place service answered ${res.status}`);++ try { return await res.json(); } catch { throw new UpstreamError('food.place.upstream', 'the place service answered something that is not JSON'); }++ }++++ async function cached(key, fn) {++ const hit = await geo.cacheGet(s, key);++ if (hit) return { body: hit.body, cached: true, fetched_at: hit.fetched_at };++ const body = await fn();++ const written = await geo.cachePut(s, key, body, osm.cacheTtlMs);++ return { body, cached: false, fetched_at: written.fetched_at };++ }++++ /** A place name → up to `limit` matches (Nominatim search), cached for the TTL. */++ function geocode(q, { limit = 1 } = {}) {++ const query = String(q || '').trim().slice(0, 200);++ if (!query) return Promise.reject(new UpstreamError('food.place.invalid', 'q: a place to search for', { status: 422 }));++ const url = new URL(osm.nominatimUrl);++ url.pathname = `${url.pathname.replace(/\/+$/, '')}/search`;++ url.search = new URLSearchParams({ q: query, format: 'jsonv2', limit: String(Math.min(Math.max(limit, 1), 5)), addressdetails: '1' }).toString();++ return cached(`nominatim:${keyOf(query)}:${limit}`, () => pacerFor(osm.nominatimUrl).run(() => fetchJson(url)));++ }++++ /** One bounded Overpass query → its elements. Cached by the query text, so the same area is asked once. */++ function overpass(query) {++ const body = `data=${encodeURIComponent(query)}`;++ return cached(`overpass:${crypto.createHash('sha256').update(query).digest('hex')}`, () => pacerFor(osm.overpassUrl).run(() => fetchJson(new URL(osm.overpassUrl), {++ method: 'POST',++ headers: { 'Content-Type': 'application/x-www-form-urlencoded' },++ body,++ })));++ }++++ return { geocode, overpass, fetchJson, UpstreamError };++}++++module.exports = { createUpstream, createPacer, UpstreamError };@@@ -3,28 +3,151 @@/*** /api/v1 — OpenVibe.Food's API.*-- * GET /ping public liveness: { ok: true, service }++ * GET /places?q=&kind=foodbank|grocery|both[&lat=&lon=&radius=&limit=] public food near a place (OpenStreetMap)++ * GET /foods[?group=&q=] public the food list++ * GET /foods/:slug public one food++ * POST /plans signed in plan a shop and save it++ * GET /plans signed in the plans you saved++ * GET /plans/:id signed in one of yours++ * GET /pantry signed in what you say is in your cupboard++ * PUT /pantry signed in replace it*-- * The product adds its own routes here. Every route that reads or changes a person's data names the capability it-- * needs (`principal.requireCapability('<food>.thing.read')`, listed in CAPABILITIES in ./principal.js) and takes-- * its per-caller numbers (`limits.reads('<food>.thing.read')` or `limits.budget('<name>')`, ./caller-limits.js).-- * A refusal is an RFC 9457 problem+json with a stable code.++ * Public reads need no token: the food list and the place search are the same for everyone. Anything a person owns++ * (a plan, a pantry) needs a signed-in caller, named with its capability in ./principal.js. The place search is the++ * expensive route (it spends OpenStreetMap's shared one-request-a-second budget) and takes its own numbers from++ * ./caller-limits.js. Errors are RFC 9457 problem+json with a stable code.*/const express = require('express');++const contracts = require('openvibe-contracts');const { asyncRouter } = require('./router');++const foods = require('../food/foods');++const { planMeals } = require('../food/planner');++const { searchPlaces } = require('../food/places');++const { matchPantry } = require('../food/pantry-match');++const store = require('../food/store');++++const PLAN_ID = /^pln_[0-9A-HJKMNP-TV-Z]{26}$/;++// The food list is not fetched from anywhere: it is carried over from OpenVibe.Tools' grocery source, and says so.++const FOOD_SOURCE = {++ name: 'OpenVibe.Tools grocery dataset',++ carried_from: 'OpenVibe.Tools/apps/maps/server/sources/grocery.js',++ note: 'Typical 2025 US (Washington) prices, carried over unchanged. Not a live price.',++};function createApi(ctx) {-- const { config, principal, limits } = ctx;++ const { config, s, principal, limits } = ctx;const r = asyncRouter();++ const fail = (req, res, status, code, detail) => contracts.http.sendProblem(res, status, code, { detail, ctx: req.ov });r.use(express.json({ limit: '64kb' }));r.use((req, res, next) => { res.set('Cache-Control', 'no-store'); next(); });r.use(principal.middleware);-- // The one route the skeleton ships. It is public and counted per caller with the default read numbers.++ // ── Liveness ─────────────────────────────────────────────r.get('/ping', limits.reads('food.api.read'), (_req, res) => res.json({ ok: true, service: config.service }));++ // ── Food near you (public) ───────────────────────────────++ r.get('/places', limits.budget('food.place.search'), async (req, res) => {++ const one = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);++ const num = (v) => (v != null && v !== '' && Number.isFinite(Number(v)) ? Number(v) : null);++ const out = await searchPlaces(ctx.upstream, {++ kind: one(req.query.kind) || 'foodbank',++ q: one(req.query.q),++ lat: num(req.query.lat),++ lon: num(req.query.lon),++ radiusKm: num(req.query.radius),++ limit: num(req.query.limit),++ }, config).catch((err) => {++ if (err && err.code) { fail(req, res, err.status || 502, err.code, err.message); return null; }++ throw err;++ });++ if (!out) return;++ // OpenStreetMap answers are public and change slowly; a short shared cache keeps repeat searches off OSM.++ res.set('Cache-Control', 'public, max-age=300');++ res.json(out);++ });++++ // ── The food list (public) ───────────────────────────────++ r.get('/foods', limits.reads('food.food.read'), (req, res) => {++ const group = typeof req.query.group === 'string' && req.query.group ? req.query.group : null;++ if (group && !foods.GROUPS[group]) return fail(req, res, 422, 'food.food.invalid', `group: one of ${Object.keys(foods.GROUPS).join(', ')}`);++ const q = typeof req.query.q === 'string' && req.query.q ? req.query.q.slice(0, 80) : null;++ const list = foods.listFoods({ group, q });++ res.set('Cache-Control', 'public, max-age=3600');++ res.json({++ foods: list.map(foods.toWire),++ count: list.length,++ groups: Object.entries(foods.GROUPS).map(([id, g]) => ({ group: id, name: g.name, daily_min_g: g.dailyMin })),++ source: FOOD_SOURCE,++ });++ });++++ r.get('/foods/:slug', limits.reads('food.food.read'), (req, res) => {++ const food = foods.getFood(req.params.slug);++ if (!food) return fail(req, res, 404, 'food.food.not_found', `no food "${String(req.params.slug).slice(0, 64)}" in the list; GET /api/v1/foods lists them`);++ res.set('Cache-Control', 'public, max-age=3600');++ res.json({ food: { ...foods.toWire(food), prices: food.prices, per_100g_note: food.per_100g ? 'Derived from the pack size in the item\'s name and the typical values per serving; approximate.' : 'The pack size in this item\'s name is not a weight, so no per-100 g figure is given.' }, source: FOOD_SOURCE });++ });++++ // ── Plans (a person's own) ───────────────────────────────++ r.post('/plans', principal.requireCapability('food.plan.write'), limits.budget('food.plan.create'), async (req, res) => {++ const b = req.body || {};++ let plan;++ try { plan = planMeals({ people: b.people, days: b.days, budget: b.budget }); } catch (err) {++ if (err && err.code === 'food.plan.invalid') return fail(req, res, 422, err.code, err.message);++ throw err;++ }++ const title = typeof b.title === 'string' && b.title.trim() ? b.title.trim().slice(0, 120) : null;++ const row = await store.insertPlan(s, {++ id: s.newId('pln'), owner: req.principal.requester, title,++ people: plan.spec.people, days: plan.spec.days, budget: plan.spec.budget, plan, created_at: s.iso(),++ });++ res.set('Location', `/api/v1/plans/${row.id}`);++ return res.status(201).json(store.planToWire(row));++ });++++ r.get('/plans', principal.requireCapability('food.plan.read'), limits.reads('food.plan.read'), async (req, res) => {++ const limit = Math.min(50, Math.max(1, parseInt(req.query.limit, 10) || 20));++ const rows = await store.listPlans(s, req.principal.requester, { limit });++ res.json({ plans: rows.map(store.planToWire) });++ });++++ r.get('/plans/:id', principal.requireCapability('food.plan.read'), limits.reads('food.plan.read'), async (req, res) => {++ const row = PLAN_ID.test(req.params.id) ? await store.planRow(s, req.principal.requester, req.params.id) : null;++ if (!row) return fail(req, res, 404, 'food.plan.not_found', 'No such plan.');++ res.json(store.planToWire(row));++ });++++ // ── Pantry (a person's own) ──────────────────────────────++ const pantryWire = (items) => {++ const match = matchPantry(items);++ return {++ items,++ foods: items.map((slug) => foods.toWire(foods.getFood(slug))),++ // "What can I make" is deterministic matching against the basic recipes; the page says plainly what it is.++ suggestions: {++ can_make: match.can_make.map((x) => ({ slug: x.slug, name: x.name, serves: x.serves, minutes: x.minutes })),++ almost: match.almost.map((x) => ({ slug: x.slug, name: x.name, serves: x.serves, minutes: x.minutes, missing: x.missing.map((m) => m.name) })),++ },++ note: 'Basic suggestions: simple combinations written by OpenVibe, matched against your list. Not dietary advice.',++ };++ };++++ r.get('/pantry', principal.requireCapability('food.pantry.read'), limits.reads('food.pantry.read'), async (req, res) => {++ res.json(pantryWire(await store.getPantry(s, req.principal.requester)));++ });++++ r.put('/pantry', principal.requireCapability('food.pantry.write'), limits.budget('food.pantry.write'), async (req, res) => {++ const b = req.body || {};++ if (!Array.isArray(b.items)) return fail(req, res, 422, 'food.pantry.invalid', 'items: an array of food slugs (GET /api/v1/foods lists them)');++ if (b.items.length > 200) return fail(req, res, 422, 'food.pantry.invalid', 'items: at most 200');++ const items = [...new Set(b.items.map((x) => String(x)))];++ const unknown = items.filter((slug) => !foods.getFood(slug));++ if (unknown.length) return fail(req, res, 422, 'food.pantry.unknown_item', `not in the food list: ${unknown.slice(0, 5).join(', ')}`);++ res.json(pantryWire(await store.setPantry(s, req.principal.requester, items)));++ });++return r;}--module.exports = { createApi };++module.exports = { createApi, FOOD_SOURCE };@@@ -32,7 +32,15 @@ function caller(req) {** 'food.thing.create': { minute: 6, hour: 60 },*/--const BUDGETS = {};++const BUDGETS = {++ // The place search is the expensive route: every miss is a Nominatim geocode and an Overpass area query, both++ // community services with a shared one-request-a-second budget (server/food/upstream.js). Answers are cached for++ // a week, so these numbers are for the callers who keep asking for new places.++ 'food.place.search': { minute: 10, hour: 120 },++ // Saving a plan and replacing a pantry are cheap writes but they are writes.++ 'food.plan.create': { minute: 20, hour: 300 },++ 'food.pantry.write': { minute: 30, hour: 600 },++};function createCallerLimits({ config, now = () => Date.now(), registry = null, log = console, enabled = true, valkey = null }) {const refused = registry@@@ -2,25 +2,37 @@/*** Crawl artifacts for openvibe.food, built with openvibe-shared/seo: robots.txt, sitemap.xml, llms.txt and-- * llms-full.txt, and the home page's JSON-LD. The public pages are for search engines and AI crawlers; sign-in and-- * the API are not.++ * llms-full.txt, and the home page's JSON-LD. The public pages are for search engines and AI crawlers; sign-in, the++ * API and anything personal (a pantry, a saved plan) are not.*-- * The product extends PAGE_TEXT and publicPages() with its own pages; the routes and headers here stay.++ * The sitemap carries every food page (server/food/foods.js) as well as the site's own pages, and llms-full.txt lists++ * the same set — the two must stay the same list.*/const fs = require('fs');const path = require('path');const seo = require('openvibe-shared/seo');const cache = require('openvibe-shared/cache-policy');const { asyncRouter } = require('./router');++const foods = require('../food/foods');const SITE_NAME = 'OpenVibe.Food';--const DESCRIPTION = 'OpenVibe.Food — What should we eat?';--const DISALLOW = ['/auth/', '/api/'];++const DESCRIPTION = 'OpenVibe.Food — What should we eat? Find food banks and budget grocery stores near you, plan meals, and cook from what is in your cupboard.';++const DISALLOW = ['/auth/', '/api/', '/pantry', '/plan/saved'];const PAGE_TEXT = {-- '/': ['OpenVibe.Food home', 'OpenVibe.Food: What should we eat?'],++ '/': ['OpenVibe.Food home', 'OpenVibe.Food: What should we eat? Find food near you, plan budget meals and cook from your cupboard.'],++ '/near': ['Food near you', 'Food banks, soup kitchens, community fridges and budget grocery stores near a place, from OpenStreetMap.'],++ '/plan': ['Meal plan', 'Plan meals for one person, a couple or a group for up to fourteen days, with a shopping list and an estimated cost.'],++ '/foods': ['The food list', 'Every food OpenVibe.Food plans with: nutrition per serving and per 100 g, and a typical price band.'],'/updates': ['What shipped on OpenVibe.Food', 'This site\'s update log, from the network changelog feed.'],};++const SUMMARIES = {++ '/': 'Find food near you, plan budget meals and cook from what you have.',++ '/near': 'Food banks and budget grocery stores near a place, from OpenStreetMap.',++ '/plan': 'A meal plan with a shopping list and an estimated cost.',++ '/foods': 'Nutrition per serving and per 100 g, and a typical price band, for every food.',++ '/updates': 'What shipped on the site.',++};function dayOf(ts) {const m = String(ts == null ? '' : ts).match(/^(\d{4}-\d{2}-\d{2})/);@@@ -34,14 +46,22 @@ function homeJsonLd(config) {const site = String(config.baseUrl).replace(/\/+$/, '');return [seo.jsonLd.website({ name: SITE_NAME, url: site, description: DESCRIPTION }),-- seo.jsonLd.softwareApp({ name: SITE_NAME, url: site, description: DESCRIPTION, category: 'BusinessApplication', keywords: 'openvibe' }),++ seo.jsonLd.softwareApp({ name: SITE_NAME, url: site, description: DESCRIPTION, category: 'BusinessApplication', keywords: 'food, meal planning, food banks, OpenStreetMap' }),seo.jsonLd.webPage({ name: SITE_NAME, url: `${site}/`, description: DESCRIPTION, siteUrl: site }),];}++/** Every public page, the food pages included (the sitemap and llms-full.txt both read this). */const publicPages = () => [{ path: '/', changefreq: 'weekly', priority: 1.0 },++ { path: '/near', changefreq: 'weekly', priority: 0.9 },++ { path: '/plan', changefreq: 'weekly', priority: 0.9 },++ { path: '/foods', changefreq: 'weekly', priority: 0.8 },{ path: '/updates', changefreq: 'daily', priority: 0.5 },++ ...foods.FOODS.map((f) => ({++ path: `/foods/${f.slug}`, changefreq: 'monthly', priority: 0.5,++ title: f.name, text: `${f.name} (${f.group_name})${f.price != null ? `, typically ${f.price} to ${f.price_max} a pack` : ''}. ${SUMMARIES['/foods']}`,++ })),];function createDiscoveryRoutes(ctx) {@@@ -53,38 +73,47 @@ function createDiscoveryRoutes(ctx) {r.get('/robots.txt', (_req, res) => {res.type('text/plain').set('Cache-Control', TEXT).send(-- '# openvibe.food: the public pages are for search and AI crawlers; sign-in and the API are not.\n'++ '# openvibe.food: the public pages are for search and AI crawlers; sign-in, the API and anything personal are not.\n'+ seo.robotsTxt({ sitemaps: [abs('/sitemap.xml')], disallow: DISALLOW }));});r.get('/llms.txt', (_req, res) => {res.type('text/plain').set('Cache-Control', TEXT).send(seo.llmsTxt({name: SITE_NAME,-- summary: 'OpenVibe.Food: What should we eat?',-- details: 'Every page is server-rendered and readable without JavaScript.',++ summary: 'OpenVibe.Food: What should we eat? Find food banks and budget grocery stores near you, plan budget meals, and cook from what is in your cupboard.',++ details: 'Every page is server-rendered and readable without JavaScript. Places come from OpenStreetMap © contributors (ODbL).',sections: [{ title: 'Start here', links: [{ title: 'OpenVibe.Food', url: abs('/'), note: 'What should we eat?' },++ { title: 'Food near you', url: abs('/near'), note: 'food banks and budget grocery stores, from OpenStreetMap' },++ { title: 'Meal plan', url: abs('/plan'), note: 'a shopping list and an estimated cost' },++ { title: 'The food list', url: abs('/foods'), note: 'nutrition and typical prices' },{ title: 'What shipped on OpenVibe.Food', url: abs('/updates') },] },{ title: 'Machine-readable', links: [{ title: 'Sitemap', url: abs('/sitemap.xml') },{ title: 'Full text for language models', url: abs('/llms-full.txt') },{ title: 'Release metadata (JSON)', url: abs('/release.json') },++ { title: 'The API', url: abs('/api/v1/foods'), note: 'JSON: places, foods, plans, pantry' },] },{ title: 'Elsewhere', links: [{ title: 'OpenVibe.Network', url: 'https://openvibe.network', note: 'accounts, apps and grants' },{ title: 'OpenVibe.Services', url: 'https://openvibe.services', note: 'apps, keys and capability grants' },++ { title: 'OpenStreetMap', url: 'https://www.openstreetmap.org/copyright', note: 'the place data, © contributors, ODbL' },] },],}));});r.get('/llms-full.txt', (_req, res) => {-- const pages = publicPages().map((p) => ({ url: p.path, title: PAGE_TEXT[p.path][0], text: PAGE_TEXT[p.path][1] }));++ const pages = publicPages().map((p) => ({++ url: p.path,++ title: p.title || PAGE_TEXT[p.path][0],++ text: p.text || PAGE_TEXT[p.path][1],++ }));res.type('text/plain').set('Cache-Control', TEXT).send(seo.llmsFull({site: SITE_NAME,-- summary: 'Every public page of OpenVibe.Food, one line each.',++ summary: 'Every public page of OpenVibe.Food, one entry each.',base: site,maxBytes: 64 * 1024,sections: [{ title: 'Pages', pages }],@@@ -1,42 +1,96 @@'use strict';/**-- * Public pages: the home page and the update log. Crawl artifacts (robots.txt, sitemap.xml, llms.txt,-- * llms-full.txt, JSON-LD) are http/discovery.js.++ * Public pages, every one server-rendered and complete without JavaScript:*-- * Every page works without JavaScript and is server-rendered through openvibe-shared/shell (render/layout.js).-- * The product replaces the home page's sections and adds its own routes here.++ * / home: find food near you, plan a week, what is in your cupboard++ * /near food banks, pantries and budget grocery stores near a place (OpenStreetMap)++ * /plan a meal plan, a shopping list and what it costs; signed-in people can save it++ * /foods the food list, grouped++ * /foods/:slug one food: nutrition per serving and per 100 g, typical prices++ * /pantry what is in your cupboard, and what you can make from it (signed in)++ * /updates the update log++ *++ * Crawl artifacts (robots.txt, sitemap.xml, llms.txt, llms-full.txt, JSON-LD) are http/discovery.js.++ * Every page that shows OpenStreetMap data carries the attribution ODbL requires, linked back.*/++const express = require('express');const ovServe = require('openvibe-shared/serve');const frame = require('openvibe-shared/frame');const showcase = require('openvibe-shared/showcase');const cache = require('openvibe-shared/cache-policy');const { asyncRouter } = require('./router');const { createDiscoveryRoutes, homeJsonLd } = require('./discovery');--const { html, raw } = require('../render/html');++const { sameOrigin } = require('./principal');++const { html, raw, table, notice, time, badge } = require('../render/html');const { send } = require('../render/layout');++const foods = require('../food/foods');++const { planMeals } = require('../food/planner');++const { searchPlaces, ATTRIBUTION } = require('../food/places');++const { matchPantry } = require('../food/pantry-match');++const store = require('../food/store');const SITE_NAME = 'OpenVibe.Food';const TAGLINE = 'What should we eat?';++const KINDS = { foodbank: 'Food banks and pantries', grocery: 'Budget grocery stores', both: 'Both' };++++const money = (n) => (n == null ? '—' : `$${Number(n).toFixed(2)}`);++const km = (n) => `${Number(n).toFixed(1)} km`;++const str = (v, max = 120) => (typeof v === 'string' && v.trim() ? v.trim().slice(0, max) : null);function createPageRoutes(ctx) {-- const { config } = ctx;++ const { config, s } = ctx;const r = asyncRouter();const PUBLIC_CACHE = cache.htmlHeaders({ maxAge: 300 });const page = (req, res, o, status = 200) => send(res, status, { viewer: req.viewer, config, path: req.originalUrl, ...o });const signedIn = (req) => req.viewer && req.viewer.kind === 'user' && req.viewer.subject;++ const ownerOf = (req) => `user:${req.viewer.subject}`;++++ // ── Small pieces ─────────────────────────────────────────++ // ODbL requires attribution wherever OSM data is shown; every result page carries it, linked back.++ const osmNote = (fetchedAt) => html`<p class="attribution small muted">Food bank and store data © <a href="${ATTRIBUTION.url}" rel="noopener">OpenStreetMap contributors</a>, available under the <a href="${ATTRIBUTION.license_url}" rel="noopener">Open Database License</a>. ${fetchedAt ? html`Fetched ${time(fetchedAt)}.` : ''} OpenVibe.Food asks OSM at most once a second and caches answers for 7 days.</p>`;++++ function searchForm({ q = '', kind = 'foodbank' } = {}) {++ const opt = (value, label) => html`<option value="${value}"${value === kind ? raw(' selected') : ''}>${label}</option>`;++ return html`<form class="ov-form food-search" method="get" action="/near">++<label for="q">Where are you?</label>++<input id="q" name="q" type="search" placeholder="Town, city or postcode" value="${q}" maxlength="120">++<label for="kind">Looking for</label>++<select id="kind" name="kind">${Object.entries(KINDS).map(([v, l]) => opt(v, l))}</select>++<button class="sc-btn sc-primary" type="submit">Find food</button>++</form>`;++ }++++ function placeRow(res_) {++ return html`<li class="place" id="${res_.id}">++<p class="place-name"><b>${res_.name}</b> ${badge(res_.type_label)} ${res_.budget === true ? badge('budget', 'ok') : ''}</p>++<p class="muted small">${km(res_.distance_km)} away${res_.address ? html` · ${res_.address}` : ''}${res_.operator ? html` · run by ${res_.operator}` : ''}</p>++${res_.opening_hours ? html`<p class="small">Opening hours: ${res_.opening_hours}</p>` : ''}++${res_.phone ? html`<p class="small">Phone: <a href="tel:${String(res_.phone).replace(/[^\d+]/g, '')}">${res_.phone}</a></p>` : ''}++<p class="small">${res_.website ? html`<a href="${res_.website}" rel="noopener nofollow">Their website</a> · ` : ''}<a href="${res_.osm_url}" rel="noopener nofollow">View on OpenStreetMap</a>${res_.wheelchair === true ? html` · wheelchair accessible` : ''}</p>++</li>`;++ }++++ function resultsBlock(out) {++ if (!out.results.length) {++ return html`<p class="muted">Nothing was found within ${out.radius_km} km. OpenStreetMap does not know every food bank — try a wider area, or ask your local council.</p>`;++ }++ return html`<ul class="places">${out.results.map(placeRow)}</ul>`;++ }// ── Home ─────────────────────────────────────────────────r.get('/', (req, res) => {const hero = showcase.hero({eyebrow: `${SITE_NAME} · ${TAGLINE}`,-- title: SITE_NAME,-- accent: TAGLINE,-- lede: `${SITE_NAME} is a new OpenVibe service. This is its skeleton: the platform plumbing below is in place, and the product is what goes on top of it.`,-- actions: signedIn(req)-- ? [{ label: 'Your account', href: '/auth/me' }, { label: 'What shipped', href: '/updates' }]-- : [{ label: 'Sign in with OpenVibe', href: '/auth/login?next=%2F', primary: true }, { label: 'What shipped', href: '/updates' }],-- note: 'Open source (AGPL-3.0). Sign-in is OpenVibe.Network; a person\'s token stays in an httpOnly cookie.',++ title: 'Eat well.', accent: 'Spend less.',++ lede: 'Find the food banks, pantries and budget grocery stores near you on a map anyone can edit. Plan meals for one person, a couple or a household for the days ahead, with the shopping list and what it costs. Tell it what is already in your cupboard and see what you can make.',++ actions: [++ { label: 'Find food near you', href: '/near', primary: true },++ { label: 'Plan a week', href: '/plan' },++ { label: 'The food list', href: '/foods' },++ ],++ note: 'Open source (AGPL-3.0). Places come from OpenStreetMap © contributors (ODbL); prices are typical, not live.',++ aside: { html: String(searchForm()) },});page(req, res, {index: true, cache: signedIn(req) ? null : PUBLIC_CACHE,@@@ -44,30 +98,261 @@ function createPageRoutes(ctx) {styles: [showcase.STYLESHEET],body: html`${raw(hero)}${raw(showcase.features({-- title: 'What is already here',-- lede: 'The parts every OpenVibe service needs, so a new product starts from them instead of rebuilding them.',++ title: 'Everything food',++ lede: 'Four things, all working today: no card, no account needed to look around.',items: [-- { icon: 'ov:account', title: 'Sign-in with OpenVibe.Network', text: 'OAuth 2 with PKCE (S256), server-side code exchange, httpOnly session cookies, and offline token verification against the Network signing key.' },-- { icon: 'ov:page', title: 'Server-rendered pages', text: 'The OpenVibe Frame (navbar and footer), the shared theme, one stylesheet, crawl artifacts and JSON-LD. Every page is complete without JavaScript.' },-- { icon: 'ov:tools', title: 'An API mount and capabilities', text: 'GET /api/v1/ping today; the router, the problem+json errors and the app/person capability guard are wired and waiting for the product\'s routes.' },-- { icon: 'ov:gauge', title: 'Limits and readiness', text: 'Per-address and per-caller rate limits, /api/health, a truthful /api/ready and Prometheus metrics on loopback.' },-- { icon: 'ov:db', title: 'PostgreSQL and migrations', text: 'openvibe-sdk/db, migrations/NNNN_*.sql applied at boot, PGlite in development, and a store with an injectable clock.' },-- { icon: 'ov:deploy', title: 'Deploy files and tests', text: 'nginx and systemd units, an environment template, and a test suite on PGlite with a mock Network, all through npm test.' },++ { icon: 'ov:location', title: 'Food near you', text: 'Food banks, soup kitchens, community fridges and free pantry boxes, plus the budget grocery stores, with distance, address and opening hours.', href: '/near' },++ { icon: 'ov:page', title: 'A meal planner', text: 'One person, a couple or a group, for up to fourteen days. It covers all six food groups, writes the shopping list and estimates what it costs.', href: '/plan' },++ { icon: 'ov:tools', title: 'A food list you can read', text: 'Every item with its nutrition per serving and per 100 g, the typical price band and the cheapest of the five budget chains.', href: '/foods' },++ { icon: 'ov:account', title: 'Your cupboard', text: 'Keep a list of what you have. Sign in and it says plainly which simple things you can already make, and what one item would unlock.', href: '/pantry' },],}))}--${raw(showcase.steps({-- title: 'How a new service starts',-- items: [-- { title: 'Generate it', text: 'node scripts/new-service.js replaces the skeleton\'s tokens (service id, name, domain, port, tagline, env prefix) in every file and file name.' },-- { title: 'Install and run', text: 'npm install, then npm run dev: the service listens on its port with an embedded PGlite database, if no DATABASE_URL is set.' },-- { title: 'Make it a product', text: 'Add the product\'s tables and migrations, its capabilities, its routes in server/http/api.js and its pages in server/http/pages.js.' },-- { title: 'Grant and deploy', text: 'Register the service and its capabilities with OpenVibe.Contracts and OpenVibe.Services, then install the unit and the vhost.' },-- ],-- }))}--${raw(showcase.cta({ title: 'Read the API', text: 'GET /api/v1/ping is the whole API today. The rest is what the product adds.', actions: [{ label: 'The API', href: '/api/v1/ping' }, { label: 'What shipped', href: '/updates' }] }))}`,++${raw(showcase.cta({++ title: 'Start where you are',++ text: 'Search your town for a food bank, plan the next three days for what you can spend, or look up what is in the tin before you open it.',++ actions: [{ label: 'Find food near you', href: '/near', primary: true }, { label: 'Plan meals', href: '/plan' }, { label: 'The food list', href: '/foods' }],++ }))}`,});});++ // ── Food near you ────────────────────────────────────────++ r.get('/near', async (req, res) => {++ const q = str(req.query.q);++ const kind = KINDS[req.query.kind] ? req.query.kind : 'foodbank';++ const num = (v) => (v != null && v !== '' && Number.isFinite(Number(v)) ? Number(v) : null);++ let out = null;++ let problem = null;++ if (q || (num(req.query.lat) != null && num(req.query.lon) != null)) {++ try {++ out = await searchPlaces(ctx.upstream, { kind, q, lat: num(req.query.lat), lon: num(req.query.lon), radiusKm: num(req.query.radius) }, config);++ } catch (err) {++ problem = err && err.code ? err.message : 'The place search is unavailable right now. Try again in a few minutes.';++ }++ }++ const title = out && out.location.name ? `Food near ${out.location.name.split(',').slice(0, 2).join(',')}` : 'Food near you';++ page(req, res, {++ title, description: 'Food banks, pantries and budget grocery stores near a place, from OpenStreetMap.',++ crumbs: [{ label: 'Food near you' }], styles: [showcase.STYLESHEET],++ body: html`<h1>Food near you</h1>++<p class="lede">Food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores, from OpenStreetMap.</p>++${searchForm({ q: q || '', kind })}++${problem ? notice(problem, 'warn') : ''}++${out ? html`<section class="near-results">++<h2>${out.location.name || 'Around those coordinates'}</h2>++<p class="muted small">Within ${out.radius_km} km, nearest first. ${out.counts.total} found${out.counts.foodbank ? html` · ${out.counts.foodbank} food banks and pantries` : ''}${out.counts.grocery ? html` · ${out.counts.grocery} grocery stores (${out.counts.budget_grocery} budget)` : ''}.</p>++${resultsBlock(out)}++${osmNote(out.fetched_at)}++</section>` : html`<p class="muted">Search for a town, a city or a postcode above — or link here with <code>?lat=</code> and <code>?lon=</code> from a map.</p>`}`,++ });++ });++++ // ── Meal plan ────────────────────────────────────────────++ function planForm(spec) {++ return html`<form class="ov-form plan-form" method="get" action="/plan">++<label for="people">People</label>++<input id="people" name="people" type="number" min="1" max="12" value="${spec.people}">++<label for="days">Days</label>++<input id="days" name="days" type="number" min="1" max="14" value="${spec.days}">++<label for="budget">Budget in dollars (optional)</label>++<input id="budget" name="budget" type="number" min="1" max="5000" step="0.01" value="${spec.budget == null ? '' : spec.budget}">++<button class="sc-btn sc-primary" type="submit">Plan it</button>++</form>`;++ }++++ function planBody(plan) {++ return html`<section class="plan-summary">++<h2>${plan.spec.people} ${plan.spec.people === 1 ? 'person' : 'people'}, ${plan.spec.days} ${plan.spec.days === 1 ? 'day' : 'days'}</h2>++<ul class="stats">++<li><b>${money(plan.totals.cost)}</b><span>estimated total</span></li>++<li><b>${money(plan.totals.cost_per_person_day)}</b><span>a person a day</span></li>++<li><b>${plan.totals.kcal_per_person_day}</b><span>kcal a person a day</span></li>++<li><b>${plan.totals.protein_g_per_person_day} g</b><span>protein a person a day</span></li>++<li><b>${plan.groups_covered} of ${plan.groups_total}</b><span>food groups covered</span></li>++</ul>++${plan.spec.budget != null ? html`<p class="muted small">Budget ${money(plan.spec.budget)}${plan.remaining_budget != null ? html` · ${money(plan.remaining_budget)} left` : ''}.</p>` : ''}++</section>++<h2>The shopping list</h2>++${table(['Item', 'Packs', 'Where', 'Cost'], plan.shopping_list.map((i) => [html`<a href="/foods/${i.slug}">${i.name}</a>`, String(i.packs), i.store_name || '—', money(i.cost)]), { empty: 'Nothing in the plan.' })}++<p class="muted small">Cheapest total ${money(plan.totals.cost)} at ${plan.by_store.length} ${plan.by_store.length === 1 ? 'store' : 'stores'}: ${plan.by_store.map((x) => `${x.store_name} ${money(x.cost)}`).join(', ')}. ${plan.totals.packs} packs.</p>++<h2>What to eat</h2>++${plan.menu.map((d) => html`<section class="plan-day"><h3>Day ${d.day}</h3>++<ul>${[['breakfast', 'Breakfast'], ['lunch', 'Lunch'], ['dinner', 'Dinner'], ['snack', 'Snack']].map(([slot, label]) => html`<li><b>${label}:</b> ${d[slot].join(', ') || '—'}</li>`)}</ul></section>`)}++<h2>Food groups</h2>++${table(['Group', 'A day, at least', 'In the plan', 'Cost'], plan.group_coverage.map((g) => [g.name, `${g.daily_min_g} g`, g.covered ? `${g.items} items, ${g.packs} packs` : '—', money(g.cost)]))}++${plan.notes.map((n) => html`<p class="muted small">${n}</p>`)}`;++ }++++ r.get('/plan', (req, res) => {++ const spec = { people: str(req.query.people, 4) || '2', days: str(req.query.days, 4) || '3', budget: str(req.query.budget, 8) || '' };++ let plan = null;++ let problem = null;++ try { plan = planMeals(spec); } catch (err) { problem = err && err.message ? err.message : 'That plan could not be made.'; }++ const savedId = str(req.query.saved, 40);++ page(req, res, {++ title: 'Meal plan', description: 'A budget meal plan with a shopping list and an estimated cost, from the OpenVibe.Food food list.',++ crumbs: [{ label: 'Meal plan' }], styles: [showcase.STYLESHEET],++ body: html`<h1>Plan meals</h1>++<p class="lede">It buys one item from each of the six food groups first, cheapest per serving, then fills up with the best calories per dollar. Deterministic: the same numbers always give the same plan.