version 0.8.0 [skip ci]

.woodpecker/e2e.yml

@@ -1,17 +0,0 @@
-when:
-  event: [push, pull_request]
-
-steps:
-  e2e-build:
-    image: rust:1
-    commands:
-      - cargo build
-
-  e2e-test:
-    image: node:24
-    directory: e2e
-    commands:
-      - apt-get update
-      - apt-get install -y --no-install-recommends ca-certificates fonts-liberation libasound2 libatk-bridge2.0-0 libatk1.0-0 libcups2 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0 libgtk-3-0 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 xdg-utils
-      - npm install && npx playwright install chromium
-      - npx playwright test

.woodpecker/test.yml

@@ -6,3 +6,13 @@ steps:
     image: rust:1
     commands:
       - cargo test --all
+      - cargo build --all
+
+  e2e-test:
+    image: node:24
+    directory: e2e
+    commands:
+      - apt-get update
+      - apt-get install -y --no-install-recommends ca-certificates fonts-liberation libasound2 libatk-bridge2.0-0 libatk1.0-0 libcups2 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0 libgtk-3-0 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 xdg-utils
+      - npm install && npx playwright install chromium
+      - npx playwright test

Cargo.lock

@@ -116,6 +116,12 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "barcoders"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3826fb6e98ec72c0c0db8c9a40af4932d16793021027469857e84c1b50a1e8f"
+
 [[package]]
 name = "base64"
 version = "0.13.1"
@@ -1772,11 +1778,12 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "sustenance"
-version = "0.4.0"
+version = "0.8.0"
 dependencies = [
  "argon2",
  "async-trait",
  "axum",
+ "barcoders",
  "base64 0.22.1",
  "futures-util",
  "hex",

Cargo.toml

@@ -1,12 +1,13 @@
 [package]
 name = "sustenance"
-version = "0.4.0"
+version = "0.8.0"
 edition = "2024"
 
 [dependencies]
 argon2 = "0.5"
 async-trait = "0.1"
 axum = { version = "0.8", features = ["ws"] }
+barcoders = { version = "2.0.0", features = ["svg"] }
 base64 = "0.22"
 futures-util = "0.3"
 hex = "0.4"

README.md

@@ -57,6 +57,8 @@ The file is optional — if it is missing or invalid, seeding is silently skippe
 - Global categories with common defaults seeded at startup and custom category creation
 - Items grouped by category and assigned from the add/edit forms
 - Meals with ingredients, markdown descriptions, and one-click "add meal to list"
+- Rewards cards with store name and number, rendered as scannable Code 128 / Code 39 barcodes
+- Single-card scan view that shows one barcode at a time and keeps the screen awake for scanning
 - Server-authoritative last-write-wins updates
 - Per-list WebSocket updates with server-rendered htmx fragments
 - In-memory presence for members currently viewing a list

e2e/fixtures.ts

@@ -1,13 +1,12 @@
 import { test as base, expect, Page } from "@playwright/test";
 import { spawn, ChildProcess } from "child_process";
-import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 
 /**
- * Starts a fresh Sustenance server against a unique, throwaway database on a
- * unique port for each test, and tears it down afterwards. This gives every
- * test a clean DB with no shared state between tests.
+ * Starts a fresh Sustenance server against an in-memory SQLite database on a
+ * unique port for each test, and tears it down afterwards. Every test gets a
+ * clean DB with no shared state between tests, and nothing is written to disk.
  */
 export const test = base.extend<{ server: { baseURL: string }; page: Page }>({
   server: [
@@ -15,10 +14,6 @@ export const test = base.extend<{ server: { baseURL: string }; page: Page }>({
       const server = await startServer();
       await use({ baseURL: server.baseURL });
       await killTree(server.child);
-      // Clean up the DB files (including -wal / -shm).
-      for (const suffix of ["", "-wal", "-shm"]) {
-        fs.rmSync(server.dbPath + suffix, { force: true });
-      }
     },
     { scope: "test", auto: true },
   ],
@@ -35,12 +30,6 @@ export const test = base.extend<{ server: { baseURL: string }; page: Page }>({
 /** Starts a server, retrying on a fresh port if the first attempt fails to bind. */
 async function startServer() {
   for (let attempt = 0; attempt < 5; attempt++) {
-    const dbPath = path.join(
-      os.tmpdir(),
-      `sustenance-e2e-${process.pid}-${Date.now()}-${Math.random()
-        .toString(36)
-        .slice(2)}.db`,
-    );
     const port = 20000 + Math.floor(Math.random() * 30000);
     const baseURL = `http://localhost:${port}`;
 
@@ -50,7 +39,7 @@ async function startServer() {
       {
         env: {
           ...process.env,
-          DATABASE_PATH: dbPath,
+          DATABASE_IN_MEMORY: "1",
           REGISTRATION_MODE: "open",
           BIND_ADDRESS: `127.0.0.1:${port}`,
           PUBLIC_BASE_URL: baseURL,
@@ -72,13 +61,10 @@ async function startServer() {
 
     try {
       await waitForServer(baseURL, child);
-      return { baseURL, child, dbPath };
+      return { baseURL, child };
     } catch (error) {
       // The server may have failed to bind (port collision). Clean up and retry.
       await killTree(child);
-      for (const suffix of ["", "-wal", "-shm"]) {
-        fs.rmSync(dbPath + suffix, { force: true });
-      }
       if (attempt === 4) {
         throw new Error(
           `server failed to start after retries; last stderr:\n${stderr}\n${error}`,

e2e/helpers.ts

@@ -46,12 +46,23 @@ export async function addItem(page: Page, name: string, quantity = "") {
 }
 
 /** Adds an ingredient to the current meal page. */
-export async function addIngredient(page: Page, name: string, quantity = "") {
+export async function addIngredient(
+  page: Page,
+  name: string,
+  quantity = "",
+  category?: string,
+) {
   await page.fill("#ingredient-name", name);
+  if (category) {
+    await page.selectOption("#ingredient-category", { label: category });
+  }
   if (quantity) {
     await page.fill("#ingredient-quantity", quantity);
   }
   await page.click("#add-ingredient-button");
+  // The form submit is hx-boosted (full body swap to the same URL), so wait for
+  // the new row to appear. This also acts as a settle point so the next action
+  // doesn't race the async body replacement and target a stale form.
   await expect(page.locator(".ingredient-list").filter({ hasText: name })).toBeVisible();
 }
 

e2e/tests/carry-over.spec.ts

@@ -0,0 +1,134 @@
+import { expect } from "@playwright/test";
+import { test } from "../fixtures";
+import { registerAndLogin, createList, createMealWithIngredients } from "../helpers";
+
+/**
+ * Opens the carry-over modal and waits for htmx to finish swapping it in, so
+ * the source `<select>`'s `change` trigger is bound before interacting with it.
+ */
+async function openCarryModal(page: import("@playwright/test").Page) {
+  await page.click(".carry-over-button");
+  const carry = page.locator(".meal-picker-backdrop");
+  await expect(carry).toBeVisible();
+  // Let htmx finish processing the freshly-swapped modal before selecting a
+  // source; otherwise the change event can be missed and no hx-get fires.
+  await page.waitForTimeout(300);
+  return carry;
+}
+
+test("a user can carry meals over from a previous list without re-adding ingredients", async ({
+  page,
+}) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMealWithIngredients(page, "Spaghetti Bolognese", [
+    { name: "Penne", quantity: "500g" },
+    { name: "Tomato", quantity: "2" },
+  ]);
+
+  // Last week's list has the meal added (with its ingredients as items).
+  await createList(page, "Last week");
+  await page.click(".add-meal-button");
+  const picker = page.locator(".meal-picker-backdrop");
+  await picker
+    .locator(".meal-picker-button")
+    .filter({ hasText: "Spaghetti Bolognese" })
+    .click();
+  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
+
+  // Create this week's (new) list.
+  await createList(page, "This week");
+  await expect(page.locator(".item-row")).toHaveCount(0);
+
+  // Open the carry-over modal and pick the source list.
+  const carry = await openCarryModal(page);
+  await expect(carry.locator(".carry-intro")).toContainText("already purchased");
+  await carry.locator("#carry-source").selectOption({ label: "Last week" });
+
+  // The source list's meals appear as selectable rows.
+  const row = carry.locator(".carry-row").filter({ hasText: "Spaghetti Bolognese" });
+  await expect(row).toBeVisible();
+
+  // Select the meal and finish.
+  await row.locator('input[type="checkbox"]').check();
+  await carry.locator(".carry-submit").click();
+
+  // The modal closes, the meal appears in the meals panel, but no items are added.
+  await expect(carry).toHaveCount(0);
+  const panel = page.locator("#list-meals-panel");
+  await expect(panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
+  await expect(page.locator(".item-row")).toHaveCount(0);
+});
+
+test("the carry-over modal lists active lists newest first and excludes the current list", async ({
+  page,
+}) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createList(page, "First list");
+  await createList(page, "Second list");
+
+  // Open carry-over on the second (current) list.
+  await page.click(".carry-over-button");
+  const carry = page.locator(".meal-picker-backdrop");
+  await expect(carry).toBeVisible();
+
+  const options = carry.locator("#carry-source option");
+  // The current list is excluded; only the other list remains.
+  await expect(options).toHaveCount(2); // placeholder + one source
+  await expect(carry.locator("#carry-source")).toContainText("First list");
+  await expect(carry.locator("#carry-source")).not.toContainText("Second list");
+});
+
+test("carrying a meal does not remove it from the source list", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMealWithIngredients(page, "Pasta", [{ name: "Penne" }]);
+  await createList(page, "Last week");
+  await page.click(".add-meal-button");
+  await page
+    .locator(".meal-picker-backdrop .meal-picker-button")
+    .filter({ hasText: "Pasta" })
+    .click();
+  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
+
+  await createList(page, "This week");
+  const carry = await openCarryModal(page);
+
+  // Select the source list; the meal rows load via hx-get.
+  await carry.locator("#carry-source").selectOption({ label: "Last week" });
+  const row = carry.locator(".carry-row").filter({ hasText: "Pasta" });
+  await expect(row).toBeVisible({ timeout: 10_000 });
+  await row.locator('input[type="checkbox"]').check();
+  await carry.locator(".carry-submit").click();
+  await expect(carry).toHaveCount(0);
+
+  // The source list still has its meal and items.
+  await page.goto("/lists");
+  await page.locator(".list-card").filter({ hasText: "Last week" }).click();
+  await expect(page.locator("#list-meals-panel .list-meal-row").filter({ hasText: "Pasta" })).toBeVisible();
+  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
+});
+
+test("submitting carry-over with no selection does not add a meal", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMealWithIngredients(page, "Pasta", [{ name: "Penne" }]);
+  await createList(page, "Last week");
+  await page.click(".add-meal-button");
+  await page
+    .locator(".meal-picker-backdrop .meal-picker-button")
+    .filter({ hasText: "Pasta" })
+    .click();
+  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
+
+  await createList(page, "This week");
+  const carry = await openCarryModal(page);
+
+  // Select the source list; the meal rows load via hx-get.
+  await carry.locator("#carry-source").selectOption({ label: "Last week" });
+  await expect(carry.locator(".carry-row").filter({ hasText: "Pasta" })).toBeVisible({
+    timeout: 10_000,
+  });
+
+  // Submit with nothing selected; the modal stays open and no meal is carried.
+  await carry.locator(".carry-submit").click();
+  await expect(carry).toBeVisible();
+  await expect(page.locator("#list-meals-panel .list-meal-row")).toHaveCount(0);
+});

