chore: sync from nutritrace-dev (v1.0.0-rc.40)

Author: thebigjoe1

.env.example

@@ -51,10 +51,14 @@ JWT_SECRET=change-me-to-a-long-random-secret
 #   .duckdb   — Legacy native DuckDB file (pre-rc.39 setups still work).
 #
 # Setup:
-#   1. Uncomment the OFF mirror volume mount in docker-compose.yml
-#   2. Set OFF_LOCAL_DB below to the in-container path (default /data/off.parquet).
-#      NutriTrace downloads the initial snapshot (~7-8 GB) automatically on
-#      first boot if the file is missing — no manual wget required.
+#   1. Uncomment the OFF mirror volume mount in docker-compose.yml. IMPORTANT:
+#      the mount points at a parent DIRECTORY (e.g. ./off-mirror:/data/off-mirror),
+#      not the file itself. Docker auto-creates missing single-file bind-mount
+#      sources as directories on the host, which breaks the atomic-swap rename
+#      during refresh with EISDIR. The file lives inside the mounted directory.
+#   2. Set OFF_LOCAL_DB below to the in-container path to the file
+#      (e.g. /data/off-mirror/off.parquet). NutriTrace downloads the initial
+#      snapshot (~7-8 GB) automatically on first boot if the file is missing.
 #   3. (Optional) Set OFF_LOCAL_ONLY=1 to refuse any fallback to the remote
 #      OFF API. True air-gap mode: lookups for products not in the mirror
 #      return "not found" instead of querying the public API.
@@ -66,7 +70,7 @@ JWT_SECRET=change-me-to-a-long-random-secret
 # atomic swap; no container restart needed. See DEPLOY.md → "Local Open Food
 # Facts mirror" for the full guide.
 #
-# OFF_LOCAL_DB=/data/off.parquet
+# OFF_LOCAL_DB=/data/off-mirror/off.parquet
 # OFF_LOCAL_ONLY=1
 # Optional — pin the download source. Defaults to the maintained Hugging Face
 # Parquet dump. To use a legacy / self-hosted DuckDB file instead, set this to

CHANGELOG.md

@@ -9,6 +9,41 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ---
 
+## [1.0.0-rc.40] — 2026-05-28
+
+### Fixed
+
+- **Diary: meal kcal footer truncated meals over 1000 kcal.** The per-meal
+  subtotal at the bottom of each diary card was dropping digits after the
+  thousands comma — a 1,234 kcal lunch displayed as "1 kcal".
+  (Issue #51, reported by @LoveHonorGirth)
+- **OFF local mirror: barcode scans threw a JS error on the client.** The
+  Parquet schema adapter assumed `product_name` lists were always real
+  Arrays, but the DuckDB Node API can return list-like iterables that
+  broke the assumption and leaked through as a non-string field, crashing
+  the client's `.trim()` call. Now coerces to a real Array up front and
+  guarantees a string output in both schema branches.
+  (Issue #22 followup, reported by @duplaja)
+
+### Changed
+
+- **OFF local mirror Docker example now uses a parent-directory bind
+  mount** (`./off-mirror:/data/off-mirror` with
+  `OFF_LOCAL_DB=/data/off-mirror/off.parquet`) across `docker-compose.yml`,
+  `DEPLOY.md`, and `.env.example`. The previous single-file bind-mount
+  example tripped Docker's auto-create-as-directory behavior on a fresh
+  host path, which then broke the atomic-swap refresh with `EISDIR`.
+  Existing setups that already work are unaffected. (Issue #22 followup)
+
+### Added
+
+- **Per-query debug logs for the OFF local mirror.** With
+  `LOG_LEVEL=debug`, every barcode and name-search lookup now prints
+  whether it was served from the local mirror or fell through to the
+  remote OFF API, with hit counts for searches.
+
+---
+
 ## [1.0.0-rc.39] — 2026-05-27
 
 ### Added

DEPLOY.md

@@ -143,16 +143,16 @@ Self-hosters on air-gapped networks, in strict-egress environments, or just want
 
 ### Setup
 
-1. Uncomment the OFF mirror volume mount in `docker-compose.yml`:
+1. Uncomment the OFF mirror volume mount in `docker-compose.yml`. **Bind-mount a parent directory, not the file itself** — Docker auto-creates missing single-file bind-mount sources as directories on the host, which then surfaces inside the container as a directory at the mount point and breaks atomic-swap refresh with `EISDIR` (issue #22 followup):
    ```yaml
-   - ${OFF_LOCAL_DB_HOST_PATH:-./off.parquet}:/data/off.parquet
+   - ${OFF_LOCAL_DB_HOST_PATH:-./off-mirror}:/data/off-mirror
    ```
-   Note: the mount is read-write so NutriTrace can perform in-place refresh via atomic swap. Earlier docs suggested `:ro`; if you previously set that, change it to writable so scheduled and manual refreshes work.
+   The mount is read-write so NutriTrace can perform in-place refresh via atomic swap. Earlier docs suggested `:ro`; if you previously set that, change it to writable so scheduled and manual refreshes work.
 
