cargo fmt

archived list count
hx boost + bug fix
2026-08-07 22:49:50 -04:00 · 2026-08-07 22:49:31 -04:00 · 2026-08-07 22:46:53 -04:00 · 2026-08-07 22:16:29 -04:00 · 2026-08-07 21:42:38 -04:00 · 2026-08-04 00:06:03 -04:00
27 changed files with 2654 additions and 393 deletions
@@ -139,6 +139,9 @@ name = "bitflags"
 version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]

 [[package]]
 name = "blake2"
@@ -158,6 +161,12 @@ dependencies = [
 "generic-array",
 ]

+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes"
 version = "1.12.1"
@@ -180,6 +189,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -235,6 +250,17 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"

+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -242,6 +268,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer",
+ "const-oid",
 "crypto-common",
 "subtle",
 ]
@@ -288,6 +315,17 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "event-listener"
 version = "5.4.2"
@@ -514,6 +552,33 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -724,6 +789,9 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]

 [[package]]
 name = "libc"
@@ -731,6 +799,24 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+dependencies = [
+ "bitflags",
+ "libc",
+ "plain",
+ "redox_syscall 0.9.1",
+]
+
 [[package]]
 name = "libsqlite3-sys"
 version = "0.30.1"
@@ -800,6 +886,16 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -858,6 +954,41 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.7",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -865,6 +996,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
 "autocfg",
+ "libm",
 ]

 [[package]]
@@ -934,7 +1066,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
 "cfg-if",
 "libc",
- "redox_syscall",
+ "redox_syscall 0.5.18",
 "smallvec",
 "windows-link",
 ]
@@ -950,6 +1082,15 @@ dependencies = [
 "subtle",
 ]

+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -962,12 +1103,39 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"

+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"

+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -1109,6 +1277,15 @@ dependencies = [
 "bitflags",
 ]

+[[package]]
+name = "redox_syscall"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07507be7b4a5f9f26eeb41eeaebb1f5a7ff29dfb29739facc21d35bf8b11c21e"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "regex-automata"
 version = "0.4.16"
@@ -1140,6 +1317,26 @@ dependencies = [
 "windows-sys 0.52.0",
 ]

+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.43"
@@ -1309,6 +1506,16 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -1320,6 +1527,9 @@ name = "smallvec"
 version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+dependencies = [
+ "serde",
+]

 [[package]]
 name = "socket2"
@@ -1340,6 +1550,16 @@ dependencies = [
 "lock_api",
 ]

+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "sqlx"
 version = "0.8.6"
@@ -1348,6 +1568,8 @@ checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
 dependencies = [
 "sqlx-core",
 "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
 "sqlx-sqlite",
 ]

@@ -1376,6 +1598,7 @@ dependencies = [
 "percent-encoding",
 "rustls",
 "serde",
+ "serde_json",
 "sha2",
 "smallvec",
 "thiserror 2.0.19",
@@ -1422,6 +1645,84 @@ dependencies = [
 "url",
 ]

+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64 0.22.1",
+ "bitflags",
+ "byteorder",
+ "bytes",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.7",
+ "rsa",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.19",
+ "tracing",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64 0.22.1",
+ "bitflags",
+ "byteorder",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.7",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.19",
+ "tracing",
+ "whoami",
+]
+
 [[package]]
 name = "sqlx-sqlite"
 version = "0.8.6"
@@ -1452,6 +1753,17 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"

+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -1460,7 +1772,7 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

 [[package]]
 name = "sustenance"
-version = "0.1.1"
+version = "0.4.0"
 dependencies = [
 "argon2",
 "async-trait",
@@ -1583,6 +1895,21 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
 [[package]]
 name = "tokio"
 version = "1.53.1"
@@ -1791,12 +2118,33 @@ version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"

+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
@@ -1861,6 +2209,12 @@ dependencies = [
 "wit-bindgen",
 ]

+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
 [[package]]
 name = "webauthn-rs"
 version = "0.3.2"
@@ -1898,19 +2252,38 @@ dependencies = [
 "rustls-pki-types",
 ]

+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"

+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
 ]

 [[package]]
@@ -1922,34 +2295,67 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
 "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
 ]

+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"

+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"

+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -1962,24 +2368,48 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"

+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"

+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"

+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"

+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -1,6 +1,6 @@
 [package]
 name = "sustenance"
-version = "0.1.1"
+version = "0.4.0"
 edition = "2024"

 [dependencies]
@@ -16,7 +16,7 @@ rand = "0.8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
-sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "macros", "tls-rustls"] }
+sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "macros", "migrate", "tls-rustls"] }
 thiserror = "2"
 tokio = { version = "1", features = ["full"] }
 tower = "0.5"
@@ -11,9 +11,17 @@ export async function registerAndLogin(page: Page, email: string) {
 }

 /** Creates a meal with the given name and markdown description. */
-export async function createMeal(page: Page, name: string, description: string) {
+export async function createMeal(
+  page: Page,
+  name: string,
+  description: string,
+  category?: string,
+) {
  await page.goto("/meals/new");
  await page.fill("#meal-name", name);
+  if (category) {
+    await page.selectOption("#meal-category", { label: category });
+  }
  await page.fill("#meal-description", description);
  await page.click('button:has-text("Save meal")');
  await expect(page).toHaveURL(/\/meals\/\d+/);
@@ -52,3 +52,47 @@ test("the add-meal picker closes when clicking outside", async ({ page }) => {
  await page.mouse.click(10, 10);
  await expect(picker).toHaveCount(0);
 });
+
+test("a meal added to a list is shown in the meals panel", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMealWithIngredients(page, "Spaghetti Bolognese", [
+    { name: "Penne", quantity: "500g" },
+    { name: "Tomato", quantity: "2" },
+  ]);
+  await createList(page, "Weekly shop");
+
+  await page.click(".add-meal-button");
+  const picker = page.locator(".meal-picker-backdrop");
+  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
+
+  // The meal appears in the "Meals on this list" panel.
+  const panel = page.locator("#list-meals-panel");
+  await expect(panel).toBeVisible();
+  await expect(panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
+});
+
+test("removing a meal from a list removes its ingredients", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMealWithIngredients(page, "Spaghetti Bolognese", [
+    { name: "Penne", quantity: "500g" },
+    { name: "Tomato", quantity: "2" },
+  ]);
+  await createList(page, "Weekly shop");
+
+  await page.click(".add-meal-button");
+  const picker = page.locator(".meal-picker-backdrop");
+  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
+
+  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
+  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toBeVisible();
+
+  // Remove the meal from the list.
+  const panel = page.locator("#list-meals-panel");
+  const row = panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" });
+  await row.locator(".list-meal-remove-button").click();
+
+  // The meal's ingredients are removed from the list.
+  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toHaveCount(0);
+  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toHaveCount(0);
+  await expect(row).toHaveCount(0);
+});
@@ -0,0 +1,83 @@
+import { expect } from "@playwright/test";
+import { test } from "../fixtures";
+import { registerAndLogin, createList, addItem } from "../helpers";
+
+test("a user can archive a list and it moves to the archive page", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createList(page, "Weekly shop");
+
+  // Archive from the list page.
+  await page.click('button:has-text("Archive")');
+
+  // Lands back on the lists page; the list is no longer shown.
+  await expect(page).toHaveURL(/\/lists/);
+  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toHaveCount(0);
+
+  // The archived list is reachable from the archive page.
+  await page.goto("/archive");
+  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toBeVisible();
+});
+
+test("the lists frame links to the archive page", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createList(page, "Weekly shop");
+  await page.goto("/lists");
+
+  await page.click('a.archive-link');
+  await expect(page).toHaveURL(/\/archive/);
+});
+
+test("an archived list is read-only", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createList(page, "Weekly shop");
+  await addItem(page, "Apple");
+  await page.click('button:has-text("Archive")');
+
+  // Open the archived list directly.
+  await page.goto("/archive");
+  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
+  await expect(page).toHaveURL(/\/lists\/\d+/);
+
+  // The item is still visible.
+  await expect(page.locator(".item-row").filter({ hasText: "Apple" })).toBeVisible();
+
+  // No mutation UI is present.
+  await expect(page.locator("#add-item-form")).toHaveCount(0);
+  await expect(page.locator(".item-actions-button")).toHaveCount(0);
+  await expect(page.locator(".check-form")).toHaveCount(0);
+  await expect(page.locator('button:has-text("+ Add meal")')).toHaveCount(0);
+});
+
+test("a user can restore an archived list and edit it again", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createList(page, "Weekly shop");
+  await addItem(page, "Apple");
+  await page.click('button:has-text("Archive")');
+
+  // Open the archived list and restore it.
+  await page.goto("/archive");
+  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
+  await page.click('button:has-text("Restore")');
+
+  // Back on the lists page, the list is active again.
+  await expect(page).toHaveURL(/\/lists/);
+  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toBeVisible();
+
+  // The list is editable again.
+  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
+  await expect(page.locator("#add-item-form")).toBeVisible();
+  await addItem(page, "Banana");
+  await expect(page.locator(".item-row").filter({ hasText: "Banana" })).toBeVisible();
+});
+
+test("the archive page shows the list name and created date", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createList(page, "Weekly shop");
+  await page.click('button:has-text("Archive")');
+
+  await page.goto("/archive");
+  const card = page.locator(".list-card").filter({ hasText: "Weekly shop" });
+  await expect(card).toBeVisible();
+  // The card shows a created date (e.g. "Created 7 Aug 2026").
+  await expect(card.locator("small")).toContainText("Created");
+});
@@ -13,3 +13,33 @@ test("a user can log out", async ({ page }) => {
  await expect(page).toHaveURL(/\/login/);
  await expect(page.locator("h1")).toContainText("Welcome back");
 });
+
+test("a user can change their password", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await page.goto("/account");
+  await page.fill("#new-password", "a-new-strong-password");
+  await page.fill("#confirm-password", "a-new-strong-password");
+  await page.click('button:has-text("Update password")');
+  await expect(page.locator(".alert-success")).toContainText("updated");
+
+  // The old password no longer works; the new one does.
+  await page.click('button:has-text("Sign out")');
+  await page.fill("#email", "alice@example.com");
+  await page.fill("#password", "a-strong-password");
+  await page.click('button[type="submit"]');
+  await expect(page.locator(".alert-error")).toContainText("incorrect");
+
+  await page.fill("#email", "alice@example.com");
+  await page.fill("#password", "a-new-strong-password");
+  await page.click('button[type="submit"]');
+  await expect(page).toHaveURL(/\/lists/);
+});
+
+test("changing password rejects a mismatched confirmation", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await page.goto("/account");
+  await page.fill("#new-password", "a-new-strong-password");
+  await page.fill("#confirm-password", "a-different-password");
+  await page.click('button:has-text("Update password")');
+  await expect(page.locator(".alert-error")).toContainText("do not match");
+});
@@ -84,6 +84,8 @@ test("a user can add a category", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");

+  // Categories are managed from the main lists page.
+  await page.goto("/lists");
  await page.fill("#category-name", "Bakery");
  await page.click("#add-category-button");

@@ -0,0 +1,111 @@
+import { expect } from "@playwright/test";
+import { test } from "../fixtures";
+import { registerAndLogin, createMeal } from "../helpers";
+
+test("meals are grouped under their category on the meals page", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+
+  await createMeal(page, "Beef Stew", "", "Beef");
+  await createMeal(page, "Chicken Curry", "", "Chicken");
+  await createMeal(page, "Plain Rice", "");
+
+  await page.goto("/meals");
+
+  // Each category appears as a heading with its meals beneath it.
+  const beef = page.locator(".category-group").filter({ hasText: "Beef" });
+  await expect(beef.locator(".category-heading")).toContainText("Beef");
+  await expect(beef.locator(".list-card").filter({ hasText: "Beef Stew" })).toBeVisible();
+
+  const chicken = page.locator(".category-group").filter({ hasText: "Chicken" });
+  await expect(chicken.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
+
+  // Uncategorized meals land in their own group.
+  const uncategorized = page.locator(".category-group").filter({ hasText: "Uncategorized" });
+  await expect(uncategorized.locator(".list-card").filter({ hasText: "Plain Rice" })).toBeVisible();
+});
+
+test("a user can create a meal category", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+
+  await page.goto("/meals");
+  await page.fill('form[action="/meals/categories"] input[name="name"]', "Breakfast");
+  await page.click('form[action="/meals/categories"] button[type="submit"]');
+
+  await expect(page).toHaveURL(/\/meals$/);
+  await expect(page.locator(".meal-category-name").filter({ hasText: "Breakfast" })).toBeVisible();
+});
+
+test("a user can delete a meal category and its meals become uncategorized", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+
+  // Create a custom category and a meal in it.
+  await page.goto("/meals");
+  await page.fill('form[action="/meals/categories"] input[name="name"]', "Breakfast");
+  await page.click('form[action="/meals/categories"] button[type="submit"]');
+  await expect(page).toHaveURL(/\/meals$/);
+
+  await createMeal(page, "Pancakes", "", "Breakfast");
+
+  // Delete the category.
+  await page.goto("/meals");
+  const row = page.locator(".meal-category-row").filter({ hasText: "Breakfast" });
+  await row.locator(".meal-category-delete").click();
+  await expect(page).toHaveURL(/\/meals$/);
+
+  // The category is gone and the meal is now uncategorized.
+  await expect(page.locator(".meal-category-name").filter({ hasText: "Breakfast" })).toHaveCount(0);
+  const uncategorized = page.locator(".category-group").filter({ hasText: "Uncategorized" });
+  await expect(uncategorized.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
+});
+
+test("a user can change a meal's category via the edit modal", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMeal(page, "Beef Stew", "", "Beef");
+
+  await page.click('button:has-text("Edit")');
+  const dialog = page.locator("dialog#meal-edit-modal");
+  await expect(dialog).toBeVisible();
+  await dialog.locator("#meal-edit-category").selectOption({ label: "Chicken" });
+  await dialog.locator("#meal-edit-save").click();
+
+  await expect(page).toHaveURL(/\/meals\/\d+/);
+  await page.goto("/meals");
+
+  const chicken = page.locator(".category-group").filter({
+    has: page.locator(".category-heading", { hasText: "Chicken" }),
+  });
+  await expect(chicken.locator(".list-card").filter({ hasText: "Beef Stew" })).toBeVisible();
+  const beef = page.locator(".category-group").filter({
+    has: page.locator(".category-heading", { hasText: "Beef" }),
+  });
+  await expect(beef.locator(".list-card").filter({ hasText: "Beef Stew" })).toHaveCount(0);
+});
+
+test("a meal's category is shown on its page", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMeal(page, "Beef Stew", "", "Beef");
+
+  await expect(page.locator(".meal-category-label")).toHaveText("(Beef)");
+});
+
+test("the add-meal picker groups meals by category", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMeal(page, "Beef Stew", "", "Beef");
+  await createMeal(page, "Chicken Curry", "", "Chicken");
+
+  // Go to a list to open the picker.
+  await page.goto("/lists");
+  await page.fill("#list-name", "Weekly shop");
+  await page.click('button:has-text("Create list")');
+  await expect(page).toHaveURL(/\/lists\/\d+/);
+
+  await page.click(".add-meal-button");
+  const picker = page.locator(".meal-picker-backdrop");
+  await expect(picker).toBeVisible();
+
+  const beef = picker.locator(".category-group").filter({ hasText: "Beef" });
+  await expect(beef.locator(".meal-picker-button").filter({ hasText: "Beef Stew" })).toBeVisible();
+
+  const chicken = picker.locator(".category-group").filter({ hasText: "Chicken" });
+  await expect(chicken.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
+});
@@ -32,6 +32,7 @@ test("a user can delete a meal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");