</p>++${planForm(spec)}++${savedId ? notice('Saved. It is in your plans below.', 'ok') : ''}++${problem ? notice(problem, 'warn') : ''}++${plan ? planBody(plan) : ''}++${plan && signedIn(req) ? html`<h2>Save this plan</h2>++<form class="ov-form save-form" method="post" action="/plan">++${['people', 'days', 'budget'].map((k) => html`<input type="hidden" name="${k}" value="${k === 'budget' ? (plan.spec.budget == null ? '' : plan.spec.budget) : plan.spec[k]}">`)}++<label for="title">Name (optional)</label>++<input id="title" name="title" type="text" maxlength="120" placeholder="e.g. Week of the 12th">++<button class="sc-btn" type="submit">Save this plan</button>++</form>` : ''}++${plan && !signedIn(req) ? html`<p class="muted small"><a href="/auth/login?next=%2Fplan">Sign in</a> to save a plan and come back to it.</p>` : ''}`,++ });++ });++++ r.post('/plan', express.urlencoded({ extended: false, limit: '64kb' }), async (req, res) => {++ res.set('Cache-Control', cache.htmlHeaders({ private: true }));++ const body = req.body || {};++ const spec = { people: str(body.people, 4) || '2', days: str(body.days, 4) || '3', budget: str(body.budget, 8) || '' };++ const back = `/plan?people=${encodeURIComponent(spec.people)}&days=${encodeURIComponent(spec.days)}&budget=${encodeURIComponent(spec.budget)}`;++ if (!signedIn(req)) return res.redirect(303, `/auth/login?next=${encodeURIComponent('/plan')}`);++ if (!sameOrigin(req, config.baseUrl)) return res.status(403).type('text/plain').send('A plan must be saved from openvibe.food itself.');++ let plan;++ try { plan = planMeals(spec); } catch (err) { return res.redirect(303, back); }++ const row = await store.insertPlan(s, {++ id: s.newId('pln'), owner: ownerOf(req), title: str(body.title, 120),++ people: plan.spec.people, days: plan.spec.days, budget: plan.spec.budget, plan, created_at: s.iso(),++ });++ return res.redirect(303, `${back}&saved=${encodeURIComponent(row.id)}`);++ });++++ // Saved plans sit under the same page: nothing personal is ever in a public cache.++ r.get('/plan/saved', async (req, res) => {++ if (!signedIn(req)) return res.redirect(303, '/auth/login?next=%2Fplan%2Fsaved');++ const rows = await store.listPlans(s, ownerOf(req), { limit: 50 });++ page(req, res, {++ title: 'Your plans', crumbs: [{ label: 'Meal plan', href: '/plan' }, { label: 'Saved' }],++ body: html`<h1>Your saved plans</h1>++${table(['Name', 'For', 'Cost', 'Saved'], rows.map((row) => {++ const plan = typeof row.plan === 'string' ? JSON.parse(row.plan) : row.plan;++ return [row.title || `Plan ${String(row.id).slice(-6)}`, `${row.people} people, ${row.days} days`, money(plan.totals.cost), time(row.created_at)];++ }), { empty: 'No saved plans yet. Make one on the plan page and save it.' })}++<p><a href="/plan">Plan another</a></p>`,++ });++ });++++ // ── The food list ────────────────────────────────────────++ r.get('/foods', (req, res) => {++ const group = foods.GROUPS[req.query.group] ? req.query.group : null;++ const q = str(req.query.q, 80);++ const list = foods.listFoods({ group, q });++ const sections = Object.entries(foods.GROUPS).filter(([id]) => !group || id === group).map(([id, def]) => {++ const items = list.filter((f) => f.group === id);++ if (!items.length) return '';++ return html`<section class="food-group"><h2 id="g-${id}">${def.name}</h2>++<p class="muted small">At least ${def.dailyMin} g a person a day. ${def.examples}.</p>++${table(['Food', 'Serving', 'kcal', 'Protein', 'Typical price'], items.map((f) => [++ html`<a href="/foods/${f.slug}">${f.name}</a>`,++ f.serving_size,++ `${f.nutrition.kcal}`,++ `${f.nutrition.protein_g} g`,++ f.price == null ? '—' : html`${money(f.price)} · ${f.band_label}`,++ ]))}</section>`;++ });++ page(req, res, {++ title: q ? `Foods matching “${q}”` : 'The food list', index: true, cache: signedIn(req) ? null : PUBLIC_CACHE,++ description: 'Every food OpenVibe.Food plans with: nutrition per serving and per 100 g, and the typical price band.',++ crumbs: [{ label: 'Food list' }], styles: [showcase.STYLESHEET],++ body: html`<h1>The food list</h1>++<p class="lede">${foods.FOODS.length} items the planner and the cupboard use. Nutrition is typical, per serving; the price is a band from five budget chains.</p>++<form class="ov-form filter-form" method="get" action="/foods">++<label for="q">Search</label>++<input id="q" name="q" type="search" value="${q || ''}" maxlength="80" placeholder="beans, oats, tuna…">++<label for="group">Group</label>++<select id="group" name="group"><option value="">All groups</option>${Object.entries(foods.GROUPS).map(([id, def]) => html`<option value="${id}"${id === group ? raw(' selected') : ''}>${def.name}</option>`)}</select>++<button class="sc-btn" type="submit">Filter</button>++</form>++${list.length ? sections : notice('Nothing matched. Try a shorter word.', 'warn')}++<p class="muted small">Carried over from the OpenVibe.Tools grocery dataset (typical 2025 US Washington prices). Not a live price.</p>`,++ });++ });++++ r.get('/foods/:slug', (req, res) => {++ const f = foods.getFood(req.params.slug);++ if (!f) return page(req, res, {++ title: 'No such food', crumbs: [{ label: 'Food list', href: '/foods' }, { label: 'Not found' }],++ body: html`<h1>No such food</h1><p>Nothing in the list is called “${String(req.params.slug).slice(0, 64)}”. <a href="/foods">See the whole list</a>.</p>`,++ }, 404);++ page(req, res, {++ title: f.name, index: true, cache: signedIn(req) ? null : PUBLIC_CACHE, styles: [showcase.STYLESHEET],++ description: `${f.name}: nutrition per serving and per 100 g, and the typical price band.`,++ crumbs: [{ label: 'Food list', href: '/foods' }, { label: f.name }],++ body: html`<h1>${f.name}</h1>++<p class="muted">${f.group_name} · a serving is ${f.serving_size}${f.serving_grams ? html` (about ${f.serving_grams} g)` : ''} · ${f.servings} servings a pack.</p>++<h2>Nutrition</h2>++${table(['', 'A serving', f.per_100g ? 'Per 100 g' : 'Per 100 g'], [++ ['Energy', `${f.nutrition.kcal} kcal`, f.per_100g ? html`${f.per_100g.kcal} kcal` : '—'],++ ['Protein', `${f.nutrition.protein_g} g`, f.per_100g ? html`${f.per_100g.protein_g} g` : '—'],++ ['Carbohydrate', `${f.nutrition.carbs_g} g`, f.per_100g ? html`${f.per_100g.carbs_g} g` : '—'],++ ['Fat', `${f.nutrition.fat_g} g`, f.per_100g ? html`${f.per_100g.fat_g} g` : '—'],++ ['Fibre', `${f.nutrition.fiber_g} g`, f.per_100g ? html`${f.per_100g.fiber_g} g` : '—'],++ ])}++<p class="muted small">${f.per_100g ? `Per 100 g is worked out from the ${f.pack_grams} g pack the name states and the typical values a serving carries; it is approximate.` : 'This item names no pack weight, so no per-100 g figure is given rather than guess one.'} A pack is about ${f.package_kcal} kcal.</p>++<h2>Typical price</h2>++<p>${f.price == null ? 'No price recorded.' : html`<b>${money(f.price)}</b> to ${money(f.price_max)} a pack · ${f.band_label} · ${money(f.cost_per_serving)} a serving`}</p>++${table(['Store', 'A pack'], f.prices.map((p) => [p.store_name, money(p.price)]))}++<p class="muted small">Typical 2025 US (Washington) prices carried over from the OpenVibe.Tools grocery dataset; not a live price.</p>++${f.tags.length ? html`<p class="tags">${f.tags.map((t) => badge(t))}</p>` : ''}++<p><a href="/plan?people=2&days=3">Plan meals with this</a> · <a href="/foods">Back to the list</a></p>`,++ });++ });++++ // ── Your cupboard ────────────────────────────────────────++ async function pantryPage(req, res, { saved = false } = {}) {++ if (!signedIn(req)) {++ return page(req, res, {++ title: 'Your cupboard', crumbs: [{ label: 'Your cupboard' }], styles: [showcase.STYLESHEET],++ body: html`<h1>Your cupboard</h1>++<p class="lede">Keep a list of what you already have and OpenVibe.Food will say which of its simple recipes you can make right now — and what one more item would unlock.</p>++<p><a class="sc-btn sc-primary" href="/auth/login?next=%2Fpantry">Sign in to keep a cupboard</a></p>`,++ });++ }++ const items = await store.getPantry(s, ownerOf(req));++ const match = matchPantry(items);++ const have = new Set(items);++ const groupsBlock = Object.entries(foods.GROUPS).map(([id, def]) => html`<fieldset class="pantry-group"><legend>${def.name}</legend>++${foods.FOODS.filter((f) => f.group === id).map((f) => html`<label class="pantry-item"><input type="checkbox" name="items" value="${f.slug}"${have.has(f.slug) ? raw(' checked') : ''}> ${f.name}</label>`)}++</fieldset>`);++ const recipeLine = (x) => html`<li><b>${x.name}</b> — serves ${x.serves}, about ${x.minutes} minutes${x.missing && x.missing.length ? html` · missing ${x.missing.join(', ')}` : ''}</li>`;++ page(req, res, {++ title: 'Your cupboard', crumbs: [{ label: 'Your cupboard' }], styles: [showcase.STYLESHEET],++ body: html`<h1>Your cupboard</h1>++<p class="lede">Tick what you have. Nothing leaves your account; the matching is done here, not by a model.</p>++${saved ? notice('Cupboard saved.', 'ok') : ''}++<form method="post" action="/pantry" class="pantry-form">++${groupsBlock}++<div class="pantry-actions"><button class="sc-btn sc-primary" type="submit">Save cupboard</button><span class="muted small">${items.length} of ${foods.FOODS.length} items</span></div>++</form>++<h2>What can I make?</h2>++<p class="muted small"><b>Basic suggestions.</b> Simple combinations written by OpenVibe from the items in the list above, matched against your cupboard. Not dietary advice, and not a full recipe book.</p>++${match.can_make.length ? html`<h3>You can make these now</h3><ul>${match.can_make.map(recipeLine)}</ul>` : html`<p class="muted">Nothing is complete yet. Tick what you have above.</p>`}++${match.almost.length ? html`<h3>One item away</h3><ul>${match.almost.map(recipeLine)}</ul>` : ''}++${match.rest.length ? html`<h3>Further off</h3><ul>${match.rest.slice(0, 6).map(recipeLine)}</ul>` : ''}`,++ });++ }++++ r.get('/pantry', (req, res) => pantryPage(req, res, { saved: !!req.query.saved }));++++ r.post('/pantry', express.urlencoded({ extended: false, limit: '64kb' }), async (req, res) => {++ res.set('Cache-Control', cache.htmlHeaders({ private: true }));++ if (!signedIn(req)) return res.redirect(303, '/auth/login?next=%2Fpantry');++ if (!sameOrigin(req, config.baseUrl)) return res.status(403).type('text/plain').send('A cupboard must be saved from openvibe.food itself.');++ // A checkbox form sends the field once per ticked box; some clients send one comma-joined value. Accept both.++ const sent = [].concat((req.body && req.body.items) || []).flatMap((v) => String(v).split(','));++ const picked = [...new Set(sent.map((x) => x.trim()).filter((slug) => foods.getFood(slug)))];++ if (picked.length > 200) return res.status(413).type('text/plain').send('That is more items than a cupboard can hold.');++ await store.setPantry(s, ownerOf(req), picked);++ return res.redirect(303, '/pantry?saved=1');++ });++// ── The update log ───────────────────────────────────────r.get('/updates', (req, res) => page(req, res, {index: true, cache: PUBLIC_CACHE,@@@ -80,4 +365,4 @@ ${raw(showcase.cta({ title: 'Read the API', text: 'GET /api/v1/ping is the wholereturn r;}--module.exports = { createPageRoutes };++module.exports = { createPageRoutes, TAGLINE, SITE_NAME };@@@ -23,7 +23,14 @@ const PROJECT_RE = /^prj_[0-9A-HJKMNP-TV-Z]{26}$/;// The product fills this in: one entry per capability its routes name, in openvibe-contracts// manifests/capabilities/<food>.*. requireCapability('<name>') refuses a name that is not listed here, so a// route can never be guarded by a capability the service does not declare.--const CAPABILITIES = [];++const CAPABILITIES = [++ 'food.place.read', // the place search: food banks and budget grocers near a point++ 'food.food.read', // the food list and one food++ 'food.plan.read', // the plans a caller saved++ 'food.plan.write', // save a plan++ 'food.pantry.read', // read a caller's pantry++ 'food.pantry.write', // replace a caller's pantry++];function decodePayload(token) {const parts = String(token || '').split('.');@@@ -8,7 +8,7 @@ const express = require('express');function asyncRouter() {const r = express.Router();-- for (const method of ['get', 'post']) {++ for (const method of ['get', 'post', 'put', 'patch', 'delete']) {const orig = r[method].bind(r);r[method] = (path, ...handlers) => orig(path, ...handlers.map((h) => (h.length === 4 ? h : (req, res, next) => {try {@@@ -24,6 +24,10 @@ const TAGLINE = 'What should we eat?';const PUBLIC_DIR = path.join(__dirname, '..', '..', 'public');// The product's own navigation: one entry per public page it serves.const NAV = [++ { label: 'Food near you', href: '/near' },++ { label: 'Meal plan', href: '/plan' },++ { label: 'Food list', href: '/foods' },++ { label: 'Cupboard', href: '/pantry' },{ label: 'What shipped', href: '/updates' },];@@@ -20,8 +20,13 @@ const READ = 'food.api.read';const rosa = t.network.addUser('rosa');const sam = t.network.addUser('sam');-- await check('BUDGETS starts empty: the product declares its own expensive routes', () => {-- assert.deepStrictEqual(BUDGETS, {});++ await check('BUDGETS declares the product\'s expensive routes, each with real numbers', () => {++ assert.deepStrictEqual(Object.keys(BUDGETS).sort(), ['food.pantry.write', 'food.place.search', 'food.plan.create']);++ for (const [name, own] of Object.entries(BUDGETS)) {++ assert.ok(own.minute > 0 && own.hour >= own.minute, `${name} has no real numbers`);++ }++ // The place search hits OpenStreetMap, so it is the tightest budget of the three.++ assert.ok(BUDGETS['food.place.search'].minute <= Math.min(BUDGETS['food.plan.create'].minute, BUDGETS['food.pantry.write'].minute));});await check('a read: 3 a minute per address, then 429 rate_limited with Retry-After; another address passes', async () => {nnew file mode 100644@@@ -0,0 +1,99 @@++'use strict';++/**++ * The food list and its pages: the API hands out the nutrition and the price band, /foods and /foods/:slug render++ * them server-side, and the sitemap and llms-full.txt carry every food page. The per-100 g figure is arithmetic on++ * the pack size in the item's own name, so a pack that states no weight says so instead of guessing.++ */++const assert = require('assert');++const { boot, check, done } = require('./helpers/boot');++const foods = require('../server/food/foods');++++(async () => {++ const t = await boot();++ try {++ await check('the food list: every group, real nutrition, a typical price band and no invented numbers', async () => {++ const r = await t.get('/api/v1/foods');++ assert.strictEqual(r.status, 200, r.text);++ const b = r.json();++ assert.ok(b.count >= 40, `only ${b.count} foods`);++ assert.strictEqual(b.groups.length, 6);++ assert.deepStrictEqual(b.groups.map((g) => g.group).sort(), ['dairy', 'fats', 'fruits', 'grains', 'protein', 'vegetables']);++ for (const f of b.foods) {++ assert.ok(f.name && f.group && f.serving_size, JSON.stringify(f));++ assert.ok(f.nutrition_per_serving.kcal >= 0 && f.nutrition_per_serving.protein_g >= 0);++ assert.ok(f.price > 0 && f.price_max >= f.price, `${f.slug} price`);++ assert.ok(['low', 'medium', 'higher', 'high'].includes(f.price_band));++ assert.strictEqual(f.url, `/foods/${f.slug}`);++ // per 100 g is there exactly when the pack size in the name is a weight++ assert.strictEqual(f.nutrition_per_100g != null, foods.packGrams(f.name) != null, `${f.slug} per-100 g`);++ }++ assert.strictEqual(b.source.name, 'OpenVibe.Tools grocery dataset', 'the provenance is stated');++ assert.strictEqual(b.foods.find((f) => f.slug === 'canned-tuna').nutrition_per_100g.kcal, 106);++ assert.strictEqual(b.foods.find((f) => f.slug === 'eggs-dozen').nutrition_per_100g, null, 'a dozen eggs states no weight');++ });++++ await check('filtering by group and by word; an unknown group is refused', async () => {++ const protein = (await t.get('/api/v1/foods?group=protein')).json();++ assert.ok(protein.count > 0 && protein.foods.every((f) => f.group === 'protein'));++ const oats = (await t.get('/api/v1/foods?q=oats')).json();++ assert.deepStrictEqual(oats.foods.map((f) => f.slug), ['oatmeal']);++ const bad = await t.get('/api/v1/foods?group=pizza');++ assert.strictEqual(bad.status, 422);++ assert.strictEqual(bad.json().code, 'food.food.invalid');++ });++++ await check('one food by slug, and a 404 with a stable code for one that is not in the list', async () => {++ const r = await t.get('/api/v1/foods/canned-tuna');++ assert.strictEqual(r.status, 200);++ const f = r.json().food;++ assert.strictEqual(f.name, 'Canned Tuna (5 oz)');++ assert.strictEqual(f.prices[0].store_name, 'Grocery Outlet', 'the cheapest chain first');++ assert.ok(f.prices.length >= 4);++ const missing = await t.get('/api/v1/foods/caviar');++ assert.strictEqual(missing.status, 404);++ assert.strictEqual(missing.json().code, 'food.food.not_found');++ });++++ await check('the /foods page and one food page render server-side, per serving and per 100 g', async () => {++ const list = await t.get('/foods');++ assert.strictEqual(list.status, 200);++ assert.match(list.headers.get('content-type'), /^text\/html/);++ assert.ok(list.text.includes('href="/foods/eggs-dozen"'), 'the list links to a food page');++ assert.ok(list.text.includes('Protein'), 'the groups are shown');++ assert.match(list.text, /<meta name="robots" content="index, follow">/);++++ const one = await t.get('/foods/canned-tuna');++ assert.strictEqual(one.status, 200);++ assert.ok(one.text.includes('Canned Tuna (5 oz)'));++ assert.ok(one.text.includes('Per 100 g'));++ assert.ok(one.text.includes('106 kcal'), 'the per-100 g energy is rendered');++ assert.ok(/Grocery Outlet/.test(one.text), 'the price table by chain');++ assert.ok(one.text.includes('Not a live price') || one.text.includes('not a live price'));++++ const bad = await t.get('/foods/caviar');++ assert.strictEqual(bad.status, 404);++ assert.match(bad.text, /No such food/);++ });++++ await check('the sitemap and llms-full.txt carry every food page', async () => {++ const sitemap = (await t.get('/sitemap.xml')).text;++ for (const slug of ['eggs-dozen', 'canned-tuna', 'white-rice']) {++ assert.ok(sitemap.includes(`<loc>https://openvibe.food/foods/${slug}</loc>`), `no /foods/${slug} in the sitemap`);++ }++ assert.ok(sitemap.includes('<loc>https://openvibe.food/near</loc>'));++ assert.ok(!sitemap.includes('/pantry'), 'a personal page is never in the sitemap');++ const full = (await t.get('/llms-full.txt')).text;++ assert.ok(full.includes('https://openvibe.food/foods/canned-tuna'), 'the food page is in llms-full.txt');++ assert.ok(!full.includes('(truncated:'), 'llms-full.txt holds every page');++ });++++ await check('the home page offers the search box and the three ways in', async () => {++ const r = await t.get('/');++ assert.strictEqual(r.status, 200);++ assert.ok(r.text.includes('action="/near"'), 'the search form posts to /near');++ assert.ok(r.text.includes('name="q"'));++ for (const href of ['/near', '/plan', '/foods', '/pantry']) assert.ok(r.text.includes(`href="${href}"`), `no link to ${href}`);++ });++ } finally { await t.close(); }++ done();++})();@@@ -3,6 +3,15 @@// (server/http/caller-limits.js) count nobody unless a test asks: boot({ callerLimits: true, limitsNow }).process.env.FOOD_RATE_LIMIT_PER_MIN = process.env.FOOD_RATE_LIMIT_PER_MIN || '100000';process.env.FOOD_API_RATE_LIMIT_PER_MIN = process.env.FOOD_API_RATE_LIMIT_PER_MIN || '100000';++// Outbound HTTP is never real in a test: unless a test names a stand-in (test/helpers/osm.js), the two OpenStreetMap++// hosts point at a closed local port, so the call fails at once instead of reaching the internet.++const OSM_OFFLINE = {++ FOOD_NOMINATIM_URL: 'http://127.0.0.1:9/nominatim',++ FOOD_OVERPASS_URL: 'http://127.0.0.1:9/overpass',++ // The one-request-a-second pace is asserted by places.test.js with the policy's real second; the rest of the++ // suite must not pay it.++ FOOD_OSM_MIN_INTERVAL_MS: '1',++};/*** Boots OpenVibe.Food on a temp database with a mock Network (test/helpers/mocks.js), captures every log line, and* returns a small HTTP client. Every test file gets its own.@@@ -27,6 +36,7 @@ async function boot(opts = {}) {NODE_ENV: 'test', PORT: '0', BASE_URL: 'https://openvibe.food', TRUST_PROXY: '1',OV_NETWORK_URL: network.url, OV_NETWORK_INTERNAL_URL: network.url,OV_OAUTH_CLIENT_ID: 'food', OV_OAUTH_CLIENT_SECRET: 'food-secret', COOKIE_SECURE: 'false',++ ...OSM_OFFLINE,...(opts.env || {}),};for (const [k, v] of Object.entries(opts.env || {})) if (v === null) delete env[k];nnew file mode 100644@@@ -0,0 +1,81 @@++'use strict';++/**++ * A stand-in for the two OpenStreetMap services OpenVibe.Food uses, on one local HTTP server:++ *++ * GET /search Nominatim (format=jsonv2): the array in `state.geocode`++ * POST /api/interpreter Overpass: the body in `state.overpass.foodbank` or `state.overpass.grocery`,++ * chosen by whether the query mentions social_facility or shop++ *++ * Every request is recorded in `.requests` as { path, at, query, body } with its timestamp, so a test can prove the++ * one-request-a-second pace (server/food/upstream.js) and prove a cache hit made no request at all.++ *++ * const osm = await startOsm();++ * const t = await boot({ env: { FOOD_NOMINATIM_URL: osm.url, FOOD_OVERPASS_URL: `${osm.url}/api/interpreter` } });++ */++const http = require('http');++++const SPRINGFIELD = { lat: '39.7817', lon: '-89.6501', display_name: 'Springfield, Illinois, United States' };++++const DEFAULT_OVER = {++ foodbank: {++ elements: [++ { type: 'node', id: 101, lat: 39.7850, lon: -89.6500, tags: { amenity: 'social_facility', social_facility: 'food_bank', name: 'Springfield Food Pantry', 'addr:housenumber': '12', 'addr:street': 'Main Street', 'addr:city': 'Springfield', 'addr:state': 'IL', opening_hours: 'Mo-Fr 09:00-16:00', phone: '+1 217 555 0101', website: 'https://example.org/pantry', wheelchair: 'yes' } },++ { type: 'node', id: 102, lat: 39.7900, lon: -89.6400, tags: { amenity: 'social_facility', social_facility: 'soup_kitchen', name: 'St. Mary Soup Kitchen', opening_hours: 'Sa 11:00-13:00' } },++ { type: 'way', id: 103, center: { lat: 39.7700, lon: -89.6600 }, tags: { amenity: 'give_box', name: 'Free pantry box' } }, // no name: falls back to its type label++ { type: 'node', id: 104, lat: 39.8200, lon: -89.7000, tags: { amenity: 'food_sharing', name: 'Riverside Community Fridge' } },++ ],++ },++ grocery: {++ elements: [++ { type: 'node', id: 201, lat: 39.7800, lon: -89.6600, tags: { shop: 'supermarket', name: 'Aldi', brand: 'Aldi', opening_hours: 'Mo-Su 08:00-20:00' } },++ { type: 'node', id: 202, lat: 39.7900, lon: -89.6600, tags: { shop: 'convenience', name: 'Corner Market' } },++ { type: 'node', id: 203, lat: 39.7750, lon: -89.6450, tags: { shop: 'variety_store', name: 'Dollar Tree' } },++ ],++ },++};++++async function startOsm(opts = {}) {++ const requests = [];++ const state = {++ geocode: opts.geocode || [SPRINGFIELD],++ overpass: opts.overpass || DEFAULT_OVER,++ fail: false,++ respond: null, // (kind, query) → body, to override per call++ };++++ const server = http.createServer((req, res) => {++ let raw = '';++ req.on('data', (d) => { raw += d; raw = raw.slice(0, 65536); });++ req.on('end', () => {++ const url = new URL(req.url, 'http://x');++ const query = url.search || '';++ requests.push({ method: req.method, path: url.pathname, query, body: raw, at: Date.now() });++ const json = (status, obj) => { res.writeHead(status, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(obj)); };++ if (state.fail) return json(503, { error: 'the stand-in OSM service is down' });++ if (url.pathname === '/search' && req.method === 'GET') {++ // Like Nominatim: a place it does not know is an empty array, not an error.++ const words = String(url.searchParams.get('q') || '').toLowerCase().split(/\W+/).filter((w) => w.length >= 3);++ return json(200, state.geocode.filter((g) => words.some((w) => String(g.display_name).toLowerCase().includes(w))));++ }++ if (url.pathname === '/api/interpreter' && req.method === 'POST') {++ const data = decodeURIComponent(new URLSearchParams(raw).get('data') || '');++ const kind = /social_facility|food_sharing|give_box/.test(data) ? 'foodbank' : 'grocery';++ if (state.respond) return json(200, state.respond(kind, data));++ return json(200, state.overpass[kind] || { elements: [] });++ }++ return json(404, { error: 'not found' });++ });++ });++ await new Promise((r) => server.listen(0, '127.0.0.1', r));++ const url = `http://127.0.0.1:${server.address().port}`;++ return {++ url, state, requests,++ env: { FOOD_NOMINATIM_URL: url, FOOD_OVERPASS_URL: `${url}/api/interpreter` },++ reset() { requests.length = 0; state.fail = false; state.respond = null; state.geocode = [SPRINGFIELD]; state.overpass = DEFAULT_OVER; },++ /** The gaps, in ms, between consecutive upstream calls — the pace a test checks. */++ gaps() { return requests.slice(1).map((r, i) => r.at - requests[i].at); },++ close: () => new Promise((r) => server.close(r)),++ };++}++++module.exports = { startOsm, SPRINGFIELD, DEFAULT_OVER };nnew file mode 100644@@@ -0,0 +1,109 @@++'use strict';++/**++ * The cupboard: what a person says they have, kept per account, and the deterministic "what can I make" that matches++ * it against the basic recipes. No model call anywhere near it. Anonymous callers are refused every read and write of++ * a personal list, an unknown food is refused rather than stored, and a PUT replaces the list.++ */++const assert = require('assert');++const { boot, check, done } = require('./helpers/boot');++const { matchPantry } = require('../server/food/pantry-match');++++const SAME = { 'sec-fetch-site': 'same-origin' };++++(async () => {++ await check('the match is deterministic and says what is missing', () => {++ const full = matchPantry(['white-rice', 'canned-beans', 'onion-3lb']);++ assert.deepStrictEqual(full.can_make.map((r) => r.slug), ['beans-and-rice']);++ assert.deepStrictEqual(full.can_make[0].missing, []);++ assert.deepStrictEqual(full.can_make[0].steps.length > 0, true);++++ const empty = matchPantry([]);++ assert.deepStrictEqual(empty.can_make, []);++ assert.strictEqual(empty.all.length, require('../server/food/recipes').RECIPES.length);++ assert.ok(empty.all.every((r) => !r.can_make && r.missing_count === r.ingredients.length));++++ const close = matchPantry(['bread-white', 'canned-tuna']);++ assert.ok(close.can_make.some((r) => r.slug === 'tuna-sandwich'));++ const almost = close.almost.find((r) => r.slug === 'eggs-on-toast');++ assert.ok(almost, 'eggs on toast is one item away');++ assert.deepStrictEqual(almost.missing.map((m) => m.name), ['Large Eggs (1 dozen)']);++ assert.strictEqual(almost.coverage, 0.5);++++ // every recipe names only foods the list knows++ const { RECIPES } = require('../server/food/recipes');++ const { getFood } = require('../server/food/foods');++ for (const r of RECIPES) for (const slug of [...r.ingredients, ...(r.optional || [])]) assert.ok(getFood(slug), `${r.slug} names ${slug}, which is not in the food list`);++ });++++ const t = await boot();++ const kim = t.network.addUser('kim');++ const lee = t.network.addUser('lee');++ try {++ await check('an anonymous caller can neither read nor write a pantry', async () => {++ assert.strictEqual((await t.get('/api/v1/pantry')).status, 401);++ assert.strictEqual((await t.get('/api/v1/pantry', { json: { items: [] }, method: 'PUT', headers: SAME })).status, 401);++ const page = await t.get('/pantry');++ assert.strictEqual(page.status, 200, 'the page itself is public: it just asks you to sign in');++ assert.match(page.text, /Sign in to keep a cupboard/);++ });++++ await check('PUT replaces the list; GET gives it back with the foods and the suggestions', async () => {++ const first = await t.get('/api/v1/pantry', { json: { items: ['white-rice', 'canned-beans', 'onion-3lb'] }, method: 'PUT', as: kim, headers: SAME });++ assert.strictEqual(first.status, 200, first.text);++ const body = first.json();++ assert.deepStrictEqual(body.items, ['canned-beans', 'onion-3lb', 'white-rice'], 'sorted');++ assert.deepStrictEqual(body.foods.map((f) => f.slug), body.items);++ assert.deepStrictEqual(body.suggestions.can_make.map((r) => r.slug), ['beans-and-rice']);++ assert.match(body.note, /Basic suggestions/);++++ const replaced = await t.get('/api/v1/pantry', { json: { items: ['bread-white', 'canned-tuna'] }, method: 'PUT', as: kim, headers: SAME });++ assert.deepStrictEqual(replaced.json().items, ['bread-white', 'canned-tuna'], 'a PUT is the whole list, not a merge');++++ const read = await t.get('/api/v1/pantry', { as: kim });++ assert.deepStrictEqual(read.json().items, ['bread-white', 'canned-tuna']);++ assert.deepStrictEqual((await t.get('/api/v1/pantry', { as: lee })).json().items, [], 'another person has their own');++ const cleared = await t.get('/api/v1/pantry', { json: { items: [] }, method: 'PUT', as: kim, headers: SAME });++ assert.deepStrictEqual(cleared.json().items, []);++ });++++ await check('an item that is not in the food list is refused, and a cleared list is a real answer', async () => {++ const bad = await t.get('/api/v1/pantry', { json: { items: ['white-rice', 'unicorn-steak'] }, method: 'PUT', as: kim, headers: SAME });++ assert.strictEqual(bad.status, 422);++ assert.strictEqual(bad.json().code, 'food.pantry.unknown_item');++ assert.match(bad.json().detail, /unicorn-steak/);++ assert.deepStrictEqual((await t.get('/api/v1/pantry', { as: kim })).json().items, [], 'nothing was stored');++ const notArray = await t.get('/api/v1/pantry', { json: { items: 'eggs-dozen' }, method: 'PUT', as: kim, headers: SAME });++ assert.strictEqual(notArray.status, 422);++ assert.strictEqual(notArray.json().code, 'food.pantry.invalid');++ });++++ await check('the cupboard page ticks what you have, saves without JavaScript, and shows what you can make', async () => {++ await t.get('/api/v1/pantry', { json: { items: ['white-rice', 'canned-beans', 'onion-3lb'] }, method: 'PUT', as: kim, headers: SAME });++ const page = await t.get('/pantry', { as: kim });++ assert.strictEqual(page.status, 200);++ assert.match(page.text, /name="items" value="white-rice" checked/);++ assert.match(page.text, /What can I make\?/);++ assert.match(page.text, /Beans and rice/);++ assert.match(page.text, /Basic suggestions/);++++ // A real checkbox form sends the field once per ticked box.++ const saved = await t.get('/pantry', {++ as: kim, method: 'POST', headers: { ...SAME, 'content-type': 'application/x-www-form-urlencoded' },++ body: 'items=bread-white&items=canned-tuna&items=butter',++ });++ assert.strictEqual(saved.status, 303, saved.text.slice(0, 200));++ assert.strictEqual(saved.headers.get('location'), '/pantry?saved=1');++ assert.deepStrictEqual((await t.get('/api/v1/pantry', { as: kim })).json().items, ['bread-white', 'butter', 'canned-tuna']);++++ const back = await t.get('/pantry?saved=1', { as: kim });++ assert.match(back.text, /Cupboard saved\./);++ assert.match(back.text, /Tuna sandwich/);++ });++++ await check('another site cannot change a signed-in visitor\'s cupboard', async () => {++ const cross = await t.get('/pantry', { as: kim, method: 'POST', body: 'items=eggs-dozen', headers: { 'content-type': 'application/x-www-form-urlencoded', 'sec-fetch-site': 'cross-site' } });++ assert.strictEqual(cross.status, 403);++ });++ } finally { await t.close(); }++ done();++})();@@@ -20,7 +20,9 @@ const BUDGETS = {jsRawKB: 264, // 239.8jsBrotliKB: 62.5, // 56.5cssFiles: 2, // 2 (app.css + the cached /shared/showcase.css)-- cssRawKB: 16.5, // 15.0++ // 16.4 since the product's own pages brought their stylesheet with them (the search and plan forms, the place++ // cards, the pantry's tick list); app.css itself stayed within a few lines.++ cssRawKB: 18.0, // 16.4cssBrotliKB: 4.1, // 3.7externalFiles: 0, // 0};nnew file mode 100644@@@ -0,0 +1,188 @@++'use strict';++/**++ * "Find food near you" end to end against a stand-in OSM (test/helpers/osm.js): the API and the page, the ODbL++ * attribution and the link back, the escaping of a hostile name from OSM, and the three rules this route lives++ * under — one upstream request a second per host, every answer cached for a week, and a per-caller budget on the++ * search itself. No test here ever calls the real OpenStreetMap.++ */++const assert = require('assert');++const { boot, check, done } = require('./helpers/boot');++const { startOsm } = require('./helpers/osm');++const { createPacer } = require('../server/food/upstream');++const geo = require('../server/food/store');++++const OVERPASS = '/api/interpreter';++++(async () => {++ await check('the pace is a queue: concurrent callers are serialised, and a failure does not stall it', async () => {++ const started = [];++ const pacer = createPacer({ minIntervalMs: 50 });++ await Promise.all([1, 2, 3, 4].map(() => pacer.run(async () => { started.push(Date.now()); })));++ assert.strictEqual(started.length, 4);++ for (let i = 1; i < started.length; i++) assert.ok(started[i] - started[i - 1] >= 45, `calls ${started[i] - started[i - 1]} ms apart`);++ await assert.rejects(pacer.run(() => Promise.reject(new Error('boom'))));++ const after = [];++ await pacer.run(async () => after.push(Date.now()));++ assert.strictEqual(after.length, 1, 'the queue kept going after a failure');++ });++++ const osm = await startOsm();++ const t = await boot({ env: { ...osm.env, FOOD_OSM_MIN_INTERVAL_MS: '1' } });++++ try {++ await check('a cached answer is kept for the TTL and an expired one is ignored', async () => {++ const s = t.ctx.s;++ const written = await geo.cachePut(s, 'nominatim:test ttl:1', [], 7 * 24 * 60 * 60 * 1000);++ const days = (Date.parse(written.expires_at) - Date.parse(written.fetched_at)) / 86_400_000;++ assert.ok(days > 6.9 && days < 7.1, `${days} days`);++ assert.ok(await geo.cacheGet(s, 'nominatim:test ttl:1'), 'a fresh row is a hit');++ await s.db.query(++ `INSERT INTO food_geo_cache (key, body, fetched_at, expires_at) VALUES ($1, $2::jsonb, $3, $4)++ ON CONFLICT (key) DO UPDATE SET body = EXCLUDED.body, expires_at = EXCLUDED.expires_at`,++ ['nominatim:stale:1', JSON.stringify([]), '2020-01-01T00:00:00.000Z', '2020-01-08T00:00:00.000Z']);++ assert.strictEqual(await geo.cacheGet(s, 'nominatim:stale:1'), null, 'a row past its TTL is not a hit');++ });++++ await check('the place search geocodes a name, lists food banks nearest first, and carries the ODbL attribution', async () => {++ const r = await t.get(`/api/v1/places?q=${encodeURIComponent('Springfield, Illinois')}&kind=foodbank`);++ assert.strictEqual(r.status, 200, r.text);++ const b = r.json();++ assert.strictEqual(b.location.from, 'geocode');++ assert.strictEqual(b.location.lat, 39.7817);++ assert.strictEqual(b.kind, 'foodbank');++ assert.strictEqual(b.results.length, 4, JSON.stringify(b.results.map((x) => x.name)));++ assert.strictEqual(b.results[0].name, 'Springfield Food Pantry');++ assert.ok(b.results[0].distance_km < b.results[1].distance_km, 'nearest first');++ assert.strictEqual(b.results[0].address, '12, Main Street, Springfield, IL');++ assert.match(b.results[0].opening_hours, /Mo-Fr 09:00-16:00/);++ assert.strictEqual(b.results[0].wheelchair, true);++ assert.strictEqual(b.results[0].osm_url, 'https://www.openstreetmap.org/node/101');++ assert.ok(b.results.some((x) => x.type_label === 'Soup kitchen'), 'a soup kitchen is labelled as one');++ assert.ok(b.results.some((x) => x.name === 'Free pantry box'), 'an unnamed one falls back to its type label');++ assert.strictEqual(b.counts.total, 4);++ assert.strictEqual(b.attribution.text, '© OpenStreetMap contributors');++ assert.strictEqual(b.attribution.url, 'https://www.openstreetmap.org/copyright');++ assert.strictEqual(b.attribution.license, 'ODbL 1.0');++ assert.match(b.fetched_at, /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/);++ assert.strictEqual(b.cached, false, 'the first search fetched');++ // One geocode and one area query: never a bulk download, and nothing else.