e2e/tests/meal-filter.spec.ts

@@ -0,0 +1,57 @@
+import { expect } from "@playwright/test";
+import { test } from "../fixtures";
+import { registerAndLogin, createList, createMeal } from "../helpers";
+
+test("the meals page filters by name as you type", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMeal(page, "Spaghetti Bolognese", "");
+  await createMeal(page, "Chicken Curry", "");
+  await createMeal(page, "Pancakes", "");
+
+  await page.goto("/meals");
+  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
+  await expect(page.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
+  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
+
+  // Type a query; only matching meals remain.
+  await page.fill("#meal-search", "chicken");
+  await expect(page.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
+  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
+  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toHaveCount(0);
+
+  // Clearing the search restores all meals.
+  await page.fill("#meal-search", "");
+  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
+  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
+});
+
+test("the meals page shows an empty state when nothing matches", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMeal(page, "Spaghetti Bolognese", "");
+
+  await page.goto("/meals");
+  await page.fill("#meal-search", "zzzz");
+  await expect(page.locator(".meal-filter-empty")).toBeVisible();
+  await expect(page.locator(".list-card")).toHaveCount(0);
+});
+
+test("the add-meal picker filters meals as you type", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await createMeal(page, "Spaghetti Bolognese", "");
+  await createMeal(page, "Chicken Curry", "");
+  await createList(page, "Weekly shop");
+
+  await page.click(".add-meal-button");
+  const picker = page.locator(".meal-picker-backdrop");
+  await expect(picker).toBeVisible();
+  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
+  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
+
+  await picker.locator(".meal-filter").fill("curry");
+  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
+  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
+
+  // The search box keeps focus and the modal stays open.
+  await expect(picker.locator(".meal-filter")).toBeFocused();
+  await expect(picker).toBeVisible();
+});

e2e/tests/meals.spec.ts

@@ -77,9 +77,7 @@ test("ingredients are grouped under their categories", async ({ page }) => {
   await createMeal(page, "Spaghetti Bolognese", "");
 
   // Add an ingredient in the default "Produce" category.
-  await page.fill("#ingredient-name", "Tomato");
-  await page.selectOption("#ingredient-category", { label: "Produce" });
-  await page.click("#add-ingredient-button");
+  await addIngredient(page, "Tomato", "", "Produce");
 
   // Add one without a category.
   await addIngredient(page, "Penne");

e2e/tests/rewards.spec.ts

@@ -0,0 +1,169 @@
+import { expect } from "@playwright/test";
+import { test } from "../fixtures";
+import { registerAndLogin } from "../helpers";
+
+/** Navigates to the rewards cards page. */
+async function gotoRewards(page: import("@playwright/test").Page) {
+  await page.goto("/rewards");
+  await expect(page.locator("h1")).toContainText("Rewards cards");
+}
+
+/**
+ * Adds a rewards card and lands back on the /rewards page with it rendered.
+ */
+async function addCard(
+  page: import("@playwright/test").Page,
+  storeName: string,
+  number: string,
+  symbology?: string,
+) {
+  await page.fill("#store-name", storeName);
+  await page.fill("#card-number", number);
+  if (symbology) {
+    await page.selectOption("#symbology", symbology);
+  }
+  await page.click('button:has-text("Add card")');
+  await expect(page).toHaveURL(/\/rewards$/);
+  const card = page.locator(".rewards-card").filter({ hasText: storeName });
+  await expect(card).toBeVisible();
+  return card;
+}
+
+test("the rewards page shows an empty state before any cards are added", async ({
+  page,
+}) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+  await expect(page.locator(".empty-state")).toContainText("No rewards cards yet");
+  await expect(page.locator(".rewards-card")).toHaveCount(0);
+});
+
+test("the Rewards link is available in the site navigation", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  const nav = page.locator(".site-nav");
+  await expect(nav.locator('a[href="/rewards"]')).toHaveText("Rewards");
+});
+
+test("a user can add a rewards card and see its barcode", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+
+  const card = await addCard(page, "Kroger", "606171584511340224537");
+
+  // The card renders an inline SVG barcode and the store's card number.
+  await expect(card.locator(".rewards-barcode svg")).toBeVisible();
+  await expect(card.locator(".rewards-number")).toHaveText("606171584511340224537");
+
+  // The barcode should be included via the embedded SVG (Code 128 set B→C mix),
+  // not rendered client-side from scratch by an image.
+  const svg = card.locator(".rewards-barcode svg");
+  await expect(svg).toHaveAttribute("viewBox", /\d+ \d+/);
+});
+
+test("a user can add a card as Code 39 and see its barcode", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+
+  const card = await addCard(page, "Safeway", "ABC123", "code39");
+  await expect(card.locator(".rewards-barcode svg")).toBeVisible();
+});
+
+test("multiple rewards cards are each rendered with their own barcode", async ({
+  page,
+}) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+
+  await addCard(page, "Kroger", "606171584511340224537");
+  await addCard(page, "Safeway", "012345678901");
+
+  await expect(page.locator(".rewards-card")).toHaveCount(2);
+  await expect(page.locator(".rewards-card").filter({ hasText: "Kroger" })).toBeVisible();
+  await expect(page.locator(".rewards-card").filter({ hasText: "Safeway" })).toBeVisible();
+});
+
+test("removing a rewards card prompts for confirmation and deletes on accept", async ({
+  page,
+}) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+  await addCard(page, "Kroger", "606171584511340224537");
+
+  await expect(page).toHaveURL(/\/rewards$/);
+  await expect(page.locator(".rewards-card")).toHaveCount(1);
+
+  page.on("dialog", (dialog) => dialog.accept());
+  await page.click('button:has-text("Remove")');
+
+  // The card is deleted and the empty state returns.
+  await expect(page.locator(".rewards-card")).toHaveCount(0);
+  await expect(page.locator(".empty-state")).toContainText("No rewards cards yet");
+});
+
+test("cancelling the remove confirmation keeps the rewards card", async ({
+  page,
+}) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+  await addCard(page, "Kroger", "606171584511340224537");
+
+  await expect(page.locator(".rewards-card")).toHaveCount(1);
+
+  page.on("dialog", (dialog) => dialog.dismiss());
+  await page.click('button:has-text("Remove")');
+
+  // The card must remain after cancelling.
+  await expect(page.locator(".rewards-card")).toHaveCount(1);
+  await expect(page.locator(".rewards-card").filter({ hasText: "Kroger" })).toBeVisible();
+});
+
+test("a user can open a single-card scan view with only one barcode", async ({
+  page,
+}) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+  await addCard(page, "Kroger", "606171584511340224537");
+  await addCard(page, "Safeway", "012345678901");
+
+  // Click the Kroger card's barcode to open its focused scan view.
+  await page
+    .locator(".rewards-card")
+    .filter({ hasText: "Kroger" })
+    .locator(".rewards-card-link")
+    .click();
+
+  await expect(page).toHaveURL(/\/rewards\/\d+/);
+  // Only one barcode is rendered on the scan page.
+  await expect(page.locator(".scan-barcode svg")).toHaveCount(1);
+  await expect(page.locator(".scan-store")).toHaveText("Kroger");
+  await expect(page.locator(".scan-card .rewards-number")).toHaveText(
+    "606171584511340224537",
+  );
+  // The wake-lock script is loaded on the scan page.
+  await expect(page.locator('script[src*="rewards.js"]')).toHaveCount(1);
+
+  // Back link returns to the list.
+  await page.click('.scan-back');
+  await expect(page).toHaveURL(/\/rewards$/);
+});
+
+test("a scan view for another user's card is not accessible", async ({ page }) => {
+  await registerAndLogin(page, "alice@example.com");
+  await gotoRewards(page);
+  await addCard(page, "Kroger", "606171584511340224537");
+
+  // Grab the card id from the URL of the scan view.
+  await page
+    .locator(".rewards-card-link")
+    .click();
+  const url = page.url();
+  const cardId = url.split("/").pop();
+
+  // Sign out and sign in as a different user.
+  await page.click('button:has-text("Sign out")');
+  await registerAndLogin(page, "bob@example.com");
+
+  // Bob cannot view Alice's card.
+  await page.goto(`/rewards/${cardId}`);
+  await expect(page.locator(".scan-barcode svg")).toHaveCount(0);
+});

e2e/tests/websocket.spec.ts

@@ -20,12 +20,25 @@ test("a list updates live for another user via websocket", async ({ page, browse
   // Give the websocket connections a moment to establish.
   await page.waitForTimeout(500);
 
+  // Both start with an empty list.
+  await expect(pageB.locator("#list-meta")).toHaveText("0 items left out of 0");
+
   // User A adds an item.
   await addItem(page, "Apple", "2");
 