+  page.on("dialog", (dialog) => dialog.accept());
  await page.click('button:has-text("Delete")');
  await expect(page).toHaveURL(/\/meals$/);
  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
@@ -38,8 +38,7 @@ test("a user can register a passkey and sign in with it", async ({ page, browser
  await p.click('button:has-text("Sign out")');
  await expect(p).toHaveURL(/\/login/);

-  // Sign in with the passkey.
-  await p.fill("#email", "alice@example.com");
+  // Sign in with the passkey without entering an email (userless sign-in).
  await p.click("#passkey-login");
  await expect(p).toHaveURL(/\/lists/);

@@ -0,0 +1,81 @@
+CREATE TABLE users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    email TEXT NOT NULL UNIQUE COLLATE NOCASE,
+    display_name TEXT NOT NULL,
+    password_hash TEXT NOT NULL,
+    user_handle BLOB NOT NULL UNIQUE,
+    created_at INTEGER NOT NULL
+);
+
+CREATE TABLE sessions (
+    token_hash BLOB PRIMARY KEY,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    csrf_token BLOB NOT NULL,
+    expires_at INTEGER NOT NULL
+);
+
+CREATE TABLE passkeys (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    credential_id TEXT NOT NULL UNIQUE,
+    credential TEXT NOT NULL,
+    counter INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL
+);
+
+CREATE TABLE lists (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL,
+    revision INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL
+);
+
+CREATE TABLE categories (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
+    position INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL
+);
+
+CREATE TABLE invitations (
+    token_hash BLOB PRIMARY KEY,
+    created_by INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    expires_at INTEGER NOT NULL
+);
+
+CREATE TABLE items (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    list_id INTEGER NOT NULL REFERENCES lists(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    quantity TEXT NOT NULL DEFAULT '',
+    note TEXT NOT NULL DEFAULT '',
+    category_id INTEGER REFERENCES categories(id) ON DELETE SET NULL,
+    checked INTEGER NOT NULL DEFAULT 0,
+    version INTEGER NOT NULL DEFAULT 1,
+    position INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE meals (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL,
+    description TEXT NOT NULL DEFAULT '',
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE meal_ingredients (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    meal_id INTEGER NOT NULL REFERENCES meals(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    quantity TEXT NOT NULL DEFAULT '',
+    note TEXT NOT NULL DEFAULT '',
+    category_id INTEGER REFERENCES categories(id) ON DELETE SET NULL,
+    position INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX items_list_idx ON items(list_id);
+CREATE INDEX meal_ingredients_meal_idx ON meal_ingredients(meal_id);
+CREATE INDEX sessions_user_idx ON sessions(user_id);
+CREATE INDEX passkeys_user_idx ON passkeys(user_id);
@@ -0,0 +1,10 @@
+CREATE TABLE meal_categories (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
+    position INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL
+);
+
+ALTER TABLE meals ADD COLUMN category_id INTEGER REFERENCES meal_categories(id) ON DELETE SET NULL;
+
+CREATE INDEX meals_category_idx ON meals(category_id);
@@ -0,0 +1,12 @@
+CREATE TABLE list_meals (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    list_id INTEGER NOT NULL REFERENCES lists(id) ON DELETE CASCADE,
+    meal_id INTEGER REFERENCES meals(id) ON DELETE SET NULL,
+    name TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+);
+
+ALTER TABLE items ADD COLUMN list_meal_id INTEGER REFERENCES list_meals(id) ON DELETE CASCADE;
+
+CREATE INDEX list_meals_list_idx ON list_meals(list_id);
+CREATE INDEX items_list_meal_idx ON items(list_meal_id);
@@ -0,0 +1 @@
+ALTER TABLE lists ADD COLUMN archived_at INTEGER;
@@ -19,6 +19,10 @@ pub struct User {
    pub id: i64,
    pub email: String,
    pub display_name: String,
+    /// Opaque, random user handle used as the WebAuthn userHandle. Kept
+    /// high-entropy and unpredictable per the WebAuthn spec to avoid user
+    /// enumeration and cross-site correlation. Stored as raw bytes.
+    pub user_handle: Vec<u8>,
 }

 #[derive(Clone, Debug)]
@@ -27,6 +31,9 @@ pub struct Passkey {
    pub user_id: i64,
    pub credential_id: String,
    pub credential: String,
+    /// WebAuthn sign counter, persisted for future cloned-authenticator
+    /// detection. Not currently read by application logic.
+    #[allow(dead_code)]
    pub counter: i64,
 }

@@ -41,6 +48,10 @@ pub struct GroceryList {
    pub id: i64,
    pub name: String,
    pub revision: i64,
+    /// Unix timestamp of when the list was created.
+    pub created_at: i64,
+    /// Unix timestamp of when the list was archived; `None` when active.
+    pub archived_at: Option<i64>,
 }

 #[derive(Clone, Debug)]
@@ -61,11 +72,18 @@ pub struct Category {
    pub name: String,
 }

+#[derive(Clone, Debug)]
+pub struct MealCategory {
+    pub id: i64,
+    pub name: String,
+}
+
 #[derive(Clone, Debug)]
 pub struct Meal {
    pub id: i64,
    pub name: String,
    pub description: String,
+    pub category_id: Option<i64>,
    pub ingredients: Vec<MealIngredient>,
 }

@@ -78,6 +96,18 @@ pub struct MealIngredient {
    pub category_id: Option<i64>,
 }

+#[derive(Clone, Debug)]
+pub struct ListMeal {
+    pub id: i64,
+    /// The catalog meal this instance came from; `None` once the meal is deleted.
+    #[allow(dead_code)]
+    pub meal_id: Option<i64>,
+    pub name: String,
+    /// When the meal was added to the list.
+    #[allow(dead_code)]
+    pub created_at: i64,
+}
+
 #[derive(Clone, Debug)]
 pub struct PresenceUser {
    pub user_id: i64,
@@ -14,13 +14,10 @@ use axum::{
    routing::{get, post},
 };
 use futures_util::{SinkExt, StreamExt};
+use maud::PreEscaped;
 use serde::{Deserialize, de::DeserializeOwned};
 use thiserror::Error;
-use tower_http::{
-    services::ServeDir,
-    set_header::SetResponseHeaderLayer,
-    trace::{DefaultMakeSpan, DefaultOnResponse, TraceLayer},
-};
+use tower_http::trace::{DefaultMakeSpan, DefaultOnResponse, TraceLayer};
 use tracing::{Level, error, warn};

 use crate::domain::{DomainError, SessionUser};
@@ -29,6 +26,13 @@ use crate::services::{AuthService, InvitationService, ListService, MealService};
 use crate::views;
 use crate::webauthn::WebAuthnService;

+/// The contents of `static/`, embedded into the binary at compile time so the
+/// app can be shipped as a single executable without a separate static directory.
+const STYLE_CSS: &[u8] = include_bytes!("../static/style.css");
+const PASSKEY_LOGIN_JS: &[u8] = include_bytes!("../static/passkey-login.js");
+const PASSKEY_REGISTER_JS: &[u8] = include_bytes!("../static/passkey-register.js");
+const PASSWORD_TOGGLE_JS: &[u8] = include_bytes!("../static/password-toggle.js");
+
 #[derive(Clone)]
 pub struct AppState {
    pub auth: Arc<AuthService>,
@@ -49,6 +53,8 @@ pub enum AppError {
    BadRequest(String),
    #[error("not found")]
    NotFound,
+    #[error("list is archived")]
+    Archived,
 }

 impl IntoResponse for AppError {
@@ -68,6 +74,10 @@ impl IntoResponse for AppError {
                StatusCode::NOT_FOUND,
                views::error_page("404", "That page could not be found."),
            ),
+            AppError::Archived => status_html_response(
+                StatusCode::CONFLICT,
+                views::error_page("409", "This list is archived and cannot be modified."),
+            ),
        }
    }
 }
@@ -90,8 +100,12 @@ pub fn build_router(state: AppState) -> Router {
            "/account/passkeys/{passkey_id}/delete",
            post(delete_passkey),
        )
+        .route("/account/password", post(change_password))
        .route("/lists", get(lists_page).post(create_list))
+        .route("/archive", get(archive_page))
        .route("/lists/{list_id}", get(list_page))
+        .route("/lists/{list_id}/archive", post(archive_list))
+        .route("/lists/{list_id}/unarchive", post(unarchive_list))
        .route("/lists/{list_id}/items", post(add_item))
        .route("/lists/{list_id}/items/{item_id}/check", post(check_item))
        .route("/lists/{list_id}/items/{item_id}/edit", post(edit_item))
@@ -100,6 +114,11 @@ pub fn build_router(state: AppState) -> Router {
        .route("/invitations", post(create_invitation))
        .route("/meals", get(meals_page).post(create_meal))
        .route("/meals/new", get(new_meal_page))
+        .route("/meals/categories", post(create_meal_category))
+        .route(
+            "/meals/categories/{category_id}/delete",
+            post(delete_meal_category),
+        )
        .route("/meals/{meal_id}", get(meal_page))
        .route("/meals/{meal_id}/edit", post(edit_meal))
        .route("/meals/{meal_id}/delete", post(delete_meal))
@@ -113,18 +132,14 @@ pub fn build_router(state: AppState) -> Router {
            post(delete_ingredient),
        )
        .route("/lists/{list_id}/add-meal", post(add_meal_to_list))
+        .route(
+            "/lists/{list_id}/meals/{list_meal_id}/remove",
+            post(remove_meal_from_list),
+        )
        .route("/lists/{list_id}/stream", get(list_stream))
        .route("/invite/{token}", get(invitation_page))
        .route("/invite/{token}/accept", post(accept_invitation))
-        .nest_service(
-            "/static",
-            tower::ServiceBuilder::new()
-                .layer(SetResponseHeaderLayer::overriding(
-                    header::CACHE_CONTROL,
-                    HeaderValue::from_static("public, max-age=0, must-revalidate"),
-                ))
-                .service(ServeDir::new("static")),
-        )
+        .route("/static/{path}", get(static_asset))
        .layer(
            TraceLayer::new_for_http()
                .make_span_with(DefaultMakeSpan::new().level(Level::INFO))
@@ -265,11 +280,13 @@ struct PasskeyRegisterFinishForm {

 #[derive(Debug, Deserialize)]
 struct PasskeyLoginStartForm {
+    #[serde(default)]
    email: String,
 }

 #[derive(Debug, Deserialize)]
 struct PasskeyLoginFinishForm {
+    token: String,
    response: webauthn_rs::proto::PublicKeyCredential,
 }

@@ -278,11 +295,20 @@ struct DeletePasskeyForm {
    csrf: String,
 }

+#[derive(Debug, Deserialize)]
+struct ChangePasswordForm {
+    csrf: String,
+    new_password: String,
+    confirm_password: String,
+}
+
 #[derive(Debug, Deserialize)]
 struct MealForm {
    name: String,
    #[serde(default)]
    description: String,
+    #[serde(default)]
+    category_id: Option<String>,
    csrf: String,
 }

@@ -313,6 +339,18 @@ async fn home() -> Redirect {
    Redirect::to("/lists")
 }

+/// Serves a file embedded in the binary from the `static/` folder.
+async fn static_asset(Path(path): Path<String>) -> Response {
+    let (mime, data) = match path.as_str() {
+        "style.css" => ("text/css", STYLE_CSS),
+        "passkey-login.js" => ("application/javascript", PASSKEY_LOGIN_JS),
+        "passkey-register.js" => ("application/javascript", PASSKEY_REGISTER_JS),
+        "password-toggle.js" => ("application/javascript", PASSWORD_TOGGLE_JS),
+        _ => return StatusCode::NOT_FOUND.into_response(),
+    };
+    ([(header::CONTENT_TYPE, mime)], data).into_response()
+}
+
 async fn log_response_status(request: Request, next: Next) -> Response {
    let method = request.method().clone();
    let uri = request.uri().clone();
@@ -441,9 +479,42 @@ async fn account_page(
        &user.session.user,
        &passkeys,
        &user.session.csrf_token,
+        None,
+        false,
    )))
 }

+async fn change_password(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    LoggedForm(form): LoggedForm<ChangePasswordForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    let passkeys = state.webauthn.list_passkeys(user.session.user.id).await?;
+    let render = |error: Option<&str>, success: bool| {
+        html_response(views::account_page(
+            &user.session.user,
+            &passkeys,
+            &user.session.csrf_token,
+            error,
+            success,
+        ))
+    };
+
+    if form.new_password != form.confirm_password {
+        return Ok(render(
+            Some("New password and confirmation do not match."),
+            false,
+        ));
+    }
+
+    state
+        .auth
+        .change_password(user.session.user.id, form.new_password)
+        .await?;
+    Ok(render(None, true))
+}
+
 async fn passkey_register_start(
    State(state): State<AppState>,
    user: CurrentUser,
@@ -475,15 +546,28 @@ async fn passkey_login_start(
    Json(form): Json<PasskeyLoginStartForm>,
 ) -> Result<Response, AppError> {
    let email = form.email.trim().to_lowercase();
-    let Some((user, _)) = state.auth.find_user_by_email(email).await? else {
-        return Err(AppError::NotFound);
+    let (challenge, token) = if email.is_empty() {
+        // Userless sign-in: no email needed, the authenticator selects a
+        // discoverable credential and returns a user handle.
+        state
+            .webauthn
+            .start_userless_authentication()
+            .await
+            .map_err(AppError::Database)?
+    } else {
+        let Some((user, _)) = state.auth.find_user_by_email(email).await? else {
+            return Err(AppError::NotFound);
+        };
+        state
+            .webauthn
+            .start_authentication(user.id)
+            .await
+            .map_err(AppError::Database)?
    };
-    let challenge = state
-        .webauthn
-        .start_authentication(user.id)
-        .await
-        .map_err(AppError::Database)?;
-    Ok(Json(challenge).into_response())
+    Ok(
+        Json(serde_json::json!({ "token": token, "publicKey": challenge.public_key }))
+            .into_response(),
+    )
 }

 async fn passkey_login_finish(
@@ -492,11 +576,7 @@ async fn passkey_login_finish(
 ) -> Result<Response, AppError> {
    let user_id = state
        .webauthn
-        .resolve_user_id_for_assertion(&form.response)
-        .await?;
-    state
-        .webauthn
-        .finish_authentication(user_id, form.response)
+        .finish_authentication(form.token, form.response)
        .await?;
    let (session_token, _) = state.auth.create_session_for_user(user_id).await?;
    let mut response = Redirect::to("/lists").into_response();
@@ -523,13 +603,28 @@ async fn lists_page(
    user: CurrentUser,
 ) -> Result<Response, AppError> {
    let lists = state.lists.list_summaries().await?;
+    let archived = state.lists.list_archived_summaries().await?;
+    let categories = state.lists.categories().await?;
    Ok(html_response(views::lists_page(
        &user.session.user,
        &lists,
+        archived.len(),
+        &categories,
        &user.session.csrf_token,
    )))
 }