++ assert.deepStrictEqual(osm.requests.map((q) => q.path).sort(), ['/search', OVERPASS].sort());++ assert.match(osm.requests.find((q) => q.path === OVERPASS).body, /around%3A\d+%2C39\.7817/);++ });++++ await check('the same place is not asked of OpenStreetMap twice: the second search is served from the cache', async () => {++ const before = osm.requests.length;++ const r = await t.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank');++ assert.strictEqual(r.status, 200, r.text);++ const b = r.json();++ assert.strictEqual(b.cached, true);++ assert.strictEqual(osm.requests.length, before, 'a cache hit makes no upstream request');++ assert.strictEqual(b.results.length, 4);++ assert.strictEqual(b.fetched_at, (await t.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank')).json().fetched_at, 'the cached fetched_at is kept');++ });++++ await check('grocery stores come with the budget mark, and a page shows the results and the attribution link', async () => {++ const r = await t.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=grocery');++ assert.strictEqual(r.status, 200, r.text);++ const b = r.json();++ const aldi = b.results.find((x) => x.name === 'Aldi');++ assert.ok(aldi, 'Aldi is listed');++ assert.strictEqual(aldi.budget, true, 'a discount chain is marked budget');++ assert.strictEqual(b.results.find((x) => x.name === 'Corner Market').budget, false);++ assert.strictEqual(b.results.find((x) => x.name === 'Dollar Tree').budget, true, 'a variety store is a budget store');++ assert.strictEqual(b.counts.budget_grocery, 2);++++ const pageRes = await t.get('/near?q=Springfield%2C%20Illinois&kind=grocery');++ assert.strictEqual(pageRes.status, 200);++ assert.match(pageRes.text, /Aldi/);++ assert.match(pageRes.text, /OpenStreetMap contributors/);++ assert.match(pageRes.text, /https:\/\/www\.openstreetmap\.org\/copyright/, 'the attribution is linked back');++ assert.match(pageRes.text, /https:\/\/opendatacommons\.org\/licenses\/odbl\/1-0\//, 'the ODbL is linked');++ assert.match(pageRes.text, /class="badge ok">budget</, 'the budget badge is shown');++ });++++ await check('a name from OpenStreetMap is escaped on the page, never taken as markup', async () => {++ osm.state.overpass = { ...osm.state.overpass, foodbank: { elements: [++ { type: 'node', id: 301, lat: 40.0, lon: -90.0, tags: { amenity: 'social_facility', social_facility: 'food_bank', name: '<script>alert(1)</script> Pantry', 'addr:city': 'Riverton' } },++ ] } };++ const api = await t.get('/api/v1/places?lat=40&lon=-90&kind=foodbank');++ assert.strictEqual(api.status, 200, api.text);++ assert.strictEqual(api.json().results[0].name, '<script>alert(1)</script> Pantry', 'the API hands back what OSM said');++++ const page = await t.get('/near?lat=40&lon=-90&kind=foodbank');++ assert.strictEqual(page.status, 200);++ assert.ok(page.text.includes('<script>alert(1)</script> Pantry'), 'the name is escaped on the page');++ assert.ok(!page.text.includes('<script>alert(1)</script>'), 'no live script reaches the page');++ });++++ await check('public reads need no token, and bad input is refused with a stable code', async () => {++ assert.strictEqual((await t.get('/api/v1/places?kind=foodbank')).status, 422, 'no q and no coordinates');++ const bad = await t.get('/api/v1/places?q=Springfield&kind=restaurants');++ assert.strictEqual(bad.status, 422);++ assert.match(bad.headers.get('content-type'), /application\/problem\+json/);++ assert.strictEqual(bad.json().code, 'food.place.invalid');++ const missing = await t.get('/api/v1/places?q=Nowhere%20At%20All');++ assert.strictEqual(missing.status, 404, 'a place Nominatim does not know');++ assert.strictEqual(missing.json().code, 'food.place.not_found');++ });++++ await check('when OSM cannot be reached the route says so and does not hang', async () => {++ osm.state.fail = true;++ const r = await t.get('/api/v1/places?lat=41&lon=-91&kind=foodbank');++ assert.strictEqual(r.status, 502);++ assert.strictEqual(r.json().code, 'food.place.upstream');++ const page = await t.get('/near?lat=41&lon=-91');++ assert.strictEqual(page.status, 200, 'the page still renders');++ assert.match(page.text, /the place service answered 503/, 'the page says what went wrong');++ osm.state.fail = false;++ });++ } finally {++ await t.close();++ await osm.close();++ }++++ // ── The pace: a boot of its own, with the policy's real one second ──++ const osm2 = await startOsm();++ const t2 = await boot({ env: { ...osm2.env, FOOD_OSM_MIN_INTERVAL_MS: '1000' } });++ try {++ await check('no two requests to the same OSM host start less than a second apart', async () => {++ const r = await t2.get(`/api/v1/places?q=${encodeURIComponent('Springfield, Illinois')}&kind=foodbank`);++ assert.strictEqual(r.status, 200, r.text);++ assert.strictEqual(osm2.requests.length, 2, JSON.stringify(osm2.requests));++ const gaps = osm2.gaps();++ assert.ok(gaps.length === 1 && gaps[0] >= 950, `the two calls were ${gaps[0]} ms apart`);++ });++++ await check('with no stand-in named, the service never reaches the real OpenStreetMap', async () => {++ // test/helpers/boot.js points both hosts at a closed local port; the call fails at once and says so.++ const offline = await boot();++ try {++ const r = await offline.get('/api/v1/places?lat=51.5&lon=-0.1&kind=foodbank');++ assert.strictEqual(r.status, 502);++ assert.strictEqual(r.json().code, 'food.place.upstream');++ assert.match(r.json().detail, /could not be reached/);++ } finally { await offline.close(); }++ });++++ await check('a caller cannot spend OpenStreetMap\'s budget: the place search is limited per caller', async () => {++ const limited = await boot({ env: { ...osm2.env, FOOD_OSM_MIN_INTERVAL_MS: '1' }, callerLimits: true, limitsNow: () => Date.UTC(2026, 9, 8, 12, 0, 0) });++ try {++ const from = { headers: { 'x-forwarded-for': '203.0.113.44' } };++ let refused = null;++ for (let i = 0; i < 11 && !refused; i++) refused = (await limited.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank', from)).status === 429 ? i + 1 : null;++ assert.strictEqual(refused, 11, 'the eleventh search in the minute is refused');++ const r = await limited.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank', from);++ assert.strictEqual(r.status, 429);++ assert.strictEqual(r.json().code, 'rate_limited');++ assert.ok(Number(r.headers.get('retry-after')) > 0);++ // Another caller is unaffected, and the food list is not part of the place budget.++ assert.strictEqual((await limited.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank', { headers: { 'x-forwarded-for': '203.0.113.45' } })).status, 200);++ assert.strictEqual((await limited.get('/api/v1/foods', from)).status, 200);++ } finally { await limited.close(); }++ });++ } finally {++ await t2.close();++ await osm2.close();++ }++ done();++})();nnew file mode 100644@@@ -0,0 +1,138 @@++'use strict';++/**++ * The meal planner: the arithmetic (deterministic, all six food groups, a budget is a cap, the total is the sum of++ * the packs), the API that saves a plan for the person who asked for it, and the page that renders and saves it++ * without JavaScript.++ */++const assert = require('assert');++const { boot, check, done } = require('./helpers/boot');++const { planMeals, PlanError } = require('../server/food/planner');++++const SAME = { 'sec-fetch-site': 'same-origin' };++const money = (n) => Math.round(n * 100) / 100;++++(async () => {++ await check('the plan is deterministic and its arithmetic adds up', () => {++ const a = planMeals({ people: 2, days: 3 });++ const b = planMeals({ people: 2, days: 3 });++ assert.deepStrictEqual(a.items, b.items, 'the same spec gives the same plan');++ assert.strictEqual(a.items.length, new Set(a.items.map((i) => i.slug)).size, 'no item twice');++++ const sum = money(a.items.reduce((n, i) => n + i.cost, 0));++ assert.strictEqual(a.totals.cost, sum, 'the total is the sum of the lines');++ for (const i of a.items) assert.strictEqual(i.cost, money(i.unit_cost * i.packs), `${i.slug} line`);++ assert.strictEqual(a.totals.cost_per_person_day, money(a.totals.cost / 6), 'cost a person a day');++ assert.strictEqual(a.totals.kcal, a.items.reduce((n, i) => n + i.kcal, 0));++ assert.strictEqual(a.totals.kcal_per_person_day, Math.round(a.totals.kcal / 6));++ assert.ok(a.totals.cost > 0 && a.totals.kcal_per_person_day > 500, JSON.stringify(a.totals));++ assert.strictEqual(a.days, 3);++ assert.strictEqual(a.menu.length, 3);++ for (const d of a.menu) assert.deepStrictEqual(Object.keys(d).sort(), ['breakfast', 'day', 'dinner', 'lunch', 'snack']);++ assert.strictEqual(a.shopping_list, a.items, 'the shopping list is the list');++ });++++ await check('a plan covers all six food groups with no budget, and says so', () => {++ const p = planMeals({ people: 4, days: 7 });++ assert.strictEqual(p.group_coverage.length, 6);++ assert.strictEqual(p.groups_covered, 6);++ assert.strictEqual(p.covers_all_groups, true);++ for (const g of p.group_coverage) {++ assert.ok(g.covered, `${g.group} is not covered`);++ assert.ok(g.packs >= 1 && g.cost > 0);++ }++ assert.ok(p.by_store.length >= 1);++ assert.ok(Math.abs(p.by_store.reduce((n, s) => n + s.cost, 0) - p.totals.cost) <= 0.02, 'the per-store totals are the total');++ });++++ await check('a budget is a hard cap; too small a budget buys the cheapest groups first and says what is missing', () => {++ const roomy = planMeals({ people: 1, days: 1, budget: 20 });++ assert.ok(roomy.totals.cost <= 20);++ assert.strictEqual(roomy.remaining_budget, money(20 - roomy.totals.cost));++++ const tight = planMeals({ people: 1, days: 1, budget: 2 });++ assert.ok(tight.totals.cost <= 2, `spent ${tight.totals.cost}`);++ assert.strictEqual(tight.covers_all_groups, false);++ assert.ok(tight.notes.some((n) => /budget did not stretch/.test(n)));++ assert.ok(tight.items.every((i) => i.unit_cost <= 2));++ });++++ await check('a spec that cannot be planned is refused, not silently changed', () => {++ assert.throws(() => planMeals({ people: 0 }), (e) => e instanceof PlanError && e.code === 'food.plan.invalid');++ assert.throws(() => planMeals({ days: 99 }), PlanError);++ assert.throws(() => planMeals({ budget: -3 }), PlanError);++ assert.strictEqual(planMeals({}).spec.people, 1, 'defaults');++ assert.strictEqual(planMeals({}).spec.days, 3);++ });++++ const t = await boot();++ const kim = t.network.addUser('kim');++ const lee = t.network.addUser('lee');++ try {++ await check('a signed-in person saves a plan and gets it back; the plan is theirs alone', async () => {++ const created = await t.get('/api/v1/plans', { as: kim, json: { people: 2, days: 4, budget: 60, title: 'Four days for two' }, headers: SAME });++ assert.strictEqual(created.status, 201, created.text);++ const body = created.json();++ assert.match(body.id, /^pln_/);++ assert.strictEqual(body.people, 2);++ assert.strictEqual(body.days, 4);++ assert.strictEqual(body.title, 'Four days for two');++ assert.strictEqual(body.plan.totals.cost, planMeals({ people: 2, days: 4, budget: 60 }).totals.cost, 'the saved plan is the generated one');++ assert.match(String(created.headers.get('location')), /^\/api\/v1\/plans\/pln_/);++++ const list = await t.get('/api/v1/plans', { as: kim });++ assert.strictEqual(list.status, 200);++ assert.deepStrictEqual(list.json().plans.map((p) => p.id), [body.id]);++ const one = await t.get(`/api/v1/plans/${body.id}`, { as: kim });++ assert.strictEqual(one.status, 200);++ assert.strictEqual(one.json().title, 'Four days for two');++++ const theirs = await t.get(`/api/v1/plans/${body.id}`, { as: lee });++ assert.strictEqual(theirs.status, 404, 'another person cannot see it');++ assert.deepStrictEqual((await t.get('/api/v1/plans', { as: lee })).json().plans, []);++ });++++ await check('a plan that makes no sense is a 422 problem, and an anonymous caller cannot write one', async () => {++ const bad = await t.get('/api/v1/plans', { as: kim, json: { people: 0 }, headers: SAME });++ assert.strictEqual(bad.status, 422);++ assert.strictEqual(bad.json().code, 'food.plan.invalid');++ const anon = await t.get('/api/v1/plans', { json: { people: 2, days: 3 } });++ assert.strictEqual(anon.status, 401, 'anonymous read of a write route');++ assert.strictEqual(anon.json().code, 'token.required');++ assert.deepStrictEqual((await t.get('/api/v1/plans')).json().code, 'token.required');++ });++++ await check('the /plan page plans without JavaScript and saves with one POST, then shows it was saved', async () => {++ const rendered = await t.get('/plan?people=3&days=2', { as: kim });++ assert.strictEqual(rendered.status, 200);++ assert.match(rendered.text, /3 people, 2 days/);++ assert.match(rendered.text, /The shopping list/);++ assert.match(rendered.text, /action="\/plan"/);++ assert.match(rendered.text, /Save this plan/, 'a signed-in visitor can save it');++++ const guest = await t.get('/plan');++ assert.match(guest.text, /Sign in<\/a> to save a plan/, 'a guest is told to sign in to save');++++ const posted = await t.get('/plan', { as: kim, method: 'POST', form: { people: '3', days: '2', title: 'Two days for three' }, headers: SAME });++ assert.strictEqual(posted.status, 303, posted.text.slice(0, 200));++ assert.match(String(posted.headers.get('location')), /^\/plan\?.*saved=pln_/);++++ const saved = (await t.get('/api/v1/plans', { as: kim })).json().plans;++ assert.ok(saved.some((p) => p.title === 'Two days for three'), 'the form saved it');++++ const back = await t.get(posted.headers.get('location'), { as: kim });++ assert.match(back.text, /Saved\./);++++ const mine = await t.get('/plan/saved', { as: kim });++ assert.strictEqual(mine.status, 200);++ assert.match(mine.text, /Two days for three/);++ const other = await t.get('/plan/saved', { as: lee });++ assert.ok(!other.text.includes('Two days for three'), 'lee sees none of kim\'s plans');++ });++++ await check('a cross-site form cannot save a plan for a signed-in visitor', async () => {++ const cross = await t.get('/plan', { as: kim, method: 'POST', form: { people: '2', days: '2' }, headers: { 'sec-fetch-site': 'cross-site' } });++ assert.strictEqual(cross.status, 403);++ });++ } finally { await t.close(); }++ done();++})();@@@ -46,6 +46,15 @@ const rel = (p, dir) => path.relative(dir, p).split(path.sep).join('/');const text = (p) => fs.readFileSync(p, 'utf8');(async () => {++ // This test is about the skeleton's generator, and only the skeleton can run it: it asserts that generating a++ // service rewrites the placeholders, and a generated service has none left to rewrite (its package name is++ // already its own, its vhost is already named). A generated service says so and skips, rather than reporting a++ // failure it cannot fix — the convention openvibe-shared/test-runner reads (`<label>: skipped (<why>)`), so the++ // file is listed with ○ and never counted as passed.++ if (JSON.parse(text(path.join(ROOT, 'package.json'))).name !== `openvibe-${token('ID')}`) {++ process.stdout.write('skeleton generator: skipped (this is a generated service, not the skeleton it came from; run it in OpenVibe.ServiceSkeleton)\n');++ return done();++ }const base = tmpDir('ov-new-service-');const dir = path.join(base, 'openvibe-sample');const printed = runGenerator(dir);
@@ -24,5 +24,18 @@ OV_OAUTH_CLIENT_SECRET=
@@ -24,5 +24,18 @@ OV_OAUTH_CLIENT_SECRET=
# OV_OAUTH_REDIRECT_URI=https://openvibe.food/auth/callback
# OV_OAUTH_REDIRECT_URI=https://openvibe.food/auth/callback
# FOOD_AUDIENCE=openvibe.food
# FOOD_AUDIENCE=openvibe.food
+# OpenStreetMap, the two services "food near you" stands on (server/food/places.js). Both are open data under ODbL 1.0
+# with published usage policies; server/food/upstream.js paces every call (one a second per host) and caches every
+# answer for FOOD_GEO_CACHE_TTL_MS. Tests point these at a stand-in (test/helpers/osm.js); never at the public hosts.
+#FOOD_NOMINATIM_URL=https://nominatim.openstreetmap.org
+#FOOD_OVERPASS_URL=https://overpass-api.de/api/interpreter
+# Identifies OpenVibe.Food to OSM, as both policies require. Defaults to OpenVibeFood/0.1 (+<BASE_URL>).
+#FOOD_OSM_USER_AGENT=
+# The pace between two requests to the same host, in ms (the policies ask for at least 1000).
+#FOOD_OSM_MIN_INTERVAL_MS=1000
+#FOOD_OSM_TIMEOUT_MS=25000
+# How long a geocode or an area answer is kept, in ms (default 7 days).
+#FOOD_GEO_CACHE_TTL_MS=604800000
+
# optional: defaults to true in production
# optional: defaults to true in production
# COOKIE_SECURE=true
# COOKIE_SECURE=true
@@ -2,6 +2,45 @@
@@ -2,6 +2,45 @@
What changed in OpenVibe.Food, newest first. Each site also publishes its patch notes at /updates.
What changed in OpenVibe.Food, newest first. Each site also publishes its patch notes at /updates.
+## 0.2.0 — 2026-10-08
+
+The product: everything food, in one service. The food tools move here from OpenVibe.Tools, without the Walmart page
+scraping that source also did.
+
+- **Find food near you** (`/near`, `GET /api/v1/places`): a place name (geocoded with Nominatim) or coordinates in,
+ food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores out of OpenStreetMap
+ (Overpass), with distance, address, opening hours, operator, phone, website and a link back to the object on OSM.
+ Every result page carries the OpenStreetMap attribution and the ODbL link ODbL requires.
+- **Inside the OSM usage policies** (`server/food/upstream.js`): we identify with `FOOD_OSM_USER_AGENT`, at most one
+ request a second per host (calls to a host queue behind each other), every answer cached in `food_geo_cache` for
+ 7 days, and only small `around:` radius queries — never a bulk download.
+- **Meal planner** (`/plan`, `POST /api/v1/plans`): for one person, a couple or a group, 1–14 days, covering the six
+ USDA MyPlate food groups from the ported food list, with a shopping list, the cheapest store per line, and an
+ estimated cost. Deterministic; a budget is a hard cap. Signed-in people can save plans (`food_plans`).
+- **Food database** (`/foods`, `/foods/:slug`, `GET /api/v1/foods[/:slug]`): the 42-item list ported from
+ OpenVibe.Tools' grocery source, with nutrition per serving and per 100 g (derived from the pack size the item's own
+ name states — and left out, not guessed, when it states no weight), the typical price band, and the chain-by-chain
+ comparison. Server-rendered and in the sitemap.
+- **Pantry** (`/pantry`, `GET`/`PUT /api/v1/pantry`): signed-in people keep what is in their cupboard (`food_pantry`)
+ and get a deterministic "what can I make" against ten basic recipes written for this service — clearly labelled
+ basic suggestions, no model call anywhere in this version.
+- **Discovery**: the sitemap now carries every food page, `/near`, `/plan` and `/foods`; llms.txt and llms-full.txt
+ list the same set; a pantry and a saved plan are never crawled.
+- **Capabilities and limits**: `food.place.read`, `food.food.read`, `food.plan.read|write`, `food.pantry.read|write`;
+ the place search has the tightest per-caller budget because it spends OpenStreetMap's shared request budget.
+- **Tests**: a stand-in Nominatim + Overpass (`test/helpers/osm.js`) — the suite never calls the internet — covering
+ the results and the attribution, the one-request-a-second queue, cache hits, the per-caller limit on the search, the
+ meal-plan arithmetic, the pantry match, signed-in saves, anonymous refusals and the escaping of an OSM name.
+
+Also:
+
+- `test/skeleton.test.js` now skips itself inside a generated service. It asserts that the skeleton's generator
+ rewrites its placeholders, which a generated service has none of; it was already failing before this change.
+- `test/helpers/boot.js` points the two OSM hosts at a closed local port unless a test names a stand-in, so no test
+ can reach the real Nominatim or Overpass.
+- The home page's CSS budget was raised from 16.5 to 18 KB: the product's own pages brought their stylesheet with them
+ (search and plan forms, place cards, the pantry tick list).
+
## 0.1.0 — 2026-10-08
## 0.1.0 — 2026-10-08
- **First release:** the service starts from the OpenVibe skeleton — sign-in with OpenVibe.Network (OAuth 2 + PKCE), server-rendered pages through the OpenVibe Frame, the `/api/v1` mount with per-caller limits, crawl artifacts, PostgreSQL migrations, the deploy files and the test suite.
- **First release:** the service starts from the OpenVibe skeleton — sign-in with OpenVibe.Network (OAuth 2 + PKCE), server-rendered pages through the OpenVibe Frame, the `/api/v1` mount with per-caller limits, crawl artifacts, PostgreSQL migrations, the deploy files and the test suite.
@@ -2,48 +2,83 @@
@@ -2,48 +2,83 @@
> What should we eat?
> What should we eat?
-**Status:** skeleton. It runs, it is tested, and its pages and API are live — but the product itself is not written yet.
+**Status:** the product works — food near you, a meal planner, the food database and the pantry are live and tested.
+Delivery comparison and recipes from the network's AI (the manifests' other pillars) are not built yet.
+
**Domain:** `openvibe.food` · **Port:** 4970 · **Service id:** `food` · **Env prefix:** `FOOD`
**Domain:** `openvibe.food` · **Port:** 4970 · **Service id:** `food` · **Env prefix:** `FOOD`
**License:** AGPL-3.0 (same as every OpenVibe service).
**License:** AGPL-3.0 (same as every OpenVibe service).
-## What is already here
+## What it does
| Piece | Where | What it does |
| Piece | Where | What it does |
|---|---|---|
|---|---|---|
-| Config | [server/config.js](server/config.js) | Every value from the environment; `load(env)` is pure so tests build a config without touching `process.env` |
-| App | [server/app.js](server/app.js) | helmet (CSP, frame-ancestors none), the Network session middleware, `/auth`, the legal pages, static assets, the `/api/v1` mount, the 404 and the error handler |
-| Sign-in | [server/auth/sso.js](server/auth/sso.js) | OAuth 2 authorization code with PKCE (S256) against OpenVibe.Network; httpOnly `food_at` / `food_rt` cookies; `/auth/me` for the shared navbar |
-| Signing key | [server/auth/keys.js](server/auth/keys.js) | The Network JWKS through `openvibe-sdk/auth`, kept fresh, verified offline |
-| Who is calling | [server/http/principal.js](server/http/principal.js) | `req.principal`: a person, an app/agent/service with a capability, or anonymous |
-| API | [server/http/api.js](server/http/api.js) | `GET /api/v1/ping`; the router, the problem+json errors and the guards are wired for the product's routes |
-| Pages | [server/http/pages.js](server/http/pages.js), [server/render/](server/render/) | The home page and `/updates`, server-rendered through `openvibe-shared/shell`, readable without JavaScript |
-| Discovery | [server/http/discovery.js](server/http/discovery.js) | `robots.txt`, `sitemap.xml`, `llms.txt`, `llms-full.txt` and the home page's JSON-LD |
-| Limits | [server/http/caller-limits.js](server/http/caller-limits.js), [deploy/nginx/](deploy/nginx/) | Per-caller limits at the API and per-address limits at nginx |
-| Health | [server/observability.js](server/observability.js) | `/api/health`, a truthful `/api/ready` (the database is required) and Prometheus metrics on loopback only |
-| Database | [server/db.js](server/db.js), [migrations/](migrations/) | PostgreSQL through `openvibe-sdk/db`; `NNNN_*.sql` applied at boot; PGlite in development |
-| Process | [server/index.js](server/index.js) | Listens on `PORT`, and stops gracefully through `openvibe-sdk/service` |
-| Deploy | [deploy/nginx/openvibe.food.conf](deploy/nginx/openvibe.food.conf), [deploy/systemd/openvibe-food.service](deploy/systemd/openvibe-food.service) | nginx vhost and systemd unit (port 4970, `/opt/openvibe.food`, `/etc/openvibe/food.env`) |
-| Tests | [test/](test/) | `npm test`: every `test/*.test.js` in its own process, on a temp PGlite database with an in-process mock of OpenVibe.Network |
+| Food near you | [/near](server/http/pages.js), [server/food/places.js](server/food/places.js) | A place name or coordinates → the food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores around it, from OpenStreetMap through Overpass, with distance, address, opening hours and a link back to the object |
+| Meal planner | [/plan](server/http/pages.js), [server/food/planner.js](server/food/planner.js) | One person, a couple or a group, 1–14 days: one item from each of the six USDA MyPlate food groups, cheapest per gram first, then the best calories a dollar, with a shopping list, the cheapest store per line and an estimated cost. Deterministic, and a budget is a hard cap |
+| Food database | [/foods, /foods/:slug](server/http/pages.js), [server/food/foods.js](server/food/foods.js) | 42 items with nutrition per serving and per 100 g, the typical price band and the chain-by-chain comparison; server-rendered and in the sitemap |
+| Pantry | [/pantry](server/http/pages.js), [server/food/pantry-match.js](server/food/pantry-match.js) | Signed in, keep what is in your cupboard and see which basic recipes you can make now, and what one more item would unlock. Deterministic; no model call |
+| The OpenStreetMap client | [server/food/upstream.js](server/food/upstream.js) | The only outbound calls this service makes: paced, cached, identified, bounded |
+| Store | [server/food/store.js](server/food/store.js), [migrations/](migrations/) | `food_geo_cache`, `food_plans`, `food_pantry` |
+| Platform | the skeleton | Sign-in with OpenVibe.Network, the OpenVibe Frame, limits, readiness, discovery, deploy files |
+
+Everything is server-rendered and works without JavaScript: the search is a GET form, saving a plan and a cupboard is
+a plain POST, and every page is complete as it leaves the server.
## API
## API
| Route | Who | |
| Route | Who | |
|---|---|---|
|---|---|---|
| `GET /api/v1/ping` | anyone | `{ ok: true, service: "food" }` |
| `GET /api/v1/ping` | anyone | `{ ok: true, service: "food" }` |
-
-Everything else the site serves is a page. The product adds its routes in [server/http/api.js](server/http/api.js), naming
-each route's capability in [server/http/principal.js](server/http/principal.js) (`CAPABILITIES`) and its numbers in
-[server/http/caller-limits.js](server/http/caller-limits.js) (`BUDGETS`).
-
-**Who can call it:** a person, with their Network token as a Bearer or this site's session; or an app, agent or service
-with a Network token for audience `openvibe.food` that holds the route's capability. A write made with the session cookie
-must come from `openvibe.food` itself. **Errors** are RFC 9457 `application/problem+json` with a stable `code`.
+| `GET /api/v1/places?q=&kind=foodbank\|grocery\|both[&lat=&lon=&radius=&limit=]` | anyone | food near a place; every answer carries the ODbL attribution |
+| `GET /api/v1/foods[?group=&q=]` | anyone | the food list |
+| `GET /api/v1/foods/:slug` | anyone | one food, with the chain-by-chain prices |
+| `POST /api/v1/plans` | signed in | plan and save: `{ people, days, budget?, title? }` → 201 with the plan |
+| `GET /api/v1/plans`, `GET /api/v1/plans/:id` | signed in | your plans, newest first |
+| `GET /api/v1/pantry` | signed in | your cupboard, with the "what can I make" suggestions |
+| `PUT /api/v1/pantry` | signed in | replace it: `{ items: ["eggs-dozen", …] }` |
+
+Public reads need no token. A person's own data (a plan, a pantry) needs a signed-in caller; an app, agent or service
+token needs the route's capability (`food.place.read`, `food.food.read`, `food.plan.read|write`,
+`food.pantry.read|write` — [server/http/principal.js](server/http/principal.js)). A write made with the session cookie
+must come from `openvibe.food` itself. Errors are RFC 9457 `application/problem+json` with a stable `code`.
+
+**Per-caller limits** ([server/http/caller-limits.js](server/http/caller-limits.js)): reads take `FOOD_LIMITS_MINUTE` /
+`FOOD_LIMITS_HOUR`; the place search, which spends OpenStreetMap's shared request budget, has its own tighter numbers,
+as do saving a plan and replacing a pantry.
+
+## Data sources and their terms
+
+**OpenStreetMap** (food banks, stores) — [openstreetmap.org](https://www.openstreetmap.org/) © OpenStreetMap
+contributors, [ODbL 1.0](https://opendatacommons.org/licenses/odbl/1-0/). Read from
+[Nominatim](https://nominatim.org/) (a place name → coordinates) and the [Overpass API](https://overpass-api.de/)
+(the database). Both have published usage policies, and this service stays inside them:
+
+- it identifies itself with `FOOD_OSM_USER_AGENT` (`OpenVibeFood/0.1 (+https://openvibe.food)`), never a browser's;
+- it makes **at most one request a second per host** — calls to the same host queue behind each other, so the service
+ cannot burst at Nominatim however many visitors arrive at once;
+- it **caches every answer** in `food_geo_cache` for 7 days (`FOOD_GEO_CACHE_TTL_MS`): a place is geocoded once and an
+ area is queried once, not once per visitor;
+- it only ever asks for a small radius around a point (`around:`), never a bulk download, and never fetches a URL a
+ caller typed;
+- the attribution and the ODbL link appear on every page that shows a result, and in every API answer.
+
+**The food list and its prices** — carried over unchanged from OpenVibe.Tools' grocery source
+(`OpenVibe.Tools/apps/maps/server/sources/grocery.js`), where the food tools live today: typical 2025 US (Washington)
+prices for five budget chains and the USDA MyPlate groups. They are a band to plan by, **never a live price**. The
+Walmart page scraping that source also did is deliberately not ported: this service never scrapes a retail site.
+
+**Nutrition** — the same source's typical values per serving. "Per 100 g" is arithmetic on the pack size stated in an
+item's own name divided by its servings (for example a 15 oz can with 3.5 servings is 121 g a serving). Where a name
+states no weight — a dozen eggs, a 12-pack of ramen — no per-100 g figure is given rather than a density guessed.
+The nutrition figures are the source's, not analysed here, and are not dietary advice.
+
+**Recipes** — ten simple combinations written for this service in plain words, using only items from the food list.
+No copied recipe text. They are labelled "basic suggestions" wherever they appear.
## Configuration
## Configuration
See [.env.example](.env.example). Required in production: `OV_OAUTH_CLIENT_SECRET` (the `food` OAuth client on the
See [.env.example](.env.example). Required in production: `OV_OAUTH_CLIENT_SECRET` (the `food` OAuth client on the
-Network), `BASE_URL`, `DATABASE_URL` and `DATABASE_DIRECT_URL`. The database is the only required readiness check; the
-Network signing key, the OAuth client and Valkey are optional (the service says so, per check, on `/api/ready`).
+Network), `BASE_URL`, `DATABASE_URL` and `DATABASE_DIRECT_URL`. `FOOD_NOMINATIM_URL` and `FOOD_OVERPASS_URL` default
+to the public OSM hosts; tests point them at a stand-in and never reach the internet.
## Development
## Development
@@ -72,8 +107,9 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md).
@@ -72,8 +107,9 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md).
- Session tokens are httpOnly cookies; a FedCM assertion or an app or service token is never a session.
- Session tokens are httpOnly cookies; a FedCM assertion or an app or service token is never a session.
- Secrets live only in the env file; only environment variable names appear in code and docs, and no secret is logged.
- Secrets live only in the env file; only environment variable names appear in code and docs, and no secret is logged.
- Request bodies are never logged.
- Request bodies are never logged.
-- Nothing in a request may decide a URL this service fetches: a caller's URL goes to OpenVibe.Tools, whose own guard
- decides what may be fetched.
+- The only two hosts this service fetches are the OSM ones named in the configuration: a URL built from that base, and
+ nothing a caller sends. A place name is data in a query string, never a URL.
+- Nothing a person keeps here (a plan, a pantry) is public, cached or crawled.