   // It should appear on User B's page without any reload.
   await expect(pageB.locator(".item-row").filter({ hasText: "Apple" })).toBeVisible();
   await expect(pageB.locator(".item-row").filter({ hasText: "Apple" }).locator(".item-qty")).toHaveText("(2)");
+  // The left/total count should also update live for User B.
+  await expect(pageB.locator("#list-meta")).toHaveText("1 items left out of 1");
+
+  // User A removes the item.
+  await page.locator(".item-actions-button").first().click();
+  await page.locator("[id^='item-edit-delete']").click();
+
+  // The item and the count should update live on User B's page.
+  await expect(pageB.locator(".item-row").filter({ hasText: "Apple" })).toHaveCount(0);
+  await expect(pageB.locator("#list-meta")).toHaveText("0 items left out of 0");
 
   await contextB.close();
 });

justfile

@@ -0,0 +1,39 @@
+# Set the Cargo.toml version, commit it, and tag the commit with that version.
+# Usage: just tag 1.2.3
+tag ver:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    # Validate the version argument.
+    if [[ ! "{{ver}}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+        echo "error: version must be in the form X.Y.Z (got '{{ver}}')" >&2
+        exit 1
+    fi
+
+    # Bump the version in Cargo.toml.
+    sed -i -E "s/^version = \".*\"/version = \"{{ver}}\"/" Cargo.toml
+
+    # Regenerate Cargo.lock so it reflects the new version.
+    cargo build
+
+    # Stage, commit, and tag.
+    git add Cargo.toml Cargo.lock
+    git commit -m "version {{ver}} [skip ci]"
+    git tag "{{ver}}"
+    git push
+    git push --tags
+
+# Run the Rust unit tests.
+# Usage: just test
+test:
+    cargo test --all
+
+# Format the Rust code.
+# Usage: just fmt
+fmt:
+    cargo fmt --all
+
+# Run the end-to-end Playwright tests.
+# Usage: just e2e
+e2e:
+    cd e2e && npm test

migrations/20240105000000_rewards_cards.sql

@@ -0,0 +1,10 @@
+CREATE TABLE rewards_cards (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    store_name TEXT NOT NULL,
+    number TEXT NOT NULL,
+    symbology TEXT NOT NULL DEFAULT 'code128',
+    created_at INTEGER NOT NULL
+);
+
+CREATE INDEX rewards_cards_user_idx ON rewards_cards(user_id);

src/assets.rs

@@ -0,0 +1,85 @@
+use std::collections::HashMap;
+use std::sync::LazyLock;
+
+use sha2::{Digest, Sha256};
+
+/// A single static asset: its embedded bytes and a content hash used to
+/// version its URL.
+pub struct StaticAsset {
+    pub data: &'static [u8],
+    pub hash: String,
+}
+
+/// A registry of the app's static assets, keyed by filename. Each asset's
+/// content hash is computed once on first use and cached, so the versioned URL
+/// changes automatically whenever the underlying file changes.
+pub struct StaticAssetStore {
+    assets: HashMap<&'static str, StaticAsset>,
+}
+
+impl StaticAssetStore {
+    fn new(entries: &[(&'static str, &'static [u8])]) -> Self {
+        let assets = entries
+            .iter()
+            .map(|(name, data)| {
+                let hash = content_hash(data);
+                (*name, StaticAsset { data, hash })
+            })
+            .collect();
+        Self { assets }
+    }
+
+    /// Looks up an asset by its filename (e.g. `"style.css"`).
+    pub fn get(&self, name: &str) -> Option<&StaticAsset> {
+        self.assets.get(name)
+    }
+
+    /// Returns the versioned URL for an asset, e.g. `/static/style.css?v=<hash>`.
+    pub fn url(&self, name: &str) -> Option<String> {
+        self.assets
+            .get(name)
+            .map(|asset| format!("/static/{name}?v={}", asset.hash))
+    }
+}
+
+fn content_hash(data: &[u8]) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(data);
+    hex::encode(hasher.finalize())
+}
+
+/// Constructs a `StaticAssetStore` from `name => path` pairs, embedding each
+/// file's bytes at compile time via `include_bytes!`.
+macro_rules! static_assets {
+    ($($name:literal => $path:literal),* $(,)?) => {
+        StaticAssetStore::new(&[
+            $(($name, include_bytes!($path))),*
+        ])
+    };
+}
+
+/// The app's static assets, loaded once on first use.
+pub static STORE: LazyLock<StaticAssetStore> = LazyLock::new(|| {
+    static_assets! {
+        "style.css" => "../static/style.css",
+        "passkey-login.js" => "../static/passkey-login.js",
+        "passkey-register.js" => "../static/passkey-register.js",
+        "password-toggle.js" => "../static/password-toggle.js",
+        "rewards.js" => "../static/rewards.js",
+        "htmx.min.js" => "../static/htmx.min.js",
+        "idiomorph-ext.min.js" => "../static/idiomorph-ext.min.js",
+        "htmx-ws.min.js" => "../static/htmx-ws.min.js",
+        "favicon.ico" => "../static/favicon.ico",
+        "favicon-32x32.png" => "../static/favicon-32x32.png",
+        "apple-touch-icon.png" => "../static/apple-touch-icon.png",
+        "logo.svg" => "../static/logo.svg",
+    }
+});
+
+/// Returns the versioned URL for a known asset, panicking if the name isn't
+/// registered (a programmer error, since these are compile-time constants).
+pub fn url(name: &str) -> String {
+    STORE
+        .url(name)
+        .unwrap_or_else(|| panic!("unknown static asset: {name}"))
+}

src/domain.rs

@@ -113,3 +113,19 @@ pub struct PresenceUser {
     pub user_id: i64,
     pub display_name: String,
 }
+
+/// A stored rewards-card number that can be shown as a scannable barcode.
+#[derive(Clone, Debug)]
+pub struct RewardsCard {
+    pub id: i64,
+    /// The owner of this card.
+    #[allow(dead_code)]
+    pub user_id: i64,
+    pub store_name: String,
+    pub number: String,
+    /// Symbology used to render the barcode (e.g. "code128", "code39").
+    pub symbology: String,
+    /// When the card was added.
+    #[allow(dead_code)]
+    pub created_at: i64,
+}

src/http.rs

@@ -20,25 +20,22 @@ use thiserror::Error;
 use tower_http::trace::{DefaultMakeSpan, DefaultOnResponse, TraceLayer};
 use tracing::{Level, error, warn};
 
+use crate::assets;
 use crate::domain::{DomainError, SessionUser};
 use crate::ports::{HubEvent, RealtimeNotifier};
-use crate::services::{AuthService, InvitationService, ListService, MealService};
+use crate::services::{
+    AuthService, InvitationService, ListService, MealService, RewardsCardService,
+};
 use crate::views;
 use crate::webauthn::WebAuthnService;
 
-/// The contents of `static/`, embedded into the binary at compile time so the
-/// app can be shipped as a single executable without a separate static directory.
-const STYLE_CSS: &[u8] = include_bytes!("../static/style.css");
-const PASSKEY_LOGIN_JS: &[u8] = include_bytes!("../static/passkey-login.js");
-const PASSKEY_REGISTER_JS: &[u8] = include_bytes!("../static/passkey-register.js");
-const PASSWORD_TOGGLE_JS: &[u8] = include_bytes!("../static/password-toggle.js");
-
 #[derive(Clone)]
 pub struct AppState {
     pub auth: Arc<AuthService>,
     pub lists: Arc<ListService>,
     pub meals: Arc<MealService>,
     pub invitations: Arc<InvitationService>,
+    pub rewards_cards: Arc<RewardsCardService>,
     pub webauthn: Arc<WebAuthnService>,
     pub realtime: Arc<dyn RealtimeNotifier>,
     pub cookie_secure: bool,
@@ -136,6 +133,14 @@ pub fn build_router(state: AppState) -> Router {
             "/lists/{list_id}/meals/{list_meal_id}/remove",
             post(remove_meal_from_list),
         )
+        .route(
+            "/lists/{list_id}/carry",
+            get(carry_over_modal).post(carry_meals),
+        )
+        .route("/lists/{list_id}/carry/meals", get(carry_source_meals))
+        .route("/rewards", get(rewards_page).post(create_rewards_card))
+        .route("/rewards/{card_id}", get(rewards_scan_page))
+        .route("/rewards/{card_id}/delete", post(delete_rewards_card))
         .route("/lists/{list_id}/stream", get(list_stream))
         .route("/invite/{token}", get(invitation_page))
         .route("/invite/{token}/accept", post(accept_invitation))
@@ -267,6 +272,14 @@ struct CategoryForm {
     csrf: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct RewardsCardForm {
+    store_name: String,
+    number: String,
+    symbology: String,
+    csrf: String,
+}
+
 #[derive(Debug, Deserialize)]
 struct PasskeyRegisterStartForm {
     csrf: String,
@@ -330,9 +343,25 @@ struct AddMealForm {
     csrf: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct CarrySourceQuery {
+    source: i64,
+}
+
+#[derive(Debug, Deserialize)]
+struct CarryMealsForm {
+    source_list_id: i64,
+    /// Selected list_meal ids as a comma-separated string, since the form
+    /// extractor does not coalesce repeated keys into a Vec.
+    #[serde(default)]
+    list_meal_ids: String,
+    csrf: String,
+}
+
 #[derive(Debug, Deserialize)]
 struct MealPickerQuery {
     picker: Option<i64>,
+    q: Option<String>,
 }
 
 async fn home() -> Redirect {
@@ -340,15 +369,27 @@ async fn home() -> Redirect {
 }
 
 /// Serves a file embedded in the binary from the `static/` folder.
+///
+/// Every asset is served with an immutable, long-lived cache header. Because
+/// the HTML references each asset under a URL that is versioned by its content
+/// hash, a changed file gets a new URL and the cache is never stale.
 async fn static_asset(Path(path): Path<String>) -> Response {
-    let (mime, data) = match path.as_str() {
-        "style.css" => ("text/css", STYLE_CSS),
-        "passkey-login.js" => ("application/javascript", PASSKEY_LOGIN_JS),
-        "passkey-register.js" => ("application/javascript", PASSKEY_REGISTER_JS),
-        "password-toggle.js" => ("application/javascript", PASSWORD_TOGGLE_JS),
-        _ => return StatusCode::NOT_FOUND.into_response(),
+    let Some(asset) = assets::STORE.get(&path) else {
+        return StatusCode::NOT_FOUND.into_response();
     };
-    ([(header::CONTENT_TYPE, mime)], data).into_response()
+    let mime = match path.rsplit('.').next() {
+        Some("css") => "text/css",
+        Some("ico") => "image/x-icon",
+        Some("png") => "image/png",
+        Some("svg") => "image/svg+xml",
+        _ => "application/javascript",
+    };
+    let mut response = ([(header::CONTENT_TYPE, mime)], asset.data).into_response();
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static("public, max-age=31536000, immutable"),
+    );
+    response
 }
 
 async fn log_response_status(request: Request, next: Next) -> Response {
@@ -813,19 +854,131 @@ async fn delete_meal_category(
     Ok(Redirect::to("/meals").into_response())
 }
 