+async fn archive_page(
+    State(state): State<AppState>,
+    user: CurrentUser,
+) -> Result<Response, AppError> {
+    let archived_lists = state.lists.list_archived_summaries().await?;
+    Ok(html_response(views::archive_page(
+        &user.session.user,
+        &archived_lists,
+    )))
+}
+
 async fn create_list(
    State(state): State<AppState>,
    user: CurrentUser,
@@ -554,17 +649,43 @@ async fn list_page(
    let access = require_list(&state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
+    let list_meals = state.meals.list_meals_on_list(list_id).await?;
    let presence = state.realtime.presence(list_id).await;
    Ok(html_response(views::list_page(
        &user.session.user,
        &access,
        &items,
        &categories,
+        &list_meals,
        &presence,
        &user.session.csrf_token,
    )))
 }

+async fn archive_list(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(list_id): Path<i64>,
+    LoggedForm(form): LoggedForm<CsrfForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    require_list(&state, list_id).await?;
+    state.lists.archive_list(list_id).await?;
+    Ok(Redirect::to("/lists").into_response())
+}
+
+async fn unarchive_list(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(list_id): Path<i64>,
+    LoggedForm(form): LoggedForm<CsrfForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    require_list(&state, list_id).await?;
+    state.lists.unarchive_list(list_id).await?;
+    Ok(Redirect::to("/lists").into_response())
+}
+
 async fn add_item(
    State(state): State<AppState>,
    user: CurrentUser,
@@ -572,7 +693,7 @@ async fn add_item(
    LoggedForm(form): LoggedForm<ItemForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_list(&state, list_id).await?;
+    require_mutable_list(&state, list_id).await?;
    let name = form.name.trim().to_owned();
    let quantity = form.quantity.trim().to_owned();
    let note = form.note.trim().to_owned();
@@ -596,7 +717,7 @@ async fn check_item(
    LoggedForm(form): LoggedForm<CheckForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_list(&state, list_id).await?;
+    require_mutable_list(&state, list_id).await?;
    let checked = match form.checked.as_str() {
        "1" | "true" => true,
        "0" | "false" => false,
@@ -616,7 +737,7 @@ async fn edit_item(
    LoggedForm(form): LoggedForm<ItemForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_list(&state, list_id).await?;
+    require_mutable_list(&state, list_id).await?;
    let name = form.name.trim().to_owned();
    if name.is_empty() || name.chars().count() > 120 {
        return Err(AppError::BadRequest(
@@ -644,7 +765,7 @@ async fn delete_item(
    LoggedForm(form): LoggedForm<CsrfForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_list(&state, list_id).await?;
+    require_mutable_list(&state, list_id).await?;
    state.lists.delete_item(list_id, item_id).await?;
    list_fragment_response(&state, &user, list_id).await
 }
@@ -665,26 +786,65 @@ async fn create_category(
    Ok(Redirect::to("/lists").into_response())
 }

+async fn create_meal_category(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    LoggedForm(form): LoggedForm<CategoryForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    let name = form.name.trim().to_owned();
+    if name.is_empty() || name.chars().count() > 60 {
+        return Err(AppError::BadRequest(
+            "Category names must be between 1 and 60 characters.".into(),
+        ));
+    }
+    state.meals.create_meal_category(name).await?;
+    Ok(Redirect::to("/meals").into_response())
+}
+
+async fn delete_meal_category(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(category_id): Path<i64>,
+    LoggedForm(form): LoggedForm<CsrfForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    state.meals.delete_meal_category(category_id).await?;
+    Ok(Redirect::to("/meals").into_response())
+}
+
 async fn meals_page(
    State(state): State<AppState>,
    user: CurrentUser,
    Query(query): Query<MealPickerQuery>,
 ) -> Result<Response, AppError> {
    let meals = state.meals.list_meals().await?;
+    let meal_categories = state.meals.list_meal_categories().await?;
    if let Some(list_id) = query.picker {
        return Ok(html_response(views::meal_picker(
            &meals,
+            &meal_categories,
            list_id,
            &user.session.csrf_token,
        )));
    }
-    Ok(html_response(views::meals_page(&user.session.user, &meals)))
+    Ok(html_response(views::meals_page(
+        &user.session.user,
+        &meals,
+        &meal_categories,
+        &user.session.csrf_token,
+    )))
 }

-async fn new_meal_page(user: CurrentUser) -> Result<Response, AppError> {
+async fn new_meal_page(
+    State(state): State<AppState>,
+    user: CurrentUser,
+) -> Result<Response, AppError> {
+    let meal_categories = state.meals.list_meal_categories().await?;
    Ok(html_response(views::meal_form_page(
        &user.session.user,
        None,
+        &meal_categories,
        &user.session.csrf_token,
    )))
 }
@@ -703,7 +863,11 @@ async fn create_meal(
    }
    let meal = state
        .meals
-        .create_meal(name, form.description.trim().to_owned())
+        .create_meal(
+            name,
+            form.description.trim().to_owned(),
+            parse_category_id(form.category_id),
+        )
        .await?;
    Ok(Redirect::to(&format!("/meals/{}", meal.id)).into_response())
 }
@@ -719,10 +883,12 @@ async fn meal_page(
        .await?
        .ok_or(AppError::NotFound)?;
    let categories = state.lists.categories().await?;
+    let meal_categories = state.meals.list_meal_categories().await?;
    Ok(html_response(views::meal_page(
        &user.session.user,
        &meal,
        &categories,
+        &meal_categories,
        &user.session.csrf_token,
    )))
 }
@@ -742,7 +908,12 @@ async fn edit_meal(
    }
    state
        .meals
-        .update_meal(meal_id, name, form.description.trim().to_owned())
+        .update_meal(
+            meal_id,
+            name,
+            form.description.trim().to_owned(),
+            parse_category_id(form.category_id),
+        )
        .await?;
    Ok(Redirect::to(&format!("/meals/{meal_id}")).into_response())
 }
@@ -832,11 +1003,26 @@ async fn add_meal_to_list(
    LoggedForm(form): LoggedForm<AddMealForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_list(&state, list_id).await?;
+    require_mutable_list(&state, list_id).await?;
    state.meals.add_meal_to_list(form.meal_id, list_id).await?;
    list_fragment_response(&state, &user, list_id).await
 }

+async fn remove_meal_from_list(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path((list_id, list_meal_id)): Path<(i64, i64)>,
+    LoggedForm(form): LoggedForm<CsrfForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    require_mutable_list(&state, list_id).await?;
+    state
+        .meals
+        .remove_meal_from_list(list_id, list_meal_id)
+        .await?;
+    list_fragment_response(&state, &user, list_id).await
+}
+
 async fn create_invitation(
    State(state): State<AppState>,
    user: CurrentUser,
@@ -1001,11 +1187,16 @@ async fn websocket_snapshot(
    let access = require_list(state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
-    Ok(
-        views::live_list_fragments(&access, &items, &categories, &user.session.csrf_token)
-            .into_string()
-            + &views::presence_panel(presence, true).into_string(),
+    let list_meals = state.meals.list_meals_on_list(list_id).await?;
+    Ok(views::live_list_fragments(
+        &access,
+        &items,
+        &categories,
+        &list_meals,
+        &user.session.csrf_token,
    )
+    .into_string()
+        + &views::presence_panel(presence, true).into_string())
 }

 async fn websocket_list_update(
@@ -1016,10 +1207,15 @@ async fn websocket_list_update(
    let access = require_list(state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
-    Ok(
-        views::live_list_fragments(&access, &items, &categories, &user.session.csrf_token)
-            .into_string(),
+    let list_meals = state.meals.list_meals_on_list(list_id).await?;
+    Ok(views::live_list_fragments(
+        &access,
+        &items,
+        &categories,
+        &list_meals,
+        &user.session.csrf_token,
    )
+    .into_string())
 }

 async fn list_fragment_response(
@@ -1030,12 +1226,26 @@ async fn list_fragment_response(
    let access = require_list(state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
-    Ok(html_response(views::list_items_fragment(
-        &access,
-        &items,
-        &categories,
-        &user.session.csrf_token,
-        false,
+    let list_meals = state.meals.list_meals_on_list(list_id).await?;
+    let editable = access.archived_at.is_none();
+    Ok(html_response(PreEscaped(
+        views::list_items_fragment(
+            &access,
+            &items,
+            &categories,
+            &user.session.csrf_token,
+            false,
+            editable,
+        )
+        .into_string()
+            + &views::list_meals_panel(
+                &list_meals,
+                list_id,
+                &user.session.csrf_token,
+                true,
+                editable,
+            )
+            .into_string(),
    )))
 }

@@ -1050,6 +1260,19 @@ async fn require_list(
        .ok_or(AppError::NotFound)
 }

+/// Like [`require_list`], but also rejects archived lists so they stay
+/// immutable until restored.
+async fn require_mutable_list(
+    state: &AppState,
+    list_id: i64,
+) -> Result<crate::domain::GroceryList, AppError> {
+    let list = require_list(state, list_id).await?;
+    if list.archived_at.is_some() {
+        return Err(AppError::Archived);
+    }
+    Ok(list)
+}
+
 async fn optional_user(
    state: &AppState,
    headers: &HeaderMap,
@@ -35,7 +35,7 @@ impl RealtimeNotifier for InMemoryHub {
            }
        });

-        let connection_id = crate::security::new_secret();
+        let connection_id = hex::encode(crate::security::new_secret());
        let already_present = room
            .connections
            .values()
@@ -19,16 +19,17 @@ use tracing::{info, warn};
 use crate::http::{AppState, build_router};
 use crate::hub::InMemoryHub;
 use crate::ports::{
-    CategoryRepository, InvitationRepository, ItemRepository, ListRepository,
-    MealIngredientRepository, MealRepository, PasskeyRepository, PasswordHasher, RealtimeNotifier,
-    SessionRepository, TokenGenerator, UserRepository,
+    CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
+    MealCategoryRepository, MealIngredientRepository, MealRepository, PasskeyRepository,
+    PasswordHasher, RealtimeNotifier, SessionRepository, TokenGenerator, UserRepository,
 };
 use crate::security::{Argon2PasswordHasher, RandomTokenGenerator};
 use crate::services::{AuthService, InvitationService, ListService, MealService, RegistrationMode};
 use crate::sqlite::{
    SqliteCategoryRepository, SqliteDatabase, SqliteInvitationRepository, SqliteItemRepository,
-    SqliteListRepository, SqliteMealIngredientRepository, SqliteMealRepository,
-    SqlitePasskeyRepository, SqliteSessionRepository, SqliteUserRepository,
+    SqliteListMealRepository, SqliteListRepository, SqliteMealCategoryRepository,
+    SqliteMealIngredientRepository, SqliteMealRepository, SqlitePasskeyRepository,
+    SqliteSessionRepository, SqliteUserRepository,
 };
 use crate::webauthn::{AppWebauthnConfig, WebAuthnService};

@@ -74,9 +75,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let lists: Arc<dyn ListRepository> = Arc::new(SqliteListRepository);
    let categories: Arc<dyn CategoryRepository> = Arc::new(SqliteCategoryRepository);
    let items: Arc<dyn ItemRepository> = Arc::new(SqliteItemRepository);
+    let list_meals: Arc<dyn ListMealRepository> = Arc::new(SqliteListMealRepository);
    let meals: Arc<dyn MealRepository> = Arc::new(SqliteMealRepository);
    let meal_ingredients: Arc<dyn MealIngredientRepository> =
        Arc::new(SqliteMealIngredientRepository);
+    let meal_categories: Arc<dyn MealCategoryRepository> = Arc::new(SqliteMealCategoryRepository);
    let invitations: Arc<dyn InvitationRepository> = Arc::new(SqliteInvitationRepository);
    let passkeys: Arc<dyn PasskeyRepository> = Arc::new(SqlitePasskeyRepository);
    let hasher: Arc<dyn PasswordHasher> = Arc::new(Argon2PasswordHasher);
@@ -107,8 +110,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
        db.clone(),
        Arc::clone(&meals),
        Arc::clone(&meal_ingredients),
+        Arc::clone(&meal_categories),
        Arc::clone(&lists),
        Arc::clone(&items),
+        Arc::clone(&list_meals),
        Arc::clone(&realtime),
    ));

@@ -132,6 +137,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let webauthn_service = Arc::new(WebAuthnService::new(
        db.clone(),
        AppWebauthnConfig::new(rp_id, rp_name, origin),
+        Arc::clone(&users),
        Arc::clone(&passkeys),
    ));

@@ -2,8 +2,8 @@ use async_trait::async_trait;
 use sqlx::SqliteConnection;

 use crate::domain::{
-    Category, DomainResult, GroceryList, Item, Meal, MealIngredient, Passkey, PresenceUser,
-    SessionUser, User,
+    Category, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, MealIngredient,
+    Passkey, PresenceUser, SessionUser, User,
 };

 /// Repositories take `&mut SqliteConnection` (which a `Transaction` derefs to),
@@ -24,6 +24,17 @@ pub trait UserRepository: Send + Sync {
        txn: &mut SqliteConnection,
        email: String,
    ) -> DomainResult<Option<(User, String)>>;
+    async fn find_user_by_handle(
+        &self,
+        txn: &mut SqliteConnection,
+        user_handle: Vec<u8>,
+    ) -> DomainResult<Option<User>>;
+    async fn update_password_hash(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        password_hash: String,
+    ) -> DomainResult<()>;
    async fn has_users(&self, txn: &mut SqliteConnection) -> DomainResult<bool>;
 }

@@ -77,6 +88,10 @@ pub trait SessionRepository: Send + Sync {
 #[async_trait]
 pub trait ListRepository: Send + Sync {
    async fn list_summaries(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<GroceryList>>;
+    async fn list_archived_summaries(
+        &self,
+        txn: &mut SqliteConnection,
+    ) -> DomainResult<Vec<GroceryList>>;
    async fn create_list(
        &self,
        txn: &mut SqliteConnection,
@@ -87,6 +102,12 @@ pub trait ListRepository: Send + Sync {
        txn: &mut SqliteConnection,
        list_id: i64,
    ) -> DomainResult<Option<GroceryList>>;
+    async fn set_archived(
+        &self,
+        txn: &mut SqliteConnection,
+        list_id: i64,
+        archived: bool,
+    ) -> DomainResult<()>;
 }

 #[async_trait]
@@ -102,6 +123,9 @@ pub struct NewItem {
    pub quantity: String,
    pub note: String,
    pub category_id: Option<i64>,
+    /// When set, links this item to the `list_meals` row it came from, so the
+    /// item is removed together with that meal instance.
+    pub list_meal_id: Option<i64>,
 }

 #[async_trait]
@@ -147,6 +171,28 @@ pub trait ItemRepository: Send + Sync {
    ) -> DomainResult<i64>;
 }