---
---
@@ -1,8 +1,8 @@
@@ -1,8 +1,8 @@
{
{
- "stage": "skeleton",
+ "stage": "product",
"code": true,
"code": true,
"wave": "W20",
"wave": "W20",
- "plan": "OpenVibe.Food starts from the OpenVibe service skeleton; the product's own plan is written here when it is",
+ "plan": "The food tools move here from OpenVibe.Tools (apps/maps grocery source, the food proxy app), ported as clean modules without the Walmart page scraping. The manifests' other pillars — delivery comparison and meal kits, cupboard recipes with the network's AI — are still to come.",
"runtime": "node 22, express 4, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
"runtime": "node 22, express 4, PostgreSQL 18 (openvibe-sdk/db, async) + Valkey 9",
"port": "4970",
"port": "4970",
"domain": "openvibe.food",
"domain": "openvibe.food",
@@ -14,32 +14,40 @@
@@ -14,32 +14,40 @@
"openvibe-sdk v0.35.2",
"openvibe-sdk v0.35.2",
"openvibe-shared v2.14.0"
"openvibe-shared v2.14.0"
],
],
- "summary": "OpenVibe.Food — What should we eat? A new OpenVibe service on the shared skeleton, not deployed yet: sign-in with OpenVibe.Network (OAuth 2 + PKCE, httpOnly session cookies), server-rendered pages through the OpenVibe Frame, the /api/v1 mount with per-caller limits, crawl artifacts, PostgreSQL migrations applied at boot, the nginx and systemd deploy files and a test suite on PGlite with a mock Network.",
+ "summary": "OpenVibe.Food — What should we eat? Food near you (food banks, pantries and budget grocery stores from OpenStreetMap, paced and cached to stay inside the OSM usage policies), a deterministic meal planner with a shopping list and an estimated cost, a 42-item food database with nutrition per serving and per 100 g, and a pantry with a plain 'what can I make' against ten basic recipes. Server-rendered pages, an API at /api/v1, per-caller limits on the place search, and a test suite that never calls the internet.",
"works": [
"works": [
- "Sign-in with OpenVibe.Network (PKCE S256, server-side code exchange, httpOnly session cookies)",
- "Server-rendered pages: the home page and /updates, through the OpenVibe Frame, complete without JavaScript",
- "Crawl artifacts: robots.txt, sitemap.xml, llms.txt, llms-full.txt and the home page's JSON-LD",
- "The API mount at /api/v1 with the problem+json error shape, the per-address limits and the per-caller limits",
- "Capability verification for app, agent and service tokens (audience openvibe.food) and for a person's own token",
- "Truthful readiness (/api/ready: the database is required) and Prometheus metrics on loopback",
- "PostgreSQL with migrations/NNNN_*.sql (openvibe-sdk/db); PGlite in development",
- "Deploy files: deploy/nginx/openvibe.food.conf and deploy/systemd/openvibe-food.service",
- "Tests on a temp PGlite database with an in-process mock of OpenVibe.Network"
+ "Food near you: /near and GET /api/v1/places — a place name (Nominatim) or coordinates, food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores from Overpass, with distance, address, opening hours and operator",
+ "The OpenStreetMap attribution and the ODbL link on every result page and in every place answer, as ODbL requires",
+ "Inside the Nominatim and Overpass usage policies: the User-Agent identifies us, at most one request a second per host through an in-process queue, every answer cached in food_geo_cache for 7 days, only small around: radius queries, never a bulk download",
+ "Meal planner: /plan and POST /api/v1/plans — one person, a couple or a group for 1–14 days, all six MyPlate groups, a shopping list, the cheapest store per line and an estimated cost; deterministic, with a budget as a hard cap",
+ "Signed-in people save plans (food_plans) and keep a pantry (food_pantry)",
+ "The food list at /foods and /foods/:slug (and GET /api/v1/foods[/:slug]): nutrition per serving and per 100 g, the typical price band and the chain-by-chain comparison, server-rendered",
+ "Pantry matching: GET/PUT /api/v1/pantry and /pantry — a deterministic 'what can I make' against ten basic recipes, clearly labelled basic suggestions, no AI call",
+ "Discovery: the sitemap carries every food page, /near, /plan and /foods; llms.txt and llms-full.txt list the same set; a pantry and a saved plan are never crawled",
+ "Capabilities (food.place.read, food.food.read, food.plan.read|write, food.pantry.read|write) and per-caller limits, with the tightest budget on the place search because it spends OpenStreetMap's shared request budget",
+ "Tests with a stand-in Nominatim and Overpass: results and attribution, the one-request-a-second queue, cache hits, escaping of an OSM name, the search's per-caller limit, the plan's arithmetic, the pantry match, signed-in saves and anonymous refusals",
+ "Sign-in with OpenVibe.Network (PKCE S256, httpOnly session cookies), the OpenVibe Frame, PostgreSQL migrations applied at boot, deploy files"
],
],
"notYet": [
"notYet": [
- "The product itself: its tables and migrations, its capabilities, its routes in server/http/api.js and its pages in server/http/pages.js",
- "Its service and capability manifests in openvibe-contracts (contracts-service is food)",
- "A deployment: the service is not registered with OpenVibe.Services nor deployed by OpenVibe.Host"
+ "Delivery-price comparison across delivery apps, and meal kits and boxes (the manifests' other pillars)",
+ "Recipes from the cupboard with the network's AI: this version is deterministic matching against ten recipes written by hand",
+ "A 'food near me' from the browser's location (only a place name or explicit coordinates today)",
+ "Fresh/live grocery prices: the price bands are typical 2025 US prices carried over from OpenVibe.Tools, not a live price",
+ "Its service and capability manifests in openvibe-contracts (contracts-service is food), and a deployment"
],
],
"capabilitiesRegistered": false,
"capabilitiesRegistered": false,
"serviceManifestRegistered": false,
"serviceManifestRegistered": false,
"deployed": false,
"deployed": false,
"placeholderInSites": false,
"placeholderInSites": false,
"features": [
"features": [
+ "food near you (OpenStreetMap: food banks, pantries, budget grocery stores)",
+ "meal planner with a shopping list and estimated cost",
+ "food database with nutrition per serving and per 100 g",
+ "pantry and 'what can I make'",
+ "signed-in saving of plans and pantries",
+ "public API with per-caller limits",
+ "server-rendered pages and crawl artifacts",
"Network sign-in",
"Network sign-in",
- "server-rendered pages",
- "api mount",
- "limits and readiness",
"deploy files"
"deploy files"
],
],
"updated": "2026-10-08"
"updated": "2026-10-08"
new file mode 100644
new file mode 100644
@@ -0,0 +1,34 @@
@@ -0,0 +1,34 @@
+-- phase: expand
+-- OpenVibe.Food: where the product's own data lives. Nothing here is ever a credential, a key or a token.
+--
+-- food_geo_cache every Nominatim geocode and Overpass answer, with its TTL (7 days), so the two OSM services are
+-- asked once for a place and not once per visitor (their usage policies; server/food/upstream.js)
+-- food_plans a saved meal plan, as the planner returned it (server/food/planner.js), with the spec beside it
+-- food_pantry what one person says is in their cupboard, one row per food in the list (server/food/foods.js)
+
+CREATE TABLE food_geo_cache (
+ key text COLLATE "C" PRIMARY KEY, -- 'nominatim:<query>' | 'overpass:<sha256 of the query>'
+ body jsonb NOT NULL, -- the upstream answer, as it came
+ fetched_at text COLLATE "C" NOT NULL, -- when it was fetched (ISO 8601, UTC)
+ expires_at text COLLATE "C" NOT NULL -- ISO 8601, UTC: past it the row is ignored and replaced
+);
+CREATE INDEX food_geo_cache_expires ON food_geo_cache (expires_at);
+
+CREATE TABLE food_plans (
+ id text COLLATE "C" PRIMARY KEY, -- pln_<ULID>
+ owner text COLLATE "C" NOT NULL, -- user:usr_…
+ title text,
+ people integer NOT NULL,
+ days integer NOT NULL,
+ budget double precision, -- the caller's budget, when one was given
+ plan jsonb NOT NULL, -- the plan the planner returned, unchanged
+ created_at text COLLATE "C" NOT NULL
+);
+CREATE INDEX food_plans_by_owner ON food_plans (owner, id DESC);
+
+CREATE TABLE food_pantry (
+ owner text COLLATE "C" NOT NULL, -- user:usr_…
+ item text COLLATE "C" NOT NULL, -- the food's slug in server/food/foods.js
+ added_at text COLLATE "C" NOT NULL,
+ PRIMARY KEY (owner, item)
+);
@@ -42,3 +42,19 @@ form.inline { display: inline; }
@@ -42,3 +42,19 @@ form.inline { display: inline; }
.page .sc-ic .ov-icon { --ovi-size: 28px !important; }
.page .sc-ic .ov-icon { --ovi-size: 28px !important; }
button.sc-btn { background: transparent; }
button.sc-btn { background: transparent; }
button.sc-btn.sc-primary { border: 0; }
button.sc-btn.sc-primary { border: 0; }
+
+/* The product's own pieces: search, results, plan, cupboard. Plain, and readable without JavaScript. */
+.ov-form { display: flex; flex-wrap: wrap; gap: 8px 12px; align-items: end; margin: 14px 0; }
+.ov-form label { display: block; font-size: .85rem; color: var(--text-secondary, #96a7c2); }
+.ov-form input, .ov-form select { font: inherit; padding: 7px 9px; border-radius: 8px; border: 1px solid var(--border-light, #2c3d5c); background: var(--bg-secondary, #0f1729); color: inherit; }
+.ov-form input[type=search] { min-width: 240px; }
+.ov-form input[type=number] { width: 120px; }
+.places { list-style: none; padding: 0; margin: 12px 0; display: grid; gap: 10px; grid-template-columns: repeat(auto-fill, minmax(300px, 1fr)); }
+.place { border: 1px solid var(--border, #1f2d47); border-radius: 10px; padding: 10px 12px; background: var(--bg-card, #131c2e); }
+.attribution { border-top: 1px solid var(--border, #1f2d47); padding-top: 8px; margin-top: 16px; }
+.stats { list-style: none; padding: 0; display: flex; flex-wrap: wrap; gap: 10px; }
+.stats li { border: 1px solid var(--border, #1f2d47); border-radius: 10px; padding: 8px 12px; background: var(--bg-card, #131c2e); }
+.stats b { display: block; font-size: 1.15rem; }
+.pantry-form fieldset { border: 1px solid var(--border, #1f2d47); border-radius: 10px; margin: 10px 0; }
+.pantry-item { display: inline-block; min-width: 240px; margin: 2px 10px 2px 0; font-size: .92rem; }
+.lede { color: var(--text-secondary, #96a7c2); max-width: 72ch; }
@@ -4,14 +4,15 @@
@@ -4,14 +4,15 @@
* OpenVibe.Food — Express app factory; server/index.js listens, tests build their own instance with a temp database
* OpenVibe.Food — Express app factory; server/index.js listens, tests build their own instance with a temp database
* and a mock Network.
* and a mock Network.
*
*
- * /, /updates the pages (http/pages.js)
+ * /, /near, /plan, /foods, /foods/:slug, /pantry, /updates the pages (http/pages.js)
* /api/v1/* the API (http/api.js)
* /api/v1/* the API (http/api.js)
* /auth/* Network SSO with PKCE (auth/sso.js)
* /auth/* Network SSO with PKCE (auth/sso.js)
* /api/health, /api/ready, /release.json, /metrics (loopback only)
* /api/health, /api/ready, /release.json, /metrics (loopback only)
*
*
- * The product fills this in: its routes in http/api.js, its pages in http/pages.js, its capabilities in
- * http/principal.js and its budgets in http/caller-limits.js. The plumbing here (helmet, SSO, legal pages,
- * static assets, the API mount, the 404 and the error handler) stays.
+ * The product's own logic lives in server/food/: the food list (foods.js), the meal planner (planner.js), the
+ * OpenStreetMap place search and its paced, cached client (places.js, upstream.js), the pantry match and its recipes
+ * (pantry-match.js, recipes.js) and the store for plans, pantry and the geocode cache (store.js). The plumbing here
+ * (helmet, SSO, legal pages, static assets, the API mount, the 404 and the error handler) stays the skeleton's.
*/
*/
const path = require('path');
const path = require('path');
const express = require('express');
const express = require('express');
@@ -26,6 +27,8 @@ const { openStore } = require('./db');
@@ -26,6 +27,8 @@ const { openStore } = require('./db');
const { createKeyStore } = require('./auth/keys');
const { createKeyStore } = require('./auth/keys');
const { createSso } = require('./auth/sso');
const { createSso } = require('./auth/sso');
const { createPrincipal } = require('./http/principal');
const { createPrincipal } = require('./http/principal');
+const { createUpstream } = require('./food/upstream');
+const foodStore = require('./food/store');
const { createApi } = require('./http/api');
const { createApi } = require('./http/api');
const { createPageRoutes } = require('./http/pages');
const { createPageRoutes } = require('./http/pages');
const { createServiceReadiness } = require('./observability');
const { createServiceReadiness } = require('./observability');
@@ -50,6 +53,12 @@ async function createApp(opts = {}) {
@@ -50,6 +53,12 @@ async function createApp(opts = {}) {
const sso = createSso({ config, keys, fetchImpl, now: s.now, log });
const sso = createSso({ config, keys, fetchImpl, now: s.now, log });
const principal = createPrincipal({ config, keys });
const principal = createPrincipal({ config, keys });
const ctx = { config, s, keys, sso, principal, log };
const ctx = { config, s, keys, sso, principal, log };
+ // The only outbound client this service has (Nominatim + Overpass, paced and cached); the pages and the API get
+ // it from here, so every test points it at a stand-in through FOOD_NOMINATIM_URL / FOOD_OVERPASS_URL.
+ // Its own wall clock, not the store's: the pace between two calls must not depend on an injected test clock.
+ ctx.upstream = createUpstream({ config, s, fetchImpl, log });
+ // Drop expired geocode/area answers; an expired row is ignored anyway, this only keeps the table small.
+ Promise.resolve(foodStore.cachePrune(s)).catch((err) => log.warn('[OpenVibe.Food] geo cache prune:', err && err.message));
const app = express();
const app = express();
app.disable('x-powered-by');
app.disable('x-powered-by');
@@ -38,6 +38,22 @@ function load(env = process.env) {
@@ -38,6 +38,22 @@ function load(env = process.env) {
db: { url: env.DATABASE_URL || '', directUrl: env.DATABASE_DIRECT_URL || '', pgliteDir: env.FOOD_PGLITE_DIR || '' },
db: { url: env.DATABASE_URL || '', directUrl: env.DATABASE_DIRECT_URL || '', pgliteDir: env.FOOD_PGLITE_DIR || '' },
valkey: { url: env.VALKEY_URL || '', prefix: env.VALKEY_PREFIX || 'ov:food:' },
valkey: { url: env.VALKEY_URL || '', prefix: env.VALKEY_PREFIX || 'ov:food:' },
+ // The two OpenStreetMap services "food near you" stands on (server/food/places.js). Both are open data with
+ // published usage policies: Nominatim at most one request a second, Overpass small bounded area queries —
+ // server/food/upstream.js paces every call to one host at a time and caches every answer for geoCacheTtlMs.
+ osm: {
+ nominatimUrl: trim(env.FOOD_NOMINATIM_URL || 'https://nominatim.openstreetmap.org'),
+ overpassUrl: trim(env.FOOD_OVERPASS_URL || 'https://overpass-api.de/api/interpreter'),
+ // Identify to OSM with a contact URL, as both policies require; never a browser User-Agent.
+ userAgent: env.FOOD_OSM_USER_AGENT || `OpenVibeFood/0.1 (+${baseUrl})`,
+ minIntervalMs: Math.max(0, int(env.FOOD_OSM_MIN_INTERVAL_MS, 1000)),
+ timeoutMs: Math.max(1000, int(env.FOOD_OSM_TIMEOUT_MS, 25_000)),
+ cacheTtlMs: Math.max(60_000, int(env.FOOD_GEO_CACHE_TTL_MS, 7 * 24 * 60 * 60 * 1000)),
+ defaultRadiusKm: 8,
+ maxRadiusKm: 50,
+ maxResults: 60,
+ },
+
// OpenVibe.Network: SSO (OAuth2 authorization server with PKCE) and its JWKS.
// OpenVibe.Network: SSO (OAuth2 authorization server with PKCE) and its JWKS.
networkUrl,
networkUrl,
networkInternalUrl: trim(env.OV_NETWORK_INTERNAL_URL || 'http://127.0.0.1:4000'),
networkInternalUrl: trim(env.OV_NETWORK_INTERNAL_URL || 'http://127.0.0.1:4000'),
new file mode 100644
new file mode 100644
@@ -0,0 +1,245 @@
@@ -0,0 +1,245 @@
+'use strict';
+
+/**
+ * The food list: what a person can plan a week of meals from, with the nutrition and the typical price behind each
+ * item. Every page and the meal planner read it here; nothing else in this service holds food data.
+ *
+ * Ported from OpenVibe.Tools' grocery source (OpenVibe.Tools/apps/maps/server/sources/grocery.js), where the food
+ * tools live today. The Walmart page scraping that source also did is deliberately *not* ported: this service never
+ * scrapes a retail site. The prices are the same hand-kept typical 2025 US (Washington) prices, carried over
+ * unchanged; they are a band to plan by, never a live price.
+ *
+ * "Per 100 g" is arithmetic on data we already have: the pack size stated in the item's own name divided by its
+ * servings gives grams per serving (server/food/foods.js packGrams). Where the name states no weight (a dozen eggs,
+ * a 12-pack of ramen) there is no per-100 g figure and the pages say so rather than guessing a density.
+ */
+
+// id, name, group, servings, serving size, kcal, protein g, carbs g, fat g, fiber g, shelf stable, tags
+const ROWS = [
+ // protein
+ ['eggs-dozen', 'Large Eggs (1 dozen)', 'protein', 12, '1 egg', 70, 6, 0.5, 5, 0, false, 'breakfast,versatile,complete-protein'],
+ ['chicken-breast', 'Chicken Breasts (per lb)', 'protein', 3, '5 oz', 165, 31, 0, 3.6, 0, false, 'lean,high-protein'],
+ ['canned-tuna', 'Canned Tuna (5 oz)', 'protein', 2.5, '2 oz', 60, 13, 0, 0.5, 0, true, 'shelf-stable,lightweight,omega-3'],
+ ['peanut-butter', 'Peanut Butter (16 oz)', 'protein', 15, '2 tbsp', 190, 7, 7, 16, 2, true, 'shelf-stable,calorie-dense'],
+ ['dried-beans', 'Dried Pinto Beans (1 lb)', 'protein', 12, '1/4 cup dry', 150, 10, 28, 0.5, 10, true, 'shelf-stable,fiber,cheap-protein'],
+ ['canned-beans', 'Canned Black Beans (15 oz)', 'protein', 3.5, '1/2 cup', 110, 7, 20, 0.5, 8, true, 'shelf-stable,fiber,ready-to-eat'],
+ ['hot-dogs', 'Hot Dogs (8 ct, 12 oz)', 'protein', 8, '1 frank', 150, 5, 2, 13, 0, false, 'easy-cook,budget-king'],
+ ['ground-beef', 'Ground Beef 73/27 (1 lb)', 'protein', 4, '4 oz', 280, 19, 0, 23, 0, false, 'high-calorie,iron-rich'],
+ ['canned-soup', 'Canned Soup, Chicken Noodle (10.5 oz)', 'protein', 2.5, '1/2 can', 60, 3, 8, 2, 1, true, 'shelf-stable,heat-and-eat'],
+ ['canned-chili', 'Canned Chili with Beans (15 oz)', 'protein', 2, '1 cup', 240, 16, 25, 8, 7, true, 'shelf-stable,high-protein,complete-meal'],
+ ['sardines', 'Sardines (3.75 oz tin)', 'protein', 2, '~3 fish', 120, 13, 0, 7, 0, true, 'shelf-stable,omega-3,no-cook'],
+ // grains
+ ['ramen-12pk', 'Ramen Noodles (12 pack)', 'grains', 12, '1 packet', 188, 4, 26, 7, 1, true, 'shelf-stable,just-add-water'],
+ ['white-rice', 'Long Grain White Rice (2 lb)', 'grains', 20, '1/4 cup dry', 160, 3, 36, 0, 0, true, 'shelf-stable,bulk-calories,versatile'],
+ ['spaghetti', 'Spaghetti (16 oz)', 'grains', 8, '2 oz dry', 200, 7, 41, 1, 2, true, 'shelf-stable,energy-dense'],
+ ['bread-white', 'White Bread (20 oz)', 'grains', 20, '1 slice', 65, 2, 13, 1, 0.5, false, 'sandwich-base,breakfast'],
+ ['oatmeal', 'Oats, Old Fashioned (42 oz)', 'grains', 30, '1/2 cup dry', 150, 5, 27, 3, 4, true, 'shelf-stable,fiber,breakfast'],
+ ['tortillas', 'Flour Tortillas (10 ct)', 'grains', 10, '1 tortilla', 140, 4, 24, 3, 1, false, 'wraps,versatile,no-cook'],
+ ['jiffy-mix', 'Corn Muffin Mix (8.5 oz)', 'grains', 6, '1 muffin', 180, 3, 28, 5, 1, true, 'shelf-stable,baking'],
+ ['mac-cheese', 'Mac & Cheese Box (7.25 oz)', 'grains', 3, '1 cup prepared', 220, 8, 48, 2, 2, true, 'shelf-stable,kid-friendly'],
+ ['granola-bars', 'Granola Bars (6 ct)', 'grains', 6, '1 bar', 100, 2, 19, 3, 1, true, 'shelf-stable,portable'],
+ ['instant-coffee', 'Instant Coffee (8 oz jar)', 'grains', 120, '1 tsp', 0, 0, 0, 0, 0, true, 'shelf-stable,no-calories'],
+ // vegetables
+ ['potatoes-5lb', 'Russet Potatoes (5 lb)', 'vegetables', 10, '1 medium', 160, 4, 37, 0, 4, true, 'calorie-dense,versatile'],
+ ['canned-corn', 'Canned Corn (15 oz)', 'vegetables', 3.5, '1/2 cup', 60, 2, 14, 0.5, 2, true, 'shelf-stable,ready-to-eat'],
+ ['baby-carrots', 'Baby Carrots (1 lb)', 'vegetables', 6, '3 oz', 35, 1, 8, 0, 2, false, 'ready-to-eat,no-cook,vitamin-a'],
+ ['canned-green-beans', 'Canned Green Beans (14.5 oz)', 'vegetables', 3.5, '1/2 cup', 20, 1, 4, 0, 1, true, 'shelf-stable,low-calorie'],
+ ['frozen-mixed-veg', 'Frozen Mixed Vegetables (12 oz)', 'vegetables', 4, '3/4 cup', 50, 2, 10, 0, 3, false, 'needs-freezer,vitamin-rich'],
+ ['onion-3lb', 'Yellow Onions (3 lb bag)', 'vegetables', 9, '1 medium', 45, 1, 11, 0, 1, true, 'flavor-base,long-lasting'],
+ ['canned-tomatoes', 'Diced Tomatoes (14.5 oz can)', 'vegetables', 3.5, '1/2 cup', 25, 1, 5, 0, 1, true, 'shelf-stable,cooking-base,vitamin-c'],
+ // fruits
+ ['bananas', 'Bananas (per lb, ~3 bananas)', 'fruits', 3, '1 medium', 105, 1, 27, 0, 3, false, 'no-cook,potassium,energy'],
+ ['apples-3lb', 'Gala Apples (3 lb bag)', 'fruits', 7, '1 medium', 95, 0.5, 25, 0, 4, false, 'no-cook,fiber,portable'],
+ ['oranges-3lb', 'Oranges (3 lb bag)', 'fruits', 6, '1 medium', 65, 1, 16, 0, 3, false, 'no-cook,vitamin-c,portable'],
+ ['canned-fruit', 'Canned Peaches (15 oz)', 'fruits', 3.5, '1/2 cup', 60, 0, 15, 0, 1, true, 'shelf-stable,ready-to-eat,sweet'],
+ ['raisins', 'Raisins (6 oz box)', 'fruits', 4, '1/4 cup', 120, 1, 32, 0, 2, true, 'shelf-stable,energy-dense'],
+ ['strawberries', 'Fresh Strawberries (1 lb)', 'fruits', 4, '1 cup', 50, 1, 12, 0, 3, false, 'vitamin-c,antioxidants'],
+ // dairy
+ ['whole-milk', 'Whole Milk (1 gallon)', 'dairy', 16, '1 cup', 150, 8, 12, 8, 0, false, 'calcium,complete-protein,vitamin-d'],
+ ['cheese-block', 'Cheddar Cheese Block (8 oz)', 'dairy', 8, '1 oz', 110, 7, 1, 9, 0, false, 'calcium,protein,portable'],
+ ['yogurt', 'Yogurt (32 oz tub)', 'dairy', 4, '1 cup', 130, 12, 17, 0, 0, false, 'probiotics,breakfast'],
+ ['powdered-milk', 'Powdered Milk (25.6 oz)', 'dairy', 24, '1/3 cup powder', 80, 8, 12, 0, 0, true, 'shelf-stable,lightweight'],
+ // fats and oils
+ ['cooking-oil', 'Vegetable Oil (48 fl oz)', 'fats', 96, '1 tbsp', 120, 0, 0, 14, 0, true, 'cooking-essential,calorie-dense'],
+ ['butter', 'Butter (16 oz / 4 sticks)', 'fats', 32, '1 tbsp', 100, 0, 0, 11, 0, false, 'cooking,flavor'],
+ ['avocado', 'Fresh Avocado (each)', 'fats', 3, '1/3 avocado', 80, 1, 4, 7, 3, false, 'healthy-fats,potassium,no-cook'],
+ ['trail-mix', 'Trail Mix (10 oz)', 'fats', 7, '3 tbsp', 160, 5, 15, 10, 2, true, 'shelf-stable,energy-dense'],
+];
+
+// The same prices the Tools source kept: the five budget chains it compared, per pack. A null price (the chain does
+// not carry the item) is simply absent. Only ever shown as a band and a comparison, never as a live price.
+const PRICES = {
+ 'eggs-dozen': { walmart: 3.24, fredmeyer: 3.49, safeway: 3.79, groceryoutlet: 2.99 },
+ 'chicken-breast': { walmart: 2.57, fredmeyer: 2.99, safeway: 3.49, groceryoutlet: 1.99 },
+ 'canned-tuna': { walmart: 1.08, fredmeyer: 1.25, safeway: 1.39, dollartree: 1.25, groceryoutlet: 0.99 },
+ 'peanut-butter': { walmart: 2.14, fredmeyer: 2.49, safeway: 2.79, dollartree: 1.25, groceryoutlet: 1.99 },
+ 'dried-beans': { walmart: 1.28, fredmeyer: 1.49, safeway: 1.69, dollartree: 1.25, groceryoutlet: 1.19 },
+ 'canned-beans': { walmart: 0.78, fredmeyer: 0.99, safeway: 1.09, dollartree: 1.25, groceryoutlet: 0.79 },
+ 'hot-dogs': { walmart: 1.00, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.99 },
+ 'ground-beef': { walmart: 5.94, fredmeyer: 5.99, safeway: 6.49, groceryoutlet: 4.99 },
+ 'canned-soup': { walmart: 0.98, fredmeyer: 1.09, safeway: 1.19, dollartree: 1.25, groceryoutlet: 0.89 },
+ 'canned-chili': { walmart: 1.48, fredmeyer: 1.69, safeway: 1.89, dollartree: 1.25, groceryoutlet: 1.29 },
+ 'sardines': { walmart: 1.08, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.89 },
+ 'ramen-12pk': { walmart: 3.97, fredmeyer: 3.99, safeway: 4.29, dollartree: 1.25, groceryoutlet: 2.99 },
+ 'white-rice': { walmart: 1.42, fredmeyer: 1.69, safeway: 1.89, dollartree: 1.25, groceryoutlet: 1.49 },
+ 'spaghetti': { walmart: 0.98, fredmeyer: 1.15, safeway: 1.29, dollartree: 1.25, groceryoutlet: 0.89 },
+ 'bread-white': { walmart: 1.18, fredmeyer: 1.39, safeway: 1.49, dollartree: 1.25, groceryoutlet: 1.29 },
+ 'oatmeal': { walmart: 3.48, fredmeyer: 3.69, safeway: 3.99, dollartree: 1.25, groceryoutlet: 2.99 },
+ 'tortillas': { walmart: 1.96, fredmeyer: 2.29, safeway: 2.49, dollartree: 1.25, groceryoutlet: 1.79 },
+ 'jiffy-mix': { walmart: 0.67, fredmeyer: 0.79, safeway: 0.89, dollartree: 1.25, groceryoutlet: 0.69 },
+ 'mac-cheese': { walmart: 0.52, fredmeyer: 0.79, safeway: 0.89, dollartree: 1.25, groceryoutlet: 0.59 },
+ 'granola-bars': { walmart: 1.96, fredmeyer: 2.29, safeway: 2.79, dollartree: 1.25, groceryoutlet: 1.49 },
+ 'instant-coffee': { walmart: 4.64, fredmeyer: 4.99, safeway: 5.49, dollartree: 1.25, groceryoutlet: 3.99 },
+ 'potatoes-5lb': { walmart: 2.47, fredmeyer: 2.79, safeway: 2.99, groceryoutlet: 2.49 },
+ 'canned-corn': { walmart: 0.76, fredmeyer: 0.89, safeway: 0.99, dollartree: 1.25, groceryoutlet: 0.69 },
+ 'baby-carrots': { walmart: 1.17, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 1.09 },
+ 'canned-green-beans': { walmart: 0.72, fredmeyer: 0.85, safeway: 0.99, dollartree: 1.25, groceryoutlet: 0.65 },
+ 'frozen-mixed-veg': { walmart: 1.14, fredmeyer: 1.29, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.99 },
+ 'onion-3lb': { walmart: 2.12, fredmeyer: 2.29, safeway: 2.49, groceryoutlet: 1.99 },
+ 'canned-tomatoes': { walmart: 0.78, fredmeyer: 0.89, safeway: 0.99, dollartree: 1.25, groceryoutlet: 0.75 },
+ 'bananas': { walmart: 0.50, fredmeyer: 0.59, safeway: 0.69, groceryoutlet: 0.49 },
+ 'apples-3lb': { walmart: 3.47, fredmeyer: 3.69, safeway: 3.99, groceryoutlet: 2.99 },
+ 'oranges-3lb': { walmart: 3.57, fredmeyer: 3.79, safeway: 3.99, groceryoutlet: 2.99 },
+ 'canned-fruit': { walmart: 1.18, fredmeyer: 1.39, safeway: 1.49, dollartree: 1.25, groceryoutlet: 0.99 },
+ 'raisins': { walmart: 1.98, fredmeyer: 2.19, safeway: 2.39, dollartree: 1.25, groceryoutlet: 1.49 },
+ 'strawberries': { walmart: 2.82, fredmeyer: 2.99, safeway: 3.29, groceryoutlet: 2.49 },
+ 'whole-milk': { walmart: 2.92, fredmeyer: 3.19, safeway: 3.49, groceryoutlet: 2.99 },
+ 'cheese-block': { walmart: 1.87, fredmeyer: 2.19, safeway: 2.49, groceryoutlet: 1.79 },
+ 'yogurt': { walmart: 2.68, fredmeyer: 2.89, safeway: 3.19, groceryoutlet: 2.49 },
+ 'powdered-milk': { walmart: 5.97, fredmeyer: 6.49, safeway: 6.99, groceryoutlet: 4.99 },
+ 'cooking-oil': { walmart: 3.74, fredmeyer: 3.99, safeway: 4.49, dollartree: 1.25, groceryoutlet: 3.49 },
+ 'butter': { walmart: 3.48, fredmeyer: 3.79, safeway: 3.99, groceryoutlet: 2.99 },
+ 'avocado': { walmart: 0.55, fredmeyer: 0.79, safeway: 0.99, groceryoutlet: 0.50 },
+ 'trail-mix': { walmart: 2.98, fredmeyer: 3.49, safeway: 3.99, dollartree: 1.25, groceryoutlet: 2.49 },
+};
+
+const STORES = {
+ walmart: 'Walmart',
+ fredmeyer: 'Fred Meyer',
+ safeway: 'Safeway',
+ dollartree: 'Dollar Tree',
+ groceryoutlet: 'Grocery Outlet',
+};
+
+// USDA MyPlate groups, as the Tools source carried them; dailyMin is grams a day (dairy, as millilitres of milk,
+// which is close enough per gram to treat the same).
+const GROUPS = {
+ protein: { name: 'Protein', dailyMin: 50, examples: 'Chicken, eggs, beans, peanut butter, canned tuna' },
+ grains: { name: 'Grains', dailyMin: 170, examples: 'Rice, bread, pasta, oatmeal, tortillas' },
+ vegetables: { name: 'Vegetables', dailyMin: 300, examples: 'Carrots, potatoes, canned corn, frozen mixed vegetables' },
+ fruits: { name: 'Fruits', dailyMin: 200, examples: 'Bananas, apples, oranges, canned fruit' },
+ dairy: { name: 'Dairy', dailyMin: 720, examples: 'Milk, cheese, yogurt' },
+ fats: { name: 'Fats & Oils', dailyMin: 25, examples: 'Cooking oil, butter, peanut butter, avocado' },
+};
+
+// Which meals an item suits (ported); used to lay a plan out over breakfast, lunch, dinner and snacks.
+const MEALS = {
+ 'eggs-dozen': 'breakfast', 'chicken-breast': 'lunch,dinner', 'canned-tuna': 'lunch,snack',
+ 'peanut-butter': 'breakfast,snack', 'dried-beans': 'lunch,dinner', 'canned-beans': 'lunch,dinner',
+ 'hot-dogs': 'lunch,dinner', 'ground-beef': 'dinner', 'ramen-12pk': 'lunch,dinner',
+ 'white-rice': 'lunch,dinner', 'spaghetti': 'dinner', 'bread-white': 'breakfast,lunch,snack',
+ 'oatmeal': 'breakfast', 'tortillas': 'lunch,dinner', 'jiffy-mix': 'breakfast,snack',
+ 'potatoes-5lb': 'lunch,dinner', 'canned-corn': 'lunch,dinner', 'baby-carrots': 'lunch,snack',
+ 'canned-green-beans': 'lunch,dinner', 'frozen-mixed-veg': 'dinner', 'onion-3lb': 'lunch,dinner',
+ 'canned-tomatoes': 'lunch,dinner', 'bananas': 'breakfast,snack', 'apples-3lb': 'breakfast,snack',
+ 'oranges-3lb': 'breakfast,snack', 'canned-fruit': 'breakfast,snack', 'raisins': 'breakfast,snack',
+ 'strawberries': 'breakfast,snack', 'whole-milk': 'breakfast', 'cheese-block': 'lunch,snack',
+ 'yogurt': 'breakfast,snack', 'powdered-milk': 'breakfast', 'cooking-oil': 'lunch,dinner',
+ 'butter': 'breakfast,lunch,dinner', 'avocado': 'lunch,snack', 'mac-cheese': 'lunch,dinner',
+ 'canned-soup': 'lunch,dinner', 'canned-chili': 'lunch,dinner', 'trail-mix': 'snack',
+ 'granola-bars': 'breakfast,snack', 'sardines': 'lunch,snack', 'instant-coffee': 'breakfast',
+};
+
+// A pack size stated in an item's own name → grams. Volume (fl oz) is deliberately absent: converting it would mean
+// assuming a density. A dozen eggs and a 12-pack of ramen state no weight, so they get no per-100 g figure.