+async fn rewards_page(
+    State(state): State<AppState>,
+    user: CurrentUser,
+) -> Result<Response, AppError> {
+    let cards = state.rewards_cards.list_cards(user.session.user.id).await?;
+    Ok(html_response(views::rewards_page(
+        &user.session.user,
+        &cards,
+        &user.session.csrf_token,
+    )))
+}
+
+async fn rewards_scan_page(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(card_id): Path<i64>,
+) -> Result<Response, AppError> {
+    let card = state
+        .rewards_cards
+        .get_card(user.session.user.id, card_id)
+        .await?
+        .ok_or(AppError::NotFound)?;
+    Ok(html_response(views::rewards_scan_page(
+        &user.session.user,
+        &card,
+    )))
+}
+
+async fn create_rewards_card(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    LoggedForm(form): LoggedForm<RewardsCardForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    let store_name = form.store_name.trim().to_owned();
+    let number = form.number.trim().to_owned();
+    let symbology = normalize_symbology(&form.symbology);
+    if store_name.is_empty() || store_name.chars().count() > 60 {
+        return Err(AppError::BadRequest(
+            "Store names must be between 1 and 60 characters.".into(),
+        ));
+    }
+    if number.is_empty() || number.chars().count() > 80 {
+        return Err(AppError::BadRequest(
+            "Card numbers must be between 1 and 80 characters.".into(),
+        ));
+    }
+    state
+        .rewards_cards
+        .create_card(user.session.user.id, store_name, number, symbology)
+        .await?;
+    Ok(Redirect::to("/rewards").into_response())
+}
+
+async fn delete_rewards_card(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(card_id): Path<i64>,
+    LoggedForm(form): LoggedForm<CsrfForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    state
+        .rewards_cards
+        .delete_card(user.session.user.id, card_id)
+        .await?;
+    Ok(Redirect::to("/rewards").into_response())
+}
+
+/// Normalizes a submitted symbology value to a known barcode type, falling
+/// back to Code 128 for unknown or empty values.
+fn normalize_symbology(value: &str) -> String {
+    match value.trim().to_ascii_lowercase().as_str() {
+        "code39" => "code39".to_owned(),
+        _ => "code128".to_owned(),
+    }
+}
+
 async fn meals_page(
     State(state): State<AppState>,
     user: CurrentUser,
     Query(query): Query<MealPickerQuery>,
+    headers: HeaderMap,
 ) -> Result<Response, AppError> {
-    let meals = state.meals.list_meals().await?;
+    let q = query.q.clone().unwrap_or_default();
+    let meals = state.meals.list_meals(&q).await?;
     let meal_categories = state.meals.list_meal_categories().await?;
+    let is_htmx = headers
+        .get("hx-request")
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|value| value == "true");
+    // A boosted navigation (e.g. the category form's POST redirect) also sends
+    // `HX-Request: true`, but must render the full page, not just the results
+    // fragment. Only a live search (an `hx-get` on the filter box) swaps the
+    // fragment. htmx marks boosted requests with `HX-Boosted: true`.
+    let is_boosted = headers
+        .get("hx-boosted")
+        .and_then(|value| value.to_str().ok())
+        .is_some_and(|value| value == "true");
     if let Some(list_id) = query.picker {
-        return Ok(html_response(views::meal_picker(
+        if query.q.is_some() {
+            // Live search inside the picker: swap only the grouped rows, keeping
+            // the modal and search box focused. The initial picker load has no
+            // `q`, so it falls through to the full modal below.
+            return Ok(html_response(views::meal_picker_results(
+                &meals,
+                &meal_categories,
+                list_id,
+                &user.session.csrf_token,
+            )));
+        }
+        let picker = views::meal_picker(
             &meals,
             &meal_categories,
             list_id,
             &user.session.csrf_token,
+            &q,
+        );
+        return Ok(html_response(picker));
+    }
+    if is_htmx && !is_boosted {
+        // Live search on the meals page: swap only the grouped results.
+        return Ok(html_response(views::meal_results(
+            &meals,
+            &meal_categories,
+            &q,
         )));
     }
     Ok(html_response(views::meals_page(
@@ -833,6 +986,7 @@ async fn meals_page(
         &meals,
         &meal_categories,
         &user.session.csrf_token,
+        &q,
     )))
 }
 
@@ -1023,6 +1177,87 @@ async fn remove_meal_from_list(
     list_fragment_response(&state, &user, list_id).await
 }
 
+/// Renders the carry-over modal: a picker of active source lists (newest first,
+/// excluding the current list) that the user can import meals from.
+async fn carry_over_modal(
+    State(state): State<AppState>,
+    _user: CurrentUser,
+    Path(dest_list_id): Path<i64>,
+) -> Result<Response, AppError> {
+    require_mutable_list(&state, dest_list_id).await?;
+    let lists = state.lists.list_summaries().await?;
+    let sources: Vec<_> = lists
+        .into_iter()
+        .filter(|list| list.id != dest_list_id)
+        .collect();
+    Ok(html_response(views::carry_over_modal(
+        &sources,
+        dest_list_id,
+    )))
+}
+
+/// Renders the selectable meal rows for a chosen source list inside the carry
+/// modal.
+async fn carry_source_meals(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(dest_list_id): Path<i64>,
+    Query(query): Query<CarrySourceQuery>,
+) -> Result<Response, AppError> {
+    require_mutable_list(&state, dest_list_id).await?;
+    let source = require_list(&state, query.source).await?;
+    if source.id == dest_list_id {
+        return Err(AppError::BadRequest(
+            "Cannot carry meals from a list into itself.".into(),
+        ));
+    }
+    let list_meals = state.meals.list_meals_on_list(source.id).await?;
+    Ok(html_response(views::carry_source_meals(
+        &list_meals,
+        source.id,
+        dest_list_id,
+        &user.session.csrf_token,
+    )))
+}
+
+/// Copies the selected meals from a source list into the current list without
+/// re-adding their ingredients.
+async fn carry_meals(
+    State(state): State<AppState>,
+    user: CurrentUser,
+    Path(dest_list_id): Path<i64>,
+    LoggedForm(form): LoggedForm<CarryMealsForm>,
+) -> Result<Response, AppError> {
+    verify_csrf(&user, &form.csrf)?;
+    require_mutable_list(&state, dest_list_id).await?;
+    let source = require_list(&state, form.source_list_id).await?;
+    if source.id == dest_list_id {
+        return Err(AppError::BadRequest(
+            "Cannot carry meals from a list into itself.".into(),
+        ));
+    }
+    if form.list_meal_ids.is_empty() {
+        return Err(AppError::BadRequest(
+            "Select at least one meal to carry over.".into(),
+        ));
+    }
+    let list_meal_ids: Vec<i64> = form
+        .list_meal_ids
+        .split(',')
+        .filter_map(|id| id.trim().parse().ok())
+        .collect();
+    if list_meal_ids.is_empty() {
+        return Err(AppError::BadRequest(
+            "Select at least one meal to carry over.".into(),
+        ));
+    }
+    state
+        .meals
+        .carry_meals_to_list(source.id, dest_list_id, &list_meal_ids)
+        .await?;
+    list_fragment_response(&state, &user, dest_list_id).await
+}
+
 async fn create_invitation(
     State(state): State<AppState>,
     user: CurrentUser,

src/main.rs

@@ -1,3 +1,4 @@
+mod assets;
 mod domain;
 mod http;
 mod hub;
@@ -21,15 +22,18 @@ use crate::hub::InMemoryHub;
 use crate::ports::{
     CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
     MealCategoryRepository, MealIngredientRepository, MealRepository, PasskeyRepository,
-    PasswordHasher, RealtimeNotifier, SessionRepository, TokenGenerator, UserRepository,
+    PasswordHasher, RealtimeNotifier, RewardsCardRepository, SessionRepository, TokenGenerator,
+    UserRepository,
 };
 use crate::security::{Argon2PasswordHasher, RandomTokenGenerator};
-use crate::services::{AuthService, InvitationService, ListService, MealService, RegistrationMode};
+use crate::services::{
+    AuthService, InvitationService, ListService, MealService, RegistrationMode, RewardsCardService,
+};
 use crate::sqlite::{
     SqliteCategoryRepository, SqliteDatabase, SqliteInvitationRepository, SqliteItemRepository,
     SqliteListMealRepository, SqliteListRepository, SqliteMealCategoryRepository,
     SqliteMealIngredientRepository, SqliteMealRepository, SqlitePasskeyRepository,
-    SqliteSessionRepository, SqliteUserRepository,
+    SqliteRewardsCardRepository, SqliteSessionRepository, SqliteUserRepository,
 };
 use crate::webauthn::{AppWebauthnConfig, WebAuthnService};
 
@@ -42,6 +46,9 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .init();
 
     let database_path = env::var("DATABASE_PATH").unwrap_or_else(|_| "sustenance.db".into());
+    let database_in_memory = env::var("DATABASE_IN_MEMORY")
+        .map(|value| value == "1" || value.eq_ignore_ascii_case("true"))
+        .unwrap_or(false);
     let bind_address = env::var("BIND_ADDRESS").unwrap_or_else(|_| "127.0.0.1:3000".into());
     // For loopback hosts, advertise `localhost` so WebAuthn works locally (browsers
     // reject IP addresses as RP IDs). Access the app via http://localhost:PORT.
@@ -69,7 +76,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     };
 