+#[async_trait]
+pub trait ListMealRepository: Send + Sync {
+    async fn list_meals(
+        &self,
+        txn: &mut SqliteConnection,
+        list_id: i64,
+    ) -> DomainResult<Vec<ListMeal>>;
+    async fn add_meal(
+        &self,
+        txn: &mut SqliteConnection,
+        list_id: i64,
+        meal_id: i64,
+        name: String,
+    ) -> DomainResult<i64>;
+    async fn remove_meal(
+        &self,
+        txn: &mut SqliteConnection,
+        list_id: i64,
+        list_meal_id: i64,
+    ) -> DomainResult<i64>;
+}
+
 #[async_trait]
 pub trait InvitationRepository: Send + Sync {
    async fn create_invitation(
@@ -163,6 +209,21 @@ pub trait InvitationRepository: Send + Sync {
    ) -> DomainResult<()>;
 }

+#[async_trait]
+pub trait MealCategoryRepository: Send + Sync {
+    async fn meal_categories(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<MealCategory>>;
+    async fn create_meal_category(
+        &self,
+        txn: &mut SqliteConnection,
+        name: String,
+    ) -> DomainResult<i64>;
+    async fn delete_meal_category(
+        &self,
+        txn: &mut SqliteConnection,
+        category_id: i64,
+    ) -> DomainResult<()>;
+}
+
 #[async_trait]
 pub trait MealRepository: Send + Sync {
    async fn create_meal(
@@ -170,6 +231,7 @@ pub trait MealRepository: Send + Sync {
        txn: &mut SqliteConnection,
        name: String,
        description: String,
+        category_id: Option<i64>,
    ) -> DomainResult<Meal>;
    async fn get_meal(
        &self,
@@ -183,6 +245,7 @@ pub trait MealRepository: Send + Sync {
        meal_id: i64,
        name: String,
        description: String,
+        category_id: Option<i64>,
    ) -> DomainResult<()>;
    async fn delete_meal(&self, txn: &mut SqliteConnection, meal_id: i64) -> DomainResult<()>;
 }
@@ -37,12 +37,14 @@ pub struct RandomTokenGenerator;
 #[async_trait]
 impl TokenGenerator for RandomTokenGenerator {
    fn generate(&self) -> String {
-        new_secret()
+        hex::encode(new_secret())
    }
 }

-pub fn new_secret() -> String {
+/// Generates 32 cryptographically random bytes. Callers that need a
+/// client-facing string should hex-encode the result.
+pub fn new_secret() -> Vec<u8> {
    let mut bytes = [0_u8; 32];
    OsRng.fill_bytes(&mut bytes);
-    hex::encode(bytes)
+    bytes.to_vec()
 }
@@ -1,10 +1,12 @@
 use std::sync::Arc;

-use crate::domain::{DomainError, DomainResult, GroceryList, Item, Meal, SessionUser, User};
+use crate::domain::{
+    DomainError, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, SessionUser, User,
+};
 use crate::ports::{
-    CategoryRepository, InvitationRepository, ItemRepository, ListRepository,
-    MealIngredientRepository, MealRepository, NewItem, PasswordHasher, RealtimeNotifier,
-    SessionRepository, TokenGenerator, UserRepository,
+    CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
+    MealCategoryRepository, MealIngredientRepository, MealRepository, NewItem, PasswordHasher,
+    RealtimeNotifier, SessionRepository, TokenGenerator, UserRepository,
 };
 use crate::sqlite::SqliteDatabase;

@@ -147,6 +149,22 @@ impl AuthService {
            })
            .await
    }
+
+    /// Replaces the user's password hash with a freshly hashed new password.
+    /// No current-password check is performed because the account page is
+    /// already authenticated and this app has no email capabilities.
+    pub async fn change_password(&self, user_id: i64, new_password: String) -> DomainResult<()> {
+        let users = Arc::clone(&self.users);
+        let hasher = Arc::clone(&self.hasher);
+        self.db
+            .run(move |txn| {
+                Box::pin(async move {
+                    let new_hash = hasher.hash(&new_password)?;
+                    users.update_password_hash(txn, user_id, new_hash).await
+                })
+            })
+            .await
+    }
 }

 pub struct ListService {
@@ -181,6 +199,13 @@ impl ListService {
            .await
    }

+    pub async fn list_archived_summaries(&self) -> DomainResult<Vec<GroceryList>> {
+        let lists = Arc::clone(&self.lists);
+        self.db
+            .run(move |txn| Box::pin(async move { lists.list_archived_summaries(txn).await }))
+            .await
+    }
+
    pub async fn create_list(&self, name: String) -> DomainResult<GroceryList> {
        let lists = Arc::clone(&self.lists);
        self.db
@@ -195,6 +220,20 @@ impl ListService {
            .await
    }

+    pub async fn archive_list(&self, list_id: i64) -> DomainResult<()> {
+        let lists = Arc::clone(&self.lists);
+        self.db
+            .run(move |txn| Box::pin(async move { lists.set_archived(txn, list_id, true).await }))
+            .await
+    }
+
+    pub async fn unarchive_list(&self, list_id: i64) -> DomainResult<()> {
+        let lists = Arc::clone(&self.lists);
+        self.db
+            .run(move |txn| Box::pin(async move { lists.set_archived(txn, list_id, false).await }))
+            .await
+    }
+
    pub async fn items(&self, list_id: i64) -> DomainResult<Vec<Item>> {
        let items = Arc::clone(&self.items);
        self.db
@@ -297,8 +336,10 @@ pub struct MealService {
    db: SqliteDatabase,
    meals: Arc<dyn MealRepository>,
    ingredients: Arc<dyn MealIngredientRepository>,
+    meal_categories: Arc<dyn MealCategoryRepository>,
    lists: Arc<dyn ListRepository>,
    items: Arc<dyn ItemRepository>,
+    list_meals: Arc<dyn ListMealRepository>,
    realtime: Arc<dyn RealtimeNotifier>,
 }

@@ -307,25 +348,36 @@ impl MealService {
        db: SqliteDatabase,
        meals: Arc<dyn MealRepository>,
        ingredients: Arc<dyn MealIngredientRepository>,
+        meal_categories: Arc<dyn MealCategoryRepository>,
        lists: Arc<dyn ListRepository>,
        items: Arc<dyn ItemRepository>,
+        list_meals: Arc<dyn ListMealRepository>,
        realtime: Arc<dyn RealtimeNotifier>,
    ) -> Self {
        Self {
            db,
            meals,
            ingredients,
+            meal_categories,
            lists,
            items,
+            list_meals,
            realtime,
        }
    }

-    pub async fn create_meal(&self, name: String, description: String) -> DomainResult<Meal> {
+    pub async fn create_meal(
+        &self,
+        name: String,
+        description: String,
+        category_id: Option<i64>,
+    ) -> DomainResult<Meal> {
        let meals = Arc::clone(&self.meals);
        self.db
            .run(move |txn| {
-                Box::pin(async move { meals.create_meal(txn, name, description).await })
+                Box::pin(
+                    async move { meals.create_meal(txn, name, description, category_id).await },
+                )
            })
            .await
    }
@@ -349,11 +401,43 @@ impl MealService {
        meal_id: i64,
        name: String,
        description: String,
+        category_id: Option<i64>,
    ) -> DomainResult<()> {
        let meals = Arc::clone(&self.meals);
        self.db
            .run(move |txn| {
-                Box::pin(async move { meals.update_meal(txn, meal_id, name, description).await })
+                Box::pin(async move {
+                    meals
+                        .update_meal(txn, meal_id, name, description, category_id)
+                        .await
+                })
+            })
+            .await
+    }
+
+    pub async fn list_meal_categories(&self) -> DomainResult<Vec<MealCategory>> {
+        let meal_categories = Arc::clone(&self.meal_categories);
+        self.db
+            .run(move |txn| Box::pin(async move { meal_categories.meal_categories(txn).await }))
+            .await
+    }
+
+    pub async fn create_meal_category(&self, name: String) -> DomainResult<i64> {
+        let meal_categories = Arc::clone(&self.meal_categories);
+        self.db
+            .run(move |txn| {
+                Box::pin(async move { meal_categories.create_meal_category(txn, name).await })
+            })
+            .await
+    }
+
+    pub async fn delete_meal_category(&self, category_id: i64) -> DomainResult<()> {
+        let meal_categories = Arc::clone(&self.meal_categories);
+        self.db
+            .run(move |txn| {
+                Box::pin(
+                    async move { meal_categories.delete_meal_category(txn, category_id).await },
+                )
            })
            .await
    }
@@ -428,11 +512,12 @@ impl MealService {
    }

    /// Expands a meal's ingredients into items on a list in one unit of work,
-    /// bumping the list revision exactly once.
+    /// recording the meal on the list and bumping the list revision exactly once.
    pub async fn add_meal_to_list(&self, meal_id: i64, list_id: i64) -> DomainResult<i64> {
        let meals = Arc::clone(&self.meals);
        let lists = Arc::clone(&self.lists);
        let items = Arc::clone(&self.items);
+        let list_meals = Arc::clone(&self.list_meals);
        let revision = self
            .db
            .run(move |txn| {
@@ -444,6 +529,9 @@ impl MealService {
                    if lists.get_list(txn, list_id).await?.is_none() {
                        return Err(DomainError::NotFound);
                    }
+                    let list_meal_id = list_meals
+                        .add_meal(txn, list_id, meal.id, meal.name.clone())
+                        .await?;
                    let new_items = meal
                        .ingredients
                        .into_iter()
@@ -452,6 +540,7 @@ impl MealService {
                            quantity: ingredient.quantity,
                            note: ingredient.note,
                            category_id: ingredient.category_id,
+                            list_meal_id: Some(list_meal_id),
                        })
                        .collect();
                    items.add_items_bulk(txn, list_id, new_items).await
@@ -461,6 +550,32 @@ impl MealService {
        self.realtime.publish_list_changed(list_id, revision).await;
        Ok(revision)
    }
+
+    /// Lists the meals that have been added to a list, most recent first.
+    pub async fn list_meals_on_list(&self, list_id: i64) -> DomainResult<Vec<ListMeal>> {
+        let list_meals = Arc::clone(&self.list_meals);
+        self.db
+            .run(move |txn| Box::pin(async move { list_meals.list_meals(txn, list_id).await }))
+            .await
+    }
+
+    /// Removes a meal instance from a list, deleting the items that came from it
+    /// and bumping the list revision exactly once.
+    pub async fn remove_meal_from_list(
+        &self,
+        list_id: i64,
+        list_meal_id: i64,
+    ) -> DomainResult<i64> {
+        let list_meals = Arc::clone(&self.list_meals);
+        let revision = self
+            .db
+            .run(move |txn| {
+                Box::pin(async move { list_meals.remove_meal(txn, list_id, list_meal_id).await })
+            })
+            .await?;
+        self.realtime.publish_list_changed(list_id, revision).await;
+        Ok(revision)
+    }
 }

 pub struct InvitationService {
@@ -3,7 +3,9 @@ use pulldown_cmark::{Options, Parser, html as cmark_html};

 use crate::{
    domain::PresenceUser,
-    domain::{Category, GroceryList, Item, Meal, MealIngredient, Passkey, User},
+    domain::{
+        Category, GroceryList, Item, ListMeal, Meal, MealCategory, MealIngredient, Passkey, User,
+    },
 };

 pub fn login_page(error: Option<&str>, invite: Option<&str>) -> Markup {
@@ -23,15 +25,19 @@ pub fn login_page(error: Option<&str>, invite: Option<&str>) -> Markup {
                        input type="hidden" name="invite" value=(invite);
                    }
                    label for="email" { "Email" }
-                    input id="email" name="email" type="email" autocomplete="email" required autofocus;
+                    input id="email" name="email" type="email" autocomplete="email" autofocus;
                    label for="password" { "Password" }
-                    input id="password" name="password" type="password" autocomplete="current-password" required;
+                    div class="password-field" {
+                        input id="password" name="password" type="password" autocomplete="current-password" required;
+                        button class="password-toggle" type="button" data-toggle-for="password" aria-label="Show password" { "Show" }
+                    }
                    button class="button button-primary" type="submit" { "Sign in" }
                }
                div class="auth-divider" { span { "or" } }
                button id="passkey-login" class="button button-secondary" type="button" { "Sign in with a passkey" }
                p class="auth-switch" { "Need an account? " a href="/register" { "Create one" } }
            }
+            script src="/static/password-toggle.js" {}
            script src="/static/passkey-login.js" {}
        },
    )
@@ -58,11 +64,15 @@ pub fn register_page(error: Option<&str>, invite: Option<&str>) -> Markup {
                    label for="email" { "Email" }
                    input id="email" name="email" type="email" autocomplete="email" required;
                    label for="password" { "Password" }
-                    input id="password" name="password" type="password" autocomplete="new-password" required;
+                    div class="password-field" {
+                        input id="password" name="password" type="password" autocomplete="new-password" required;
+                        button class="password-toggle" type="button" data-toggle-for="password" aria-label="Show password" { "Show" }
+                    }
                    button class="button button-primary" type="submit" { "Create account" }
                }
                p class="auth-switch" { "Already have an account? " a href="/login" { "Sign in" } }
            }
+            script src="/static/password-toggle.js" {}
        },
    )
 }
@@ -82,7 +92,13 @@ pub fn registration_closed_page() -> Markup {
    )
 }

-pub fn account_page(user: &User, passkeys: &[Passkey], csrf_token: &str) -> Markup {
+pub fn account_page(
+    user: &User,
+    passkeys: &[Passkey],
+    csrf_token: &str,
+    password_error: Option<&str>,
+    password_success: bool,
+) -> Markup {
    page(
        "Account",
        Some(user),
@@ -121,13 +137,46 @@ pub fn account_page(user: &User, passkeys: &[Passkey], csrf_token: &str) -> Mark
                    }
                    button id="add-passkey" class="button button-primary" type="button" data-csrf=(csrf_token) { "Add a passkey" }
                }
+                section class="panel" {
+                    div class="panel-heading" {
+                        h2 { "Password" }
+                    }
+                    p { "Set a new password for your account." }
+                    @if let Some(error) = password_error {
+                        div class="alert alert-error" role="alert" { (error) }
+                    }
+                    @if password_success {
+                        div class="alert alert-success" role="alert" { "Your password has been updated." }
+                    }
+                    form method="post" action="/account/password" class="stack" {
+                        input type="hidden" name="csrf" value=(csrf_token);
+                        label for="new-password" { "New password" }
+                        div class="password-field" {
+                            input id="new-password" name="new_password" type="password" autocomplete="new-password" required;
+                            button class="password-toggle" type="button" data-toggle-for="new-password" aria-label="Show password" { "Show" }
+                        }
+                        label for="confirm-password" { "Confirm new password" }
+                        div class="password-field" {
+                            input id="confirm-password" name="confirm_password" type="password" autocomplete="new-password" required;
+                            button class="password-toggle" type="button" data-toggle-for="confirm-password" aria-label="Show password" { "Show" }
+                        }
+                        button class="button button-primary" type="submit" { "Update password" }
+                    }
+                }
            }
+            script src="/static/password-toggle.js" {}
            script src="/static/passkey-register.js" {}
        },
    )
 }

