Mise en Place

Auth

• Password stored as base64-encoded bcrypt hash in env vars — raw bcrypt hashes contain special characters that break .env parsing
• Session managed via iron-session cookie (30 days)
• Single shared password, no user accounts — personal use only
• Demo mode is not authenticated

Data Architecture

• Soft delete pattern for recipes — deleted flag set, data retained in Redis
• Redis key structure:
  • recipes:ids — set of all recipe IDs
  • recipes:{id} — individual recipe JSON
  • weeks:{monday-date} — week slot data keyed by Monday's date
  • plans:ids — set of all plan IDs
  • plans:{id} — individual plan JSON

Hosting & Infrastructure

• Vercel and Upstash regions should be matched for lowest latency — worth checking in both dashboards
• export const dynamic = 'force-dynamic' should be added to all API routes to prevent stale caching on Vercel
• Photo storage not implemented — would require Vercel Blob or Cloudflare R2 if added later

Known Issues

• PWA standalone mode is inconsistent across pages — Apple pins the URL from when you added to home screen (/recipes), so only that page runs in true standalone mode. No clean fix exists; known iOS limitation