     // Build the adapters (ports) and wire them into application services.
-    let db = SqliteDatabase::open(&database_path).await?;
+    let db = if database_in_memory {
+        SqliteDatabase::open_in_memory().await?
+    } else {
+        SqliteDatabase::open(&database_path).await?
+    };
     let users: Arc<dyn UserRepository> = Arc::new(SqliteUserRepository);
     let sessions: Arc<dyn SessionRepository> = Arc::new(SqliteSessionRepository);
     let lists: Arc<dyn ListRepository> = Arc::new(SqliteListRepository);
@@ -82,6 +93,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let meal_categories: Arc<dyn MealCategoryRepository> = Arc::new(SqliteMealCategoryRepository);
     let invitations: Arc<dyn InvitationRepository> = Arc::new(SqliteInvitationRepository);
     let passkeys: Arc<dyn PasskeyRepository> = Arc::new(SqlitePasskeyRepository);
+    let rewards_cards: Arc<dyn RewardsCardRepository> = Arc::new(SqliteRewardsCardRepository);
     let hasher: Arc<dyn PasswordHasher> = Arc::new(Argon2PasswordHasher);
     let tokens: Arc<dyn TokenGenerator> = Arc::new(RandomTokenGenerator);
     let realtime: Arc<dyn RealtimeNotifier> = Arc::new(InMemoryHub::default());
@@ -106,6 +118,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         Arc::clone(&invitations),
         Arc::clone(&tokens),
     ));
+    let rewards_cards_service = Arc::new(RewardsCardService::new(
+        db.clone(),
+        Arc::clone(&rewards_cards),
+    ));
     let meals_service = Arc::new(MealService::new(
         db.clone(),
         Arc::clone(&meals),
@@ -149,6 +165,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         lists: lists_service,
         meals: meals_service,
         invitations: invitations_service,
+        rewards_cards: rewards_cards_service,
         webauthn: webauthn_service,
         realtime,
         cookie_secure,
@@ -163,6 +180,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .with_graceful_shutdown(shutdown_signal())
         .await?;
     info!("shutdown complete; closing database");
+    // Explicitly close the pool so SQLite can checkpoint and remove the
+    // WAL/SHM sidecar files. Without this, the pool's background close task
+    // races with process exit and the sidecars can be left behind.
+    db.close().await;
     Ok(())
 }
 

src/ports.rs

@@ -3,7 +3,7 @@ use sqlx::SqliteConnection;
 
 use crate::domain::{
     Category, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, MealIngredient,
-    Passkey, PresenceUser, SessionUser, User,
+    Passkey, PresenceUser, RewardsCard, SessionUser, User,
 };
 
 /// Repositories take `&mut SqliteConnection` (which a `Transaction` derefs to),
@@ -182,7 +182,7 @@ pub trait ListMealRepository: Send + Sync {
         &self,
         txn: &mut SqliteConnection,
         list_id: i64,
-        meal_id: i64,
+        meal_id: Option<i64>,
         name: String,
     ) -> DomainResult<i64>;
     async fn remove_meal(
@@ -191,6 +191,16 @@ pub trait ListMealRepository: Send + Sync {
         list_id: i64,
         list_meal_id: i64,
     ) -> DomainResult<i64>;
+    /// Copies the given meal instances from one list to another without
+    /// expanding their ingredients into items (they were already purchased).
+    /// Returns the new rows and the destination list's bumped revision.
+    async fn copy_meals_to_list(
+        &self,
+        txn: &mut SqliteConnection,
+        source_list_id: i64,
+        dest_list_id: i64,
+        list_meal_ids: &[i64],
+    ) -> DomainResult<(Vec<ListMeal>, i64)>;
 }
 
 #[async_trait]
@@ -238,7 +248,7 @@ pub trait MealRepository: Send + Sync {
         txn: &mut SqliteConnection,
         meal_id: i64,
     ) -> DomainResult<Option<Meal>>;
-    async fn list_meals(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<Meal>>;
+    async fn list_meals(&self, txn: &mut SqliteConnection, query: &str) -> DomainResult<Vec<Meal>>;
     async fn update_meal(
         &self,
         txn: &mut SqliteConnection,
@@ -314,3 +324,33 @@ pub enum HubEvent {
     ListChanged { list_id: i64, revision: i64 },
     PresenceChanged { list_id: i64 },
 }
+
+/// Stores and retrieves a user's rewards cards.
+#[async_trait]
+pub trait RewardsCardRepository: Send + Sync {
+    async fn list_cards(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+    ) -> DomainResult<Vec<RewardsCard>>;
+    async fn get_card(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        card_id: i64,
+    ) -> DomainResult<Option<RewardsCard>>;
+    async fn create_card(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        store_name: String,
+        number: String,
+        symbology: String,
+    ) -> DomainResult<RewardsCard>;
+    async fn delete_card(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        card_id: i64,
+    ) -> DomainResult<()>;
+}

src/services.rs

@@ -1,12 +1,13 @@
 use std::sync::Arc;
 
 use crate::domain::{
-    DomainError, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, SessionUser, User,
+    DomainError, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, RewardsCard,
+    SessionUser, User,
 };
 use crate::ports::{
     CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
     MealCategoryRepository, MealIngredientRepository, MealRepository, NewItem, PasswordHasher,
-    RealtimeNotifier, SessionRepository, TokenGenerator, UserRepository,
+    RealtimeNotifier, RewardsCardRepository, SessionRepository, TokenGenerator, UserRepository,
 };
 use crate::sqlite::SqliteDatabase;
 
@@ -389,10 +390,11 @@ impl MealService {
             .await
     }
 
-    pub async fn list_meals(&self) -> DomainResult<Vec<Meal>> {
+    pub async fn list_meals(&self, query: &str) -> DomainResult<Vec<Meal>> {
         let meals = Arc::clone(&self.meals);
+        let query = query.to_owned();
         self.db
-            .run(move |txn| Box::pin(async move { meals.list_meals(txn).await }))
+            .run(move |txn| Box::pin(async move { meals.list_meals(txn, &query).await }))
             .await
     }
 
@@ -530,7 +532,7 @@ impl MealService {
                         return Err(DomainError::NotFound);
                     }
                     let list_meal_id = list_meals
-                        .add_meal(txn, list_id, meal.id, meal.name.clone())
+                        .add_meal(txn, list_id, Some(meal.id), meal.name.clone())
                         .await?;
                     let new_items = meal
                         .ingredients
@@ -576,6 +578,34 @@ impl MealService {
         self.realtime.publish_list_changed(list_id, revision).await;
         Ok(revision)
     }
+
+    /// Copies the given meal instances from a source list into the destination
+    /// list without re-expanding their ingredients into items (they were already
+    /// purchased). The source list is left untouched. Publishes a realtime update
+    /// for the destination only.
+    pub async fn carry_meals_to_list(
+        &self,
+        source_list_id: i64,
+        dest_list_id: i64,
+        list_meal_ids: &[i64],
+    ) -> DomainResult<Vec<ListMeal>> {
+        let list_meals = Arc::clone(&self.list_meals);
+        let ids = list_meal_ids.to_vec();
+        let (copied, revision) = self
+            .db
+            .run(move |txn| {
+                Box::pin(async move {
+                    list_meals
+                        .copy_meals_to_list(txn, source_list_id, dest_list_id, &ids)
+                        .await
+                })
+            })
+            .await?;
+        self.realtime
+            .publish_list_changed(dest_list_id, revision)
+            .await;
+        Ok(copied)
+    }
 }
 
 pub struct InvitationService {
@@ -628,3 +658,54 @@ impl InvitationService {
             .await
     }
 }
+
+pub struct RewardsCardService {
+    db: SqliteDatabase,
+    cards: Arc<dyn RewardsCardRepository>,
+}
+
+impl RewardsCardService {
+    pub fn new(db: SqliteDatabase, cards: Arc<dyn RewardsCardRepository>) -> Self {
+        Self { db, cards }
+    }
+
+    pub async fn list_cards(&self, user_id: i64) -> DomainResult<Vec<RewardsCard>> {
+        let cards = Arc::clone(&self.cards);
+        self.db
+            .run(move |txn| Box::pin(async move { cards.list_cards(txn, user_id).await }))
+            .await
+    }
+
+    pub async fn get_card(&self, user_id: i64, card_id: i64) -> DomainResult<Option<RewardsCard>> {
+        let cards = Arc::clone(&self.cards);
+        self.db
+            .run(move |txn| Box::pin(async move { cards.get_card(txn, user_id, card_id).await }))
+            .await
+    }
+
+    pub async fn create_card(
+        &self,
+        user_id: i64,
+        store_name: String,
+        number: String,
+        symbology: String,
+    ) -> DomainResult<RewardsCard> {
+        let cards = Arc::clone(&self.cards);
+        self.db
+            .run(move |txn| {
+                Box::pin(async move {
+                    cards
+                        .create_card(txn, user_id, store_name, number, symbology)
+                        .await
+                })
+            })
+            .await
+    }
+
+    pub async fn delete_card(&self, user_id: i64, card_id: i64) -> DomainResult<()> {
+        let cards = Arc::clone(&self.cards);
+        self.db
+            .run(move |txn| Box::pin(async move { cards.delete_card(txn, user_id, card_id).await }))
+            .await
+    }
+}

src/sqlite.rs

@@ -8,12 +8,12 @@ use sqlx::{Connection, Row, SqliteConnection, SqlitePool, sqlite::SqliteConnectO
 
 use crate::domain::{
     Category, DomainError, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory,
-    MealIngredient, Passkey, SessionUser, User,
+    MealIngredient, Passkey, RewardsCard, SessionUser, User,
 };
 use crate::ports::{
     CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
     MealCategoryRepository, MealIngredientRepository, MealRepository, NewItem, PasskeyRepository,
-    SessionRepository, UserRepository,
+    RewardsCardRepository, SessionRepository, UserRepository,
 };
 
 /// The embedded SQL migrations, applied automatically on startup.
@@ -39,26 +39,32 @@ impl SqliteDatabase {
         Ok(Self { pool })
     }
 