-pub fn lists_page(user: &User, lists: &[GroceryList], csrf_token: &str) -> Markup {
+pub fn lists_page(
+    user: &User,
+    lists: &[GroceryList],
+    archived_count: usize,
+    categories: &[Category],
+    csrf_token: &str,
+) -> Markup {
    page(
        "Your lists",
        Some(user),
@@ -135,7 +184,7 @@ pub fn lists_page(user: &User, lists: &[GroceryList], csrf_token: &str) -> Marku
            div class="page-heading" {
                div {
                    p class="eyebrow" { "SHARED LISTS" }
-                    h1 { "Grocery lists" }
+                    h1 class="page-title" { "Grocery lists" }
                    p class="lede" { "Everything you need, in one place." }
                }
            }
@@ -144,6 +193,7 @@ pub fn lists_page(user: &User, lists: &[GroceryList], csrf_token: &str) -> Marku
                    div class="panel-heading" {
                        h2 { "Lists" }
                        span class="count-badge" { (lists.len()) }
+                        a class="archive-link" href="/archive" { "Archived " span class="count-badge" { (archived_count) } " →" }
                    }
                    @if lists.is_empty() {
                        div class="empty-state" {
@@ -174,6 +224,7 @@ pub fn lists_page(user: &User, lists: &[GroceryList], csrf_token: &str) -> Marku
                        button class="button button-primary" type="submit" { "Create list" }
                    }
                }
+                (categories_panel(categories, csrf_token, false))
                section id="sharing" class="panel sharing-panel" {
                    div class="panel-heading" { h2 { "Invite someone" } }
                    p { "Create a one-time invite link so a new person can join." }
@@ -193,7 +244,55 @@ pub fn lists_page(user: &User, lists: &[GroceryList], csrf_token: &str) -> Marku
    )
 }

-pub fn meals_page(user: &User, meals: &[Meal]) -> Markup {
+pub fn archive_page(user: &User, archived_lists: &[GroceryList]) -> Markup {
+    page(
+        "Archive",
+        Some(user),
+        html! {
+            div class="page-heading" {
+                div {
+                    p class="eyebrow" { "ARCHIVE" }
+                    h1 class="page-title" { "Archived lists" }
+                    p class="lede" { "Past lists, kept for reference." }
+                }
+                a class="button button-quiet" href="/lists" { "← Back to lists" }
+            }
+            section class="panel" {
+                div class="panel-heading" {
+                    h2 { "Archive" }
+                    span class="count-badge" { (archived_lists.len()) }
+                }
+                @if archived_lists.is_empty() {
+                    div class="empty-state" {
+                        div class="empty-mark" { "🗄" }
+                        h3 { "Nothing archived yet" }
+                        p { "Archive a list and it will show up here." }
+                    }
+                } @else {
+                    div class="list-cards" {
+                        @for list in archived_lists {
+                            a class="list-card archived-list-card" href=(format!("/lists/{}", list.id)) {
+                                span class="list-card-icon" { "🗄" }
+                                span class="list-card-copy" {
+                                    strong { (list.name) }
+                                    small { "Created " (format_date(list.created_at)) }
+                                }
+                                span class="list-card-arrow" { "→" }
+                            }
+                        }
+                    }
+                }
+            }
+        },
+    )
+}
+
+pub fn meals_page(
+    user: &User,
+    meals: &[Meal],
+    meal_categories: &[MealCategory],
+    csrf_token: &str,
+) -> Markup {
    page(
        "Meals",
        Some(user),
@@ -201,11 +300,18 @@ pub fn meals_page(user: &User, meals: &[Meal]) -> Markup {
            div class="page-heading" {
                div {
                    p class="eyebrow" { "MEAL LIBRARY" }
-                    h1 { "Meals" }
+                    h1 class="page-title" { "Meals" }
                    p class="lede" { "Save a meal and add its ingredients to any list." }
                }
                a class="button button-primary" href="/meals/new" { "New meal" }
            }
+            @if meals.is_empty() {
+                div class="empty-state" {
+                    div class="empty-mark" { "🍽" }
+                    h3 { "No meals yet" }
+                    p { "Create a meal to reuse its ingredients across your lists." }
+                }
+            }
            div class="dashboard-grid" {
                section class="panel" {
                    div class="panel-heading" {
@@ -213,21 +319,52 @@ pub fn meals_page(user: &User, meals: &[Meal]) -> Markup {
                        span class="count-badge" { (meals.len()) }
                    }
                    @if meals.is_empty() {
-                        div class="empty-state" {
-                            div class="empty-mark" { "🍽" }
-                            h3 { "No meals yet" }
-                            p { "Create a meal to reuse its ingredients across your lists." }
-                        }
+                        p class="muted" { "Create a meal to get started." }
                    } @else {
-                        div class="list-cards" {
-                            @for meal in meals {
-                                a class="list-card" href=(format!("/meals/{}", meal.id)) {
-                                    span class="list-card-icon" { "🍽" }
-                                    span class="list-card-copy" {
-                                        strong { (meal.name) }
-                                        small { (meal.ingredients.len()) " ingredients" }
+                        @for (category_name, category_meals) in meal_groups(meals, meal_categories) {
+                            div class="category-group" {
+                                div class="category-heading" {
+                                    h3 { (category_name) " (" (category_meals.len()) ")" }
+                                }
+                                div class="list-cards" {
+                                    @for meal in category_meals {
+                                        a class="list-card" href=(format!("/meals/{}", meal.id)) {
+                                            span class="list-card-icon" { "🍽" }
+                                            span class="list-card-copy" {
+                                                strong { (meal.name) }
+                                                small { (meal.ingredients.len()) " ingredients" }
+                                            }
+                                            span class="list-card-arrow" { "→" }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                aside class="side-column" {
+                    section class="panel categories-panel" {
+                        div class="panel-heading" {
+                            h2 { "Meal categories" }
+                        }
+                        p { "Organize meals by type." }
+                        form method="post" action="/meals/categories" class="category-form" {
+                            input type="hidden" name="csrf" value=(csrf_token);
+                            input name="name" type="text" maxlength="60" placeholder="New category" required;
+                            button class="button button-small button-secondary" type="submit" { "Add" }
+                        }
+                        @if meal_categories.is_empty() {
+                            p class="muted category-empty" { "No categories yet." }
+                        } @else {
+                            div class="meal-category-list" {
+                                @for category in meal_categories {
+                                    div class="meal-category-row" {
+                                        span class="meal-category-name" { (category.name) }
+                                        form method="post" action=(format!("/meals/categories/{}/delete", category.id)) {
+                                            input type="hidden" name="csrf" value=(csrf_token);
+                                            button class="meal-category-delete" type="submit" aria-label=(format!("Delete {}", category.name)) { "✕" }
+                                        }
                                    }
-                                    span class="list-card-arrow" { "→" }
                                }
                            }
                        }
@@ -238,7 +375,47 @@ pub fn meals_page(user: &User, meals: &[Meal]) -> Markup {
    )
 }

-pub fn meal_picker(meals: &[Meal], list_id: i64, csrf_token: &str) -> Markup {
+fn meal_groups<'a>(
+    meals: &'a [Meal],
+    meal_categories: &[MealCategory],
+) -> Vec<(String, Vec<&'a Meal>)> {
+    let mut groups = Vec::new();
+    for category in meal_categories {
+        let in_category = meals
+            .iter()
+            .filter(|meal| meal.category_id == Some(category.id))
+            .collect::<Vec<_>>();
+        if !in_category.is_empty() {
+            groups.push((category.name.clone(), in_category));
+        }
+    }
+
+    let uncategorized = meals
+        .iter()
+        .filter(|meal| meal.category_id.is_none())
+        .collect::<Vec<_>>();
+    if !uncategorized.is_empty() {
+        groups.push(("Uncategorized".into(), uncategorized));
+    }
+    groups
+}
+
+/// Returns the display name of a meal's category, if it has one.
+fn meal_category_name(meal: &Meal, meal_categories: &[MealCategory]) -> Option<String> {
+    meal.category_id.and_then(|id| {
+        meal_categories
+            .iter()
+            .find(|category| category.id == id)
+            .map(|category| category.name.clone())
+    })
+}
+
+pub fn meal_picker(
+    meals: &[Meal],
+    meal_categories: &[MealCategory],
+    list_id: i64,
+    csrf_token: &str,
+) -> Markup {
    html! {
        div class="meal-picker-backdrop" onclick="if (event.target === this) this.remove()" {
            div class="meal-picker-modal" role="dialog" aria-modal="true" aria-label="Add a meal" {
@@ -258,23 +435,30 @@ pub fn meal_picker(meals: &[Meal], list_id: i64, csrf_token: &str) -> Markup {
                    }
                } @else {
                    div class="meal-picker-list" {
-                        @for meal in meals {
-                            form
-                                hx-post=(format!("/lists/{}/add-meal", list_id))
-                                hx-target="#list-items"
-                                hx-swap="outerHTML"
-                                hx-on::after-request="if (event.detail.successful) this.closest('.meal-picker-backdrop').remove()"
-                                class="meal-picker-row"
-                            {
-                                input type="hidden" name="csrf" value=(csrf_token);
-                                input type="hidden" name="meal_id" value=(meal.id);
-                                button class="meal-picker-button" type="submit" {
-                                    span class="meal-picker-icon" { "🍽" }
-                                    span class="meal-picker-copy" {
-                                        strong { (meal.name) }
-                                        small { (meal.ingredients.len()) " ingredients" }
+                        @for (category_name, category_meals) in meal_groups(meals, meal_categories) {
+                            div class="category-group" {
+                                div class="category-heading" {
+                                    h3 { (category_name) }
+                                }
+                                @for meal in category_meals {
+                                    form
+                                        hx-post=(format!("/lists/{}/add-meal", list_id))
+                                        hx-target="#list-items"
+                                        hx-swap="outerHTML"
+                                        hx-on::after-request="if (event.detail.successful) this.closest('.meal-picker-backdrop').remove()"
+                                        class="meal-picker-row"
+                                    {
+                                        input type="hidden" name="csrf" value=(csrf_token);
+                                        input type="hidden" name="meal_id" value=(meal.id);
+                                        button class="meal-picker-button" type="submit" {
+                                            span class="meal-picker-icon" { "🍽" }
+                                            span class="meal-picker-copy" {
+                                                strong { (meal.name) }
+                                                small { (meal.ingredients.len()) " ingredients" }
+                                            }
+                                            span class="meal-picker-add" { "Add" }
+                                        }
                                    }
-                                    span class="meal-picker-add" { "Add" }
                                }
                            }
                        }
@@ -285,15 +469,27 @@ pub fn meal_picker(meals: &[Meal], list_id: i64, csrf_token: &str) -> Markup {
    }
 }

-pub fn meal_form_page(user: &User, meal: Option<&Meal>, csrf_token: &str) -> Markup {
-    let (title, action, name, description) = match meal {
+pub fn meal_form_page(
+    user: &User,
+    meal: Option<&Meal>,
+    meal_categories: &[MealCategory],
+    csrf_token: &str,
+) -> Markup {
+    let (title, action, name, description, category_id) = match meal {
        Some(meal) => (
            "Edit meal",
            format!("/meals/{}/edit", meal.id),
            meal.name.clone(),
            meal.description.clone(),
+            meal.category_id,
+        ),
+        None => (
+            "New meal",
+            "/meals".into(),
+            String::new(),
+            String::new(),
+            None,
        ),
-        None => ("New meal", "/meals".into(), String::new(), String::new()),
    };
    page(
        title,
@@ -308,6 +504,21 @@ pub fn meal_form_page(user: &User, meal: Option<&Meal>, csrf_token: &str) -> Mar
                    input type="hidden" name="csrf" value=(csrf_token);
                    label for="meal-name" { "Name" }
                    input id="meal-name" name="name" type="text" maxlength="120" value=(name) required;
+                    label for="meal-category" { "Category" }
+                    select id="meal-category" name="category_id" {
+                        @if category_id.is_none() {
+                            option value="" selected { "Uncategorized" }
+                        } @else {
+                            option value="" { "Uncategorized" }
+                        }
+                        @for category in meal_categories {
+                            @if category_id == Some(category.id) {
+                                option value=(category.id) selected { (category.name) }
+                            } @else {
+                                option value=(category.id) { (category.name) }
+                            }
+                        }
+                    }
                    label for="meal-description" { "Description (markdown)" }
                    textarea id="meal-description" name="description" rows="8" { (description) }
                    button class="button button-primary" type="submit" { "Save meal" }
@@ -320,20 +531,19 @@ pub fn meal_form_page(user: &User, meal: Option<&Meal>, csrf_token: &str) -> Mar
    )
 }