 2. Set the env vars in `.env`:
    ```bash
-   OFF_LOCAL_DB_HOST_PATH=/path/on/host/off.parquet   # the host path (will be created if missing)
-   OFF_LOCAL_DB=/data/off.parquet                     # the in-container path
+   OFF_LOCAL_DB_HOST_PATH=/path/on/host/off-mirror        # parent directory on host
+   OFF_LOCAL_DB=/data/off-mirror/off.parquet              # in-container path to the file
    # Optional — pin the download URL (defaults to the maintained Hugging Face Parquet dump).
    # OFF_LOCAL_URL=https://huggingface.co/datasets/openfoodfacts/product-database/resolve/main/food.parquet?download=true
    # Optional — full air-gap mode (never call api.openfoodfacts.org)
@@ -176,8 +176,8 @@ You can also click **Refresh Now** in the same panel to force an immediate refre
 Prefer the command line? You can still drop a fresh file in place manually:
 
 ```bash
-wget 'https://huggingface.co/datasets/openfoodfacts/product-database/resolve/main/food.parquet?download=true' -O /path/on/host/off.parquet.new
-mv /path/on/host/off.parquet.new /path/on/host/off.parquet
+wget 'https://huggingface.co/datasets/openfoodfacts/product-database/resolve/main/food.parquet?download=true' -O /path/on/host/off-mirror/off.parquet.new
+mv /path/on/host/off-mirror/off.parquet.new /path/on/host/off-mirror/off.parquet
 # Optional — trigger reopen without waiting for the next lookup:
 docker compose restart
 ```

android/app/build.gradle

@@ -19,8 +19,8 @@ android {
         applicationId "com.nutritrace.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 108
-        versionName "1.0.0-rc.39"
+        versionCode 109
+        versionName "1.0.0-rc.40"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

docker-compose.yml

@@ -12,11 +12,18 @@ services:
       # OFF_LOCAL_DB in .env. NutriTrace downloads the initial ~7-8 GB
       # Parquet snapshot from Hugging Face automatically on first boot if
       # the file is missing; subsequent refreshes happen on a schedule from
-      # the Settings UI. Mount is read-write so atomic swap during refresh
-      # succeeds. File extension is auto-detected — Parquet (default) or
-      # legacy .duckdb both supported. See DEPLOY.md → "Local Open Food
+      # the Settings UI. File extension is auto-detected — Parquet (default)
+      # or legacy .duckdb both supported. See DEPLOY.md → "Local Open Food
       # Facts mirror" for the full recipe.
-      # - ${OFF_LOCAL_DB_HOST_PATH:-./off.parquet}:/data/off.parquet
+      #
+      # IMPORTANT: bind-mount a parent DIRECTORY, not the file itself.
+      # Docker auto-creates missing single-file bind-mount sources as
+      # directories on the host, which then surfaces inside the container
+      # as a directory at the mount point and breaks the atomic-swap
+      # rename during refresh with EISDIR (issue #22 followup, reported
+      # by @duplaja). The file lives inside the mounted directory; set
+      # OFF_LOCAL_DB to the in-container path of the file below.
+      # - ${OFF_LOCAL_DB_HOST_PATH:-./off-mirror}:/data/off-mirror
     # Forward every variable from .env into the container. Without this, only
     # variables explicitly named in the `environment:` block below reach the
     # app, so .env settings like INSECURE_COOKIES were silently ignored (#41).
@@ -80,11 +87,12 @@ services:
       # and are read-only there — edit via .env / docker-compose / k8s secrets.
       # Optional — Local Open Food Facts mirror (Issue #22). When set,
       # barcode + name lookups try the local mirror before reaching out
-      # to api.openfoodfacts.org. Path is the in-container path matching
-      # the volume mount above. File extension is auto-detected — Parquet
-      # (default since rc.39) or legacy .duckdb both supported. See
-      # DEPLOY.md for download / refresh.
-      # - OFF_LOCAL_DB=${OFF_LOCAL_DB:-}                        # e.g. /data/off.parquet
+      # to api.openfoodfacts.org. Path is the in-container path to the
+      # mirror file, which lives inside the directory bind-mount above.
+      # File extension is auto-detected (Parquet default since rc.39, or
+      # legacy .duckdb still supported). See DEPLOY.md for download /
+      # refresh.
+      # - OFF_LOCAL_DB=${OFF_LOCAL_DB:-}                        # e.g. /data/off-mirror/off.parquet
       # - OFF_LOCAL_ONLY=${OFF_LOCAL_ONLY:-}                    # 1 = air-gap mode, never call remote OFF
       # - OFF_LOCAL_URL=${OFF_LOCAL_URL:-}                      # override download source (defaults to HF Parquet)
       # Any server env var may also be supplied via <NAME>_FILE, for example:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nutritrace",
-  "version": "1.0.0-rc.39",
+  "version": "1.0.0-rc.40",
   "private": true,
   "type": "module",
   "scripts": {

server/lib/off-local.js

@@ -463,12 +463,26 @@ function _sniffParquet(filePath) {
 // which file format was used.
 