+const UNIT_G = { oz: 28.3495, lb: 453.592, lbs: 453.592, pound: 453.592, pounds: 453.592, g: 1, gram: 1, grams: 1, kg: 1000, kilogram: 1000, gallon: 3785.41, gal: 3785.41, l: 1000, litre: 1000, liter: 1000, ml: 1 };
+function packGrams(name) {
+ const str = String(name);
+ const m = str.match(/(\d+(?:\.\d+)?)\s*(fl\.?\s*oz|oz|lbs?|pounds?|kgs?|kilograms?|grams?|kg|g|gallons?|gal|l|litres?|liters?|ml)\b/i);
+ // "Chicken Breasts (per lb)" and "Bananas (per lb)" state a unit with no number: that is one of it.
+ const bare = m ? null : str.match(/\bper\s+(fl\.?\s*oz|oz|lbs?|pounds?|kgs?|kg|g|gallons?|gal|litres?|liters?|l|ml)\b/i);
+ const unitText = m ? m[2] : bare && bare[1];
+ if (!unitText) return null;
+ const unit = unitText.toLowerCase().replace(/[.\s]/g, '');
+ if (/^(floz|foz)$/.test(unit)) return null; // a volume: no density known, so no grams
+ const g = UNIT_G[unit];
+ return g ? (m ? Number(m[1]) : 1) * g : null;
+}
+
+const round = (n, d = 0) => { const p = 10 ** d; return Math.round((Number(n) + Number.EPSILON) * p) / p; };
+const nullPrice = (v) => (v === null || v === undefined || v === '' ? null : Number(v));
+
+function band(min) {
+ if (min <= 2) return 'low';
+ if (min <= 4) return 'medium';
+ if (min <= 8) return 'higher';
+ return 'high';
+}
+const BAND_LABEL = { low: 'under $2 a pack', medium: '$2–4 a pack', higher: '$4–8 a pack', high: 'over $8 a pack' };
+
+/** One row plus its prices → what the pages, the planner and the pantry match read. */
+function build([id, name, group, servings, servingSize, kcal, proteinG, carbsG, fatG, fiberG, shelfStable, tags]) {
+ const prices = PRICES[id] || {};
+ const known = Object.entries(prices).map(([store, price]) => ({ store, store_name: STORES[store], price: nullPrice(price) }))
+ .filter((p) => p.price != null).sort((a, b) => a.price - b.price || (a.store < b.store ? -1 : 1));
+ const price = known.length ? known[0].price : null;
+ const priceMax = known.length ? known[known.length - 1].price : null;
+ const grams = packGrams(name);
+ const servingGrams = grams && servings ? round(grams / servings, 1) : null;
+ const per100 = servingGrams ? {
+ kcal: round(kcal * 100 / servingGrams),
+ protein_g: round(proteinG * 100 / servingGrams, 1),
+ carbs_g: round(carbsG * 100 / servingGrams, 1),
+ fat_g: round(fatG * 100 / servingGrams, 1),
+ fiber_g: round(fiberG * 100 / servingGrams, 1),
+ } : null;
+ return {
+ id, slug: id, name, group,
+ group_name: GROUPS[group].name,
+ servings, serving_size: servingSize,
+ nutrition: { kcal, protein_g: proteinG, carbs_g: carbsG, fat_g: fatG, fiber_g: fiberG },
+ serving_grams: servingGrams,
+ pack_grams: grams ? round(grams) : null,
+ per_100g: per100,
+ package_kcal: round(kcal * servings),
+ package_protein_g: round(proteinG * servings),
+ price, price_max: priceMax,
+ cheapest_store: known.length ? known[0].store : null,
+ cheapest_store_name: known.length ? known[0].store_name : null,
+ prices: known,
+ band: price == null ? null : band(price),
+ band_label: price == null ? null : BAND_LABEL[band(price)],
+ cost_per_serving: price == null ? null : round(price / servings, 2),
+ cost_per_gram: price == null || !grams ? null : round(price / grams, 4),
+ kcal_per_dollar: price == null ? null : round(kcal * servings / price),
+ shelf_stable: !!shelfStable,
+ meals: (MEALS[id] || 'lunch,dinner').split(','),
+ tags: String(tags).split(','),
+ };
+}
+
+const FOODS = ROWS.map(build).sort((a, b) => (a.group === b.group ? (a.name < b.name ? -1 : 1) : (Object.keys(GROUPS).indexOf(a.group) - Object.keys(GROUPS).indexOf(b.group))));
+const BY_SLUG = new Map(FOODS.map((f) => [f.slug, f]));
+
+const listFoods = ({ group = null, q = null } = {}) => {
+ let foods = FOODS;
+ if (group && GROUPS[group]) foods = foods.filter((f) => f.group === group);
+ if (q) {
+ const needle = String(q).toLowerCase();
+ foods = foods.filter((f) => f.name.toLowerCase().includes(needle) || f.tags.some((t) => t.includes(needle)));
+ }
+ return foods;
+};
+const getFood = (slug) => BY_SLUG.get(String(slug)) || null;
+
+/** The list as the API hands it out (no store-by-store table: that is the food page's job). */
+const toWire = (f) => ({
+ slug: f.slug, name: f.name, group: f.group, group_name: f.group_name,
+ servings: f.servings, serving_size: f.serving_size, serving_grams: f.serving_grams,
+ nutrition_per_serving: f.nutrition, nutrition_per_100g: f.per_100g,
+ price: f.price, price_max: f.price_max, price_band: f.band, price_band_label: f.band_label,
+ cheapest_store: f.cheapest_store, cost_per_serving: f.cost_per_serving, kcal_per_dollar: f.kcal_per_dollar,
+ shelf_stable: f.shelf_stable, tags: f.tags, meals: f.meals, url: `/foods/${f.slug}`,
+});
+
+module.exports = { FOODS, GROUPS, STORES, MEALS, BY_SLUG, listFoods, getFood, toWire, band, BAND_LABEL, packGrams, round };
new file mode 100644
new file mode 100644
@@ -0,0 +1,50 @@
@@ -0,0 +1,50 @@
+'use strict';
+
+/**
+ * "What can I make?": match what a person says is in their cupboard against the basic recipes (server/food/recipes.js).
+ *
+ * Deterministic and offline — no model call, no ranking magic. A recipe can be made when every ingredient it needs is
+ * in the pantry; the rest are listed with what is missing, so the answer is useful even when nothing is complete.
+ * Everything the pantry holds is a food from the list, so an unknown item can never reach this function.
+ */
+
+const { RECIPES } = require('./recipes');
+const { getFood } = require('./foods');
+
+const nameOf = (slug) => { const f = getFood(slug); return f ? f.name : slug; };
+
+/** One recipe vs one set of pantry slugs. */
+function score(recipe, pantry) {
+ const has = (slug) => pantry.has(slug);
+ const ingredientList = recipe.ingredients.map((slug) => ({ slug, name: nameOf(slug), have: has(slug), optional: false }));
+ const optionalList = (recipe.optional || []).map((slug) => ({ slug, name: nameOf(slug), have: has(slug), optional: true }));
+ const missing = ingredientList.filter((i) => !i.have);
+ return {
+ slug: recipe.slug, name: recipe.name, serves: recipe.serves, minutes: recipe.minutes, steps: recipe.steps,
+ ingredients: ingredientList, optional: optionalList,
+ have: ingredientList.filter((i) => i.have),
+ missing,
+ optional_have: optionalList.filter((i) => i.have),
+ optional_missing: optionalList.filter((i) => !i.have),
+ can_make: missing.length === 0,
+ missing_count: missing.length,
+ coverage: ingredientList.length ? Number(((ingredientList.length - missing.length) / ingredientList.length).toFixed(2)) : 1,
+ };
+}
+
+/**
+ * Every recipe against what the pantry holds, best first: what can be made, then what is closest, then by name.
+ * `pantry` is an array of food slugs.
+ */
+function matchPantry(pantrySlugs = []) {
+ const pantry = new Set(pantrySlugs);
+ const all = RECIPES.map((r) => score(r, pantry)).sort((a, b) => (Number(b.can_make) - Number(a.can_make)) || (a.missing_count - b.missing_count) || (a.name < b.name ? -1 : 1));
+ return {
+ can_make: all.filter((r) => r.can_make),
+ almost: all.filter((r) => !r.can_make && r.missing_count <= 1),
+ rest: all.filter((r) => !r.can_make && r.missing_count > 1),
+ all,
+ };
+}
+
+module.exports = { matchPantry, score };
new file mode 100644
new file mode 100644
@@ -0,0 +1,187 @@
@@ -0,0 +1,187 @@
+'use strict';
+
+/**
+ * "Find food near you": food banks, pantries, soup kitchens and community fridges, and budget grocery stores, from
+ * OpenStreetMap through Overpass. The tag shapes and the classification are ported from OpenVibe.Tools' grocery
+ * source (apps/maps/server/sources/grocery.js); the queries here are bounded to one radius around one point and one
+ * kind of tag, and server/food/upstream.js paces and caches every one of them.
+ *
+ * Everything this module returns is © OpenStreetMap contributors, under ODbL. Callers must show the attribution and
+ * link it back — the pages do (server/http/pages.js), and the API returns it with every answer.
+ */
+
+const { UpstreamError } = require('./upstream');
+
+const ATTRIBUTION = {
+ text: '© OpenStreetMap contributors',
+ url: 'https://www.openstreetmap.org/copyright',
+ license: 'ODbL 1.0',
+ license_url: 'https://opendatacommons.org/licenses/odbl/1-0/',
+};
+const SOURCE = {
+ name: 'OpenStreetMap',
+ url: 'https://www.openstreetmap.org/',
+ via: 'Overpass API',
+ license: 'ODbL 1.0',
+ fetched_note: 'fetched by OpenVibe.Food and cached for 7 days',
+};
+
+// The four kinds of free food OpenStreetMap tags, as the Tools source classified them.
+const FOOD_BANK_TYPES = {
+ food_bank: { label: 'Food bank', offers: 'Pre-packaged food' },
+ soup_kitchen: { label: 'Soup kitchen', offers: 'Hot prepared meals' },
+ food_sharing: { label: 'Community fridge', offers: 'Drop off or pick up food' },
+ give_box: { label: 'Free pantry box', offers: 'Free pantry items' },
+};
+
+// Chains OpenStreetMap tags as a discount grocer. Anything else is still listed, without the budget mark.
+const BUDGET_BRANDS = [/aldi/i, /lidl/i, /netto/i, /penny markt/i, /dollar tree/i, /dollar general/i, /family dollar/i, /grocery outlet/i, /save ?a ?lot/i, /winco/i, /food ?4 ?less/i, /foods ?co/i, /price ?rite/i, /action\b/i, /biedronka/i, /żabka/i];
+
+const KINDS = ['foodbank', 'grocery'];
+
+function haversineKm(aLat, aLon, bLat, bLon) {
+ const R = 6371.0088;
+ const toRad = (d) => d * Math.PI / 180;
+ const dLat = toRad(bLat - aLat);
+ const dLon = toRad(bLon - aLon);
+ const h = Math.sin(dLat / 2) ** 2 + Math.cos(toRad(aLat)) * Math.cos(toRad(bLat)) * Math.sin(dLon / 2) ** 2;
+ return 2 * R * Math.asin(Math.min(1, Math.sqrt(h)));
+}
+
+function formatAddress(tags) {
+ const parts = [tags['addr:housenumber'], tags['addr:street'], tags['addr:city'], tags['addr:state'], tags['addr:postcode']]
+ .map((p) => (p == null ? '' : String(p).trim())).filter(Boolean);
+ return parts.join(', ');
+}
+
+const isBudgetStore = (tags) => {
+ if (tags.shop === 'variety_store') return true; // a dollar store is a budget store by definition
+ const brand = `${tags.brand || ''} ${tags.name || ''} ${tags.operator || ''}`;
+ return BUDGET_BRANDS.some((re) => re.test(brand));
+};
+
+/** The Overpass query for one kind, bounded to `radiusM` metres around one point. Never a bulk download. */
+function queryFor(kind, lat, lon, radiusM) {
+ const around = `(around:${radiusM},${lat},${lon})`;
+ if (kind === 'foodbank') {
+ return `[out:json][timeout:25];(
+nwr["amenity"="social_facility"]["social_facility"="food_bank"]${around};
+nwr["amenity"="social_facility"]["social_facility"="soup_kitchen"]${around};
+nwr["amenity"="food_bank"]${around};
+nwr["amenity"="food_sharing"]${around};
+nwr["amenity"="give_box"]${around};
+);out center tags;`;
+ }
+ return `[out:json][timeout:25];(
+nwr["shop"~"^(supermarket|convenience|grocery|greengrocer|variety_store|wholesale|frozen_food)$"]${around};
+);out center tags;`;
+}
+
+/** One Overpass element → one result, or null when it carries no usable position. */
+function toResult(el, kind, origin) {
+ const lat = el.lat != null ? el.lat : (el.center && el.center.lat);
+ const lon = el.lon != null ? el.lon : (el.center && el.center.lon);
+ if (lat == null || lon == null) return null;
+ const tags = el.tags || {};
+ const fbType = tags.social_facility === 'soup_kitchen' ? 'soup_kitchen'
+ : tags.amenity === 'food_sharing' ? 'food_sharing'
+ : tags.amenity === 'give_box' ? 'give_box' : 'food_bank';
+ const type = kind === 'grocery' ? (tags.shop || 'supermarket') : fbType;
+ const label = kind === 'grocery'
+ ? type.replace(/_/g, ' ').replace(/^\w/, (c) => c.toUpperCase())
+ : FOOD_BANK_TYPES[fbType].label;
+ return {
+ id: `osm-${el.type}-${el.id}`,
+ osm_type: el.type, osm_id: el.id,
+ osm_url: `https://www.openstreetmap.org/${el.type}/${el.id}`,
+ kind, type, type_label: label,
+ name: tags.name || tags.operator || label,
+ lat, lon,
+ distance_km: Math.round(haversineKm(origin.lat, origin.lon, lat, lon) * 10) / 10,
+ address: formatAddress(tags) || null,
+ opening_hours: tags.opening_hours || null,
+ operator: tags.operator || null,
+ phone: tags.phone || tags['contact:phone'] || null,
+ website: tags.website || tags['contact:website'] || null,
+ wheelchair: tags.wheelchair === 'yes' ? true : tags.wheelchair === 'no' ? false : null,
+ budget: kind === 'grocery' ? isBudgetStore(tags) : (tags.fee === 'yes' ? false : null),
+ };
+}
+
+/** Elements → results, deduplicated by where they are, nearest first. */
+function elementsToResults(elements, kind, origin, limit) {
+ const seen = new Set();
+ const out = [];
+ for (const el of elements || []) {
+ const r = toResult(el, kind, origin);
+ if (!r) continue;
+ const key = `${r.name.toLowerCase()}@${r.lat.toFixed(4)},${r.lon.toFixed(4)}`;
+ if (seen.has(key)) continue;
+ seen.add(key);
+ out.push(r);
+ }
+ out.sort((a, b) => a.distance_km - b.distance_km || (a.name < b.name ? -1 : 1));
+ return limit ? out.slice(0, limit) : out;
+}
+
+const clamp = (n, lo, hi) => Math.min(Math.max(n, lo), hi);
+
+/**
+ * The place search behind both the API and the pages.
+ *
+ * { kind: 'foodbank' | 'grocery' | 'both', q, lat, lon, radiusKm, limit }
+ *
+ * A name (q) is geocoded with Nominatim, once, and cached; the area query is cached too. Throws UpstreamError
+ * (food.place.invalid on bad input, food.place.upstream when OSM cannot be reached).
+ */
+async function searchPlaces(upstream, { kind = 'foodbank', q = null, lat = null, lon = null, radiusKm = null, limit = null } = {}, config) {
+ const kinds = kind === 'both' ? KINDS : [kind];
+ if (!kinds.every((k) => KINDS.includes(k))) throw new UpstreamError('food.place.invalid', 'kind: foodbank, grocery or both', { status: 422 });
+
+ let place = null;
+ if (Number.isFinite(lat) && Number.isFinite(lon)) {
+ place = { name: null, lat: Number(lat), lon: Number(lon), from: 'coordinates' };
+ } else if (q && String(q).trim()) {
+ const g = await upstream.geocode(q, { limit: 1 });
+ const hit = Array.isArray(g.body) ? g.body[0] : null;
+ if (!hit) throw new UpstreamError('food.place.not_found', `no place called “${String(q).slice(0, 80)}”; try a town and state, or a postcode`, { status: 404 });
+ const la = Number(hit.lat); const lo = Number(hit.lon);
+ if (!Number.isFinite(la) || !Number.isFinite(lo)) throw new UpstreamError('food.place.upstream', 'the place service gave no coordinates for that place');
+ place = { name: hit.display_name || String(q), lat: la, lon: lo, from: 'geocode', geocoded_at: g.fetched_at };
+ } else {
+ throw new UpstreamError('food.place.invalid', 'q: a place to search for (or lat and lon)', { status: 422 });
+ }
+
+ const maxRadius = (config && config.osm.maxRadiusKm) || 50;
+ const rad = clamp(Number(radiusKm) || (config && config.osm.defaultRadiusKm) || 8, 0.5, maxRadius);
+ const cap = clamp(Number(limit) || (config && config.osm.maxResults) || 60, 1, (config && config.osm.maxResults) || 60);
+ const radiusM = Math.round(rad * 1000);
+
+ const perKind = {};
+ let fetchedAt = null;
+ let cached = true;
+ for (const k of kinds) {
+ const r = await upstream.overpass(queryFor(k, place.lat, place.lon, radiusM));
+ perKind[k] = elementsToResults(r.body && r.body.elements, k, place, cap);
+ if (!r.cached) cached = false;
+ if (!fetchedAt || r.fetched_at > fetchedAt) fetchedAt = r.fetched_at;
+ }
+
+ const results = kinds.flatMap((k) => perKind[k]).sort((a, b) => a.distance_km - b.distance_km || a.kind.localeCompare(b.kind) || (a.name < b.name ? -1 : 1));
+ const counts = { total: results.length, foodbank: (perKind.foodbank || []).length, grocery: (perKind.grocery || []).length, budget_grocery: (perKind.grocery || []).filter((r) => r.budget).length };
+
+ return {
+ location: place,
+ kind: kind === 'both' ? 'both' : kinds[0],
+ radius_km: rad,
+ results,
+ counts,
+ per_kind: perKind,
+ fetched_at: fetchedAt,
+ cached,
+ attribution: ATTRIBUTION,
+ source: SOURCE,
+ };
+}
+
+module.exports = { searchPlaces, haversineKm, formatAddress, isBudgetStore, queryFor, elementsToResults, ATTRIBUTION, SOURCE, FOOD_BANK_TYPES, KINDS };
new file mode 100644
new file mode 100644
@@ -0,0 +1,146 @@
@@ -0,0 +1,146 @@
+'use strict';
+
+/**
+ * The meal planner: a shopping list and an estimated cost for one person, a couple or a group over N days, built
+ * from the food list (server/food/foods.js). Deterministic — the same spec always gives the same plan — so a saved
+ * plan and the page that shows it agree, and a test can check the arithmetic.
+ *
+ * How it plans, plainly:
+ * 1. coverage one item from each of the six food groups, cheapest per serving first, enough packs to reach the
+ * group's daily minimum (USDA MyPlate, as the food list carries it) for everyone for every day
+ * 2. energy the rest of the packs, best calories per dollar first, until the calorie target is met
+ * 3. layout the items are spread over breakfast, lunch, dinner and snacks, rotating day by day
+ *
+ * It is an estimate to shop by: prices are typical, not live, and "serves" is what the pack says.
+ */
+
+const { FOODS, GROUPS, round } = require('./foods');
+
+const KCAL_PER_PERSON_DAY = 2000;
+const LIMITS = { people: [1, 12], days: [1, 14], budget: [1, 5000] };
+
+class PlanError extends Error {
+ constructor(code, detail) { super(detail); this.code = code; }
+}
+
+const whole = (v) => (Number.isFinite(Number(v)) ? Math.trunc(Number(v)) : NaN);
+
+/** Parse and check a spec; throws PlanError (the API turns it into 422 problem+json, a page into a notice). */
+function spec(input = {}) {
+ const people = whole(input.people == null || input.people === '' ? 1 : input.people);
+ const days = whole(input.days == null || input.days === '' ? 3 : input.days);
+ if (!(people >= LIMITS.people[0] && people <= LIMITS.people[1])) throw new PlanError('food.plan.invalid', `people: a whole number from ${LIMITS.people[0]} to ${LIMITS.people[1]}`);
+ if (!(days >= LIMITS.days[0] && days <= LIMITS.days[1])) throw new PlanError('food.plan.invalid', `days: a whole number from ${LIMITS.days[0]} to ${LIMITS.days[1]}`);
+ let budget = null;
+ if (input.budget != null && input.budget !== '') {
+ budget = Number(input.budget);
+ if (!(budget >= LIMITS.budget[0] && budget <= LIMITS.budget[1])) throw new PlanError('food.plan.invalid', `budget: a number from ${LIMITS.budget[0]} to ${LIMITS.budget[1]}, or leave it out`);
+ budget = round(budget, 2);
+ }
+ return { people, days, budget };
+}
+
+// Cheapest way to put a gram of the group on the table (the group minimum is in grams), then most energy a dollar.
+const byCost = (a, b) => ((a.cost_per_gram == null ? a.cost_per_serving : a.cost_per_gram) - (b.cost_per_gram == null ? b.cost_per_serving : b.cost_per_gram)) || (b.kcal_per_dollar - a.kcal_per_dollar) || (a.id < b.id ? -1 : 1);
+const byEnergy = (a, b) => (b.kcal_per_dollar - a.kcal_per_dollar) || (a.price - b.price) || (a.id < b.id ? -1 : 1);
+
+function planMeals(input = {}) {
+ const s = spec(input);
+ const targetKcal = s.people * s.days * KCAL_PER_PERSON_DAY;
+ const picks = new Map(); // id → { food, packs }
+ const add = (food, n) => { const cur = picks.get(food.id); picks.set(food.id, { food, packs: (cur ? cur.packs : 0) + n }); };
+ const costOf = () => round([...picks.values()].reduce((n, p) => n + p.food.price * p.packs, 0), 2);
+ const kcalOf = () => [...picks.values()].reduce((n, p) => n + p.food.package_kcal * p.packs, 0);
+
+ // 1. Coverage. Prefer items whose pack states a weight, so the daily minimum can be met by arithmetic.
+ const coverage = [];
+ for (const [group, def] of Object.entries(GROUPS)) {
+ const inGroup = FOODS.filter((f) => f.group === group && f.price != null);
+ const withGrams = inGroup.filter((f) => f.serving_grams);
+ const pick = (withGrams.length ? withGrams : inGroup).sort(byCost)[0];
+ if (!pick) continue;
+ const servingsNeeded = pick.serving_grams ? Math.ceil(s.people * s.days * def.dailyMin / pick.serving_grams) : s.people * s.days;
+ coverage.push({ food: pick, packs: Math.max(1, Math.ceil(servingsNeeded / pick.servings)) });
+ }
+ for (const { food, packs } of coverage.sort((a, b) => a.food.price - b.food.price || (a.food.id < b.food.id ? -1 : 1))) {
+ if (s.budget != null && round(costOf() + food.price * packs, 2) > s.budget) continue;
+ add(food, packs);
+ }
+
+ // 2. Energy. One pack at a time, best calories per dollar first; a bound so an impossible target stops.
+ const energyOrder = FOODS.filter((f) => f.price != null).sort(byEnergy);
+ for (let guard = 0; guard < 80 && kcalOf() < targetKcal; guard++) {
+ const food = energyOrder[guard % energyOrder.length];
+ if (s.budget != null && round(costOf() + food.price, 2) > s.budget) break;
+ add(food, 1);
+ }
+
+ // 3. The list, the shopping order (by cheapest store, then name) and the per-group coverage.
+ const items = [...picks.values()].map(({ food, packs }) => ({
+ slug: food.slug, name: food.name, group: food.group, group_name: food.group_name,
+ packs, unit_cost: food.price, cost: round(food.price * packs, 2),
+ kcal: food.package_kcal * packs, protein_g: round(food.package_protein_g * packs),
+ store: food.cheapest_store, store_name: food.cheapest_store_name,
+ meals: food.meals,
+ })).sort((a, b) => (a.store < b.store ? -1 : a.store > b.store ? 1 : 0) || (a.name < b.name ? -1 : 1));
+
+ const totalCost = round(items.reduce((n, i) => n + i.cost, 0), 2);
+ const totalKcal = items.reduce((n, i) => n + i.kcal, 0);
+ const totalProtein = items.reduce((n, i) => n + i.protein_g, 0);
+ const personDays = s.people * s.days;
+
+ const groupCoverage = Object.entries(GROUPS).map(([group, def]) => {
+ const mine = items.filter((i) => i.group === group);
+ return { group, name: def.name, daily_min_g: def.dailyMin, covered: mine.length > 0, items: mine.length, packs: mine.reduce((n, i) => n + i.packs, 0), cost: round(mine.reduce((n, i) => n + i.cost, 0), 2) };
+ });
+
+ // One menu a day, rotating each item through the meals it suits, so the days are not all identical.
+ const menuItems = items.slice().sort((a, b) => (a.group < b.group ? -1 : a.group > b.group ? 1 : (a.name < b.name ? -1 : 1)));
+ const days = [];
+ for (let d = 0; d < s.days; d++) {
+ const day = { day: d + 1, breakfast: [], lunch: [], dinner: [], snack: [] };
+ for (const item of menuItems) {
+ const slot = item.meals[(d % item.meals.length + item.meals.length) % item.meals.length] || 'dinner';
+ day[slot].push(item.name);
+ }
+ days.push(day);
+ }
+
+ const byStore = [...new Set(items.map((i) => i.store))].filter(Boolean).map((store) => ({
+ store, store_name: items.find((i) => i.store === store).store_name,
+ items: items.filter((i) => i.store === store).length,
+ cost: round(items.filter((i) => i.store === store).reduce((n, i) => n + i.cost, 0), 2),
+ })).sort((a, b) => a.store < b.store ? -1 : 1);
+
+ const coveredGroups = groupCoverage.filter((g) => g.covered).length;
+ return {
+ spec: { people: s.people, days: s.days, budget: s.budget },
+ items, shopping_list: items, by_store: byStore, days: s.days, menu: days,
+ group_coverage: groupCoverage,
+ totals: {
+ cost: totalCost,
+ cost_per_person_day: round(totalCost / personDays, 2),
+ kcal: totalKcal,
+ kcal_per_person_day: Math.round(totalKcal / personDays),
+ protein_g: Math.round(totalProtein),
+ protein_g_per_person_day: Math.round(totalProtein / personDays),
+ target_kcal_per_person_day: KCAL_PER_PERSON_DAY,
+ items: items.length,
+ packs: items.reduce((n, i) => n + i.packs, 0),
+ },
+ covers_all_groups: coveredGroups === groupCoverage.length,
+ groups_covered: coveredGroups,
+ groups_total: groupCoverage.length,
+ remaining_budget: s.budget == null ? null : round(s.budget - totalCost, 2),
+ notes: [
+ 'Cost is an estimate from typical 2025 US (Washington) prices carried over from OpenVibe.Tools, not a live price.',
+ ...(s.budget != null && coveredGroups < groupCoverage.length ? ['The budget did not stretch to every food group; the plan buys the cheapest items first.'] : []),
+ ...(kcalOf() < targetKcal ? [`The plan is under the ${KCAL_PER_PERSON_DAY} kcal a person a day target (it stays inside the budget).`] : []),
+ // Shops are whole packs, so a short plan supplies more than its own days; saying so is clearer than a
+ // calories-a-day figure that looks absurd next to the target.
+ ...(kcalOf() > targetKcal * 1.15 ? [`The shops are whole packs: this basket supplies about ${Math.round(kcalOf() / (s.people * KCAL_PER_PERSON_DAY))} days of energy at ${KCAL_PER_PERSON_DAY} kcal a person, whatever the plan length.`] : []),
+ ],
+ };
+}
+
+module.exports = { planMeals, spec, PlanError, KCAL_PER_PERSON_DAY, LIMITS };
new file mode 100644
new file mode 100644
@@ -0,0 +1,76 @@
@@ -0,0 +1,76 @@
+'use strict';
+
+/**
+ * A small set of basic recipes, written for this service in plain words (no copied recipe text, nothing
+ * copyrighted), each naming only items from the food list (server/food/foods.js). They exist so the pantry can answer
+ * "what can I make?" without an AI call: server/food/pantry-match.js matches a person's cupboard against them.
+ *
+ * These are deliberately simple combinations and the pantry page labels them as such. They are not dietary advice.
+ */
+
+const RECIPES = [
+ {
+ slug: 'beans-and-rice', name: 'Beans and rice', serves: 2, minutes: 25,
+ ingredients: ['white-rice', 'canned-beans', 'onion-3lb'], optional: ['cooking-oil', 'canned-tomatoes', 'cheese-block'],
+ steps: [
+ 'Cook the rice as the packet says.',
+ 'Chop the onion and soften it in a little oil in a pan.',
+ 'Add the beans (and the tomatoes, if you have them) and heat through.',
+ 'Spoon the beans over the rice. Cheese on top if you like.',
+ ],
+ },
+ {
+ slug: 'tuna-pasta', name: 'Tuna pasta', serves: 2, minutes: 20,
+ ingredients: ['spaghetti', 'canned-tuna', 'canned-tomatoes'], optional: ['cooking-oil', 'onion-3lb'],
+ steps: [
+ 'Boil the spaghetti until tender, then drain it.',
+ 'Warm the tomatoes in the same pan with a little oil and, if you have one, a chopped onion.',
+ 'Stir in the drained tuna, then the spaghetti.',
+ ],
+ },
+ {
+ slug: 'tuna-sandwich', name: 'Tuna sandwich', serves: 1, minutes: 5,
+ ingredients: ['bread-white', 'canned-tuna'], optional: ['cooking-oil', 'onion-3lb', 'avocado'],
+ steps: ['Drain the tuna and mash it with a little oil.', 'Spread it between two slices of bread.'],
+ },
+ {
+ slug: 'eggs-on-toast', name: 'Eggs on toast', serves: 1, minutes: 10,
+ ingredients: ['eggs-dozen', 'bread-white'], optional: ['butter', 'cheese-block'],
+ steps: ['Toast two slices of bread.', 'Scramble or fry two eggs.', 'Put the eggs on the toast.'],
+ },
+ {
+ slug: 'oatmeal-with-fruit', name: 'Oatmeal with fruit', serves: 1, minutes: 8,
+ ingredients: ['oatmeal', 'bananas'], optional: ['whole-milk', 'raisins', 'canned-fruit', 'peanut-butter'],
+ steps: ['Simmer the oats in water or milk for about five minutes.', 'Slice the fruit over the top.'],
+ },
+ {
+ slug: 'quesadilla', name: 'Cheese quesadilla', serves: 1, minutes: 10,
+ ingredients: ['tortillas', 'cheese-block'], optional: ['canned-beans', 'avocado', 'canned-corn'],
+ steps: ['Put grated cheese on half a tortilla and fold it over.', 'Cook in a dry pan until the cheese melts, turning once.'],
+ },
+ {
+ slug: 'vegetable-rice-bowl', name: 'Vegetable rice bowl', serves: 2, minutes: 25,
+ ingredients: ['white-rice', 'frozen-mixed-veg', 'onion-3lb'], optional: ['cooking-oil', 'canned-corn', 'canned-green-beans', 'canned-beans'],
+ steps: ['Cook the rice.', 'Fry the chopped onion in oil, add the vegetables and cook until hot through.', 'Serve the vegetables over the rice.'],
+ },
+ {
+ slug: 'chili-rice-bowl', name: 'Chili and rice bowl', serves: 1, minutes: 15,
+ ingredients: ['canned-chili', 'white-rice'], optional: ['cheese-block', 'canned-corn', 'yogurt'],
+ steps: ['Cook the rice.', 'Warm the chili in a pan.', 'Spoon the chili over the rice.'],
+ },
+ {
+ slug: 'peanut-butter-banana-sandwich', name: 'Peanut butter and banana sandwich', serves: 1, minutes: 5,
+ ingredients: ['bread-white', 'peanut-butter', 'bananas'],
+ optional: [],
+ steps: ['Spread peanut butter on a slice of bread.', 'Slice the banana over it and close the sandwich.'],
+ },
+ {
+ slug: 'potato-egg-hash', name: 'Potato and egg hash', serves: 2, minutes: 30,
+ ingredients: ['potatoes-5lb', 'eggs-dozen', 'onion-3lb'], optional: ['cooking-oil', 'cheese-block', 'canned-green-beans'],
+ steps: ['Dice the potatoes and onion and fry them in oil until soft and browned, about twenty minutes.', 'Make gaps in the pan, break in the eggs and cook until set.', 'Season and serve.'],
+ },
+];
+
+const bySlug = new Map(RECIPES.map((r) => [r.slug, r]));
+
+module.exports = { RECIPES, RECIPE_BY_SLUG: bySlug };
new file mode 100644
new file mode 100644
@@ -0,0 +1,67 @@
@@ -0,0 +1,67 @@
+'use strict';
+
+/**
+ * What OpenVibe.Food keeps in its own database (migrations/0002_food.sql): the cache in front of the two OpenStreetMap
+ * services, saved meal plans and a person's pantry list. Every function takes the store (server/db.js createStore)
+ * first; nothing here is a secret, and the cache body is only ever an upstream answer, never a person's data.