-pub fn meal_page(user: &User, meal: &Meal, categories: &[Category], csrf_token: &str) -> Markup {
+pub fn meal_page(
+    user: &User,
+    meal: &Meal,
+    categories: &[Category],
+    meal_categories: &[MealCategory],
+    csrf_token: &str,
+) -> Markup {
    page(
        &meal.name,
        Some(user),
        html! {
            div class="page-heading" {
                a class="back-link" href="/meals" { "← All meals" }
-                div class="list-topbar-actions" {
-                    button type="button" class="button button-small button-quiet" onclick="document.getElementById('meal-edit-modal').showModal()" { "Edit" }
-                    form method="post" action=(format!("/meals/{}/delete", meal.id)) {
-                        input type="hidden" name="csrf" value=(csrf_token);
-                        button class="danger-link" type="submit" { "Delete" }
-                    }
-                }
            }
            dialog id="meal-edit-modal" class="item-modal" {
                div class="item-modal-card" {
@@ -345,6 +555,21 @@ pub fn meal_page(user: &User, meal: &Meal, categories: &[Category], csrf_token:
                        input type="hidden" name="csrf" value=(csrf_token);
                        label { "Name" }
                        input id="meal-edit-name" name="name" value=(meal.name) maxlength="120" required;
+                        label { "Category" }
+                        select id="meal-edit-category" name="category_id" {
+                            @if meal.category_id.is_none() {
+                                option value="" selected { "Uncategorized" }
+                            } @else {
+                                option value="" { "Uncategorized" }
+                            }
+                            @for category in meal_categories {
+                                @if meal.category_id == Some(category.id) {
+                                    option value=(category.id) selected { (category.name) }
+                                } @else {
+                                    option value=(category.id) { (category.name) }
+                                }
+                            }
+                        }
                        label { "Description (markdown)" }
                        textarea id="meal-edit-description" name="description" rows="8" { (meal.description) }
                        button id="meal-edit-save" class="button button-primary" type="submit" { "Save meal" }
@@ -356,7 +581,14 @@ pub fn meal_page(user: &User, meal: &Meal, categories: &[Category], csrf_token:
                    div class="list-heading" {
                        div {
                            p class="eyebrow" { "MEAL" }
-                            h1 { (meal.name) }
+                            h1 { (meal.name) @if let Some(category_name) = meal_category_name(meal, meal_categories) { span class="meal-category-label" { "(" (category_name) ")" } } }
+                        }
+                        div class="list-topbar-actions" {
+                            button type="button" class="button button-small button-quiet" onclick="document.getElementById('meal-edit-modal').showModal()" { "Edit" }
+                            form method="post" action=(format!("/meals/{}/delete", meal.id)) onsubmit="return confirm('Delete this meal and its ingredients? This cannot be undone.')" {
+                                input type="hidden" name="csrf" value=(csrf_token);
+                                button class="danger-link bordered-delete" type="submit" { "Delete" }
+                            }
                        }
                    }
                    @if meal.description.is_empty() {
@@ -364,7 +596,7 @@ pub fn meal_page(user: &User, meal: &Meal, categories: &[Category], csrf_token:
                    } @else {
                        div class="markdown" { (render_markdown(&meal.description)) }
                    }
-                    h2 class="category-heading" { "Ingredients" }
+                    hr class="ingredients-divider" {}
                    @if meal.ingredients.is_empty() {
                        p class="muted" { "No ingredients yet." }
                    } @else {
@@ -382,14 +614,14 @@ pub fn meal_page(user: &User, meal: &Meal, categories: &[Category], csrf_token:
                            input type="hidden" name="csrf" value=(csrf_token);
                            label { "Name" }
                            input id="ingredient-name" name="name" type="text" maxlength="120" required;
-                            label { "Quantity" }
-                            input id="ingredient-quantity" name="quantity" type="text" maxlength="40";
-                            label { "Note" }
-                            input id="ingredient-note" name="note" type="text" maxlength="120";
                            label { "Category" }
                            select id="ingredient-category" name="category_id" {
                                (category_options(categories, None))
                            }
+                            label { "Quantity" }
+                            input id="ingredient-quantity" name="quantity" type="text" maxlength="40";
+                            label { "Note" }
+                            input id="ingredient-note" name="note" type="text" maxlength="120";
                            button id="add-ingredient-button" class="button button-primary" type="submit" { "Add ingredient" }
                        }
                    }
@@ -431,19 +663,19 @@ fn ingredient_row(
                    input type="hidden" name="csrf" value=(csrf_token);
                    label { "Name" }
                    input id=(format!("ingredient-edit-name-{}", ingredient.id)) name="name" value=(ingredient.name) maxlength="120" required;
-                    label { "Quantity" }
-                    input id=(format!("ingredient-edit-quantity-{}", ingredient.id)) name="quantity" value=(ingredient.quantity) maxlength="40";
-                    label { "Note" }
-                    input id=(format!("ingredient-edit-note-{}", ingredient.id)) name="note" value=(ingredient.note) maxlength="120";
                    label { "Category" }
                    select id=(format!("ingredient-edit-category-{}", ingredient.id)) name="category_id" {
                        (category_options(categories, ingredient.category_id))
                    }
+                    label { "Quantity" }
+                    input id=(format!("ingredient-edit-quantity-{}", ingredient.id)) name="quantity" value=(ingredient.quantity) maxlength="40";
+                    label { "Note" }
+                    input id=(format!("ingredient-edit-note-{}", ingredient.id)) name="note" value=(ingredient.note) maxlength="120";
                    button id=(format!("ingredient-edit-save-{}", ingredient.id)) class="button button-primary" type="submit" { "Save" }
                }
                form method="post" action=(format!("/meals/{}/ingredients/{}/delete", meal_id, ingredient.id)) {
                    input type="hidden" name="csrf" value=(csrf_token);
-                    button id=(format!("ingredient-edit-delete-{}", ingredient.id)) class="danger-link" type="submit" { "Remove" }
+                    button id=(format!("ingredient-edit-delete-{}", ingredient.id)) class="button button-danger" type="submit" { "Remove" }
                }
            }
        }
@@ -525,6 +757,13 @@ mod tests {
        assert!(html.contains("<strong>"), "expected <strong>, got: {html}");
        assert!(html.contains("<em>"), "expected <em>, got: {html}");
    }
+
+    #[test]
+    fn format_date_renders_human_readable_date() {
+        // 2026-08-07T00:00:00Z in Unix seconds.
+        let ts = 1_786_060_800;
+        assert_eq!(format_date(ts), "7 Aug 2026");
+    }
 }

 pub fn list_page(
@@ -532,6 +771,7 @@ pub fn list_page(
    list: &GroceryList,
    items: &[Item],
    categories: &[Category],
+    list_meals: &[ListMeal],
    presence: &[PresenceUser],
    csrf_token: &str,
 ) -> Markup {
@@ -543,9 +783,11 @@ pub fn list_page(
                a class="back-link" href="/lists" { "← All lists" }
                div class="list-topbar-actions" {
                    span class="live-pill" { span class="live-dot" {} "Live" }
-                    button class="button button-small add-meal-button" hx-get=(format!("/meals?picker={}", list.id)) hx-target="#meal-picker" hx-swap="innerHTML" { "+ Add meal" }
                }
            }
+            @if let Some(ts) = list.archived_at {
+                div class="archived-banner" { "This list was archived on " (format_date(ts)) "." }
+            }
            div id="meal-picker" class="meal-picker" {}
            div class="list-layout" {
                section class="panel list-panel" {
@@ -555,12 +797,25 @@ pub fn list_page(
                            h1 { (list.name) }
                            p class="list-meta" { (items.iter().filter(|item| !item.checked).count()) " items to get" }
                        }
+                        div class="list-topbar-actions" {
+                            @if list.archived_at.is_some() {
+                                form method="post" action=(format!("/lists/{}/unarchive", list.id)) {
+                                    input type="hidden" name="csrf" value=(csrf_token);
+                                    button class="button button-small button-quiet" type="submit" { "Restore" }
+                                }
+                            } @else {
+                                form method="post" action=(format!("/lists/{}/archive", list.id)) {
+                                    input type="hidden" name="csrf" value=(csrf_token);
+                                    button class="button button-small button-quiet" type="submit" { "Archive" }
+                                }
+                            }
+                        }
                    }
-                    (list_content_fragment(list, items, categories, csrf_token, false))
+                    (list_content_fragment(list, items, categories, csrf_token, false, list.archived_at.is_none()))
                }
                aside class="side-column" {
+                    (list_meals_panel(list_meals, list.id, csrf_token, false, list.archived_at.is_none()))
                    (presence_panel(presence, false))
-                    (categories_panel(categories, csrf_token, false))
                    section class="panel tip-panel" {
                        span class="tip-label" { "TIP" }
                        p { "Check items off as you go. Everyone viewing this list will see it instantly." }
@@ -578,17 +833,18 @@ pub fn list_content_fragment(
    categories: &[Category],
    csrf_token: &str,
    out_of_band: bool,
+    editable: bool,
 ) -> Markup {
    if out_of_band {
        html! {
            div id="list-content" hx-swap-oob="outerHTML" {
-                (list_content(list, items, categories, csrf_token))
+                (list_content(list, items, categories, csrf_token, editable))
            }
        }
    } else {
        html! {
            div id="list-content" {
-                (list_content(list, items, categories, csrf_token))
+                (list_content(list, items, categories, csrf_token, editable))
            }
        }
    }
@@ -599,26 +855,29 @@ fn list_content(
    items: &[Item],
    categories: &[Category],
    csrf_token: &str,
+    editable: bool,
 ) -> Markup {
    html! {
-        form
-            id="add-item-form"
-            class="add-item-form"
-            hx-post=(format!("/lists/{}/items", list.id))
-            hx-target="#list-items"
-            hx-swap="outerHTML"
-            hx-on::after-request="if (event.detail.successful) this.reset()"
-        {
-            input type="hidden" name="csrf" value=(csrf_token);
-            label class="sr-only" for="item-name" { "Item name" }
-            input id="item-name" name="name" type="text" maxlength="120" placeholder="Add an item..." autocomplete="off" required;
-            input id="item-quantity" name="quantity" type="text" maxlength="40" placeholder="Qty" aria-label="Quantity";
-            select id="item-category" name="category_id" aria-label="Category" {
-                (category_options(categories, None))
+        @if editable {
+            form
+                id="add-item-form"
+                class="add-item-form"
+                hx-post=(format!("/lists/{}/items", list.id))
+                hx-target="#list-items"
+                hx-swap="outerHTML"
+                hx-on::after-request="if (event.detail.successful) this.reset()"
+            {
+                input type="hidden" name="csrf" value=(csrf_token);
+                label class="sr-only" for="item-name" { "Item name" }
+                input id="item-name" name="name" type="text" maxlength="120" placeholder="Add an item..." autocomplete="off" required;
+                select id="item-category" name="category_id" aria-label="Category" {
+                    (category_options(categories, None))
+                }
+                input id="item-quantity" name="quantity" type="text" maxlength="40" placeholder="Qty" aria-label="Quantity";
+                button id="add-item-button" class="button button-primary add-button" type="submit" { "+ Add" }
            }
-            button id="add-item-button" class="button button-primary add-button" type="submit" { "+ Add" }
        }
-        (list_items_fragment(list, items, categories, csrf_token, false))
+        (list_items_fragment(list, items, categories, csrf_token, false, editable))
    }
 }

@@ -628,23 +887,29 @@ pub fn list_items_fragment(
    categories: &[Category],
    csrf_token: &str,
    out_of_band: bool,
+    editable: bool,
 ) -> Markup {
    if out_of_band {
        html! {
            div id="list-items" class="items" data-revision=(list.revision) hx-swap-oob="outerHTML" {
-                (list_items_content(items, categories, csrf_token))
+                (list_items_content(items, categories, csrf_token, editable))
            }
        }
    } else {
        html! {
            div id="list-items" class="items" data-revision=(list.revision) {
-                (list_items_content(items, categories, csrf_token))
+                (list_items_content(items, categories, csrf_token, editable))
            }
        }
    }
 }

-fn list_items_content(items: &[Item], categories: &[Category], csrf_token: &str) -> Markup {
+fn list_items_content(
+    items: &[Item],
+    categories: &[Category],
+    csrf_token: &str,
+    editable: bool,
+) -> Markup {
    html! {
        @if items.is_empty() {
            div class="empty-items" {
@@ -655,7 +920,7 @@ fn list_items_content(items: &[Item], categories: &[Category], csrf_token: &str)
        } @else {
            div class="item-list" {
                @for group in item_groups(items, categories) {
-                    (category_group(&group.0, &group.1, categories, csrf_token))
+                    (category_group(&group.0, &group.1, categories, csrf_token, editable))
                }
            }
        }
@@ -689,32 +954,37 @@ fn category_group(
    items: &[&Item],
    categories: &[Category],
    csrf_token: &str,
+    editable: bool,
 ) -> Markup {
    html! {
        section class="category-group" {
            h2 class="category-heading" { (name) }
            @for item in items {
-                (item_row(item, categories, csrf_token))
+                (item_row(item, categories, csrf_token, editable))
            }
        }
    }
 }

-fn item_row(item: &Item, categories: &[Category], csrf_token: &str) -> Markup {
+fn item_row(item: &Item, categories: &[Category], csrf_token: &str, editable: bool) -> Markup {
    let next_checked = if item.checked { "0" } else { "1" };
    html! {
        article class=(if item.checked { "item-row is-checked" } else { "item-row" }) id=(format!("item-{}", item.id)) data-version=(item.version) {
-            form
-                class="check-form"
-                hx-post=(format!("/lists/{}/items/{}/check", item.list_id, item.id))
-                hx-target="#list-items"
-                hx-swap="outerHTML"
-            {
-                input type="hidden" name="csrf" value=(csrf_token);
-                input type="hidden" name="checked" value=(next_checked);
-                button id=(format!("item-check-{}", item.id)) class="check-button" type="submit" aria-label=(if item.checked { "Mark unchecked" } else { "Mark complete" }) {
-                    @if item.checked { "✓" } @else { "" }
+            @if editable {
+                form
+                    class="check-form"
+                    hx-post=(format!("/lists/{}/items/{}/check", item.list_id, item.id))
+                    hx-target="#list-items"
+                    hx-swap="outerHTML"
+                {
+                    input type="hidden" name="csrf" value=(csrf_token);
+                    input type="hidden" name="checked" value=(next_checked);
+                    button id=(format!("item-check-{}", item.id)) class="check-button" type="submit" aria-label=(if item.checked { "Mark unchecked" } else { "Mark complete" }) {
+                        @if item.checked { "✓" } @else { "" }
+                    }
                }
+            } @else if item.checked {
+                span class="check-button check-button-static" { "✓" }
            }
            label class="item-copy" for=(format!("item-check-{}", item.id)) {
                @if !item.quantity.is_empty() {
@@ -725,39 +995,41 @@ fn item_row(item: &Item, categories: &[Category], csrf_token: &str) -> Markup {
                    small { (item.note) }
                }
            }
-            button type="button" class="item-actions-button" aria-label="Item actions" onclick=(format!("document.getElementById('item-edit-{}').showModal()", item.id)) { "•••" }
-            dialog id=(format!("item-edit-{}", item.id)) class="item-modal" {
-                div class="item-modal-card" {
-                    div class="item-modal-header" {
-                        h3 { (item.name) }
-                        button type="button" class="meal-picker-close" aria-label="Close" onclick="this.closest('dialog').close()" { "✕" }
-                    }
-                    form
-                        hx-post=(format!("/lists/{}/items/{}/edit", item.list_id, item.id))
-                        hx-target="#list-items"
-                        hx-swap="outerHTML"
-                        class="stack"
-                    {
-                        input type="hidden" name="csrf" value=(csrf_token);
-                        label { "Name" }
-                        input id=(format!("item-edit-name-{}", item.id)) name="name" value=(item.name) maxlength="120" required;
-                        label { "Quantity" }
-                        input id=(format!("item-edit-quantity-{}", item.id)) name="quantity" value=(item.quantity) maxlength="40";
-                        label { "Note" }
-                        input id=(format!("item-edit-note-{}", item.id)) name="note" value=(item.note) maxlength="120";
-                        label { "Category" }
-                        select id=(format!("item-edit-category-{}", item.id)) name="category_id" {
-                            (category_options(categories, item.category_id))
+            @if editable {
+                button type="button" class="item-actions-button" aria-label="Item actions" onclick=(format!("document.getElementById('item-edit-{}').showModal()", item.id)) { "•••" }
+                dialog id=(format!("item-edit-{}", item.id)) class="item-modal" {
+                    div class="item-modal-card" {
+                        div class="item-modal-header" {
+                            h3 { (item.name) }
+                            button type="button" class="meal-picker-close" aria-label="Close" onclick="this.closest('dialog').close()" { "✕" }
+                        }
+                        form
+                            hx-post=(format!("/lists/{}/items/{}/edit", item.list_id, item.id))
+                            hx-target="#list-items"
+                            hx-swap="outerHTML"
+                            class="stack"
+                        {
+                            input type="hidden" name="csrf" value=(csrf_token);
+                            label { "Name" }
+                            input id=(format!("item-edit-name-{}", item.id)) name="name" value=(item.name) maxlength="120" required;
+                            label { "Category" }
+                            select id=(format!("item-edit-category-{}", item.id)) name="category_id" {
+                                (category_options(categories, item.category_id))
+                            }
+                            label { "Quantity" }
+                            input id=(format!("item-edit-quantity-{}", item.id)) name="quantity" value=(item.quantity) maxlength="40";
+                            label { "Note" }
+                            input id=(format!("item-edit-note-{}", item.id)) name="note" value=(item.note) maxlength="120";
+                            button id=(format!("item-edit-save-{}", item.id)) class="button button-primary" type="submit" { "Save" }
+                        }
+                        form
+                            hx-post=(format!("/lists/{}/items/{}/delete", item.list_id, item.id))
+                            hx-target="#list-items"
+                            hx-swap="outerHTML"
+                        {
+                            input type="hidden" name="csrf" value=(csrf_token);
+                            button id=(format!("item-edit-delete-{}", item.id)) class="button button-danger" type="submit" { "Remove item" }
                        }
-                        button id=(format!("item-edit-save-{}", item.id)) class="button button-primary" type="submit" { "Save" }
-                    }
-                    form
-                        hx-post=(format!("/lists/{}/items/{}/delete", item.list_id, item.id))
-                        hx-target="#list-items"
-                        hx-swap="outerHTML"
-                    {
-                        input type="hidden" name="csrf" value=(csrf_token);
-                        button id=(format!("item-edit-delete-{}", item.id)) class="danger-link" type="submit" { "Remove item" }
                    }
                }
            }
@@ -827,11 +1099,64 @@ pub fn live_list_fragments(
    list: &GroceryList,
    items: &[Item],
    categories: &[Category],
+    list_meals: &[ListMeal],
    csrf_token: &str,
 ) -> Markup {
+    let editable = list.archived_at.is_none();
    html! {
-        (list_content_fragment(list, items, categories, csrf_token, true))
-        (categories_panel(categories, csrf_token, true))
+        (list_items_fragment(list, items, categories, csrf_token, true, editable))
+        (list_meals_panel(list_meals, list.id, csrf_token, true, editable))
+    }
+}
+
+pub fn list_meals_panel(
+    list_meals: &[ListMeal],
+    list_id: i64,
+    csrf_token: &str,
+    out_of_band: bool,
+    editable: bool,
+) -> Markup {
+    let panel = html! {
+        div class="panel-heading" {
+            h2 { "Meals on this list" }
+            span class="count-badge" { (list_meals.len()) }
+        }
+        @if list_meals.is_empty() {
+            p class="muted" { "No meals added yet." }
+        } @else {
+            div class="list-meals" {
+                @for meal in list_meals {
+                    div class="list-meal-row" {
+                        span class="list-meal-icon" { "🍽" }
+                        span class="list-meal-name" { (meal.name) }
+                        @if editable {
+                            form
+                                hx-post=(format!("/lists/{}/meals/{}/remove", list_id, meal.id))
+                                hx-target="#list-items"
+                                hx-swap="outerHTML"
+                                class="list-meal-remove"
+                            {
+                                input type="hidden" name="csrf" value=(csrf_token);
+                                button type="submit" class="list-meal-remove-button" aria-label=(format!("Remove {} from list", meal.name)) { "✕" }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        @if editable {
+            button class="button button-small add-meal-button" hx-get=(format!("/meals?picker={}", list_id)) hx-target="#meal-picker" hx-swap="innerHTML" { "+ Add meal" }
+        }
+    };
+
+    if out_of_band {
+        html! {
+            section id="list-meals-panel" class="panel list-meals-panel" hx-swap-oob="outerHTML" { (panel) }
+        }
+    } else {
+        html! {
+            section id="list-meals-panel" class="panel list-meals-panel" { (panel) }
+        }
    }
 }