-    #[cfg(test)]
+    /// Opens an in-memory database. Every connection in the pool shares the same
+    /// in-memory database via a named shared-cache database, so the schema and
+    /// data are visible across the whole pool. Nothing is persisted to disk.
     pub async fn open_in_memory() -> DomainResult<Self> {
-        // A pool of `:memory:` connections would each get a separate database,
-        // so use a unique temporary file that shares the schema across the pool.
+        // A plain `:memory:` database is private to each connection, so a pool
+        // would get a separate database per connection. Use a uniquely-named
+        // shared-cache in-memory database instead so the whole pool shares one.
+        //
+        // The name must be unique per call: shared-cache in-memory databases are
+        // keyed by name, so two calls with the same name within a process would
+        // resolve to the same database and share state. This matters for the
+        // unit tests, which run many `open_in_memory()` calls in parallel within
+        // a single process and need isolation from each other. The counter makes
+        // each call unique. (Shared-cache and in-memory databases are per-process,
+        // so there is no cross-process collision to guard against.)
         use std::sync::atomic::{AtomicU64, Ordering};
         static COUNTER: AtomicU64 = AtomicU64::new(0);
         let unique = COUNTER.fetch_add(1, Ordering::Relaxed);
-        let path = std::env::temp_dir().join(format!(
-            "sustenance-test-{}-{}-{}.db",
-            std::process::id(),
-            now(),
-            unique
-        ));
-        let path = path.to_str().unwrap();
+        let filename = format!("file:sustenance-in-memory-{}", unique);
         let options = SqliteConnectOptions::new()
-            .filename(path)
-            .journal_mode(sqlx::sqlite::SqliteJournalMode::Wal)
+            .filename(filename)
+            .in_memory(true)
+            .shared_cache(true)
+            .journal_mode(sqlx::sqlite::SqliteJournalMode::Memory)
             .foreign_keys(true)
-            .busy_timeout(std::time::Duration::from_secs(5))
-            .create_if_missing(true);
+            .busy_timeout(std::time::Duration::from_secs(5));
         let pool = SqlitePool::connect_with(options).await.map_err(db_error)?;
         MIGRATOR.run(&pool).await.map_err(migrate_error)?;
         seed_default_categories(&pool).await?;
@@ -68,6 +74,14 @@ impl SqliteDatabase {
 }
 
 impl SqliteDatabase {
+    /// Closes the connection pool, waiting for all connections to be released
+    /// and closed. This lets SQLite checkpoint and remove the WAL/SHM sidecar
+    /// files on a clean shutdown; without it, the pool's background close task
+    /// races with process exit and the sidecars may be left behind.
+    pub async fn close(&self) {
+        self.pool.close().await;
+    }
+
     /// Runs `operation` inside a single transaction, committing on success and
     /// rolling back on error. Multiple repositories can participate in the same
     /// transaction so their writes commit together atomically.
@@ -832,7 +846,7 @@ impl ListMealRepository for SqliteListMealRepository {
         &self,
         txn: &mut SqliteConnection,
         list_id: i64,
-        meal_id: i64,
+        meal_id: Option<i64>,
         name: String,
     ) -> DomainResult<i64> {
         sqlx::query(
@@ -872,6 +886,41 @@ impl ListMealRepository for SqliteListMealRepository {
         }
         bump_revision(txn, list_id).await
     }
+
+    async fn copy_meals_to_list(
+        &self,
+        txn: &mut SqliteConnection,
+        source_list_id: i64,
+        dest_list_id: i64,
+        list_meal_ids: &[i64],
+    ) -> DomainResult<(Vec<ListMeal>, i64)> {
+        let mut copied = Vec::with_capacity(list_meal_ids.len());
+        for list_meal_id in list_meal_ids {
+            let row =
+                sqlx::query("SELECT meal_id, name FROM list_meals WHERE id = ?1 AND list_id = ?2")
+                    .bind(list_meal_id)
+                    .bind(source_list_id)
+                    .fetch_optional(&mut *txn)
+                    .await
+                    .map_err(db_error)?;
+            let Some(row) = row else {
+                return Err(DomainError::NotFound);
+            };
+            let meal_id: Option<i64> = row.get(0);
+            let name: String = row.get(1);
+            let id = self
+                .add_meal(txn, dest_list_id, meal_id, name.clone())
+                .await?;
+            copied.push(ListMeal {
+                id,
+                meal_id,
+                name,
+                created_at: now(),
+            });
+        }
+        let revision = bump_revision(txn, dest_list_id).await?;
+        Ok((copied, revision))
+    }
 }
 
 #[derive(Clone, Copy)]
@@ -1083,12 +1132,15 @@ impl MealRepository for SqliteMealRepository {
         }))
     }
 
-    async fn list_meals(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<Meal>> {
+    async fn list_meals(&self, txn: &mut SqliteConnection, query: &str) -> DomainResult<Vec<Meal>> {
         let rows = sqlx::query(
             "SELECT id, name, description, category_id
              FROM meals
+             WHERE (?1 = '' OR name LIKE '%' || ?2 || '%' ESCAPE '\\')
              ORDER BY name COLLATE NOCASE ASC",
         )
+        .bind(query)
+        .bind(escape_like(query))
         .fetch_all(&mut *txn)
         .await
         .map_err(db_error)?;
@@ -1278,6 +1330,115 @@ impl MealIngredientRepository for SqliteMealIngredientRepository {
     }
 }
 
+#[derive(Clone, Copy)]
+pub struct SqliteRewardsCardRepository;
+
+#[async_trait]
+impl RewardsCardRepository for SqliteRewardsCardRepository {
+    async fn list_cards(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+    ) -> DomainResult<Vec<RewardsCard>> {
+        let rows = sqlx::query(
+            "SELECT id, user_id, store_name, number, symbology, created_at
+             FROM rewards_cards
+             WHERE user_id = ?1
+             ORDER BY created_at DESC, id DESC",
+        )
+        .bind(user_id)
+        .fetch_all(&mut *txn)
+        .await
+        .map_err(db_error)?;
+        Ok(rows.into_iter().map(map_rewards_card_row).collect())
+    }
+
+    async fn get_card(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        card_id: i64,
+    ) -> DomainResult<Option<RewardsCard>> {
+        let row = sqlx::query(
+            "SELECT id, user_id, store_name, number, symbology, created_at
+             FROM rewards_cards
+             WHERE id = ?1 AND user_id = ?2",
+        )
+        .bind(card_id)
+        .bind(user_id)
+        .fetch_optional(&mut *txn)
+        .await
+        .map_err(db_error)?;
+        Ok(row.map(map_rewards_card_row))
+    }
+
+    async fn create_card(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        store_name: String,
+        number: String,
+        symbology: String,
+    ) -> DomainResult<RewardsCard> {
+        sqlx::query(
+            "INSERT INTO rewards_cards (user_id, store_name, number, symbology, created_at)
+             VALUES (?1, ?2, ?3, ?4, ?5)",
+        )
+        .bind(user_id)
+        .bind(&store_name)
+        .bind(&number)
+        .bind(&symbology)
+        .bind(now())
+        .execute(&mut *txn)
+        .await
+        .map_err(db_error)?;
+        let card_id = sqlx::query("SELECT last_insert_rowid()")
+            .fetch_one(&mut *txn)
+            .await
+            .map_err(db_error)?
+            .get::<i64, _>(0);
+        Ok(RewardsCard {
+            id: card_id,
+            user_id,
+            store_name,
+            number,
+            symbology,
+            created_at: now(),
+        })
+    }
+
+    async fn delete_card(
+        &self,
+        txn: &mut SqliteConnection,
+        user_id: i64,
+        card_id: i64,
+    ) -> DomainResult<()> {
+        let changed = sqlx::query("DELETE FROM rewards_cards WHERE id = ?1 AND user_id = ?2")
+            .bind(card_id)
+            .bind(user_id)
+            .execute(&mut *txn)
+            .await
+            .map_err(db_error)?
+            .rows_affected();
+        if changed == 0 {
+            return Err(DomainError::NotFound);
+        }
+        Ok(())
+    }
+}
+
+/// Maps a `rewards_cards` row (in the shared column order) to a `RewardsCard`.
+fn map_rewards_card_row(row: sqlx::sqlite::SqliteRow) -> RewardsCard {
+    RewardsCard {
+        id: row.get(0),
+        user_id: row.get(1),
+        store_name: row.get(2),
+        number: row.get(3),
+        symbology: row.get(4),
+        created_at: row.get(5),
+    }
+}
+
 async fn ensure_category(txn: &mut SqliteConnection, category_id: Option<i64>) -> DomainResult<()> {
     let Some(category_id) = category_id else {
         return Ok(());
@@ -1354,6 +1515,14 @@ fn db_error(error: sqlx::Error) -> DomainError {
     DomainError::Database(error.to_string())
 }
 
+/// Escapes a user-supplied search term so `%`, `_` and `\` are matched
+/// literally when interpolated into a `LIKE` pattern with `ESCAPE '\'`.
+fn escape_like(term: &str) -> String {
+    term.replace('\\', "\\\\")
+        .replace('%', "\\%")
+        .replace('_', "\\_")
+}
+
 fn migrate_error(error: sqlx::migrate::MigrateError) -> DomainError {
     DomainError::Database(error.to_string())
 }
@@ -2326,7 +2495,7 @@ mod tests {
         let meals = db
             .run(move |txn| {
                 let meals = meals.clone();
-                Box::pin(async move { meals.list_meals(txn).await })
+                Box::pin(async move { meals.list_meals(txn, "").await })
             })
             .await
             .unwrap();
@@ -2335,6 +2504,51 @@ mod tests {
         assert_eq!(names, vec!["Pasta".to_owned(), "Salad".to_owned()]);
     }
 
+    #[tokio::test]
+    async fn list_meals_filters_by_name_case_insensitively() {
+        let db = setup().await;
+        create_meal(&db, "Pasta Carbonara").await;
+        create_meal(&db, "Chicken Curry").await;
+        let meals = SqliteMealRepository;
+        let names = |posted_query: &str| {
+            let meals = meals.clone();
+            let posted_query = posted_query.to_owned();
+            db.run(move |txn| {
+                let meals = meals.clone();
+                Box::pin(async move { meals.list_meals(txn, &posted_query).await })
+            })
+        };
+        let matched = names("pasta").await.unwrap();
+        let matched_names = matched.iter().map(|m| m.name.as_str()).collect::<Vec<_>>();
+        assert_eq!(matched_names, vec!["Pasta Carbonara"]);
+        assert!(names("pizza").await.unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn list_meals_escapes_like_wildcards() {
+        let db = setup().await;
+        create_meal(&db, "100% Wholemeal Bread").await;
+        create_meal(&db, "Salad").await;
+        let meals = SqliteMealRepository;
+        let names = |posted_query: &str| {
+            let meals = meals.clone();
+            let posted_query = posted_query.to_owned();
+            db.run(move |txn| {
+                let meals = meals.clone();
+                Box::pin(async move { meals.list_meals(txn, &posted_query).await })
+            })
+        };
+        // A bare `%` must not act as a wildcard matching every meal: it only
+        // matches meals that contain a literal `%` character.
+        let matched = names("%").await.unwrap();
+        assert_eq!(matched.len(), 1);
+        assert_eq!(matched[0].name, "100% Wholemeal Bread");
+        // `_` and `%` in the query are matched literally.
+        let matched = names("100%").await.unwrap();
+        assert_eq!(matched.len(), 1);
+        assert_eq!(matched[0].name, "100% Wholemeal Bread");
+    }
+
     #[tokio::test]
     async fn get_meal_returns_meal_with_ingredients() {
         let db = setup().await;
@@ -2568,7 +2782,9 @@ mod tests {
         let id = db
             .run(move |txn| {
                 let list_meals = list_meals.clone();
-                Box::pin(async move { list_meals.add_meal(txn, list_id, meal_id, name).await })
+                Box::pin(
+                    async move { list_meals.add_meal(txn, list_id, Some(meal_id), name).await },
+                )
             })
             .await
             .unwrap();
@@ -2671,6 +2887,100 @@ mod tests {
         assert!(matches!(result, Err(DomainError::NotFound)));
     }
 