+ */
+
+const PLAN_LIST_LIMIT = 50;
+
+const parse = (v) => (v == null ? null : typeof v === 'string' ? JSON.parse(v) : v);
+
+// ── food_geo_cache ───────────────────────────────────────────
+/** A cached upstream answer that has not expired, or null. */
+async function cacheGet(s, key) {
+ const row = await s.db.maybe('SELECT body, fetched_at, expires_at FROM food_geo_cache WHERE key = $1', [key]);
+ if (!row || row.expires_at <= s.iso()) return null;
+ return { body: parse(row.body), fetched_at: row.fetched_at, expires_at: row.expires_at };
+}
+async function cachePut(s, key, body, ttlMs) {
+ const fetchedAt = s.iso();
+ const expiresAt = new Date(s.now() + ttlMs).toISOString();
+ await s.db.query(
+ `INSERT INTO food_geo_cache (key, body, fetched_at, expires_at) VALUES ($1, $2::jsonb, $3, $4)
+ ON CONFLICT (key) DO UPDATE SET body = EXCLUDED.body, fetched_at = EXCLUDED.fetched_at, expires_at = EXCLUDED.expires_at`,
+ [key, JSON.stringify(body), fetchedAt, expiresAt]);
+ return { fetched_at: fetchedAt, expires_at: expiresAt };
+}
+/** Drop expired rows (called at boot; the table stays small because every answer is bounded). */
+const cachePrune = (s) => s.db.exec('DELETE FROM food_geo_cache WHERE expires_at <= $1', [s.iso()]);
+
+// ── food_plans ───────────────────────────────────────────────
+async function insertPlan(s, p) {
+ await s.db.query(
+ 'INSERT INTO food_plans (id, owner, title, people, days, budget, plan, created_at) VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8)',
+ [p.id, p.owner, p.title || null, p.people, p.days, p.budget, JSON.stringify(p.plan), p.created_at]);
+ return planRow(s, p.owner, p.id);
+}
+const planRow = (s, owner, id) => s.db.maybe('SELECT * FROM food_plans WHERE owner = $1 AND id = $2', [owner, id]);
+async function listPlans(s, owner, { limit = 20 } = {}) {
+ return s.db.many('SELECT * FROM food_plans WHERE owner = $1 ORDER BY id DESC LIMIT $2', [owner, Math.min(limit, PLAN_LIST_LIMIT)]);
+}
+const deletePlan = (s, owner, id) => s.db.exec('DELETE FROM food_plans WHERE owner = $1 AND id = $2', [owner, id]);
+
+const planToWire = (row) => ({
+ id: row.id, title: row.title || null, people: Number(row.people), days: Number(row.days),
+ budget: row.budget == null ? null : Number(row.budget), created_at: row.created_at, plan: parse(row.plan),
+});
+
+// ── food_pantry ──────────────────────────────────────────────
+const getPantry = async (s, owner) => (await s.db.many('SELECT item, added_at FROM food_pantry WHERE owner = $1 ORDER BY item', [owner])).map((r) => r.item);
+const pantryRows = (s, owner) => s.db.many('SELECT item, added_at FROM food_pantry WHERE owner = $1 ORDER BY item', [owner]);
+/** Replace a person's pantry with exactly this list, in one transaction (what PUT means). */
+async function setPantry(s, owner, items) {
+ const addedAt = s.iso();
+ await s.tx(async () => {
+ await s.db.query('DELETE FROM food_pantry WHERE owner = $1', [owner]);
+ for (const item of items) await s.db.query('INSERT INTO food_pantry (owner, item, added_at) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING', [owner, item, addedAt]);
+ });
+ return items.slice().sort();
+}
+
+module.exports = {
+ cacheGet, cachePut, cachePrune,
+ insertPlan, planRow, listPlans, deletePlan, planToWire,
+ getPantry, pantryRows, setPantry,
+};
new file mode 100644
new file mode 100644
@@ -0,0 +1,102 @@
@@ -0,0 +1,102 @@
+'use strict';
+
+/**
+ * The only two hosts OpenVibe.Food fetches from: Nominatim (a place name → coordinates) and Overpass (the
+ * OpenStreetMap database, for food banks and grocery stores). Both are community services with published usage
+ * policies, and this module is what keeps us inside them:
+ *
+ * - identify every request carries FOOD_OSM_USER_AGENT (an OpenVibe.Food contact URL), never a browser's
+ * - pace one request a second to a host, at most: calls to the same host queue behind each other, so the
+ * service as a whole cannot burst at Nominatim however many visitors arrive at once
+ * - cache every answer is kept in food_geo_cache for FOOD_GEO_CACHE_TTL_MS (7 days): a place is geocoded once,
+ * an area is queried once, not once per visitor
+ * - bound area queries are a small `around:` radius and a single kind of tag, never a bulk download
+ *
+ * Only a URL built from the configured base is ever fetched; nothing a caller sends becomes a URL. There are no
+ * other outbound calls in this service.
+ */
+
+const crypto = require('crypto');
+const geo = require('./store');
+
+class UpstreamError extends Error {
+ constructor(code, detail, { status = 502 } = {}) { super(detail); this.code = code; this.status = status; }
+}
+
+/** Serialises calls to one host and keeps at least `minIntervalMs` between the moments they start. */
+function createPacer({ minIntervalMs, now = () => Date.now() }) {
+ let chain = Promise.resolve();
+ let last = -Infinity;
+ return {
+ run(fn) {
+ const p = chain.then(async () => {
+ const wait = last + minIntervalMs - now();
+ if (wait > 0) await new Promise((r) => setTimeout(r, wait));
+ last = now();
+ return fn();
+ });
+ chain = p.then(() => undefined, () => undefined);
+ return p;
+ },
+ };
+}
+
+const keyOf = (q) => String(q).trim().toLowerCase().replace(/\s+/g, ' ');
+
+function createUpstream({ config, s, fetchImpl = globalThis.fetch, now = () => Date.now(), log = console } = {}) {
+ const osm = config.osm;
+ const pacers = new Map();
+ const pacerFor = (rawUrl) => {
+ const host = new URL(rawUrl).host;
+ if (!pacers.has(host)) pacers.set(host, createPacer({ minIntervalMs: osm.minIntervalMs, now }));
+ return pacers.get(host);
+ };
+
+ /** Fetch a URL built from `base` (never from caller input), with the OSM User-Agent and a hard timeout. */
+ async function fetchJson(url, init = {}) {
+ let res;
+ try {
+ res = await fetchImpl(url.toString(), {
+ ...init,
+ headers: { 'User-Agent': osm.userAgent, Accept: 'application/json', ...(init.headers || {}) },
+ signal: AbortSignal.timeout(osm.timeoutMs),
+ });
+ } catch (err) {
+ throw new UpstreamError('food.place.upstream', `the place service could not be reached (${err && err.name === 'TimeoutError' ? 'timed out' : 'network error'})`);
+ }
+ if (!res.ok) throw new UpstreamError('food.place.upstream', `the place service answered ${res.status}`);
+ try { return await res.json(); } catch { throw new UpstreamError('food.place.upstream', 'the place service answered something that is not JSON'); }
+ }
+
+ async function cached(key, fn) {
+ const hit = await geo.cacheGet(s, key);
+ if (hit) return { body: hit.body, cached: true, fetched_at: hit.fetched_at };
+ const body = await fn();
+ const written = await geo.cachePut(s, key, body, osm.cacheTtlMs);
+ return { body, cached: false, fetched_at: written.fetched_at };
+ }
+
+ /** A place name → up to `limit` matches (Nominatim search), cached for the TTL. */
+ function geocode(q, { limit = 1 } = {}) {
+ const query = String(q || '').trim().slice(0, 200);
+ if (!query) return Promise.reject(new UpstreamError('food.place.invalid', 'q: a place to search for', { status: 422 }));
+ const url = new URL(osm.nominatimUrl);
+ url.pathname = `${url.pathname.replace(/\/+$/, '')}/search`;
+ url.search = new URLSearchParams({ q: query, format: 'jsonv2', limit: String(Math.min(Math.max(limit, 1), 5)), addressdetails: '1' }).toString();
+ return cached(`nominatim:${keyOf(query)}:${limit}`, () => pacerFor(osm.nominatimUrl).run(() => fetchJson(url)));
+ }
+
+ /** One bounded Overpass query → its elements. Cached by the query text, so the same area is asked once. */
+ function overpass(query) {
+ const body = `data=${encodeURIComponent(query)}`;
+ return cached(`overpass:${crypto.createHash('sha256').update(query).digest('hex')}`, () => pacerFor(osm.overpassUrl).run(() => fetchJson(new URL(osm.overpassUrl), {
+ method: 'POST',
+ headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+ body,
+ })));
+ }
+
+ return { geocode, overpass, fetchJson, UpstreamError };
+}
+
+module.exports = { createUpstream, createPacer, UpstreamError };
@@ -3,28 +3,151 @@
@@ -3,28 +3,151 @@
/**
/**
* /api/v1 — OpenVibe.Food's API.
* /api/v1 — OpenVibe.Food's API.
*
*
- * GET /ping public liveness: { ok: true, service }
+ * GET /places?q=&kind=foodbank|grocery|both[&lat=&lon=&radius=&limit=] public food near a place (OpenStreetMap)
+ * GET /foods[?group=&q=] public the food list
+ * GET /foods/:slug public one food
+ * POST /plans signed in plan a shop and save it
+ * GET /plans signed in the plans you saved
+ * GET /plans/:id signed in one of yours
+ * GET /pantry signed in what you say is in your cupboard
+ * PUT /pantry signed in replace it
*
*
- * The product adds its own routes here. Every route that reads or changes a person's data names the capability it
- * needs (`principal.requireCapability('<food>.thing.read')`, listed in CAPABILITIES in ./principal.js) and takes
- * its per-caller numbers (`limits.reads('<food>.thing.read')` or `limits.budget('<name>')`, ./caller-limits.js).
- * A refusal is an RFC 9457 problem+json with a stable code.
+ * Public reads need no token: the food list and the place search are the same for everyone. Anything a person owns
+ * (a plan, a pantry) needs a signed-in caller, named with its capability in ./principal.js. The place search is the
+ * expensive route (it spends OpenStreetMap's shared one-request-a-second budget) and takes its own numbers from
+ * ./caller-limits.js. Errors are RFC 9457 problem+json with a stable code.
*/
*/
const express = require('express');
const express = require('express');
+const contracts = require('openvibe-contracts');
const { asyncRouter } = require('./router');
const { asyncRouter } = require('./router');
+const foods = require('../food/foods');
+const { planMeals } = require('../food/planner');
+const { searchPlaces } = require('../food/places');
+const { matchPantry } = require('../food/pantry-match');
+const store = require('../food/store');
+
+const PLAN_ID = /^pln_[0-9A-HJKMNP-TV-Z]{26}$/;
+// The food list is not fetched from anywhere: it is carried over from OpenVibe.Tools' grocery source, and says so.
+const FOOD_SOURCE = {
+ name: 'OpenVibe.Tools grocery dataset',
+ carried_from: 'OpenVibe.Tools/apps/maps/server/sources/grocery.js',
+ note: 'Typical 2025 US (Washington) prices, carried over unchanged. Not a live price.',
+};
function createApi(ctx) {
function createApi(ctx) {
- const { config, principal, limits } = ctx;
+ const { config, s, principal, limits } = ctx;
const r = asyncRouter();
const r = asyncRouter();
+ const fail = (req, res, status, code, detail) => contracts.http.sendProblem(res, status, code, { detail, ctx: req.ov });
r.use(express.json({ limit: '64kb' }));
r.use(express.json({ limit: '64kb' }));
r.use((req, res, next) => { res.set('Cache-Control', 'no-store'); next(); });
r.use((req, res, next) => { res.set('Cache-Control', 'no-store'); next(); });
r.use(principal.middleware);
r.use(principal.middleware);
- // The one route the skeleton ships. It is public and counted per caller with the default read numbers.
+ // ── Liveness ─────────────────────────────────────────────
r.get('/ping', limits.reads('food.api.read'), (_req, res) => res.json({ ok: true, service: config.service }));
r.get('/ping', limits.reads('food.api.read'), (_req, res) => res.json({ ok: true, service: config.service }));
+ // ── Food near you (public) ───────────────────────────────
+ r.get('/places', limits.budget('food.place.search'), async (req, res) => {
+ const one = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
+ const num = (v) => (v != null && v !== '' && Number.isFinite(Number(v)) ? Number(v) : null);
+ const out = await searchPlaces(ctx.upstream, {
+ kind: one(req.query.kind) || 'foodbank',
+ q: one(req.query.q),
+ lat: num(req.query.lat),
+ lon: num(req.query.lon),
+ radiusKm: num(req.query.radius),
+ limit: num(req.query.limit),
+ }, config).catch((err) => {
+ if (err && err.code) { fail(req, res, err.status || 502, err.code, err.message); return null; }
+ throw err;
+ });
+ if (!out) return;
+ // OpenStreetMap answers are public and change slowly; a short shared cache keeps repeat searches off OSM.
+ res.set('Cache-Control', 'public, max-age=300');
+ res.json(out);
+ });
+
+ // ── The food list (public) ───────────────────────────────
+ r.get('/foods', limits.reads('food.food.read'), (req, res) => {
+ const group = typeof req.query.group === 'string' && req.query.group ? req.query.group : null;
+ if (group && !foods.GROUPS[group]) return fail(req, res, 422, 'food.food.invalid', `group: one of ${Object.keys(foods.GROUPS).join(', ')}`);
+ const q = typeof req.query.q === 'string' && req.query.q ? req.query.q.slice(0, 80) : null;
+ const list = foods.listFoods({ group, q });
+ res.set('Cache-Control', 'public, max-age=3600');
+ res.json({
+ foods: list.map(foods.toWire),
+ count: list.length,
+ groups: Object.entries(foods.GROUPS).map(([id, g]) => ({ group: id, name: g.name, daily_min_g: g.dailyMin })),
+ source: FOOD_SOURCE,
+ });
+ });
+
+ r.get('/foods/:slug', limits.reads('food.food.read'), (req, res) => {
+ const food = foods.getFood(req.params.slug);
+ if (!food) return fail(req, res, 404, 'food.food.not_found', `no food "${String(req.params.slug).slice(0, 64)}" in the list; GET /api/v1/foods lists them`);
+ res.set('Cache-Control', 'public, max-age=3600');
+ res.json({ food: { ...foods.toWire(food), prices: food.prices, per_100g_note: food.per_100g ? 'Derived from the pack size in the item\'s name and the typical values per serving; approximate.' : 'The pack size in this item\'s name is not a weight, so no per-100 g figure is given.' }, source: FOOD_SOURCE });
+ });
+
+ // ── Plans (a person's own) ───────────────────────────────
+ r.post('/plans', principal.requireCapability('food.plan.write'), limits.budget('food.plan.create'), async (req, res) => {
+ const b = req.body || {};
+ let plan;
+ try { plan = planMeals({ people: b.people, days: b.days, budget: b.budget }); } catch (err) {
+ if (err && err.code === 'food.plan.invalid') return fail(req, res, 422, err.code, err.message);
+ throw err;
+ }
+ const title = typeof b.title === 'string' && b.title.trim() ? b.title.trim().slice(0, 120) : null;
+ const row = await store.insertPlan(s, {
+ id: s.newId('pln'), owner: req.principal.requester, title,
+ people: plan.spec.people, days: plan.spec.days, budget: plan.spec.budget, plan, created_at: s.iso(),
+ });
+ res.set('Location', `/api/v1/plans/${row.id}`);
+ return res.status(201).json(store.planToWire(row));
+ });
+
+ r.get('/plans', principal.requireCapability('food.plan.read'), limits.reads('food.plan.read'), async (req, res) => {
+ const limit = Math.min(50, Math.max(1, parseInt(req.query.limit, 10) || 20));
+ const rows = await store.listPlans(s, req.principal.requester, { limit });
+ res.json({ plans: rows.map(store.planToWire) });
+ });
+
+ r.get('/plans/:id', principal.requireCapability('food.plan.read'), limits.reads('food.plan.read'), async (req, res) => {
+ const row = PLAN_ID.test(req.params.id) ? await store.planRow(s, req.principal.requester, req.params.id) : null;
+ if (!row) return fail(req, res, 404, 'food.plan.not_found', 'No such plan.');
+ res.json(store.planToWire(row));
+ });
+
+ // ── Pantry (a person's own) ──────────────────────────────
+ const pantryWire = (items) => {
+ const match = matchPantry(items);
+ return {
+ items,
+ foods: items.map((slug) => foods.toWire(foods.getFood(slug))),
+ // "What can I make" is deterministic matching against the basic recipes; the page says plainly what it is.
+ suggestions: {
+ can_make: match.can_make.map((x) => ({ slug: x.slug, name: x.name, serves: x.serves, minutes: x.minutes })),
+ almost: match.almost.map((x) => ({ slug: x.slug, name: x.name, serves: x.serves, minutes: x.minutes, missing: x.missing.map((m) => m.name) })),
+ },
+ note: 'Basic suggestions: simple combinations written by OpenVibe, matched against your list. Not dietary advice.',
+ };
+ };
+
+ r.get('/pantry', principal.requireCapability('food.pantry.read'), limits.reads('food.pantry.read'), async (req, res) => {
+ res.json(pantryWire(await store.getPantry(s, req.principal.requester)));
+ });
+
+ r.put('/pantry', principal.requireCapability('food.pantry.write'), limits.budget('food.pantry.write'), async (req, res) => {
+ const b = req.body || {};
+ if (!Array.isArray(b.items)) return fail(req, res, 422, 'food.pantry.invalid', 'items: an array of food slugs (GET /api/v1/foods lists them)');
+ if (b.items.length > 200) return fail(req, res, 422, 'food.pantry.invalid', 'items: at most 200');
+ const items = [...new Set(b.items.map((x) => String(x)))];
+ const unknown = items.filter((slug) => !foods.getFood(slug));
+ if (unknown.length) return fail(req, res, 422, 'food.pantry.unknown_item', `not in the food list: ${unknown.slice(0, 5).join(', ')}`);
+ res.json(pantryWire(await store.setPantry(s, req.principal.requester, items)));
+ });
+
return r;
return r;
}
}
-module.exports = { createApi };
+module.exports = { createApi, FOOD_SOURCE };
@@ -32,7 +32,15 @@ function caller(req) {
@@ -32,7 +32,15 @@ function caller(req) {
*
*
* 'food.thing.create': { minute: 6, hour: 60 },
* 'food.thing.create': { minute: 6, hour: 60 },
*/
*/
-const BUDGETS = {};
+const BUDGETS = {
+ // The place search is the expensive route: every miss is a Nominatim geocode and an Overpass area query, both
+ // community services with a shared one-request-a-second budget (server/food/upstream.js). Answers are cached for
+ // a week, so these numbers are for the callers who keep asking for new places.
+ 'food.place.search': { minute: 10, hour: 120 },
+ // Saving a plan and replacing a pantry are cheap writes but they are writes.
+ 'food.plan.create': { minute: 20, hour: 300 },
+ 'food.pantry.write': { minute: 30, hour: 600 },
+};
function createCallerLimits({ config, now = () => Date.now(), registry = null, log = console, enabled = true, valkey = null }) {
function createCallerLimits({ config, now = () => Date.now(), registry = null, log = console, enabled = true, valkey = null }) {
const refused = registry
const refused = registry
@@ -2,25 +2,37 @@
@@ -2,25 +2,37 @@
/**
/**
* Crawl artifacts for openvibe.food, built with openvibe-shared/seo: robots.txt, sitemap.xml, llms.txt and
* Crawl artifacts for openvibe.food, built with openvibe-shared/seo: robots.txt, sitemap.xml, llms.txt and
- * llms-full.txt, and the home page's JSON-LD. The public pages are for search engines and AI crawlers; sign-in and
- * the API are not.
+ * llms-full.txt, and the home page's JSON-LD. The public pages are for search engines and AI crawlers; sign-in, the
+ * API and anything personal (a pantry, a saved plan) are not.
*
*
- * The product extends PAGE_TEXT and publicPages() with its own pages; the routes and headers here stay.
+ * The sitemap carries every food page (server/food/foods.js) as well as the site's own pages, and llms-full.txt lists
+ * the same set — the two must stay the same list.
*/
*/
const fs = require('fs');
const fs = require('fs');
const path = require('path');
const path = require('path');
const seo = require('openvibe-shared/seo');
const seo = require('openvibe-shared/seo');
const cache = require('openvibe-shared/cache-policy');
const cache = require('openvibe-shared/cache-policy');
const { asyncRouter } = require('./router');
const { asyncRouter } = require('./router');
+const foods = require('../food/foods');
const SITE_NAME = 'OpenVibe.Food';
const SITE_NAME = 'OpenVibe.Food';
-const DESCRIPTION = 'OpenVibe.Food — What should we eat?';
-const DISALLOW = ['/auth/', '/api/'];
+const DESCRIPTION = 'OpenVibe.Food — What should we eat? Find food banks and budget grocery stores near you, plan meals, and cook from what is in your cupboard.';
+const DISALLOW = ['/auth/', '/api/', '/pantry', '/plan/saved'];
const PAGE_TEXT = {
const PAGE_TEXT = {
- '/': ['OpenVibe.Food home', 'OpenVibe.Food: What should we eat?'],
+ '/': ['OpenVibe.Food home', 'OpenVibe.Food: What should we eat? Find food near you, plan budget meals and cook from your cupboard.'],
+ '/near': ['Food near you', 'Food banks, soup kitchens, community fridges and budget grocery stores near a place, from OpenStreetMap.'],
+ '/plan': ['Meal plan', 'Plan meals for one person, a couple or a group for up to fourteen days, with a shopping list and an estimated cost.'],
+ '/foods': ['The food list', 'Every food OpenVibe.Food plans with: nutrition per serving and per 100 g, and a typical price band.'],
'/updates': ['What shipped on OpenVibe.Food', 'This site\'s update log, from the network changelog feed.'],
'/updates': ['What shipped on OpenVibe.Food', 'This site\'s update log, from the network changelog feed.'],
};
};
+const SUMMARIES = {
+ '/': 'Find food near you, plan budget meals and cook from what you have.',
+ '/near': 'Food banks and budget grocery stores near a place, from OpenStreetMap.',
+ '/plan': 'A meal plan with a shopping list and an estimated cost.',
+ '/foods': 'Nutrition per serving and per 100 g, and a typical price band, for every food.',
+ '/updates': 'What shipped on the site.',
+};
function dayOf(ts) {
function dayOf(ts) {
const m = String(ts == null ? '' : ts).match(/^(\d{4}-\d{2}-\d{2})/);
const m = String(ts == null ? '' : ts).match(/^(\d{4}-\d{2}-\d{2})/);
@@ -34,14 +46,22 @@ function homeJsonLd(config) {
@@ -34,14 +46,22 @@ function homeJsonLd(config) {
const site = String(config.baseUrl).replace(/\/+$/, '');
const site = String(config.baseUrl).replace(/\/+$/, '');
return [
return [
seo.jsonLd.website({ name: SITE_NAME, url: site, description: DESCRIPTION }),
seo.jsonLd.website({ name: SITE_NAME, url: site, description: DESCRIPTION }),
- seo.jsonLd.softwareApp({ name: SITE_NAME, url: site, description: DESCRIPTION, category: 'BusinessApplication', keywords: 'openvibe' }),
+ seo.jsonLd.softwareApp({ name: SITE_NAME, url: site, description: DESCRIPTION, category: 'BusinessApplication', keywords: 'food, meal planning, food banks, OpenStreetMap' }),
seo.jsonLd.webPage({ name: SITE_NAME, url: `${site}/`, description: DESCRIPTION, siteUrl: site }),
seo.jsonLd.webPage({ name: SITE_NAME, url: `${site}/`, description: DESCRIPTION, siteUrl: site }),
];
];
}
}
+/** Every public page, the food pages included (the sitemap and llms-full.txt both read this). */
const publicPages = () => [
const publicPages = () => [
{ path: '/', changefreq: 'weekly', priority: 1.0 },
{ path: '/', changefreq: 'weekly', priority: 1.0 },
+ { path: '/near', changefreq: 'weekly', priority: 0.9 },
+ { path: '/plan', changefreq: 'weekly', priority: 0.9 },
+ { path: '/foods', changefreq: 'weekly', priority: 0.8 },
{ path: '/updates', changefreq: 'daily', priority: 0.5 },
{ path: '/updates', changefreq: 'daily', priority: 0.5 },
+ ...foods.FOODS.map((f) => ({
+ path: `/foods/${f.slug}`, changefreq: 'monthly', priority: 0.5,
+ title: f.name, text: `${f.name} (${f.group_name})${f.price != null ? `, typically ${f.price} to ${f.price_max} a pack` : ''}. ${SUMMARIES['/foods']}`,
+ })),
];
];
function createDiscoveryRoutes(ctx) {
function createDiscoveryRoutes(ctx) {
@@ -53,38 +73,47 @@ function createDiscoveryRoutes(ctx) {
@@ -53,38 +73,47 @@ function createDiscoveryRoutes(ctx) {
r.get('/robots.txt', (_req, res) => {
r.get('/robots.txt', (_req, res) => {
res.type('text/plain').set('Cache-Control', TEXT).send(
res.type('text/plain').set('Cache-Control', TEXT).send(
- '# openvibe.food: the public pages are for search and AI crawlers; sign-in and the API are not.\n'
+ '# openvibe.food: the public pages are for search and AI crawlers; sign-in, the API and anything personal are not.\n'
+ seo.robotsTxt({ sitemaps: [abs('/sitemap.xml')], disallow: DISALLOW }));
+ seo.robotsTxt({ sitemaps: [abs('/sitemap.xml')], disallow: DISALLOW }));
});
});
r.get('/llms.txt', (_req, res) => {
r.get('/llms.txt', (_req, res) => {
res.type('text/plain').set('Cache-Control', TEXT).send(seo.llmsTxt({
res.type('text/plain').set('Cache-Control', TEXT).send(seo.llmsTxt({
name: SITE_NAME,
name: SITE_NAME,
- summary: 'OpenVibe.Food: What should we eat?',
- details: 'Every page is server-rendered and readable without JavaScript.',
+ summary: 'OpenVibe.Food: What should we eat? Find food banks and budget grocery stores near you, plan budget meals, and cook from what is in your cupboard.',
+ details: 'Every page is server-rendered and readable without JavaScript. Places come from OpenStreetMap © contributors (ODbL).',
sections: [
sections: [
{ title: 'Start here', links: [
{ title: 'Start here', links: [
{ title: 'OpenVibe.Food', url: abs('/'), note: 'What should we eat?' },
{ title: 'OpenVibe.Food', url: abs('/'), note: 'What should we eat?' },
+ { title: 'Food near you', url: abs('/near'), note: 'food banks and budget grocery stores, from OpenStreetMap' },
+ { title: 'Meal plan', url: abs('/plan'), note: 'a shopping list and an estimated cost' },
+ { title: 'The food list', url: abs('/foods'), note: 'nutrition and typical prices' },
{ title: 'What shipped on OpenVibe.Food', url: abs('/updates') },
{ title: 'What shipped on OpenVibe.Food', url: abs('/updates') },
] },
] },
{ title: 'Machine-readable', links: [
{ title: 'Machine-readable', links: [
{ title: 'Sitemap', url: abs('/sitemap.xml') },
{ title: 'Sitemap', url: abs('/sitemap.xml') },
{ title: 'Full text for language models', url: abs('/llms-full.txt') },
{ title: 'Full text for language models', url: abs('/llms-full.txt') },
{ title: 'Release metadata (JSON)', url: abs('/release.json') },
{ title: 'Release metadata (JSON)', url: abs('/release.json') },
+ { title: 'The API', url: abs('/api/v1/foods'), note: 'JSON: places, foods, plans, pantry' },
] },
] },
{ title: 'Elsewhere', links: [
{ title: 'Elsewhere', links: [
{ title: 'OpenVibe.Network', url: 'https://openvibe.network', note: 'accounts, apps and grants' },
{ title: 'OpenVibe.Network', url: 'https://openvibe.network', note: 'accounts, apps and grants' },
{ title: 'OpenVibe.Services', url: 'https://openvibe.services', note: 'apps, keys and capability grants' },
{ title: 'OpenVibe.Services', url: 'https://openvibe.services', note: 'apps, keys and capability grants' },
+ { title: 'OpenStreetMap', url: 'https://www.openstreetmap.org/copyright', note: 'the place data, © contributors, ODbL' },
] },
] },
],
],
}));
}));
});
});
r.get('/llms-full.txt', (_req, res) => {
r.get('/llms-full.txt', (_req, res) => {
- const pages = publicPages().map((p) => ({ url: p.path, title: PAGE_TEXT[p.path][0], text: PAGE_TEXT[p.path][1] }));
+ const pages = publicPages().map((p) => ({
+ url: p.path,
+ title: p.title || PAGE_TEXT[p.path][0],
+ text: p.text || PAGE_TEXT[p.path][1],
+ }));
res.type('text/plain').set('Cache-Control', TEXT).send(seo.llmsFull({
res.type('text/plain').set('Cache-Control', TEXT).send(seo.llmsFull({
site: SITE_NAME,
site: SITE_NAME,
- summary: 'Every public page of OpenVibe.Food, one line each.',
+ summary: 'Every public page of OpenVibe.Food, one entry each.',
base: site,
base: site,
maxBytes: 64 * 1024,
maxBytes: 64 * 1024,
sections: [{ title: 'Pages', pages }],
sections: [{ title: 'Pages', pages }],
@@ -1,42 +1,96 @@
@@ -1,42 +1,96 @@
'use strict';
'use strict';
/**
/**
- * Public pages: the home page and the update log. Crawl artifacts (robots.txt, sitemap.xml, llms.txt,
- * llms-full.txt, JSON-LD) are http/discovery.js.
+ * Public pages, every one server-rendered and complete without JavaScript:
*
*
- * Every page works without JavaScript and is server-rendered through openvibe-shared/shell (render/layout.js).
- * The product replaces the home page's sections and adds its own routes here.
+ * / home: find food near you, plan a week, what is in your cupboard
+ * /near food banks, pantries and budget grocery stores near a place (OpenStreetMap)
+ * /plan a meal plan, a shopping list and what it costs; signed-in people can save it
+ * /foods the food list, grouped
+ * /foods/:slug one food: nutrition per serving and per 100 g, typical prices
+ * /pantry what is in your cupboard, and what you can make from it (signed in)
+ * /updates the update log
+ *
+ * Crawl artifacts (robots.txt, sitemap.xml, llms.txt, llms-full.txt, JSON-LD) are http/discovery.js.
+ * Every page that shows OpenStreetMap data carries the attribution ODbL requires, linked back.
*/
*/
+const express = require('express');
const ovServe = require('openvibe-shared/serve');
const ovServe = require('openvibe-shared/serve');
const frame = require('openvibe-shared/frame');
const frame = require('openvibe-shared/frame');
const showcase = require('openvibe-shared/showcase');
const showcase = require('openvibe-shared/showcase');
const cache = require('openvibe-shared/cache-policy');
const cache = require('openvibe-shared/cache-policy');
const { asyncRouter } = require('./router');
const { asyncRouter } = require('./router');
const { createDiscoveryRoutes, homeJsonLd } = require('./discovery');
const { createDiscoveryRoutes, homeJsonLd } = require('./discovery');
-const { html, raw } = require('../render/html');
+const { sameOrigin } = require('./principal');
+const { html, raw, table, notice, time, badge } = require('../render/html');
const { send } = require('../render/layout');
const { send } = require('../render/layout');
+const foods = require('../food/foods');
+const { planMeals } = require('../food/planner');
+const { searchPlaces, ATTRIBUTION } = require('../food/places');
+const { matchPantry } = require('../food/pantry-match');
+const store = require('../food/store');
const SITE_NAME = 'OpenVibe.Food';
const SITE_NAME = 'OpenVibe.Food';
const TAGLINE = 'What should we eat?';
const TAGLINE = 'What should we eat?';
+const KINDS = { foodbank: 'Food banks and pantries', grocery: 'Budget grocery stores', both: 'Both' };
+
+const money = (n) => (n == null ? '—' : `$${Number(n).toFixed(2)}`);
+const km = (n) => `${Number(n).toFixed(1)} km`;
+const str = (v, max = 120) => (typeof v === 'string' && v.trim() ? v.trim().slice(0, max) : null);
function createPageRoutes(ctx) {
function createPageRoutes(ctx) {
- const { config } = ctx;
+ const { config, s } = ctx;
const r = asyncRouter();
const r = asyncRouter();
const PUBLIC_CACHE = cache.htmlHeaders({ maxAge: 300 });
const PUBLIC_CACHE = cache.htmlHeaders({ maxAge: 300 });
const page = (req, res, o, status = 200) => send(res, status, { viewer: req.viewer, config, path: req.originalUrl, ...o });
const page = (req, res, o, status = 200) => send(res, status, { viewer: req.viewer, config, path: req.originalUrl, ...o });
const signedIn = (req) => req.viewer && req.viewer.kind === 'user' && req.viewer.subject;
const signedIn = (req) => req.viewer && req.viewer.kind === 'user' && req.viewer.subject;
+ const ownerOf = (req) => `user:${req.viewer.subject}`;
+
+ // ── Small pieces ─────────────────────────────────────────
+ // ODbL requires attribution wherever OSM data is shown; every result page carries it, linked back.