@@ -919,6 +1244,31 @@ pub fn invite_result(url: &str) -> Markup {
    }
 }

+/// Formats a Unix timestamp as a human-readable date (e.g. "7 Aug 2026").
+fn format_date(timestamp: i64) -> String {
+    let days = timestamp.div_euclid(86_400);
+    let (y, m, d) = civil_from_days(days);
+    const MONTHS: [&str; 12] = [
+        "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
+    ];
+    format!("{} {} {}", d, MONTHS[(m - 1) as usize], y)
+}
+
+/// Converts a count of days since the Unix epoch into a (year, month, day)
+/// civil date using Howard Hinnant's `civil_from_days` algorithm.
+fn civil_from_days(z: i64) -> (i64, i64, i64) {
+    let z = z + 719_468;
+    let era = z.div_euclid(146_097);
+    let doe = z.rem_euclid(146_097);
+    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+    let y = yoe + era * 400;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    (if m <= 2 { y + 1 } else { y }, m, d)
+}
+
 pub fn error_page(status: &str, message: &str) -> Markup {
    page(
        status,
@@ -946,7 +1296,7 @@ fn page(title: &str, user: Option<&User>, content: Markup) -> Markup {
                script src="https://unpkg.com/htmx.org@2.0.4" {}
                script src="https://unpkg.com/htmx-ext-ws@2.0.2/ws.js" {}
            }
-            body {
+            body hx-boost="true" {
                header class="site-header" {
                    a class="brand" href="/lists" { span class="brand-mark" { "S" } "Sustenance" }
                    @if let Some(user) = user {
@@ -7,12 +7,13 @@ use webauthn_rs::{
    error::WebauthnError as WanError,
    proto::{
        CreationChallengeResponse, Credential, PublicKeyCredential, RegisterPublicKeyCredential,
-        RequestChallengeResponse,
+        RequestChallengeResponse, UserVerificationPolicy,
    },
 };

 use crate::domain::{DomainError, DomainResult, Passkey as DbPasskey, User};
-use crate::ports::PasskeyRepository;
+use crate::ports::{PasskeyRepository, UserRepository};
+use crate::security::new_secret;
 use crate::sqlite::SqliteDatabase;

 /// Site-specific WebAuthn configuration, derived from env vars.
@@ -20,6 +21,7 @@ pub struct AppWebauthnConfig {
    rp_id: String,
    rp_name: String,
    origin: url::Url,
+    require_resident_key: bool,
 }

 impl AppWebauthnConfig {
@@ -28,6 +30,10 @@ impl AppWebauthnConfig {
            rp_id,
            rp_name,
            origin,
+            // Resident (discoverable) keys let users sign in without typing an
+            // email, because the authenticator can select the credential on its
+            // own and return the user handle.
+            require_resident_key: true,
        }
    }
 }
@@ -42,18 +48,24 @@ impl WebauthnConfig for AppWebauthnConfig {
    fn get_relying_party_id(&self) -> &str {
        &self.rp_id
    }
+    fn get_require_resident_key(&self) -> bool {
+        self.require_resident_key
+    }
 }

-/// A single-use, in-memory challenge store keyed by user id.
+/// A single-use, in-memory challenge store. Registrations are keyed by user id;
+/// authentications are keyed by a random token so that userless (discoverable)
+/// ceremonies can be correlated back to the finish request.
 #[derive(Default)]
 struct ChallengeStore {
    registrations: HashMap<i64, RegistrationState>,
-    authentications: HashMap<i64, AuthenticationState>,
+    authentications: HashMap<String, AuthenticationState>,
 }

 pub struct WebAuthnService {
    db: SqliteDatabase,
    webauthn: Webauthn<AppWebauthnConfig>,
+    users: Arc<dyn UserRepository>,
    passkeys: Arc<dyn PasskeyRepository>,
    challenges: Mutex<ChallengeStore>,
 }
@@ -62,12 +74,14 @@ impl WebAuthnService {
    pub fn new(
        db: SqliteDatabase,
        config: AppWebauthnConfig,
+        users: Arc<dyn UserRepository>,
        passkeys: Arc<dyn PasskeyRepository>,
    ) -> Self {
        let webauthn = Webauthn::new(config);
        Self {
            db,
            webauthn,
+            users,
            passkeys,
            challenges: Mutex::new(ChallengeStore::default()),
        }
@@ -75,9 +89,19 @@ impl WebAuthnService {

    /// Start a passkey registration ceremony for an authenticated user.
    pub fn start_registration(&self, user: &User) -> DomainResult<CreationChallengeResponse> {
+        // Use the user's opaque, random user handle as the WebAuthn userHandle
+        // so that userless (discoverable) sign-in can resolve the owning user
+        // from the assertion's userHandle without exposing the numeric id.
        let (challenge, state) = self
            .webauthn
-            .generate_challenge_register(&user.display_name, true)
+            .generate_challenge_register_options(
+                user.user_handle.clone(),
+                user.email.clone(),
+                user.display_name.clone(),
+                None,
+                Some(UserVerificationPolicy::Required),
+                None,
+            )
            .map_err(webauthn_error)?;
        self.challenges
            .lock()
@@ -127,11 +151,12 @@ impl WebAuthnService {
            .await
    }

-    /// Start a passkey authentication ceremony for a user.
+    /// Start a passkey authentication ceremony for a user identified by email.
+    /// Returns the challenge and a token used to correlate the finish request.
    pub async fn start_authentication(
        &self,
        user_id: i64,
-    ) -> DomainResult<RequestChallengeResponse> {
+    ) -> DomainResult<(RequestChallengeResponse, String)> {
        let passkeys = Arc::clone(&self.passkeys);
        let db = self.db.clone();
        let credentials: Vec<Credential> = db
@@ -156,28 +181,91 @@ impl WebAuthnService {
            .webauthn
            .generate_challenge_authenticate(credentials)
            .map_err(webauthn_error)?;
+        let token = hex::encode(new_secret());
        self.challenges
            .lock()
            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
            .authentications
-            .insert(user_id, state);
-        Ok(challenge)
+            .insert(token.clone(), state);
+        Ok((challenge, token))
    }

-    /// Finish a passkey authentication ceremony.
+    /// Start a userless passkey authentication ceremony. No email is required:
+    /// the authenticator selects a discoverable credential and returns a user
+    /// handle that we resolve to the owning user on finish.
+    pub async fn start_userless_authentication(
+        &self,
+    ) -> DomainResult<(RequestChallengeResponse, String)> {
+        let (challenge, mut state) = self
+            .webauthn
+            .generate_challenge_authenticate_options(vec![], None)
+            .map_err(webauthn_error)?;
+        // With no allowCredentials the browser will offer any discoverable
+        // credential for this RP; the credential set is populated from the
+        // user handle once the assertion is received.
+        state.set_allowed_credentials(vec![]);
+        let token = hex::encode(new_secret());
+        self.challenges
+            .lock()
+            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
+            .authentications
+            .insert(token.clone(), state);
+        Ok((challenge, token))
+    }
+
+    /// Finish a passkey authentication ceremony, resolving the owning user from
+    /// the credential id (and, for userless ceremonies, the user handle).
    pub async fn finish_authentication(
        &self,
-        user_id: i64,
+        token: String,
        response: PublicKeyCredential,
-    ) -> DomainResult<()> {
-        let state = self
+    ) -> DomainResult<i64> {
+        let mut state = self
            .challenges
            .lock()
            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
            .authentications
-            .remove(&user_id)
+            .remove(&token)
            .ok_or(DomainError::NotFound)?;

+        // For userless ceremonies the assertion carries a user handle that
+        // identifies the user; load that user's credentials so the signature
+        // can be verified against the correct key.
+        if let Some(user_handle) = response.get_user_handle() {
+            let handle = user_handle.to_vec();
+            let users = Arc::clone(&self.users);
+            let db = self.db.clone();
+            let user_id = db
+                .run(move |txn| {
+                    let users = users.clone();
+                    Box::pin(async move {
+                        let user = users
+                            .find_user_by_handle(txn, handle)
+                            .await?
+                            .ok_or(DomainError::NotFound)?;
+                        Ok(user.id)
+                    })
+                })
+                .await?;
+            let passkeys = Arc::clone(&self.passkeys);
+            let credentials: Vec<Credential> = db
+                .run(move |txn| {
+                    let passkeys = passkeys.clone();
+                    Box::pin(async move {
+                        let rows = passkeys.list_for_user(txn, user_id).await?;
+                        let mut creds = Vec::new();
+                        for row in rows {
+                            let cred: Credential = serde_json::from_str(&row.credential)
+                                .map_err(|e| DomainError::Database(e.to_string()))?;
+                            creds.push(cred);
+                        }
+                        Ok(creds)
+                    })
+                })
+                .await?;
+            state.set_allowed_credentials(credentials);
+        }
+
        let (cred_id, auth_data) = self
            .webauthn
            .authenticate_credential(&response, &state)
@@ -189,28 +277,30 @@ impl WebAuthnService {
        let passkeys = Arc::clone(&self.passkeys);
        let db = self.db.clone();
        let credential_id_b64 = base64_url(cred_id);
-        db.run(move |txn| {
-            let passkeys = passkeys.clone();
-            Box::pin(async move {
-                let stored = passkeys
-                    .find_by_credential_id(txn, credential_id_b64)
-                    .await?
-                    .ok_or(DomainError::NotFound)?;
-                let mut cred: Credential = serde_json::from_str(&stored.credential)
-                    .map_err(|e| DomainError::Database(e.to_string()))?;
-                cred.counter = auth_data.counter;
-                let serialized = serde_json::to_string(&cred)
-                    .map_err(|e| DomainError::Database(e.to_string()))?;
-                sqlx::query("UPDATE passkeys SET credential = ?1 WHERE id = ?2")
-                    .bind(&serialized)
-                    .bind(stored.id)
-                    .execute(&mut *txn)
-                    .await
-                    .map_err(db_error)?;
-                Ok(())
+        let user_id = db
+            .run(move |txn| {
+                let passkeys = passkeys.clone();
+                Box::pin(async move {
+                    let stored = passkeys
+                        .find_by_credential_id(txn, credential_id_b64)
+                        .await?
+                        .ok_or(DomainError::NotFound)?;
+                    let mut cred: Credential = serde_json::from_str(&stored.credential)
+                        .map_err(|e| DomainError::Database(e.to_string()))?;
+                    cred.counter = auth_data.counter;
+                    let serialized = serde_json::to_string(&cred)
+                        .map_err(|e| DomainError::Database(e.to_string()))?;
+                    sqlx::query("UPDATE passkeys SET credential = ?1 WHERE id = ?2")
+                        .bind(&serialized)
+                        .bind(stored.id)
+                        .execute(&mut *txn)
+                        .await
+                        .map_err(db_error)?;
+                    Ok(stored.user_id)
+                })
            })
-        })
-        .await
+            .await?;
+        Ok(user_id)
    }

    /// List the passkeys registered to a user.
@@ -234,27 +324,6 @@ impl WebAuthnService {
            })
            .await
    }
-
-    /// Resolve the user id that owns the credential in an assertion response.
-    pub async fn resolve_user_id_for_assertion(
-        &self,
-        response: &PublicKeyCredential,
-    ) -> DomainResult<i64> {
-        let passkeys = Arc::clone(&self.passkeys);
-        let db = self.db.clone();
-        let credential_id_b64 = base64_url(&response.raw_id.0);
-        db.run(move |txn| {
-            let passkeys = passkeys.clone();
-            Box::pin(async move {
-                let stored = passkeys
-                    .find_by_credential_id(txn, credential_id_b64)
-                    .await?
-                    .ok_or(DomainError::NotFound)?;
-                Ok(stored.user_id)
-            })
-        })
-        .await
-    }
 }

 fn base64_url(bytes: &[u8]) -> String {
@@ -6,31 +6,27 @@ function b64ToBytes(b64) {
 }

 document.getElementById("passkey-login").addEventListener("click", async () => {
-  const email = document.getElementById("email").value;
-  if (!email) {
-    alert("Enter your email first.");
-    return;
-  }
+  const email = document.getElementById("email").value.trim();
  const start = await fetch("/auth/passkey/login/start", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ email }),
  });
  if (!start.ok) {
-    alert("No passkey found for that email.");
+    alert("No passkey found for that account.");
    return;
  }
-  const options = await start.json();
-  const pk = options.publicKey;
+  const data = await start.json();
+  const pk = data.publicKey;
  pk.challenge = b64ToBytes(pk.challenge);
  if (pk.allowCredentials) {
    pk.allowCredentials.forEach((c) => (c.id = b64ToBytes(c.id)));
  }
-  const credential = await navigator.credentials.get(options);
+  const credential = await navigator.credentials.get({ publicKey: pk });
  const finish = await fetch("/auth/passkey/login/finish", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ response: credential }),
+    body: JSON.stringify({ token: data.token, response: credential }),
  });
  if (finish.ok) {
    window.location.href = "/lists";
@@ -0,0 +1,16 @@
+// Toggle password visibility so users can check for typos, especially on mobile.
+document.querySelectorAll(".password-toggle").forEach(function (button) {
+  button.addEventListener("pointerdown", function (event) {
+    // Toggle on press (not click) for an instant response. preventScroll avoids
+    // a scroll-to-input animation that makes rapid toggling feel laggy, and
+    // keeping focus on the input keeps the mobile keyboard open.
+    event.preventDefault();
+    var input = document.getElementById(button.getAttribute("data-toggle-for"));
+    if (!input) return;
+    var showing = input.type === "text";
+    input.type = showing ? "password" : "text";
+    button.textContent = showing ? "Show" : "Hide";
+    button.setAttribute("aria-label", showing ? "Show password" : "Hide password");
+    input.focus({ preventScroll: true });
+  });
+});
@@ -67,14 +67,25 @@ h3 { margin-bottom: 6px; font-size: 1rem; }
 .muted { color: var(--muted); }