 function _toOffProduct(row) {
-  if (Array.isArray(row.product_name)) {
-    // Parquet shape
-    const name = _extractLocalized(row.product_name) || _extractLocalized(row.generic_name);
+  // Normalize LIST<STRUCT> columns up front: DuckDB Node API can return
+  // LIST values as either a real Array (typical) or a list-like object
+  // (iterable but not Array.isArray) depending on version. The previous
+  // Array.isArray check missed the latter case and dropped through to the
+  // legacy branch, which then leaked the raw list object out as
+  // product_name and broke the client's .trim() call (issue #22 followup
+  // from @duplaja). Coerce to a real Array here so both branches see the
+  // shape they expect.
+  const _asArray = v => Array.isArray(v)
+    ? v
+    : (v != null && typeof v !== 'string' && typeof v[Symbol.iterator] === 'function')
+      ? Array.from(v)
+      : null;
+  const pnList = _asArray(row.product_name);
+  if (pnList) {
+    // Parquet shape: product_name is LIST<{lang, text}>
+    const name = _extractLocalized(pnList) || _extractLocalized(_asArray(row.generic_name));
     return {
       code: row.code,
-      product_name: name,
+      product_name: typeof name === 'string' ? name : '',
       brands: row.brands || '',
       brands_tags: row.brands_tags || [],
       categories: row.categories || '',
@@ -480,11 +494,11 @@ function _toOffProduct(row) {
       nutriments: _unfoldNutrimentsList(row.nutriments),
     };
   }
-  // Legacy native DuckDB shape
+  // Legacy native DuckDB shape (product_name is a plain string column)
   const nutriments = _flattenNutrimentsStruct(row.nutriments) || _pickNutrimentColumns(row);
   return {
     code: row.code,
-    product_name: row.product_name || '',
+    product_name: typeof row.product_name === 'string' ? row.product_name : '',
     brands: row.brands || '',
     brands_tags: row.brands_tags || [],
     categories: row.categories || '',

server/routes/proxy.js

@@ -110,8 +110,15 @@ async function _tryLocalOff(parsedUrl) {
     if (!m) return undefined;
     const code = m[1];
     const result = await lookupByBarcode(code);
-    if (result == null) return undefined;          // mirror errored — fall through (or 503 in air-gap)
-    if (result.status === 0 && !airGap) return undefined;   // mirror miss in non-air-gap — try live
+    if (result == null) {
+      logger.debug(`[off-local] barcode ${code} → mirror error, falling through to remote OFF`);
+      return undefined;
+    }
+    if (result.status === 0 && !airGap) {
+      logger.debug(`[off-local] barcode ${code} → miss, falling through to remote OFF`);
+      return undefined;
+    }
+    logger.debug(`[off-local] barcode ${code} → hit from local mirror${airGap && result.status === 0 ? ' (air-gap, returning empty)' : ''}`);
     return result;
   }
   // Name search: /search?q=...&page=...&page_size=...
@@ -120,8 +127,16 @@ async function _tryLocalOff(parsedUrl) {
     const page = parseInt(parsedUrl.searchParams.get('page') || '1', 10);
     const pageSize = parseInt(parsedUrl.searchParams.get('page_size') || '20', 10);
     const result = await searchByName(q, { page, pageSize });
-    if (result == null) return undefined;
-    if ((result.hits?.length ?? 0) === 0 && !airGap) return undefined;  // empty search in non-air-gap — try live
+    if (result == null) {
+      logger.debug(`[off-local] search "${q}" → mirror error, falling through to remote OFF`);
+      return undefined;
+    }
+    const hitCount = result.hits?.length ?? 0;
+    if (hitCount === 0 && !airGap) {
+      logger.debug(`[off-local] search "${q}" → 0 hits, falling through to remote OFF`);
+      return undefined;
+    }
+    logger.debug(`[off-local] search "${q}" → ${hitCount} hits from local mirror${airGap && hitCount === 0 ? ' (air-gap, returning empty)' : ''}`);
     return result;
   }
   // Any other OFF endpoint (CGI scripts for product upload, images, etc.):

src/lib/version.js

@@ -1 +1 @@
-export const APP_VERSION = 'v1.0.0-rc.39';
+export const APP_VERSION = 'v1.0.0-rc.40';

src/routes/Diary.svelte

@@ -581,7 +581,13 @@
     const p = Math.round((t.proteins || 0) * 4 / cal * 100);
     const c = Math.round((t.carbohydrates || 0) * 4 / cal * 100);
     const f = Math.round((t.fat || 0) * 9 / cal * 100);
-    return { cal: Math.round(cal).toLocaleString(), p, c, f };
+    // cal stays as a number — the meal-macro-footer passes it through
+    // Nutrition.displayEnergy() which does parseFloat() internally. Returning
+    // a locale-formatted string like "29,710" used to break that parseFloat
+    // (it'd stop at the comma and yield 29), truncating meal kcal totals
+    // above 1000 to the leading digit(s). The template handles display-side
+    // commas via _mtEnergy.value.toLocaleString() below. (Issue #51)
+    return { cal: Math.round(cal), p, c, f };
   }
 
   function getMealItems(entryItems, mealIdx) {