+    #[tokio::test]
+    async fn copying_meals_to_another_list_does_not_add_items() {
+        let db = setup().await;
+        let source = create_list(&db, "Last week").await;
+        let dest = create_list(&db, "This week").await;
+        let meal = create_meal(&db, "Pasta").await;
+        add_ingredient(&db, meal.id, "Penne", None).await;
+        let list_meal = add_meal_to_list(&db, source.id, &meal).await;
+
+        let list_meals = SqliteListMealRepository;
+        let (copied, revision) = db
+            .run(move |txn| {
+                let list_meals = list_meals.clone();
+                Box::pin(async move {
+                    list_meals
+                        .copy_meals_to_list(txn, source.id, dest.id, &[list_meal.id])
+                        .await
+                })
+            })
+            .await
+            .unwrap();
+
+        // The meal is copied to the destination, but no items are created.
+        assert_eq!(copied.len(), 1);
+        assert_eq!(copied[0].name, "Pasta");
+        assert_eq!(copied[0].meal_id, Some(meal.id));
+        assert!(get_items(&db, dest.id).await.is_empty());
+        // The destination revision is bumped exactly once.
+        assert_eq!(revision, 1);
+        // The source meal is untouched.
+        let source_meals = db
+            .run(move |txn| {
+                let list_meals = list_meals.clone();
+                Box::pin(async move { list_meals.list_meals(txn, source.id).await })
+            })
+            .await
+            .unwrap();
+        assert_eq!(source_meals.len(), 1);
+    }
+
+    #[tokio::test]
+    async fn copying_a_meal_with_a_deleted_catalog_meal_preserves_its_name() {
+        let db = setup().await;
+        let source = create_list(&db, "Last week").await;
+        let dest = create_list(&db, "This week").await;
+        let meal = create_meal(&db, "Pasta").await;
+        let list_meal = add_meal_to_list(&db, source.id, &meal).await;
+
+        // Delete the catalog meal; the list_meals row keeps its name but meal_id
+        // becomes NULL.
+        let meals = SqliteMealRepository;
+        db.run(move |txn| {
+            let meals = meals.clone();
+            Box::pin(async move { meals.delete_meal(txn, meal.id).await })
+        })
+        .await
+        .unwrap();
+
+        let list_meals = SqliteListMealRepository;
+        let (copied, _) = db
+            .run(move |txn| {
+                let list_meals = list_meals.clone();
+                Box::pin(async move {
+                    list_meals
+                        .copy_meals_to_list(txn, source.id, dest.id, &[list_meal.id])
+                        .await
+                })
+            })
+            .await
+            .unwrap();
+        assert_eq!(copied.len(), 1);
+        assert_eq!(copied[0].name, "Pasta");
+        assert_eq!(copied[0].meal_id, None);
+    }
+
+    #[tokio::test]
+    async fn copying_an_unknown_meal_fails() {
+        let db = setup().await;
+        let source = create_list(&db, "Last week").await;
+        let dest = create_list(&db, "This week").await;
+        let list_meals = SqliteListMealRepository;
+        let result = db
+            .run(move |txn| {
+                let list_meals = list_meals.clone();
+                Box::pin(async move {
+                    list_meals
+                        .copy_meals_to_list(txn, source.id, dest.id, &[9999])
+                        .await
+                })
+            })
+            .await;
+        assert!(matches!(result, Err(DomainError::NotFound)));
+    }
+
     // ---- PasskeyRepository ----
 
     #[tokio::test]
@@ -2772,4 +3082,176 @@ mod tests {
             .await;
         assert!(matches!(result, Err(DomainError::NotFound)));
     }
+
+    // ---- RewardsCardRepository ----
+
+    #[tokio::test]
+    async fn rewards_card_crud_roundtrip() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let cards = SqliteRewardsCardRepository;
+
+        let created = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move {
+                    cards
+                        .create_card(
+                            txn,
+                            user.id,
+                            "Kroger".into(),
+                            "6011 2345 6789".into(),
+                            "code128".into(),
+                        )
+                        .await
+                })
+            })
+            .await
+            .unwrap();
+        assert!(created.id > 0);
+        assert_eq!(created.user_id, user.id);
+        assert_eq!(created.store_name, "Kroger");
+        assert_eq!(created.number, "6011 2345 6789");
+        assert_eq!(created.symbology, "code128");
+
+        let listed = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.list_cards(txn, user.id).await })
+            })
+            .await
+            .unwrap();
+        assert_eq!(listed.len(), 1);
+        assert_eq!(listed[0].id, created.id);
+
+        db.run(move |txn| {
+            let cards = cards.clone();
+            Box::pin(async move { cards.delete_card(txn, user.id, created.id).await })
+        })
+        .await
+        .unwrap();
+
+        let after = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.list_cards(txn, user.id).await })
+            })
+            .await
+            .unwrap();
+        assert!(after.is_empty());
+    }
+
+    #[tokio::test]
+    async fn rewards_cards_are_scoped_to_their_user() {
+        let db = setup().await;
+        let alice = create_user(&db, "alice@example.com").await;
+        let bob = create_user(&db, "bob@example.com").await;
+        let cards = SqliteRewardsCardRepository;
+
+        db.run(move |txn| {
+            let cards = cards.clone();
+            Box::pin(async move {
+                cards
+                    .create_card(
+                        txn,
+                        alice.id,
+                        "Kroger".into(),
+                        "123".into(),
+                        "code128".into(),
+                    )
+                    .await
+            })
+        })
+        .await
+        .unwrap();
+
+        let bobs = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.list_cards(txn, bob.id).await })
+            })
+            .await
+            .unwrap();
+        assert!(bobs.is_empty());
+
+        // Bob cannot delete Alice's card.
+        let result = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.delete_card(txn, bob.id, 1).await })
+            })
+            .await;
+        assert!(matches!(result, Err(DomainError::NotFound)));
+    }
+
+    #[tokio::test]
+    async fn delete_missing_rewards_card_fails() {
+        let db = setup().await;
+        let user = create_user(&db, "alice@example.com").await;
+        let cards = SqliteRewardsCardRepository;
+        let result = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.delete_card(txn, user.id, 9999).await })
+            })
+            .await;
+        assert!(matches!(result, Err(DomainError::NotFound)));
+    }
+
+    #[tokio::test]
+    async fn get_rewards_card_returns_card_or_none() {
+        let db = setup().await;
+        let alice = create_user(&db, "alice@example.com").await;
+        let bob = create_user(&db, "bob@example.com").await;
+        let cards = SqliteRewardsCardRepository;
+
+        let created = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move {
+                    cards
+                        .create_card(
+                            txn,
+                            alice.id,
+                            "Kroger".into(),
+                            "601123456789".into(),
+                            "code128".into(),
+                        )
+                        .await
+                })
+            })
+            .await
+            .unwrap();
+
+        // The owner can fetch their card.
+        let found = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.get_card(txn, alice.id, created.id).await })
+            })
+            .await
+            .unwrap();
+        assert_eq!(found.as_ref().map(|c| c.id), Some(created.id));
+        assert_eq!(found.unwrap().store_name, "Kroger");
+
+        // Another user cannot fetch it.
+        let not_found = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.get_card(txn, bob.id, created.id).await })
+            })
+            .await
+            .unwrap();
+        assert!(not_found.is_none());
+
+        // A missing id returns None.
+        let missing = db
+            .run(move |txn| {
+                let cards = cards.clone();
+                Box::pin(async move { cards.get_card(txn, alice.id, 9999).await })
+            })
+            .await
+            .unwrap();
+        assert!(missing.is_none());
+    }
 }

src/views.rs

@@ -4,7 +4,8 @@ use pulldown_cmark::{Options, Parser, html as cmark_html};
 use crate::{
     domain::PresenceUser,
     domain::{
-        Category, GroceryList, Item, ListMeal, Meal, MealCategory, MealIngredient, Passkey, User,
+        Category, GroceryList, Item, ListMeal, Meal, MealCategory, MealIngredient, Passkey,
+        RewardsCard, User,
     },
 };
 