+ const osmNote = (fetchedAt) => html`<p class="attribution small muted">Food bank and store data © <a href="${ATTRIBUTION.url}" rel="noopener">OpenStreetMap contributors</a>, available under the <a href="${ATTRIBUTION.license_url}" rel="noopener">Open Database License</a>. ${fetchedAt ? html`Fetched ${time(fetchedAt)}.` : ''} OpenVibe.Food asks OSM at most once a second and caches answers for 7 days.</p>`;
+
+ function searchForm({ q = '', kind = 'foodbank' } = {}) {
+ const opt = (value, label) => html`<option value="${value}"${value === kind ? raw(' selected') : ''}>${label}</option>`;
+ return html`<form class="ov-form food-search" method="get" action="/near">
+<label for="q">Where are you?</label>
+<input id="q" name="q" type="search" placeholder="Town, city or postcode" value="${q}" maxlength="120">
+<label for="kind">Looking for</label>
+<select id="kind" name="kind">${Object.entries(KINDS).map(([v, l]) => opt(v, l))}</select>
+<button class="sc-btn sc-primary" type="submit">Find food</button>
+</form>`;
+ }
+
+ function placeRow(res_) {
+ return html`<li class="place" id="${res_.id}">
+<p class="place-name"><b>${res_.name}</b> ${badge(res_.type_label)} ${res_.budget === true ? badge('budget', 'ok') : ''}</p>
+<p class="muted small">${km(res_.distance_km)} away${res_.address ? html` · ${res_.address}` : ''}${res_.operator ? html` · run by ${res_.operator}` : ''}</p>
+${res_.opening_hours ? html`<p class="small">Opening hours: ${res_.opening_hours}</p>` : ''}
+${res_.phone ? html`<p class="small">Phone: <a href="tel:${String(res_.phone).replace(/[^\d+]/g, '')}">${res_.phone}</a></p>` : ''}
+<p class="small">${res_.website ? html`<a href="${res_.website}" rel="noopener nofollow">Their website</a> · ` : ''}<a href="${res_.osm_url}" rel="noopener nofollow">View on OpenStreetMap</a>${res_.wheelchair === true ? html` · wheelchair accessible` : ''}</p>
+</li>`;
+ }
+
+ function resultsBlock(out) {
+ if (!out.results.length) {
+ return html`<p class="muted">Nothing was found within ${out.radius_km} km. OpenStreetMap does not know every food bank — try a wider area, or ask your local council.</p>`;
+ }
+ return html`<ul class="places">${out.results.map(placeRow)}</ul>`;
+ }
// ── Home ─────────────────────────────────────────────────
// ── Home ─────────────────────────────────────────────────
r.get('/', (req, res) => {
r.get('/', (req, res) => {
const hero = showcase.hero({
const hero = showcase.hero({
eyebrow: `${SITE_NAME} · ${TAGLINE}`,
eyebrow: `${SITE_NAME} · ${TAGLINE}`,
- title: SITE_NAME,
- accent: TAGLINE,
- lede: `${SITE_NAME} is a new OpenVibe service. This is its skeleton: the platform plumbing below is in place, and the product is what goes on top of it.`,
- actions: signedIn(req)
- ? [{ label: 'Your account', href: '/auth/me' }, { label: 'What shipped', href: '/updates' }]
- : [{ label: 'Sign in with OpenVibe', href: '/auth/login?next=%2F', primary: true }, { label: 'What shipped', href: '/updates' }],
- note: 'Open source (AGPL-3.0). Sign-in is OpenVibe.Network; a person\'s token stays in an httpOnly cookie.',
+ title: 'Eat well.', accent: 'Spend less.',
+ lede: 'Find the food banks, pantries and budget grocery stores near you on a map anyone can edit. Plan meals for one person, a couple or a household for the days ahead, with the shopping list and what it costs. Tell it what is already in your cupboard and see what you can make.',
+ actions: [
+ { label: 'Find food near you', href: '/near', primary: true },
+ { label: 'Plan a week', href: '/plan' },
+ { label: 'The food list', href: '/foods' },
+ ],
+ note: 'Open source (AGPL-3.0). Places come from OpenStreetMap © contributors (ODbL); prices are typical, not live.',
+ aside: { html: String(searchForm()) },
});
});
page(req, res, {
page(req, res, {
index: true, cache: signedIn(req) ? null : PUBLIC_CACHE,
index: true, cache: signedIn(req) ? null : PUBLIC_CACHE,
@@ -44,30 +98,261 @@ function createPageRoutes(ctx) {
@@ -44,30 +98,261 @@ function createPageRoutes(ctx) {
styles: [showcase.STYLESHEET],
styles: [showcase.STYLESHEET],
body: html`${raw(hero)}
body: html`${raw(hero)}
${raw(showcase.features({
${raw(showcase.features({
- title: 'What is already here',
- lede: 'The parts every OpenVibe service needs, so a new product starts from them instead of rebuilding them.',
+ title: 'Everything food',
+ lede: 'Four things, all working today: no card, no account needed to look around.',
items: [
items: [
- { icon: 'ov:account', title: 'Sign-in with OpenVibe.Network', text: 'OAuth 2 with PKCE (S256), server-side code exchange, httpOnly session cookies, and offline token verification against the Network signing key.' },
- { icon: 'ov:page', title: 'Server-rendered pages', text: 'The OpenVibe Frame (navbar and footer), the shared theme, one stylesheet, crawl artifacts and JSON-LD. Every page is complete without JavaScript.' },
- { icon: 'ov:tools', title: 'An API mount and capabilities', text: 'GET /api/v1/ping today; the router, the problem+json errors and the app/person capability guard are wired and waiting for the product\'s routes.' },
- { icon: 'ov:gauge', title: 'Limits and readiness', text: 'Per-address and per-caller rate limits, /api/health, a truthful /api/ready and Prometheus metrics on loopback.' },
- { icon: 'ov:db', title: 'PostgreSQL and migrations', text: 'openvibe-sdk/db, migrations/NNNN_*.sql applied at boot, PGlite in development, and a store with an injectable clock.' },
- { icon: 'ov:deploy', title: 'Deploy files and tests', text: 'nginx and systemd units, an environment template, and a test suite on PGlite with a mock Network, all through npm test.' },
+ { icon: 'ov:location', title: 'Food near you', text: 'Food banks, soup kitchens, community fridges and free pantry boxes, plus the budget grocery stores, with distance, address and opening hours.', href: '/near' },
+ { icon: 'ov:page', title: 'A meal planner', text: 'One person, a couple or a group, for up to fourteen days. It covers all six food groups, writes the shopping list and estimates what it costs.', href: '/plan' },
+ { icon: 'ov:tools', title: 'A food list you can read', text: 'Every item with its nutrition per serving and per 100 g, the typical price band and the cheapest of the five budget chains.', href: '/foods' },
+ { icon: 'ov:account', title: 'Your cupboard', text: 'Keep a list of what you have. Sign in and it says plainly which simple things you can already make, and what one item would unlock.', href: '/pantry' },
],
],
}))}
}))}
-${raw(showcase.steps({
- title: 'How a new service starts',
- items: [
- { title: 'Generate it', text: 'node scripts/new-service.js replaces the skeleton\'s tokens (service id, name, domain, port, tagline, env prefix) in every file and file name.' },
- { title: 'Install and run', text: 'npm install, then npm run dev: the service listens on its port with an embedded PGlite database, if no DATABASE_URL is set.' },
- { title: 'Make it a product', text: 'Add the product\'s tables and migrations, its capabilities, its routes in server/http/api.js and its pages in server/http/pages.js.' },
- { title: 'Grant and deploy', text: 'Register the service and its capabilities with OpenVibe.Contracts and OpenVibe.Services, then install the unit and the vhost.' },
- ],
- }))}
-${raw(showcase.cta({ title: 'Read the API', text: 'GET /api/v1/ping is the whole API today. The rest is what the product adds.', actions: [{ label: 'The API', href: '/api/v1/ping' }, { label: 'What shipped', href: '/updates' }] }))}`,
+${raw(showcase.cta({
+ title: 'Start where you are',
+ text: 'Search your town for a food bank, plan the next three days for what you can spend, or look up what is in the tin before you open it.',
+ actions: [{ label: 'Find food near you', href: '/near', primary: true }, { label: 'Plan meals', href: '/plan' }, { label: 'The food list', href: '/foods' }],
+ }))}`,
});
});
});
});
+ // ── Food near you ────────────────────────────────────────
+ r.get('/near', async (req, res) => {
+ const q = str(req.query.q);
+ const kind = KINDS[req.query.kind] ? req.query.kind : 'foodbank';
+ const num = (v) => (v != null && v !== '' && Number.isFinite(Number(v)) ? Number(v) : null);
+ let out = null;
+ let problem = null;
+ if (q || (num(req.query.lat) != null && num(req.query.lon) != null)) {
+ try {
+ out = await searchPlaces(ctx.upstream, { kind, q, lat: num(req.query.lat), lon: num(req.query.lon), radiusKm: num(req.query.radius) }, config);
+ } catch (err) {
+ problem = err && err.code ? err.message : 'The place search is unavailable right now. Try again in a few minutes.';
+ }
+ }
+ const title = out && out.location.name ? `Food near ${out.location.name.split(',').slice(0, 2).join(',')}` : 'Food near you';
+ page(req, res, {
+ title, description: 'Food banks, pantries and budget grocery stores near a place, from OpenStreetMap.',
+ crumbs: [{ label: 'Food near you' }], styles: [showcase.STYLESHEET],
+ body: html`<h1>Food near you</h1>
+<p class="lede">Food banks, soup kitchens, community fridges, free pantry boxes and budget grocery stores, from OpenStreetMap.</p>
+${searchForm({ q: q || '', kind })}
+${problem ? notice(problem, 'warn') : ''}
+${out ? html`<section class="near-results">
+<h2>${out.location.name || 'Around those coordinates'}</h2>
+<p class="muted small">Within ${out.radius_km} km, nearest first. ${out.counts.total} found${out.counts.foodbank ? html` · ${out.counts.foodbank} food banks and pantries` : ''}${out.counts.grocery ? html` · ${out.counts.grocery} grocery stores (${out.counts.budget_grocery} budget)` : ''}.</p>
+${resultsBlock(out)}
+${osmNote(out.fetched_at)}
+</section>` : html`<p class="muted">Search for a town, a city or a postcode above — or link here with <code>?lat=</code> and <code>?lon=</code> from a map.</p>`}`,
+ });
+ });
+
+ // ── Meal plan ────────────────────────────────────────────
+ function planForm(spec) {
+ return html`<form class="ov-form plan-form" method="get" action="/plan">
+<label for="people">People</label>
+<input id="people" name="people" type="number" min="1" max="12" value="${spec.people}">
+<label for="days">Days</label>
+<input id="days" name="days" type="number" min="1" max="14" value="${spec.days}">
+<label for="budget">Budget in dollars (optional)</label>
+<input id="budget" name="budget" type="number" min="1" max="5000" step="0.01" value="${spec.budget == null ? '' : spec.budget}">
+<button class="sc-btn sc-primary" type="submit">Plan it</button>
+</form>`;
+ }
+
+ function planBody(plan) {
+ return html`<section class="plan-summary">
+<h2>${plan.spec.people} ${plan.spec.people === 1 ? 'person' : 'people'}, ${plan.spec.days} ${plan.spec.days === 1 ? 'day' : 'days'}</h2>
+<ul class="stats">
+<li><b>${money(plan.totals.cost)}</b><span>estimated total</span></li>
+<li><b>${money(plan.totals.cost_per_person_day)}</b><span>a person a day</span></li>
+<li><b>${plan.totals.kcal_per_person_day}</b><span>kcal a person a day</span></li>
+<li><b>${plan.totals.protein_g_per_person_day} g</b><span>protein a person a day</span></li>
+<li><b>${plan.groups_covered} of ${plan.groups_total}</b><span>food groups covered</span></li>
+</ul>
+${plan.spec.budget != null ? html`<p class="muted small">Budget ${money(plan.spec.budget)}${plan.remaining_budget != null ? html` · ${money(plan.remaining_budget)} left` : ''}.</p>` : ''}
+</section>
+<h2>The shopping list</h2>
+${table(['Item', 'Packs', 'Where', 'Cost'], plan.shopping_list.map((i) => [html`<a href="/foods/${i.slug}">${i.name}</a>`, String(i.packs), i.store_name || '—', money(i.cost)]), { empty: 'Nothing in the plan.' })}
+<p class="muted small">Cheapest total ${money(plan.totals.cost)} at ${plan.by_store.length} ${plan.by_store.length === 1 ? 'store' : 'stores'}: ${plan.by_store.map((x) => `${x.store_name} ${money(x.cost)}`).join(', ')}. ${plan.totals.packs} packs.</p>
+<h2>What to eat</h2>
+${plan.menu.map((d) => html`<section class="plan-day"><h3>Day ${d.day}</h3>
+<ul>${[['breakfast', 'Breakfast'], ['lunch', 'Lunch'], ['dinner', 'Dinner'], ['snack', 'Snack']].map(([slot, label]) => html`<li><b>${label}:</b> ${d[slot].join(', ') || '—'}</li>`)}</ul></section>`)}
+<h2>Food groups</h2>
+${table(['Group', 'A day, at least', 'In the plan', 'Cost'], plan.group_coverage.map((g) => [g.name, `${g.daily_min_g} g`, g.covered ? `${g.items} items, ${g.packs} packs` : '—', money(g.cost)]))}
+${plan.notes.map((n) => html`<p class="muted small">${n}</p>`)}`;
+ }
+
+ r.get('/plan', (req, res) => {
+ const spec = { people: str(req.query.people, 4) || '2', days: str(req.query.days, 4) || '3', budget: str(req.query.budget, 8) || '' };
+ let plan = null;
+ let problem = null;
+ try { plan = planMeals(spec); } catch (err) { problem = err && err.message ? err.message : 'That plan could not be made.'; }
+ const savedId = str(req.query.saved, 40);
+ page(req, res, {
+ title: 'Meal plan', description: 'A budget meal plan with a shopping list and an estimated cost, from the OpenVibe.Food food list.',
+ crumbs: [{ label: 'Meal plan' }], styles: [showcase.STYLESHEET],
+ body: html`<h1>Plan meals</h1>
+<p class="lede">It buys one item from each of the six food groups first, cheapest per serving, then fills up with the best calories per dollar. Deterministic: the same numbers always give the same plan.</p>
+${planForm(spec)}
+${savedId ? notice('Saved. It is in your plans below.', 'ok') : ''}
+${problem ? notice(problem, 'warn') : ''}
+${plan ? planBody(plan) : ''}
+${plan && signedIn(req) ? html`<h2>Save this plan</h2>
+<form class="ov-form save-form" method="post" action="/plan">
+${['people', 'days', 'budget'].map((k) => html`<input type="hidden" name="${k}" value="${k === 'budget' ? (plan.spec.budget == null ? '' : plan.spec.budget) : plan.spec[k]}">`)}
+<label for="title">Name (optional)</label>
+<input id="title" name="title" type="text" maxlength="120" placeholder="e.g. Week of the 12th">
+<button class="sc-btn" type="submit">Save this plan</button>
+</form>` : ''}
+${plan && !signedIn(req) ? html`<p class="muted small"><a href="/auth/login?next=%2Fplan">Sign in</a> to save a plan and come back to it.</p>` : ''}`,
+ });
+ });
+
+ r.post('/plan', express.urlencoded({ extended: false, limit: '64kb' }), async (req, res) => {
+ res.set('Cache-Control', cache.htmlHeaders({ private: true }));
+ const body = req.body || {};
+ const spec = { people: str(body.people, 4) || '2', days: str(body.days, 4) || '3', budget: str(body.budget, 8) || '' };
+ const back = `/plan?people=${encodeURIComponent(spec.people)}&days=${encodeURIComponent(spec.days)}&budget=${encodeURIComponent(spec.budget)}`;
+ if (!signedIn(req)) return res.redirect(303, `/auth/login?next=${encodeURIComponent('/plan')}`);
+ if (!sameOrigin(req, config.baseUrl)) return res.status(403).type('text/plain').send('A plan must be saved from openvibe.food itself.');
+ let plan;
+ try { plan = planMeals(spec); } catch (err) { return res.redirect(303, back); }
+ const row = await store.insertPlan(s, {
+ id: s.newId('pln'), owner: ownerOf(req), title: str(body.title, 120),
+ people: plan.spec.people, days: plan.spec.days, budget: plan.spec.budget, plan, created_at: s.iso(),
+ });
+ return res.redirect(303, `${back}&saved=${encodeURIComponent(row.id)}`);
+ });
+
+ // Saved plans sit under the same page: nothing personal is ever in a public cache.
+ r.get('/plan/saved', async (req, res) => {
+ if (!signedIn(req)) return res.redirect(303, '/auth/login?next=%2Fplan%2Fsaved');
+ const rows = await store.listPlans(s, ownerOf(req), { limit: 50 });
+ page(req, res, {
+ title: 'Your plans', crumbs: [{ label: 'Meal plan', href: '/plan' }, { label: 'Saved' }],
+ body: html`<h1>Your saved plans</h1>
+${table(['Name', 'For', 'Cost', 'Saved'], rows.map((row) => {
+ const plan = typeof row.plan === 'string' ? JSON.parse(row.plan) : row.plan;
+ return [row.title || `Plan ${String(row.id).slice(-6)}`, `${row.people} people, ${row.days} days`, money(plan.totals.cost), time(row.created_at)];
+ }), { empty: 'No saved plans yet. Make one on the plan page and save it.' })}
+<p><a href="/plan">Plan another</a></p>`,
+ });
+ });
+
+ // ── The food list ────────────────────────────────────────
+ r.get('/foods', (req, res) => {
+ const group = foods.GROUPS[req.query.group] ? req.query.group : null;
+ const q = str(req.query.q, 80);
+ const list = foods.listFoods({ group, q });
+ const sections = Object.entries(foods.GROUPS).filter(([id]) => !group || id === group).map(([id, def]) => {
+ const items = list.filter((f) => f.group === id);
+ if (!items.length) return '';
+ return html`<section class="food-group"><h2 id="g-${id}">${def.name}</h2>
+<p class="muted small">At least ${def.dailyMin} g a person a day. ${def.examples}.</p>
+${table(['Food', 'Serving', 'kcal', 'Protein', 'Typical price'], items.map((f) => [
+ html`<a href="/foods/${f.slug}">${f.name}</a>`,
+ f.serving_size,
+ `${f.nutrition.kcal}`,
+ `${f.nutrition.protein_g} g`,
+ f.price == null ? '—' : html`${money(f.price)} · ${f.band_label}`,
+ ]))}</section>`;
+ });
+ page(req, res, {
+ title: q ? `Foods matching “${q}”` : 'The food list', index: true, cache: signedIn(req) ? null : PUBLIC_CACHE,
+ description: 'Every food OpenVibe.Food plans with: nutrition per serving and per 100 g, and the typical price band.',
+ crumbs: [{ label: 'Food list' }], styles: [showcase.STYLESHEET],
+ body: html`<h1>The food list</h1>
+<p class="lede">${foods.FOODS.length} items the planner and the cupboard use. Nutrition is typical, per serving; the price is a band from five budget chains.</p>
+<form class="ov-form filter-form" method="get" action="/foods">
+<label for="q">Search</label>
+<input id="q" name="q" type="search" value="${q || ''}" maxlength="80" placeholder="beans, oats, tuna…">
+<label for="group">Group</label>
+<select id="group" name="group"><option value="">All groups</option>${Object.entries(foods.GROUPS).map(([id, def]) => html`<option value="${id}"${id === group ? raw(' selected') : ''}>${def.name}</option>`)}</select>
+<button class="sc-btn" type="submit">Filter</button>
+</form>
+${list.length ? sections : notice('Nothing matched. Try a shorter word.', 'warn')}
+<p class="muted small">Carried over from the OpenVibe.Tools grocery dataset (typical 2025 US Washington prices). Not a live price.</p>`,
+ });
+ });
+
+ r.get('/foods/:slug', (req, res) => {
+ const f = foods.getFood(req.params.slug);
+ if (!f) return page(req, res, {
+ title: 'No such food', crumbs: [{ label: 'Food list', href: '/foods' }, { label: 'Not found' }],
+ body: html`<h1>No such food</h1><p>Nothing in the list is called “${String(req.params.slug).slice(0, 64)}”. <a href="/foods">See the whole list</a>.</p>`,
+ }, 404);
+ page(req, res, {
+ title: f.name, index: true, cache: signedIn(req) ? null : PUBLIC_CACHE, styles: [showcase.STYLESHEET],
+ description: `${f.name}: nutrition per serving and per 100 g, and the typical price band.`,
+ crumbs: [{ label: 'Food list', href: '/foods' }, { label: f.name }],
+ body: html`<h1>${f.name}</h1>
+<p class="muted">${f.group_name} · a serving is ${f.serving_size}${f.serving_grams ? html` (about ${f.serving_grams} g)` : ''} · ${f.servings} servings a pack.</p>
+<h2>Nutrition</h2>
+${table(['', 'A serving', f.per_100g ? 'Per 100 g' : 'Per 100 g'], [
+ ['Energy', `${f.nutrition.kcal} kcal`, f.per_100g ? html`${f.per_100g.kcal} kcal` : '—'],
+ ['Protein', `${f.nutrition.protein_g} g`, f.per_100g ? html`${f.per_100g.protein_g} g` : '—'],
+ ['Carbohydrate', `${f.nutrition.carbs_g} g`, f.per_100g ? html`${f.per_100g.carbs_g} g` : '—'],
+ ['Fat', `${f.nutrition.fat_g} g`, f.per_100g ? html`${f.per_100g.fat_g} g` : '—'],
+ ['Fibre', `${f.nutrition.fiber_g} g`, f.per_100g ? html`${f.per_100g.fiber_g} g` : '—'],
+ ])}
+<p class="muted small">${f.per_100g ? `Per 100 g is worked out from the ${f.pack_grams} g pack the name states and the typical values a serving carries; it is approximate.` : 'This item names no pack weight, so no per-100 g figure is given rather than guess one.'} A pack is about ${f.package_kcal} kcal.</p>
+<h2>Typical price</h2>
+<p>${f.price == null ? 'No price recorded.' : html`<b>${money(f.price)}</b> to ${money(f.price_max)} a pack · ${f.band_label} · ${money(f.cost_per_serving)} a serving`}</p>
+${table(['Store', 'A pack'], f.prices.map((p) => [p.store_name, money(p.price)]))}
+<p class="muted small">Typical 2025 US (Washington) prices carried over from the OpenVibe.Tools grocery dataset; not a live price.</p>
+${f.tags.length ? html`<p class="tags">${f.tags.map((t) => badge(t))}</p>` : ''}
+<p><a href="/plan?people=2&days=3">Plan meals with this</a> · <a href="/foods">Back to the list</a></p>`,
+ });
+ });
+
+ // ── Your cupboard ────────────────────────────────────────
+ async function pantryPage(req, res, { saved = false } = {}) {
+ if (!signedIn(req)) {
+ return page(req, res, {
+ title: 'Your cupboard', crumbs: [{ label: 'Your cupboard' }], styles: [showcase.STYLESHEET],
+ body: html`<h1>Your cupboard</h1>
+<p class="lede">Keep a list of what you already have and OpenVibe.Food will say which of its simple recipes you can make right now — and what one more item would unlock.</p>
+<p><a class="sc-btn sc-primary" href="/auth/login?next=%2Fpantry">Sign in to keep a cupboard</a></p>`,
+ });
+ }
+ const items = await store.getPantry(s, ownerOf(req));
+ const match = matchPantry(items);
+ const have = new Set(items);
+ const groupsBlock = Object.entries(foods.GROUPS).map(([id, def]) => html`<fieldset class="pantry-group"><legend>${def.name}</legend>
+${foods.FOODS.filter((f) => f.group === id).map((f) => html`<label class="pantry-item"><input type="checkbox" name="items" value="${f.slug}"${have.has(f.slug) ? raw(' checked') : ''}> ${f.name}</label>`)}
+</fieldset>`);
+ const recipeLine = (x) => html`<li><b>${x.name}</b> — serves ${x.serves}, about ${x.minutes} minutes${x.missing && x.missing.length ? html` · missing ${x.missing.join(', ')}` : ''}</li>`;
+ page(req, res, {
+ title: 'Your cupboard', crumbs: [{ label: 'Your cupboard' }], styles: [showcase.STYLESHEET],
+ body: html`<h1>Your cupboard</h1>
+<p class="lede">Tick what you have. Nothing leaves your account; the matching is done here, not by a model.</p>
+${saved ? notice('Cupboard saved.', 'ok') : ''}
+<form method="post" action="/pantry" class="pantry-form">
+${groupsBlock}
+<div class="pantry-actions"><button class="sc-btn sc-primary" type="submit">Save cupboard</button><span class="muted small">${items.length} of ${foods.FOODS.length} items</span></div>
+</form>
+<h2>What can I make?</h2>
+<p class="muted small"><b>Basic suggestions.</b> Simple combinations written by OpenVibe from the items in the list above, matched against your cupboard. Not dietary advice, and not a full recipe book.</p>
+${match.can_make.length ? html`<h3>You can make these now</h3><ul>${match.can_make.map(recipeLine)}</ul>` : html`<p class="muted">Nothing is complete yet. Tick what you have above.</p>`}
+${match.almost.length ? html`<h3>One item away</h3><ul>${match.almost.map(recipeLine)}</ul>` : ''}
+${match.rest.length ? html`<h3>Further off</h3><ul>${match.rest.slice(0, 6).map(recipeLine)}</ul>` : ''}`,
+ });
+ }
+
+ r.get('/pantry', (req, res) => pantryPage(req, res, { saved: !!req.query.saved }));
+
+ r.post('/pantry', express.urlencoded({ extended: false, limit: '64kb' }), async (req, res) => {
+ res.set('Cache-Control', cache.htmlHeaders({ private: true }));
+ if (!signedIn(req)) return res.redirect(303, '/auth/login?next=%2Fpantry');
+ if (!sameOrigin(req, config.baseUrl)) return res.status(403).type('text/plain').send('A cupboard must be saved from openvibe.food itself.');
+ // A checkbox form sends the field once per ticked box; some clients send one comma-joined value. Accept both.
+ const sent = [].concat((req.body && req.body.items) || []).flatMap((v) => String(v).split(','));
+ const picked = [...new Set(sent.map((x) => x.trim()).filter((slug) => foods.getFood(slug)))];
+ if (picked.length > 200) return res.status(413).type('text/plain').send('That is more items than a cupboard can hold.');
+ await store.setPantry(s, ownerOf(req), picked);
+ return res.redirect(303, '/pantry?saved=1');
+ });
+
// ── The update log ───────────────────────────────────────
// ── The update log ───────────────────────────────────────
r.get('/updates', (req, res) => page(req, res, {
r.get('/updates', (req, res) => page(req, res, {
index: true, cache: PUBLIC_CACHE,
index: true, cache: PUBLIC_CACHE,
@@ -80,4 +365,4 @@ ${raw(showcase.cta({ title: 'Read the API', text: 'GET /api/v1/ping is the whole
@@ -80,4 +365,4 @@ ${raw(showcase.cta({ title: 'Read the API', text: 'GET /api/v1/ping is the whole
return r;
return r;
}
}
-module.exports = { createPageRoutes };
+module.exports = { createPageRoutes, TAGLINE, SITE_NAME };
@@ -23,7 +23,14 @@ const PROJECT_RE = /^prj_[0-9A-HJKMNP-TV-Z]{26}$/;
@@ -23,7 +23,14 @@ const PROJECT_RE = /^prj_[0-9A-HJKMNP-TV-Z]{26}$/;
// The product fills this in: one entry per capability its routes name, in openvibe-contracts
// The product fills this in: one entry per capability its routes name, in openvibe-contracts
// manifests/capabilities/<food>.*. requireCapability('<name>') refuses a name that is not listed here, so a
// manifests/capabilities/<food>.*. requireCapability('<name>') refuses a name that is not listed here, so a
// route can never be guarded by a capability the service does not declare.
// route can never be guarded by a capability the service does not declare.
-const CAPABILITIES = [];
+const CAPABILITIES = [
+ 'food.place.read', // the place search: food banks and budget grocers near a point
+ 'food.food.read', // the food list and one food
+ 'food.plan.read', // the plans a caller saved
+ 'food.plan.write', // save a plan
+ 'food.pantry.read', // read a caller's pantry
+ 'food.pantry.write', // replace a caller's pantry
+];
function decodePayload(token) {
function decodePayload(token) {
const parts = String(token || '').split('.');
const parts = String(token || '').split('.');
@@ -8,7 +8,7 @@ const express = require('express');
@@ -8,7 +8,7 @@ const express = require('express');
function asyncRouter() {
function asyncRouter() {
const r = express.Router();
const r = express.Router();
- for (const method of ['get', 'post']) {
+ for (const method of ['get', 'post', 'put', 'patch', 'delete']) {
const orig = r[method].bind(r);
const orig = r[method].bind(r);
r[method] = (path, ...handlers) => orig(path, ...handlers.map((h) => (h.length === 4 ? h : (req, res, next) => {
r[method] = (path, ...handlers) => orig(path, ...handlers.map((h) => (h.length === 4 ? h : (req, res, next) => {
try {
try {
@@ -24,6 +24,10 @@ const TAGLINE = 'What should we eat?';
@@ -24,6 +24,10 @@ const TAGLINE = 'What should we eat?';
const PUBLIC_DIR = path.join(__dirname, '..', '..', 'public');
const PUBLIC_DIR = path.join(__dirname, '..', '..', 'public');
// The product's own navigation: one entry per public page it serves.
// The product's own navigation: one entry per public page it serves.
const NAV = [
const NAV = [
+ { label: 'Food near you', href: '/near' },
+ { label: 'Meal plan', href: '/plan' },
+ { label: 'Food list', href: '/foods' },
+ { label: 'Cupboard', href: '/pantry' },
{ label: 'What shipped', href: '/updates' },
{ label: 'What shipped', href: '/updates' },
];
];
@@ -20,8 +20,13 @@ const READ = 'food.api.read';
@@ -20,8 +20,13 @@ const READ = 'food.api.read';
const rosa = t.network.addUser('rosa');
const rosa = t.network.addUser('rosa');
const sam = t.network.addUser('sam');
const sam = t.network.addUser('sam');
- await check('BUDGETS starts empty: the product declares its own expensive routes', () => {
- assert.deepStrictEqual(BUDGETS, {});
+ await check('BUDGETS declares the product\'s expensive routes, each with real numbers', () => {
+ assert.deepStrictEqual(Object.keys(BUDGETS).sort(), ['food.pantry.write', 'food.place.search', 'food.plan.create']);
+ for (const [name, own] of Object.entries(BUDGETS)) {
+ assert.ok(own.minute > 0 && own.hour >= own.minute, `${name} has no real numbers`);
+ }
+ // The place search hits OpenStreetMap, so it is the tightest budget of the three.
+ assert.ok(BUDGETS['food.place.search'].minute <= Math.min(BUDGETS['food.plan.create'].minute, BUDGETS['food.pantry.write'].minute));
});
});
await check('a read: 3 a minute per address, then 429 rate_limited with Retry-After; another address passes', async () => {
await check('a read: 3 a minute per address, then 429 rate_limited with Retry-After; another address passes', async () => {
new file mode 100644
new file mode 100644
@@ -0,0 +1,99 @@
@@ -0,0 +1,99 @@
+'use strict';
+/**
+ * The food list and its pages: the API hands out the nutrition and the price band, /foods and /foods/:slug render
+ * them server-side, and the sitemap and llms-full.txt carry every food page. The per-100 g figure is arithmetic on
+ * the pack size in the item's own name, so a pack that states no weight says so instead of guessing.
+ */
+const assert = require('assert');
+const { boot, check, done } = require('./helpers/boot');
+const foods = require('../server/food/foods');
+
+(async () => {
+ const t = await boot();
+ try {
+ await check('the food list: every group, real nutrition, a typical price band and no invented numbers', async () => {
+ const r = await t.get('/api/v1/foods');
+ assert.strictEqual(r.status, 200, r.text);
+ const b = r.json();
+ assert.ok(b.count >= 40, `only ${b.count} foods`);
+ assert.strictEqual(b.groups.length, 6);
+ assert.deepStrictEqual(b.groups.map((g) => g.group).sort(), ['dairy', 'fats', 'fruits', 'grains', 'protein', 'vegetables']);
+ for (const f of b.foods) {
+ assert.ok(f.name && f.group && f.serving_size, JSON.stringify(f));
+ assert.ok(f.nutrition_per_serving.kcal >= 0 && f.nutrition_per_serving.protein_g >= 0);
+ assert.ok(f.price > 0 && f.price_max >= f.price, `${f.slug} price`);
+ assert.ok(['low', 'medium', 'higher', 'high'].includes(f.price_band));
+ assert.strictEqual(f.url, `/foods/${f.slug}`);
+ // per 100 g is there exactly when the pack size in the name is a weight
+ assert.strictEqual(f.nutrition_per_100g != null, foods.packGrams(f.name) != null, `${f.slug} per-100 g`);
+ }
+ assert.strictEqual(b.source.name, 'OpenVibe.Tools grocery dataset', 'the provenance is stated');
+ assert.strictEqual(b.foods.find((f) => f.slug === 'canned-tuna').nutrition_per_100g.kcal, 106);
+ assert.strictEqual(b.foods.find((f) => f.slug === 'eggs-dozen').nutrition_per_100g, null, 'a dozen eggs states no weight');
+ });
+
+ await check('filtering by group and by word; an unknown group is refused', async () => {
+ const protein = (await t.get('/api/v1/foods?group=protein')).json();
+ assert.ok(protein.count > 0 && protein.foods.every((f) => f.group === 'protein'));
+ const oats = (await t.get('/api/v1/foods?q=oats')).json();
+ assert.deepStrictEqual(oats.foods.map((f) => f.slug), ['oatmeal']);
+ const bad = await t.get('/api/v1/foods?group=pizza');
+ assert.strictEqual(bad.status, 422);
+ assert.strictEqual(bad.json().code, 'food.food.invalid');
+ });
+
+ await check('one food by slug, and a 404 with a stable code for one that is not in the list', async () => {
+ const r = await t.get('/api/v1/foods/canned-tuna');
+ assert.strictEqual(r.status, 200);
+ const f = r.json().food;
+ assert.strictEqual(f.name, 'Canned Tuna (5 oz)');
+ assert.strictEqual(f.prices[0].store_name, 'Grocery Outlet', 'the cheapest chain first');
+ assert.ok(f.prices.length >= 4);
+ const missing = await t.get('/api/v1/foods/caviar');
+ assert.strictEqual(missing.status, 404);
+ assert.strictEqual(missing.json().code, 'food.food.not_found');
+ });
+
+ await check('the /foods page and one food page render server-side, per serving and per 100 g', async () => {
+ const list = await t.get('/foods');
+ assert.strictEqual(list.status, 200);
+ assert.match(list.headers.get('content-type'), /^text\/html/);
+ assert.ok(list.text.includes('href="/foods/eggs-dozen"'), 'the list links to a food page');
+ assert.ok(list.text.includes('Protein'), 'the groups are shown');
+ assert.match(list.text, /<meta name="robots" content="index, follow">/);
+
+ const one = await t.get('/foods/canned-tuna');
+ assert.strictEqual(one.status, 200);
+ assert.ok(one.text.includes('Canned Tuna (5 oz)'));
+ assert.ok(one.text.includes('Per 100 g'));
+ assert.ok(one.text.includes('106 kcal'), 'the per-100 g energy is rendered');
+ assert.ok(/Grocery Outlet/.test(one.text), 'the price table by chain');
+ assert.ok(one.text.includes('Not a live price') || one.text.includes('not a live price'));
+
+ const bad = await t.get('/foods/caviar');
+ assert.strictEqual(bad.status, 404);
+ assert.match(bad.text, /No such food/);
+ });
+
+ await check('the sitemap and llms-full.txt carry every food page', async () => {
+ const sitemap = (await t.get('/sitemap.xml')).text;
+ for (const slug of ['eggs-dozen', 'canned-tuna', 'white-rice']) {
+ assert.ok(sitemap.includes(`<loc>https://openvibe.food/foods/${slug}</loc>`), `no /foods/${slug} in the sitemap`);
+ }
+ assert.ok(sitemap.includes('<loc>https://openvibe.food/near</loc>'));
+ assert.ok(!sitemap.includes('/pantry'), 'a personal page is never in the sitemap');
+ const full = (await t.get('/llms-full.txt')).text;
+ assert.ok(full.includes('https://openvibe.food/foods/canned-tuna'), 'the food page is in llms-full.txt');
+ assert.ok(!full.includes('(truncated:'), 'llms-full.txt holds every page');
+ });
+
+ await check('the home page offers the search box and the three ways in', async () => {
+ const r = await t.get('/');
+ assert.strictEqual(r.status, 200);
+ assert.ok(r.text.includes('action="/near"'), 'the search form posts to /near');
+ assert.ok(r.text.includes('name="q"'));
+ for (const href of ['/near', '/plan', '/foods', '/pantry']) assert.ok(r.text.includes(`href="${href}"`), `no link to ${href}`);
+ });
+ } finally { await t.close(); }
+ done();
+})();
@@ -3,6 +3,15 @@
@@ -3,6 +3,15 @@
// (server/http/caller-limits.js) count nobody unless a test asks: boot({ callerLimits: true, limitsNow }).
// (server/http/caller-limits.js) count nobody unless a test asks: boot({ callerLimits: true, limitsNow }).
process.env.FOOD_RATE_LIMIT_PER_MIN = process.env.FOOD_RATE_LIMIT_PER_MIN || '100000';
process.env.FOOD_RATE_LIMIT_PER_MIN = process.env.FOOD_RATE_LIMIT_PER_MIN || '100000';
process.env.FOOD_API_RATE_LIMIT_PER_MIN = process.env.FOOD_API_RATE_LIMIT_PER_MIN || '100000';
process.env.FOOD_API_RATE_LIMIT_PER_MIN = process.env.FOOD_API_RATE_LIMIT_PER_MIN || '100000';
+// Outbound HTTP is never real in a test: unless a test names a stand-in (test/helpers/osm.js), the two OpenStreetMap
+// hosts point at a closed local port, so the call fails at once instead of reaching the internet.
+const OSM_OFFLINE = {
+ FOOD_NOMINATIM_URL: 'http://127.0.0.1:9/nominatim',
+ FOOD_OVERPASS_URL: 'http://127.0.0.1:9/overpass',
+ // The one-request-a-second pace is asserted by places.test.js with the policy's real second; the rest of the
+ // suite must not pay it.
+ FOOD_OSM_MIN_INTERVAL_MS: '1',
+};
/**
/**
* Boots OpenVibe.Food on a temp database with a mock Network (test/helpers/mocks.js), captures every log line, and
* Boots OpenVibe.Food on a temp database with a mock Network (test/helpers/mocks.js), captures every log line, and
* returns a small HTTP client. Every test file gets its own.
* returns a small HTTP client. Every test file gets its own.