 .page-heading { display: flex; justify-content: space-between; align-items: end; margin-bottom: 34px; }
+.page-heading h1.page-title { font-size: clamp(1.6rem, 3.2vw, 2.3rem); }
 .dashboard-grid { display: grid; grid-template-columns: minmax(0, 1.5fr) minmax(260px, .8fr); gap: 22px; align-items: start; }
 .panel { padding: 26px; border: 1px solid rgba(221, 225, 210, .9); border-radius: 24px; background: rgba(255, 253, 248, .88); box-shadow: var(--shadow); }
 .panel-heading { display: flex; justify-content: space-between; align-items: center; gap: 12px; margin-bottom: 22px; }
+.archive-link { margin-left: auto; color: var(--muted); font-size: .78rem; font-weight: 700; text-decoration: none; }
+.archive-link:hover { color: var(--deep-sage); }
 .count-badge { display: inline-grid; place-items: center; min-width: 27px; height: 27px; padding: 0 8px; border-radius: 99px; color: var(--deep-sage); background: #e8f0e1; font-size: .78rem; font-weight: 800; }
 .stack { display: grid; gap: 9px; }
 .stack label { color: var(--muted); font-size: .82rem; font-weight: 700; }
 input { width: 100%; min-height: 46px; padding: 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; }
 input:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
+.password-field { position: relative; }
+.password-field input { padding-right: 64px; }
+.password-toggle { position: absolute; top: 50%; right: 8px; transform: translateY(-50%); min-height: 32px; padding: 5px 10px; border: 0; border-radius: 9px; cursor: pointer; color: var(--deep-sage); background: #e7f0e1; font-weight: 800; font-size: .78rem; }
+.password-toggle:hover { background: #dbe9d2; }
+select { width: 100%; min-height: 46px; padding: 10px 34px 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; font: inherit; appearance: none; -webkit-appearance: none; background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16'><path d='M4 6l4 4 4-4' fill='none' stroke='%2355715d' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'/></svg>"); background-repeat: no-repeat; background-position: right 12px center; }
+select:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
+select option { color: var(--ink); background: #fff; }
+select option:checked { color: var(--deep-sage); font-weight: 700; }
 textarea { width: 100%; padding: 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; font: inherit; resize: vertical; }
 textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
 .button { display: inline-flex; align-items: center; justify-content: center; min-height: 44px; padding: 10px 17px; border: 0; border-radius: 12px; cursor: pointer; text-decoration: none; font-weight: 800; transition: transform .16s ease, box-shadow .16s ease, background .16s ease; }
@@ -91,12 +102,18 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .list-card-copy { display: grid; flex: 1; gap: 2px; }
 .list-card-copy small { color: var(--muted); font-size: .75rem; }
 .list-card-arrow { color: var(--muted); font-size: 1.25rem; }
+.archived-list-card { opacity: .72; }
+.archived-list-card .list-card-icon { color: var(--muted); background: #eef0ea; }
+.archived-list-card .list-card-copy { align-items: flex-start; }
+.archived-list-card form { margin-left: auto; }
+.archived-banner { margin-bottom: 18px; padding: 11px 14px; border: 1px solid var(--line); border-radius: 12px; color: var(--muted); background: #f1f3ec; font-size: .82rem; font-weight: 700; }
 .empty-state { padding: 35px 18px 24px; text-align: center; color: var(--muted); }
 .empty-mark { display: grid; place-items: center; width: 50px; height: 50px; margin: 0 auto 15px; border-radius: 18px; color: var(--deep-sage); background: #edf3e8; font-size: 1.8rem; }
 .empty-state h3 { color: var(--ink); }

 .auth-card { width: min(100%, 480px); margin: 7vh auto 0; padding: clamp(27px, 6vw, 54px); border: 1px solid var(--line); border-radius: 28px; background: rgba(255, 253, 248, .9); box-shadow: var(--shadow); }
 .auth-card .button { margin-top: 11px; }
+#passkey-login { width: 100%; }
 .auth-divider { display: flex; align-items: center; gap: 12px; margin: 20px 0 4px; color: var(--muted); font-size: .8rem; }
 .auth-divider::before, .auth-divider::after { content: ""; flex: 1; height: 1px; background: var(--line); }
 .passkey-list { display: grid; gap: 8px; margin-bottom: 16px; }
@@ -107,6 +124,7 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .auth-switch a { color: var(--deep-sage); font-weight: 800; }
 .alert { margin-bottom: 18px; padding: 12px 14px; border-radius: 12px; font-size: .9rem; }
 .alert-error { color: #874d40; background: #fbe7e0; }
+.alert-success { color: #3d6b4f; background: #e4f2e6; }

 .list-topbar { display: flex; justify-content: space-between; align-items: center; margin-bottom: 27px; }
 .back-link { color: var(--muted); font-size: .85rem; font-weight: 700; text-decoration: none; }
@@ -126,7 +144,8 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .list-heading { display: flex; justify-content: space-between; margin-bottom: 25px; }
 .list-heading h1 { max-width: 100%; margin-bottom: 5px; overflow-wrap: anywhere; font-size: clamp(1.45rem, 2.8vw, 2.05rem); }
 .list-meta { margin: 0; color: var(--muted); font-size: .85rem; }
-.add-item-form { display: grid; grid-template-columns: minmax(0, 1fr) 90px 145px auto; gap: 8px; margin-bottom: 19px; }
+.meal-category-label { margin-left: 10px; color: var(--muted); font-size: .8em; font-weight: 500; white-space: nowrap; }
+.add-item-form { display: grid; grid-template-columns: minmax(0, 1fr) 145px 90px auto; gap: 8px; margin-bottom: 19px; }
 .add-item-form input { min-height: 50px; }
 .add-item-form select { min-height: 50px; }
 .add-button { min-height: 50px; }
@@ -134,11 +153,14 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .item-list { display: grid; gap: 6px; }
 .category-group + .category-group { margin-top: 18px; }
 .category-heading { margin: 0 7px 4px; color: var(--deep-sage); font-size: .72rem; letter-spacing: .12em; text-transform: uppercase; }
+.ingredients-divider { margin: 26px 0 18px; border: 0; border-top: 1px solid var(--line); }
 .item-row { display: flex; align-items: center; gap: 12px; min-height: 66px; padding: 9px 7px 9px 10px; border-bottom: 1px solid #edf0e6; }
 .item-row:last-child { border-bottom: 0; }
 .check-form { flex: 0 0 auto; }
 .check-button { display: grid; place-items: center; width: 28px; height: 28px; padding: 0; border: 2px solid #c8d6c1; border-radius: 9px; color: #fff; background: transparent; cursor: pointer; font-size: .88rem; font-weight: 900; }
 .is-checked .check-button { border-color: var(--deep-sage); background: var(--deep-sage); }
+.check-button-static { cursor: default; }
+.is-checked .check-button-static { border-color: var(--deep-sage); background: var(--deep-sage); }
 .item-copy { display: grid; grid-template-columns: auto 1fr; flex: 1; min-width: 0; gap: 2px 7px; align-items: baseline; }
 .item-copy strong { grid-column: 2; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .item-qty { grid-column: 1; grid-row: 1; color: var(--muted); font-weight: 700; white-space: nowrap; }
@@ -207,6 +229,10 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .edit-form { margin-bottom: 12px; }
 .edit-form input { min-height: 38px; padding: 7px 10px; font-size: .85rem; }
 .danger-link { padding: 0; border: 0; color: var(--coral); background: none; cursor: pointer; font-size: .8rem; font-weight: 800; }
+.bordered-delete { padding: 7px 14px; border: 1px solid var(--coral); border-radius: 10px; background: none; }
+.bordered-delete:hover { background: #fbeae4; }
+.button-danger { width: 100%; color: var(--coral); background: #fbeae4; }
+.button-danger:hover { background: #f7ddd4; }
 .empty-items { padding: 34px 10px 18px; color: var(--muted); text-align: center; }
 .empty-items-icon { display: block; margin-bottom: 7px; color: var(--yellow); font-size: 1.7rem; }
 .empty-items p { margin-bottom: 2px; color: var(--ink); font-weight: 800; }
@@ -217,12 +243,28 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .category-form input { min-height: 38px; padding: 7px 10px; font-size: .84rem; }
 .category-list { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 14px; }
 .category-chip { padding: 5px 9px; border-radius: 99px; color: var(--deep-sage); background: #edf3e8; font-size: .72rem; font-weight: 800; }
+/* Meal categories side panel */
+.meal-category-list { display: grid; gap: 2px; margin-top: 14px; }
+.meal-category-row { display: flex; align-items: center; justify-content: space-between; gap: 8px; padding: 7px 4px; border-bottom: 1px solid #edf0e6; }
+.meal-category-row:last-child { border-bottom: 0; }
+.meal-category-name { font-size: .9rem; font-weight: 700; }
+.meal-category-delete { padding: 2px 6px; border: 0; border-radius: 7px; color: var(--muted); background: transparent; cursor: pointer; font-size: .8rem; line-height: 1; }
+.meal-category-delete:hover { color: var(--coral); background: #fbeae4; }
 .category-empty { margin: 13px 0 0; font-size: .8rem; }
 .category-result { margin-top: 10px; }
 .category-success { margin: 0; color: var(--deep-sage); font-size: .76rem; font-weight: 800; }
 .presence-list { display: grid; gap: 12px; }
 .presence-person { display: flex; align-items: center; gap: 10px; font-size: .9rem; font-weight: 700; }
 .avatar { display: grid; place-items: center; width: 32px; height: 32px; border-radius: 11px; color: var(--deep-sage); background: #e6f0df; font-size: .7rem; font-weight: 900; }
+.list-meals { display: grid; gap: 8px; }
+.list-meal-row { display: flex; align-items: center; gap: 10px; padding: 6px 4px; border-bottom: 1px solid #edf0e6; }
+.list-meal-row:last-child { border-bottom: 0; }
+.list-meal-icon { display: grid; place-items: center; flex: 0 0 auto; width: 30px; height: 30px; border-radius: 10px; color: var(--deep-sage); background: #eef4e9; font-size: .95rem; }
+.list-meal-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: .9rem; font-weight: 700; }
+.list-meal-remove { margin: 0; flex: 0 0 auto; }
+.list-meal-remove-button { padding: 2px 7px; border: 0; border-radius: 7px; color: var(--muted); background: transparent; cursor: pointer; font-size: .8rem; line-height: 1; }
+.list-meal-remove-button:hover { color: var(--coral); background: #fbeae4; }
+.list-meals-panel .add-meal-button { margin-top: 12px; width: 100%; }
 .sharing-panel p, .tip-panel p { color: var(--muted); font-size: .86rem; }
 .invite-result { margin-top: 15px; }
 .invite-link-result { padding: 11px; border-radius: 12px; background: #f1f5ec; }
Author	SHA1	Message	Date
sbstp	9267786371	cargo fmt ci/woodpecker/push/fmt Pipeline is pending Details ci/woodpecker/push/test Pipeline is pending Details ci/woodpecker/push/e2e Pipeline was canceled Details	2026-08-07 22:49:50 -04:00
sbstp	e24f4ff7e2	archived list count	2026-08-07 22:49:31 -04:00
sbstp	56cd6e32e9	hx boost + bug fix	2026-08-07 22:46:53 -04:00
sbstp	689bd95ff0	list archive ci/woodpecker/push/e2e Pipeline was successful Details ci/woodpecker/push/fmt Pipeline failed Details ci/woodpecker/push/test Pipeline was successful Details	2026-08-07 22:16:29 -04:00
sbstp	240d993d57	improve ux	2026-08-07 21:42:38 -04:00
sbstp	c2f6b07742	version 0.4.0 [skip ci] ci/woodpecker/tag/release Pipeline was successful Details	2026-08-04 00:06:03 -04:00
sbstp	863d43ef8c	record meals that were added to list, allow delete with ingredients ci/woodpecker/push/e2e Pipeline was successful Details ci/woodpecker/push/fmt Pipeline was successful Details ci/woodpecker/push/test Pipeline was successful Details	2026-08-04 00:01:23 -04:00
sbstp	dcd1203d31	fix width of passkey button ci/woodpecker/push/e2e Pipeline was successful Details ci/woodpecker/push/fmt Pipeline was successful Details ci/woodpecker/push/test Pipeline was successful Details	2026-08-03 22:36:40 -04:00
sbstp	5638fc4979	fmt & version 0.3.0 [skip ci] ci/woodpecker/tag/release Pipeline was successful Details	2026-08-03 21:35:40 -04:00
sbstp	3695fc68d6	meal categories ci/woodpecker/push/e2e Pipeline was successful Details ci/woodpecker/push/fmt Pipeline failed Details ci/woodpecker/push/test Pipeline was successful Details	2026-08-03 21:29:33 -04:00
sbstp	cf6853d71e	show/hide password button	2026-08-03 21:02:03 -04:00
sbstp	fdbf40adac	style updates	2026-08-03 14:58:10 -04:00
sbstp	a6482ddb0e	reset/update password ci/woodpecker/push/e2e Pipeline was successful Details ci/woodpecker/push/fmt Pipeline failed Details ci/woodpecker/push/test Pipeline was successful Details	2026-08-03 11:33:24 -04:00
sbstp	3160a898be	version 0.2.0 [skip ci] ci/woodpecker/tag/release Pipeline was successful Details	2026-08-03 00:24:54 -04:00
sbstp	209363774c	passwordless login + proper migrations ci/woodpecker/push/e2e Pipeline was successful Details ci/woodpecker/push/fmt Pipeline was successful Details ci/woodpecker/push/test Pipeline was successful Details	2026-08-03 00:23:10 -04:00
sbstp	1291c5a33a	embed assets and version 0.1.2 ci/woodpecker/push/e2e Pipeline was successful Details ci/woodpecker/push/fmt Pipeline was successful Details ci/woodpecker/push/test Pipeline was successful Details ci/woodpecker/tag/release Pipeline was successful Details	2026-08-02 21:28:54 -04:00
				`@@ -0,0 +1 @@`
				`ALTER TABLE lists ADD COLUMN archived_at INTEGER;`