@@ -27,6 +36,7 @@ async function boot(opts = {}) {
@@ -27,6 +36,7 @@ async function boot(opts = {}) {
NODE_ENV: 'test', PORT: '0', BASE_URL: 'https://openvibe.food', TRUST_PROXY: '1',
NODE_ENV: 'test', PORT: '0', BASE_URL: 'https://openvibe.food', TRUST_PROXY: '1',
OV_NETWORK_URL: network.url, OV_NETWORK_INTERNAL_URL: network.url,
OV_NETWORK_URL: network.url, OV_NETWORK_INTERNAL_URL: network.url,
OV_OAUTH_CLIENT_ID: 'food', OV_OAUTH_CLIENT_SECRET: 'food-secret', COOKIE_SECURE: 'false',
OV_OAUTH_CLIENT_ID: 'food', OV_OAUTH_CLIENT_SECRET: 'food-secret', COOKIE_SECURE: 'false',
+ ...OSM_OFFLINE,
...(opts.env || {}),
...(opts.env || {}),
};
};
for (const [k, v] of Object.entries(opts.env || {})) if (v === null) delete env[k];
for (const [k, v] of Object.entries(opts.env || {})) if (v === null) delete env[k];
new file mode 100644
new file mode 100644
@@ -0,0 +1,81 @@
@@ -0,0 +1,81 @@
+'use strict';
+/**
+ * A stand-in for the two OpenStreetMap services OpenVibe.Food uses, on one local HTTP server:
+ *
+ * GET /search Nominatim (format=jsonv2): the array in `state.geocode`
+ * POST /api/interpreter Overpass: the body in `state.overpass.foodbank` or `state.overpass.grocery`,
+ * chosen by whether the query mentions social_facility or shop
+ *
+ * Every request is recorded in `.requests` as { path, at, query, body } with its timestamp, so a test can prove the
+ * one-request-a-second pace (server/food/upstream.js) and prove a cache hit made no request at all.
+ *
+ * const osm = await startOsm();
+ * const t = await boot({ env: { FOOD_NOMINATIM_URL: osm.url, FOOD_OVERPASS_URL: `${osm.url}/api/interpreter` } });
+ */
+const http = require('http');
+
+const SPRINGFIELD = { lat: '39.7817', lon: '-89.6501', display_name: 'Springfield, Illinois, United States' };
+
+const DEFAULT_OVER = {
+ foodbank: {
+ elements: [
+ { type: 'node', id: 101, lat: 39.7850, lon: -89.6500, tags: { amenity: 'social_facility', social_facility: 'food_bank', name: 'Springfield Food Pantry', 'addr:housenumber': '12', 'addr:street': 'Main Street', 'addr:city': 'Springfield', 'addr:state': 'IL', opening_hours: 'Mo-Fr 09:00-16:00', phone: '+1 217 555 0101', website: 'https://example.org/pantry', wheelchair: 'yes' } },
+ { type: 'node', id: 102, lat: 39.7900, lon: -89.6400, tags: { amenity: 'social_facility', social_facility: 'soup_kitchen', name: 'St. Mary Soup Kitchen', opening_hours: 'Sa 11:00-13:00' } },
+ { type: 'way', id: 103, center: { lat: 39.7700, lon: -89.6600 }, tags: { amenity: 'give_box', name: 'Free pantry box' } }, // no name: falls back to its type label
+ { type: 'node', id: 104, lat: 39.8200, lon: -89.7000, tags: { amenity: 'food_sharing', name: 'Riverside Community Fridge' } },
+ ],
+ },
+ grocery: {
+ elements: [
+ { type: 'node', id: 201, lat: 39.7800, lon: -89.6600, tags: { shop: 'supermarket', name: 'Aldi', brand: 'Aldi', opening_hours: 'Mo-Su 08:00-20:00' } },
+ { type: 'node', id: 202, lat: 39.7900, lon: -89.6600, tags: { shop: 'convenience', name: 'Corner Market' } },
+ { type: 'node', id: 203, lat: 39.7750, lon: -89.6450, tags: { shop: 'variety_store', name: 'Dollar Tree' } },
+ ],
+ },
+};
+
+async function startOsm(opts = {}) {
+ const requests = [];
+ const state = {
+ geocode: opts.geocode || [SPRINGFIELD],
+ overpass: opts.overpass || DEFAULT_OVER,
+ fail: false,
+ respond: null, // (kind, query) → body, to override per call
+ };
+
+ const server = http.createServer((req, res) => {
+ let raw = '';
+ req.on('data', (d) => { raw += d; raw = raw.slice(0, 65536); });
+ req.on('end', () => {
+ const url = new URL(req.url, 'http://x');
+ const query = url.search || '';
+ requests.push({ method: req.method, path: url.pathname, query, body: raw, at: Date.now() });
+ const json = (status, obj) => { res.writeHead(status, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(obj)); };
+ if (state.fail) return json(503, { error: 'the stand-in OSM service is down' });
+ if (url.pathname === '/search' && req.method === 'GET') {
+ // Like Nominatim: a place it does not know is an empty array, not an error.
+ const words = String(url.searchParams.get('q') || '').toLowerCase().split(/\W+/).filter((w) => w.length >= 3);
+ return json(200, state.geocode.filter((g) => words.some((w) => String(g.display_name).toLowerCase().includes(w))));
+ }
+ if (url.pathname === '/api/interpreter' && req.method === 'POST') {
+ const data = decodeURIComponent(new URLSearchParams(raw).get('data') || '');
+ const kind = /social_facility|food_sharing|give_box/.test(data) ? 'foodbank' : 'grocery';
+ if (state.respond) return json(200, state.respond(kind, data));
+ return json(200, state.overpass[kind] || { elements: [] });
+ }
+ return json(404, { error: 'not found' });
+ });
+ });
+ await new Promise((r) => server.listen(0, '127.0.0.1', r));
+ const url = `http://127.0.0.1:${server.address().port}`;
+ return {
+ url, state, requests,
+ env: { FOOD_NOMINATIM_URL: url, FOOD_OVERPASS_URL: `${url}/api/interpreter` },
+ reset() { requests.length = 0; state.fail = false; state.respond = null; state.geocode = [SPRINGFIELD]; state.overpass = DEFAULT_OVER; },
+ /** The gaps, in ms, between consecutive upstream calls — the pace a test checks. */
+ gaps() { return requests.slice(1).map((r, i) => r.at - requests[i].at); },
+ close: () => new Promise((r) => server.close(r)),
+ };
+}
+
+module.exports = { startOsm, SPRINGFIELD, DEFAULT_OVER };
new file mode 100644
new file mode 100644
@@ -0,0 +1,109 @@
@@ -0,0 +1,109 @@
+'use strict';
+/**
+ * The cupboard: what a person says they have, kept per account, and the deterministic "what can I make" that matches
+ * it against the basic recipes. No model call anywhere near it. Anonymous callers are refused every read and write of
+ * a personal list, an unknown food is refused rather than stored, and a PUT replaces the list.
+ */
+const assert = require('assert');
+const { boot, check, done } = require('./helpers/boot');
+const { matchPantry } = require('../server/food/pantry-match');
+
+const SAME = { 'sec-fetch-site': 'same-origin' };
+
+(async () => {
+ await check('the match is deterministic and says what is missing', () => {
+ const full = matchPantry(['white-rice', 'canned-beans', 'onion-3lb']);
+ assert.deepStrictEqual(full.can_make.map((r) => r.slug), ['beans-and-rice']);
+ assert.deepStrictEqual(full.can_make[0].missing, []);
+ assert.deepStrictEqual(full.can_make[0].steps.length > 0, true);
+
+ const empty = matchPantry([]);
+ assert.deepStrictEqual(empty.can_make, []);
+ assert.strictEqual(empty.all.length, require('../server/food/recipes').RECIPES.length);
+ assert.ok(empty.all.every((r) => !r.can_make && r.missing_count === r.ingredients.length));
+
+ const close = matchPantry(['bread-white', 'canned-tuna']);
+ assert.ok(close.can_make.some((r) => r.slug === 'tuna-sandwich'));
+ const almost = close.almost.find((r) => r.slug === 'eggs-on-toast');
+ assert.ok(almost, 'eggs on toast is one item away');
+ assert.deepStrictEqual(almost.missing.map((m) => m.name), ['Large Eggs (1 dozen)']);
+ assert.strictEqual(almost.coverage, 0.5);
+
+ // every recipe names only foods the list knows
+ const { RECIPES } = require('../server/food/recipes');
+ const { getFood } = require('../server/food/foods');
+ for (const r of RECIPES) for (const slug of [...r.ingredients, ...(r.optional || [])]) assert.ok(getFood(slug), `${r.slug} names ${slug}, which is not in the food list`);
+ });
+
+ const t = await boot();
+ const kim = t.network.addUser('kim');
+ const lee = t.network.addUser('lee');
+ try {
+ await check('an anonymous caller can neither read nor write a pantry', async () => {
+ assert.strictEqual((await t.get('/api/v1/pantry')).status, 401);
+ assert.strictEqual((await t.get('/api/v1/pantry', { json: { items: [] }, method: 'PUT', headers: SAME })).status, 401);
+ const page = await t.get('/pantry');
+ assert.strictEqual(page.status, 200, 'the page itself is public: it just asks you to sign in');
+ assert.match(page.text, /Sign in to keep a cupboard/);
+ });
+
+ await check('PUT replaces the list; GET gives it back with the foods and the suggestions', async () => {
+ const first = await t.get('/api/v1/pantry', { json: { items: ['white-rice', 'canned-beans', 'onion-3lb'] }, method: 'PUT', as: kim, headers: SAME });
+ assert.strictEqual(first.status, 200, first.text);
+ const body = first.json();
+ assert.deepStrictEqual(body.items, ['canned-beans', 'onion-3lb', 'white-rice'], 'sorted');
+ assert.deepStrictEqual(body.foods.map((f) => f.slug), body.items);
+ assert.deepStrictEqual(body.suggestions.can_make.map((r) => r.slug), ['beans-and-rice']);
+ assert.match(body.note, /Basic suggestions/);
+
+ const replaced = await t.get('/api/v1/pantry', { json: { items: ['bread-white', 'canned-tuna'] }, method: 'PUT', as: kim, headers: SAME });
+ assert.deepStrictEqual(replaced.json().items, ['bread-white', 'canned-tuna'], 'a PUT is the whole list, not a merge');
+
+ const read = await t.get('/api/v1/pantry', { as: kim });
+ assert.deepStrictEqual(read.json().items, ['bread-white', 'canned-tuna']);
+ assert.deepStrictEqual((await t.get('/api/v1/pantry', { as: lee })).json().items, [], 'another person has their own');
+ const cleared = await t.get('/api/v1/pantry', { json: { items: [] }, method: 'PUT', as: kim, headers: SAME });
+ assert.deepStrictEqual(cleared.json().items, []);
+ });
+
+ await check('an item that is not in the food list is refused, and a cleared list is a real answer', async () => {
+ const bad = await t.get('/api/v1/pantry', { json: { items: ['white-rice', 'unicorn-steak'] }, method: 'PUT', as: kim, headers: SAME });
+ assert.strictEqual(bad.status, 422);
+ assert.strictEqual(bad.json().code, 'food.pantry.unknown_item');
+ assert.match(bad.json().detail, /unicorn-steak/);
+ assert.deepStrictEqual((await t.get('/api/v1/pantry', { as: kim })).json().items, [], 'nothing was stored');
+ const notArray = await t.get('/api/v1/pantry', { json: { items: 'eggs-dozen' }, method: 'PUT', as: kim, headers: SAME });
+ assert.strictEqual(notArray.status, 422);
+ assert.strictEqual(notArray.json().code, 'food.pantry.invalid');
+ });
+
+ await check('the cupboard page ticks what you have, saves without JavaScript, and shows what you can make', async () => {
+ await t.get('/api/v1/pantry', { json: { items: ['white-rice', 'canned-beans', 'onion-3lb'] }, method: 'PUT', as: kim, headers: SAME });
+ const page = await t.get('/pantry', { as: kim });
+ assert.strictEqual(page.status, 200);
+ assert.match(page.text, /name="items" value="white-rice" checked/);
+ assert.match(page.text, /What can I make\?/);
+ assert.match(page.text, /Beans and rice/);
+ assert.match(page.text, /Basic suggestions/);
+
+ // A real checkbox form sends the field once per ticked box.
+ const saved = await t.get('/pantry', {
+ as: kim, method: 'POST', headers: { ...SAME, 'content-type': 'application/x-www-form-urlencoded' },
+ body: 'items=bread-white&items=canned-tuna&items=butter',
+ });
+ assert.strictEqual(saved.status, 303, saved.text.slice(0, 200));
+ assert.strictEqual(saved.headers.get('location'), '/pantry?saved=1');
+ assert.deepStrictEqual((await t.get('/api/v1/pantry', { as: kim })).json().items, ['bread-white', 'butter', 'canned-tuna']);
+
+ const back = await t.get('/pantry?saved=1', { as: kim });
+ assert.match(back.text, /Cupboard saved\./);
+ assert.match(back.text, /Tuna sandwich/);
+ });
+
+ await check('another site cannot change a signed-in visitor\'s cupboard', async () => {
+ const cross = await t.get('/pantry', { as: kim, method: 'POST', body: 'items=eggs-dozen', headers: { 'content-type': 'application/x-www-form-urlencoded', 'sec-fetch-site': 'cross-site' } });
+ assert.strictEqual(cross.status, 403);
+ });
+ } finally { await t.close(); }
+ done();
+})();
@@ -20,7 +20,9 @@ const BUDGETS = {
@@ -20,7 +20,9 @@ const BUDGETS = {
jsRawKB: 264, // 239.8
jsRawKB: 264, // 239.8
jsBrotliKB: 62.5, // 56.5
jsBrotliKB: 62.5, // 56.5
cssFiles: 2, // 2 (app.css + the cached /shared/showcase.css)
cssFiles: 2, // 2 (app.css + the cached /shared/showcase.css)
- cssRawKB: 16.5, // 15.0
+ // 16.4 since the product's own pages brought their stylesheet with them (the search and plan forms, the place
+ // cards, the pantry's tick list); app.css itself stayed within a few lines.
+ cssRawKB: 18.0, // 16.4
cssBrotliKB: 4.1, // 3.7
cssBrotliKB: 4.1, // 3.7
externalFiles: 0, // 0
externalFiles: 0, // 0
};
};
new file mode 100644
new file mode 100644
@@ -0,0 +1,188 @@
@@ -0,0 +1,188 @@
+'use strict';
+/**
+ * "Find food near you" end to end against a stand-in OSM (test/helpers/osm.js): the API and the page, the ODbL
+ * attribution and the link back, the escaping of a hostile name from OSM, and the three rules this route lives
+ * under — one upstream request a second per host, every answer cached for a week, and a per-caller budget on the
+ * search itself. No test here ever calls the real OpenStreetMap.
+ */
+const assert = require('assert');
+const { boot, check, done } = require('./helpers/boot');
+const { startOsm } = require('./helpers/osm');
+const { createPacer } = require('../server/food/upstream');
+const geo = require('../server/food/store');
+
+const OVERPASS = '/api/interpreter';
+
+(async () => {
+ await check('the pace is a queue: concurrent callers are serialised, and a failure does not stall it', async () => {
+ const started = [];
+ const pacer = createPacer({ minIntervalMs: 50 });
+ await Promise.all([1, 2, 3, 4].map(() => pacer.run(async () => { started.push(Date.now()); })));
+ assert.strictEqual(started.length, 4);
+ for (let i = 1; i < started.length; i++) assert.ok(started[i] - started[i - 1] >= 45, `calls ${started[i] - started[i - 1]} ms apart`);
+ await assert.rejects(pacer.run(() => Promise.reject(new Error('boom'))));
+ const after = [];
+ await pacer.run(async () => after.push(Date.now()));
+ assert.strictEqual(after.length, 1, 'the queue kept going after a failure');
+ });
+
+ const osm = await startOsm();
+ const t = await boot({ env: { ...osm.env, FOOD_OSM_MIN_INTERVAL_MS: '1' } });
+
+ try {
+ await check('a cached answer is kept for the TTL and an expired one is ignored', async () => {
+ const s = t.ctx.s;
+ const written = await geo.cachePut(s, 'nominatim:test ttl:1', [], 7 * 24 * 60 * 60 * 1000);
+ const days = (Date.parse(written.expires_at) - Date.parse(written.fetched_at)) / 86_400_000;
+ assert.ok(days > 6.9 && days < 7.1, `${days} days`);
+ assert.ok(await geo.cacheGet(s, 'nominatim:test ttl:1'), 'a fresh row is a hit');
+ await s.db.query(
+ `INSERT INTO food_geo_cache (key, body, fetched_at, expires_at) VALUES ($1, $2::jsonb, $3, $4)
+ ON CONFLICT (key) DO UPDATE SET body = EXCLUDED.body, expires_at = EXCLUDED.expires_at`,
+ ['nominatim:stale:1', JSON.stringify([]), '2020-01-01T00:00:00.000Z', '2020-01-08T00:00:00.000Z']);
+ assert.strictEqual(await geo.cacheGet(s, 'nominatim:stale:1'), null, 'a row past its TTL is not a hit');
+ });
+
+ await check('the place search geocodes a name, lists food banks nearest first, and carries the ODbL attribution', async () => {
+ const r = await t.get(`/api/v1/places?q=${encodeURIComponent('Springfield, Illinois')}&kind=foodbank`);
+ assert.strictEqual(r.status, 200, r.text);
+ const b = r.json();
+ assert.strictEqual(b.location.from, 'geocode');
+ assert.strictEqual(b.location.lat, 39.7817);
+ assert.strictEqual(b.kind, 'foodbank');
+ assert.strictEqual(b.results.length, 4, JSON.stringify(b.results.map((x) => x.name)));
+ assert.strictEqual(b.results[0].name, 'Springfield Food Pantry');
+ assert.ok(b.results[0].distance_km < b.results[1].distance_km, 'nearest first');
+ assert.strictEqual(b.results[0].address, '12, Main Street, Springfield, IL');
+ assert.match(b.results[0].opening_hours, /Mo-Fr 09:00-16:00/);
+ assert.strictEqual(b.results[0].wheelchair, true);
+ assert.strictEqual(b.results[0].osm_url, 'https://www.openstreetmap.org/node/101');
+ assert.ok(b.results.some((x) => x.type_label === 'Soup kitchen'), 'a soup kitchen is labelled as one');
+ assert.ok(b.results.some((x) => x.name === 'Free pantry box'), 'an unnamed one falls back to its type label');
+ assert.strictEqual(b.counts.total, 4);
+ assert.strictEqual(b.attribution.text, '© OpenStreetMap contributors');
+ assert.strictEqual(b.attribution.url, 'https://www.openstreetmap.org/copyright');
+ assert.strictEqual(b.attribution.license, 'ODbL 1.0');
+ assert.match(b.fetched_at, /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/);
+ assert.strictEqual(b.cached, false, 'the first search fetched');
+ // One geocode and one area query: never a bulk download, and nothing else.
+ assert.deepStrictEqual(osm.requests.map((q) => q.path).sort(), ['/search', OVERPASS].sort());
+ assert.match(osm.requests.find((q) => q.path === OVERPASS).body, /around%3A\d+%2C39\.7817/);
+ });
+
+ await check('the same place is not asked of OpenStreetMap twice: the second search is served from the cache', async () => {
+ const before = osm.requests.length;
+ const r = await t.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank');
+ assert.strictEqual(r.status, 200, r.text);
+ const b = r.json();
+ assert.strictEqual(b.cached, true);
+ assert.strictEqual(osm.requests.length, before, 'a cache hit makes no upstream request');
+ assert.strictEqual(b.results.length, 4);
+ assert.strictEqual(b.fetched_at, (await t.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank')).json().fetched_at, 'the cached fetched_at is kept');
+ });
+
+ await check('grocery stores come with the budget mark, and a page shows the results and the attribution link', async () => {
+ const r = await t.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=grocery');
+ assert.strictEqual(r.status, 200, r.text);
+ const b = r.json();
+ const aldi = b.results.find((x) => x.name === 'Aldi');
+ assert.ok(aldi, 'Aldi is listed');
+ assert.strictEqual(aldi.budget, true, 'a discount chain is marked budget');
+ assert.strictEqual(b.results.find((x) => x.name === 'Corner Market').budget, false);
+ assert.strictEqual(b.results.find((x) => x.name === 'Dollar Tree').budget, true, 'a variety store is a budget store');
+ assert.strictEqual(b.counts.budget_grocery, 2);
+
+ const pageRes = await t.get('/near?q=Springfield%2C%20Illinois&kind=grocery');
+ assert.strictEqual(pageRes.status, 200);
+ assert.match(pageRes.text, /Aldi/);
+ assert.match(pageRes.text, /OpenStreetMap contributors/);
+ assert.match(pageRes.text, /https:\/\/www\.openstreetmap\.org\/copyright/, 'the attribution is linked back');
+ assert.match(pageRes.text, /https:\/\/opendatacommons\.org\/licenses\/odbl\/1-0\//, 'the ODbL is linked');
+ assert.match(pageRes.text, /class="badge ok">budget</, 'the budget badge is shown');
+ });
+
+ await check('a name from OpenStreetMap is escaped on the page, never taken as markup', async () => {
+ osm.state.overpass = { ...osm.state.overpass, foodbank: { elements: [
+ { type: 'node', id: 301, lat: 40.0, lon: -90.0, tags: { amenity: 'social_facility', social_facility: 'food_bank', name: '<script>alert(1)</script> Pantry', 'addr:city': 'Riverton' } },
+ ] } };
+ const api = await t.get('/api/v1/places?lat=40&lon=-90&kind=foodbank');
+ assert.strictEqual(api.status, 200, api.text);
+ assert.strictEqual(api.json().results[0].name, '<script>alert(1)</script> Pantry', 'the API hands back what OSM said');
+
+ const page = await t.get('/near?lat=40&lon=-90&kind=foodbank');
+ assert.strictEqual(page.status, 200);
+ assert.ok(page.text.includes('<script>alert(1)</script> Pantry'), 'the name is escaped on the page');
+ assert.ok(!page.text.includes('<script>alert(1)</script>'), 'no live script reaches the page');
+ });
+
+ await check('public reads need no token, and bad input is refused with a stable code', async () => {
+ assert.strictEqual((await t.get('/api/v1/places?kind=foodbank')).status, 422, 'no q and no coordinates');
+ const bad = await t.get('/api/v1/places?q=Springfield&kind=restaurants');
+ assert.strictEqual(bad.status, 422);
+ assert.match(bad.headers.get('content-type'), /application\/problem\+json/);
+ assert.strictEqual(bad.json().code, 'food.place.invalid');
+ const missing = await t.get('/api/v1/places?q=Nowhere%20At%20All');
+ assert.strictEqual(missing.status, 404, 'a place Nominatim does not know');
+ assert.strictEqual(missing.json().code, 'food.place.not_found');
+ });
+
+ await check('when OSM cannot be reached the route says so and does not hang', async () => {
+ osm.state.fail = true;
+ const r = await t.get('/api/v1/places?lat=41&lon=-91&kind=foodbank');
+ assert.strictEqual(r.status, 502);
+ assert.strictEqual(r.json().code, 'food.place.upstream');
+ const page = await t.get('/near?lat=41&lon=-91');
+ assert.strictEqual(page.status, 200, 'the page still renders');
+ assert.match(page.text, /the place service answered 503/, 'the page says what went wrong');
+ osm.state.fail = false;
+ });
+ } finally {
+ await t.close();
+ await osm.close();
+ }
+
+ // ── The pace: a boot of its own, with the policy's real one second ──
+ const osm2 = await startOsm();
+ const t2 = await boot({ env: { ...osm2.env, FOOD_OSM_MIN_INTERVAL_MS: '1000' } });
+ try {
+ await check('no two requests to the same OSM host start less than a second apart', async () => {
+ const r = await t2.get(`/api/v1/places?q=${encodeURIComponent('Springfield, Illinois')}&kind=foodbank`);
+ assert.strictEqual(r.status, 200, r.text);
+ assert.strictEqual(osm2.requests.length, 2, JSON.stringify(osm2.requests));
+ const gaps = osm2.gaps();
+ assert.ok(gaps.length === 1 && gaps[0] >= 950, `the two calls were ${gaps[0]} ms apart`);
+ });
+
+ await check('with no stand-in named, the service never reaches the real OpenStreetMap', async () => {
+ // test/helpers/boot.js points both hosts at a closed local port; the call fails at once and says so.
+ const offline = await boot();
+ try {
+ const r = await offline.get('/api/v1/places?lat=51.5&lon=-0.1&kind=foodbank');
+ assert.strictEqual(r.status, 502);
+ assert.strictEqual(r.json().code, 'food.place.upstream');
+ assert.match(r.json().detail, /could not be reached/);
+ } finally { await offline.close(); }
+ });
+
+ await check('a caller cannot spend OpenStreetMap\'s budget: the place search is limited per caller', async () => {
+ const limited = await boot({ env: { ...osm2.env, FOOD_OSM_MIN_INTERVAL_MS: '1' }, callerLimits: true, limitsNow: () => Date.UTC(2026, 9, 8, 12, 0, 0) });
+ try {
+ const from = { headers: { 'x-forwarded-for': '203.0.113.44' } };
+ let refused = null;
+ for (let i = 0; i < 11 && !refused; i++) refused = (await limited.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank', from)).status === 429 ? i + 1 : null;
+ assert.strictEqual(refused, 11, 'the eleventh search in the minute is refused');
+ const r = await limited.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank', from);
+ assert.strictEqual(r.status, 429);
+ assert.strictEqual(r.json().code, 'rate_limited');
+ assert.ok(Number(r.headers.get('retry-after')) > 0);
+ // Another caller is unaffected, and the food list is not part of the place budget.
+ assert.strictEqual((await limited.get('/api/v1/places?lat=39.7817&lon=-89.6501&kind=foodbank', { headers: { 'x-forwarded-for': '203.0.113.45' } })).status, 200);
+ assert.strictEqual((await limited.get('/api/v1/foods', from)).status, 200);
+ } finally { await limited.close(); }
+ });
+ } finally {
+ await t2.close();
+ await osm2.close();
+ }
+ done();
+})();
new file mode 100644
new file mode 100644
@@ -0,0 +1,138 @@
@@ -0,0 +1,138 @@
+'use strict';
+/**
+ * The meal planner: the arithmetic (deterministic, all six food groups, a budget is a cap, the total is the sum of
+ * the packs), the API that saves a plan for the person who asked for it, and the page that renders and saves it
+ * without JavaScript.
+ */
+const assert = require('assert');
+const { boot, check, done } = require('./helpers/boot');
+const { planMeals, PlanError } = require('../server/food/planner');
+
+const SAME = { 'sec-fetch-site': 'same-origin' };
+const money = (n) => Math.round(n * 100) / 100;
+
+(async () => {
+ await check('the plan is deterministic and its arithmetic adds up', () => {
+ const a = planMeals({ people: 2, days: 3 });
+ const b = planMeals({ people: 2, days: 3 });
+ assert.deepStrictEqual(a.items, b.items, 'the same spec gives the same plan');
+ assert.strictEqual(a.items.length, new Set(a.items.map((i) => i.slug)).size, 'no item twice');
+
+ const sum = money(a.items.reduce((n, i) => n + i.cost, 0));
+ assert.strictEqual(a.totals.cost, sum, 'the total is the sum of the lines');
+ for (const i of a.items) assert.strictEqual(i.cost, money(i.unit_cost * i.packs), `${i.slug} line`);
+ assert.strictEqual(a.totals.cost_per_person_day, money(a.totals.cost / 6), 'cost a person a day');
+ assert.strictEqual(a.totals.kcal, a.items.reduce((n, i) => n + i.kcal, 0));
+ assert.strictEqual(a.totals.kcal_per_person_day, Math.round(a.totals.kcal / 6));
+ assert.ok(a.totals.cost > 0 && a.totals.kcal_per_person_day > 500, JSON.stringify(a.totals));
+ assert.strictEqual(a.days, 3);
+ assert.strictEqual(a.menu.length, 3);
+ for (const d of a.menu) assert.deepStrictEqual(Object.keys(d).sort(), ['breakfast', 'day', 'dinner', 'lunch', 'snack']);
+ assert.strictEqual(a.shopping_list, a.items, 'the shopping list is the list');
+ });
+
+ await check('a plan covers all six food groups with no budget, and says so', () => {
+ const p = planMeals({ people: 4, days: 7 });
+ assert.strictEqual(p.group_coverage.length, 6);
+ assert.strictEqual(p.groups_covered, 6);
+ assert.strictEqual(p.covers_all_groups, true);
+ for (const g of p.group_coverage) {
+ assert.ok(g.covered, `${g.group} is not covered`);
+ assert.ok(g.packs >= 1 && g.cost > 0);
+ }
+ assert.ok(p.by_store.length >= 1);
+ assert.ok(Math.abs(p.by_store.reduce((n, s) => n + s.cost, 0) - p.totals.cost) <= 0.02, 'the per-store totals are the total');
+ });
+
+ await check('a budget is a hard cap; too small a budget buys the cheapest groups first and says what is missing', () => {
+ const roomy = planMeals({ people: 1, days: 1, budget: 20 });
+ assert.ok(roomy.totals.cost <= 20);
+ assert.strictEqual(roomy.remaining_budget, money(20 - roomy.totals.cost));
+
+ const tight = planMeals({ people: 1, days: 1, budget: 2 });
+ assert.ok(tight.totals.cost <= 2, `spent ${tight.totals.cost}`);
+ assert.strictEqual(tight.covers_all_groups, false);
+ assert.ok(tight.notes.some((n) => /budget did not stretch/.test(n)));
+ assert.ok(tight.items.every((i) => i.unit_cost <= 2));
+ });
+
+ await check('a spec that cannot be planned is refused, not silently changed', () => {
+ assert.throws(() => planMeals({ people: 0 }), (e) => e instanceof PlanError && e.code === 'food.plan.invalid');
+ assert.throws(() => planMeals({ days: 99 }), PlanError);
+ assert.throws(() => planMeals({ budget: -3 }), PlanError);
+ assert.strictEqual(planMeals({}).spec.people, 1, 'defaults');
+ assert.strictEqual(planMeals({}).spec.days, 3);
+ });
+
+ const t = await boot();
+ const kim = t.network.addUser('kim');
+ const lee = t.network.addUser('lee');
+ try {
+ await check('a signed-in person saves a plan and gets it back; the plan is theirs alone', async () => {
+ const created = await t.get('/api/v1/plans', { as: kim, json: { people: 2, days: 4, budget: 60, title: 'Four days for two' }, headers: SAME });
+ assert.strictEqual(created.status, 201, created.text);
+ const body = created.json();
+ assert.match(body.id, /^pln_/);
+ assert.strictEqual(body.people, 2);
+ assert.strictEqual(body.days, 4);
+ assert.strictEqual(body.title, 'Four days for two');
+ assert.strictEqual(body.plan.totals.cost, planMeals({ people: 2, days: 4, budget: 60 }).totals.cost, 'the saved plan is the generated one');
+ assert.match(String(created.headers.get('location')), /^\/api\/v1\/plans\/pln_/);
+
+ const list = await t.get('/api/v1/plans', { as: kim });
+ assert.strictEqual(list.status, 200);
+ assert.deepStrictEqual(list.json().plans.map((p) => p.id), [body.id]);
+ const one = await t.get(`/api/v1/plans/${body.id}`, { as: kim });
+ assert.strictEqual(one.status, 200);
+ assert.strictEqual(one.json().title, 'Four days for two');
+
+ const theirs = await t.get(`/api/v1/plans/${body.id}`, { as: lee });
+ assert.strictEqual(theirs.status, 404, 'another person cannot see it');
+ assert.deepStrictEqual((await t.get('/api/v1/plans', { as: lee })).json().plans, []);
+ });
+
+ await check('a plan that makes no sense is a 422 problem, and an anonymous caller cannot write one', async () => {
+ const bad = await t.get('/api/v1/plans', { as: kim, json: { people: 0 }, headers: SAME });
+ assert.strictEqual(bad.status, 422);
+ assert.strictEqual(bad.json().code, 'food.plan.invalid');
+ const anon = await t.get('/api/v1/plans', { json: { people: 2, days: 3 } });
+ assert.strictEqual(anon.status, 401, 'anonymous read of a write route');
+ assert.strictEqual(anon.json().code, 'token.required');
+ assert.deepStrictEqual((await t.get('/api/v1/plans')).json().code, 'token.required');
+ });
+
+ await check('the /plan page plans without JavaScript and saves with one POST, then shows it was saved', async () => {
+ const rendered = await t.get('/plan?people=3&days=2', { as: kim });
+ assert.strictEqual(rendered.status, 200);
+ assert.match(rendered.text, /3 people, 2 days/);
+ assert.match(rendered.text, /The shopping list/);
+ assert.match(rendered.text, /action="\/plan"/);
+ assert.match(rendered.text, /Save this plan/, 'a signed-in visitor can save it');
+
+ const guest = await t.get('/plan');
+ assert.match(guest.text, /Sign in<\/a> to save a plan/, 'a guest is told to sign in to save');
+
+ const posted = await t.get('/plan', { as: kim, method: 'POST', form: { people: '3', days: '2', title: 'Two days for three' }, headers: SAME });
+ assert.strictEqual(posted.status, 303, posted.text.slice(0, 200));
+ assert.match(String(posted.headers.get('location')), /^\/plan\?.*saved=pln_/);
+
+ const saved = (await t.get('/api/v1/plans', { as: kim })).json().plans;
+ assert.ok(saved.some((p) => p.title === 'Two days for three'), 'the form saved it');
+
+ const back = await t.get(posted.headers.get('location'), { as: kim });
+ assert.match(back.text, /Saved\./);
+
+ const mine = await t.get('/plan/saved', { as: kim });
+ assert.strictEqual(mine.status, 200);
+ assert.match(mine.text, /Two days for three/);
+ const other = await t.get('/plan/saved', { as: lee });
+ assert.ok(!other.text.includes('Two days for three'), 'lee sees none of kim\'s plans');
+ });
+
+ await check('a cross-site form cannot save a plan for a signed-in visitor', async () => {
+ const cross = await t.get('/plan', { as: kim, method: 'POST', form: { people: '2', days: '2' }, headers: { 'sec-fetch-site': 'cross-site' } });
+ assert.strictEqual(cross.status, 403);
+ });
+ } finally { await t.close(); }
+ done();
+})();
@@ -46,6 +46,15 @@ const rel = (p, dir) => path.relative(dir, p).split(path.sep).join('/');
@@ -46,6 +46,15 @@ const rel = (p, dir) => path.relative(dir, p).split(path.sep).join('/');
const text = (p) => fs.readFileSync(p, 'utf8');
const text = (p) => fs.readFileSync(p, 'utf8');
(async () => {
(async () => {
+ // This test is about the skeleton's generator, and only the skeleton can run it: it asserts that generating a
+ // service rewrites the placeholders, and a generated service has none left to rewrite (its package name is
+ // already its own, its vhost is already named). A generated service says so and skips, rather than reporting a
+ // failure it cannot fix — the convention openvibe-shared/test-runner reads (`<label>: skipped (<why>)`), so the
+ // file is listed with ○ and never counted as passed.
+ if (JSON.parse(text(path.join(ROOT, 'package.json'))).name !== `openvibe-${token('ID')}`) {
+ process.stdout.write('skeleton generator: skipped (this is a generated service, not the skeleton it came from; run it in OpenVibe.ServiceSkeleton)\n');
+ return done();
+ }
const base = tmpDir('ov-new-service-');
const base = tmpDir('ov-new-service-');
const dir = path.join(base, 'openvibe-sample');
const dir = path.join(base, 'openvibe-sample');
const printed = runGenerator(dir);
const printed = runGenerator(dir);