@@ -37,8 +38,8 @@ pub fn login_page(error: Option<&str>, invite: Option<&str>) -> Markup {
                 button id="passkey-login" class="button button-secondary" type="button" { "Sign in with a passkey" }
                 p class="auth-switch" { "Need an account? " a href="/register" { "Create one" } }
             }
-            script src="/static/password-toggle.js" {}
-            script src="/static/passkey-login.js" {}
+            script src=(crate::assets::url("password-toggle.js")) {}
+            script src=(crate::assets::url("passkey-login.js")) {}
         },
     )
 }
@@ -72,7 +73,7 @@ pub fn register_page(error: Option<&str>, invite: Option<&str>) -> Markup {
                 }
                 p class="auth-switch" { "Already have an account? " a href="/login" { "Sign in" } }
             }
-            script src="/static/password-toggle.js" {}
+            script src=(crate::assets::url("password-toggle.js")) {}
         },
     )
 }
@@ -164,8 +165,8 @@ pub fn account_page(
                     }
                 }
             }
-            script src="/static/password-toggle.js" {}
-            script src="/static/passkey-register.js" {}
+            script src=(crate::assets::url("password-toggle.js")) {}
+            script src=(crate::assets::url("passkey-register.js")) {}
         },
     )
 }
@@ -292,6 +293,7 @@ pub fn meals_page(
     meals: &[Meal],
     meal_categories: &[MealCategory],
     csrf_token: &str,
+    q: &str,
 ) -> Markup {
     page(
         "Meals",
@@ -305,7 +307,7 @@ pub fn meals_page(
                 }
                 a class="button button-primary" href="/meals/new" { "New meal" }
             }
-            @if meals.is_empty() {
+            @if meals.is_empty() && q.is_empty() {
                 div class="empty-state" {
                     div class="empty-mark" { "🍽" }
                     h3 { "No meals yet" }
@@ -318,28 +320,21 @@ pub fn meals_page(
                         h2 { "All meals" }
                         span class="count-badge" { (meals.len()) }
                     }
-                    @if meals.is_empty() {
-                        p class="muted" { "Create a meal to get started." }
-                    } @else {
-                        @for (category_name, category_meals) in meal_groups(meals, meal_categories) {
-                            div class="category-group" {
-                                div class="category-heading" {
-                                    h3 { (category_name) " (" (category_meals.len()) ")" }
-                                }
-                                div class="list-cards" {
-                                    @for meal in category_meals {
-                                        a class="list-card" href=(format!("/meals/{}", meal.id)) {
-                                            span class="list-card-icon" { "🍽" }
-                                            span class="list-card-copy" {
-                                                strong { (meal.name) }
-                                                small { (meal.ingredients.len()) " ingredients" }
-                                            }
-                                            span class="list-card-arrow" { "→" }
-                                        }
-                                    }
-                                }
-                            }
-                        }
+                    div class="meal-filter-bar" {
+                        input
+                            class="meal-filter"
+                            id="meal-search"
+                            type="search"
+                            name="q"
+                            value=(q)
+                            placeholder="Search meals"
+                            hx-get="/meals"
+                            hx-trigger="input changed delay:200ms"
+                            hx-target="#meal-results"
+                            hx-swap="innerHTML";
+                    }
+                    div id="meal-results" {
+                        (meal_results(meals, meal_categories, q))
                     }
                 }
                 aside class="side-column" {
@@ -375,6 +370,42 @@ pub fn meals_page(
     )
 }
 
+/// Renders the meals page's grouped results, or the appropriate empty state.
+/// Distinct from the database-empty state: when a search yields no matches the
+/// list is empty (pre-filtered in SQL) even though meals exist, so we show a
+/// search-specific message.
+pub fn meal_results(meals: &[Meal], meal_categories: &[MealCategory], q: &str) -> Markup {
+    html! {
+        @if meals.is_empty() && q.is_empty() {
+            p class="muted" { "Create a meal to get started." }
+        } @else if meals.is_empty() {
+            div class="meal-filter-empty" {
+                p { "No meals match your search." }
+            }
+        } @else {
+            @for (category_name, category_meals) in meal_groups(meals, meal_categories) {
+                div class="category-group" {
+                    div class="category-heading" {
+                        h3 { (category_name) " (" (category_meals.len()) ")" }
+                    }
+                    div class="list-cards" {
+                        @for meal in category_meals {
+                            a class="list-card" href=(format!("/meals/{}", meal.id)) {
+                                span class="list-card-icon" { "🍽" }
+                                span class="list-card-copy" {
+                                    strong { (meal.name) }
+                                    small { (meal.ingredients.len()) " ingredients" }
+                                }
+                                span class="list-card-arrow" { "→" }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
 fn meal_groups<'a>(
     meals: &'a [Meal],
     meal_categories: &[MealCategory],
@@ -415,6 +446,7 @@ pub fn meal_picker(
     meal_categories: &[MealCategory],
     list_id: i64,
     csrf_token: &str,
+    q: &str,
 ) -> Markup {
     html! {
         div class="meal-picker-backdrop" onclick="if (event.target === this) this.remove()" {
@@ -426,7 +458,19 @@ pub fn meal_picker(
                     }
                     button class="meal-picker-close" type="button" aria-label="Close" onclick="this.closest('.meal-picker-backdrop').remove()" { "✕" }
                 }
-                @if meals.is_empty() {
+                div class="meal-filter-bar meal-filter-bar-picker" {
+                    input
+                        class="meal-filter"
+                        name="q"
+                        type="search"
+                        value=(q)
+                        placeholder="Search meals"
+                        hx-get=(format!("/meals?picker={}", list_id))
+                        hx-trigger="input changed delay:200ms"
+                        hx-target="#meal-picker-results"
+                        hx-swap="innerHTML";
+                }
+                @if meals.is_empty() && q.is_empty() {
                     div class="meal-picker-empty" {
                         span class="empty-mark" { "🍽" }
                         h3 { "No meals yet" }
@@ -434,32 +478,51 @@ pub fn meal_picker(
                         a class="button button-primary" href="/meals/new" { "Create a meal" }
                     }
                 } @else {
-                    div class="meal-picker-list" {
-                        @for (category_name, category_meals) in meal_groups(meals, meal_categories) {
-                            div class="category-group" {
-                                div class="category-heading" {
-                                    h3 { (category_name) }
-                                }
-                                @for meal in category_meals {
-                                    form
-                                        hx-post=(format!("/lists/{}/add-meal", list_id))
-                                        hx-target="#list-items"
-                                        hx-swap="outerHTML"
-                                        hx-on::after-request="if (event.detail.successful) this.closest('.meal-picker-backdrop').remove()"
-                                        class="meal-picker-row"
-                                    {
-                                        input type="hidden" name="csrf" value=(csrf_token);
-                                        input type="hidden" name="meal_id" value=(meal.id);
-                                        button class="meal-picker-button" type="submit" {
-                                            span class="meal-picker-icon" { "🍽" }
-                                            span class="meal-picker-copy" {
-                                                strong { (meal.name) }
-                                                small { (meal.ingredients.len()) " ingredients" }
-                                            }
-                                            span class="meal-picker-add" { "Add" }
-                                        }
-                                    }
+                    div id="meal-picker-results" class="meal-picker-list" {
+                        (meal_picker_results(meals, meal_categories, list_id, csrf_token))
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// The grouped picker rows, or the search-specific empty state. Kept separate
+/// from the database-empty state above.
+pub fn meal_picker_results(
+    meals: &[Meal],
+    meal_categories: &[MealCategory],
+    list_id: i64,
+    csrf_token: &str,
+) -> Markup {
+    html! {
+        @if meals.is_empty() {
+            div class="meal-picker-empty" {
+                p { "No meals match your search." }
+            }
+        } @else {
+            @for (category_name, category_meals) in meal_groups(meals, meal_categories) {
+                div class="category-group" {
+                    div class="category-heading" {
+                        h3 { (category_name) }
+                    }
+                    @for meal in category_meals {
+                        form
+                            hx-post=(format!("/lists/{}/add-meal", list_id))
+                            hx-target="#list-items"
+                            hx-swap="morph:outerHTML"
+                            hx-on::after-request="if (event.detail.successful) this.closest('.meal-picker-backdrop').remove()"
+                            class="meal-picker-row"
+                        {
+                            input type="hidden" name="csrf" value=(csrf_token);
+                            input type="hidden" name="meal_id" value=(meal.id);
+                            button class="meal-picker-button" type="submit" {
+                                span class="meal-picker-icon" { "🍽" }
+                                span class="meal-picker-copy" {
+                                    strong { (meal.name) }
+                                    small { (meal.ingredients.len()) " ingredients" }
                                 }
+                                span class="meal-picker-add" { "Add" }
                             }
                         }
                     }
@@ -585,7 +648,7 @@ pub fn meal_page(
                         }
                         div class="list-topbar-actions" {
                             button type="button" class="button button-small button-quiet" onclick="document.getElementById('meal-edit-modal').showModal()" { "Edit" }
-                            form method="post" action=(format!("/meals/{}/delete", meal.id)) onsubmit="return confirm('Delete this meal and its ingredients? This cannot be undone.')" {
+                            form method="post" action=(format!("/meals/{}/delete", meal.id)) hx-confirm="Delete this meal and its ingredients? This cannot be undone." {
                                 input type="hidden" name="csrf" value=(csrf_token);
                                 button class="danger-link bordered-delete" type="submit" { "Delete" }
                             }
@@ -743,6 +806,19 @@ fn render_markdown(source: &str) -> Markup {
 mod tests {
     use super::*;
 
+    /// Extracts the rendered SVG width from `viewBox="0 0 <width> <height>"`.
+    fn svg_width(svg: &str) -> u32 {
+        let viewbox = svg
+            .split("viewBox=\"")
+            .nth(1)
+            .expect("expected viewBox")
+            .split('"')
+            .next()
+            .unwrap();
+        let width = viewbox.split_whitespace().nth(2).expect("expected width");
+        width.parse().expect("expected numeric width")
+    }
+
     #[test]
     fn render_markdown_turns_bullets_into_list_html() {
         let html = render_markdown("- one\n- two\n").into_string();
@@ -764,6 +840,76 @@ mod tests {
         let ts = 1_786_060_800;
         assert_eq!(format_date(ts), "7 Aug 2026");
     }
+
+    #[test]
+    fn barcode_svg_renders_code128_svg() {
+        let html = barcode_svg("code128", "601123456789").into_string();
+        assert!(html.contains("<svg"), "expected svg, got: {html}");
+        assert!(html.contains("</svg>"), "expected closing svg, got: {html}");
+    }
+
+    #[test]
+    fn code128_uses_set_c_for_even_digit_numbers() {
+        // Set C (Ć) packs two digits per symbol, so an even-length digit-only
+        // number should be encoded with set C rather than set B.
+        assert_eq!(code128_input("601123456789"), "Ć601123456789");
+        // Non-numeric data falls back to set B.
+        assert_eq!(code128_input("ABC123"), "ƁABC123");
+        assert_eq!(code128_input(""), "Ɓ");
+    }
+
+    #[test]
+    fn code128_odd_digit_numbers_lead_with_set_b_then_switch_to_set_c() {
+        // 21-digit number: first digit in set B, then set C for the rest.
+        assert_eq!(
+            code128_input("606171584511340224537"),
+            "Ɓ6Ć06171584511340224537"
+        );
+    }
+
+    #[test]
+    fn code128_set_c_renders_shorter_than_set_b() {
+        let number = "601123456789";
+        let set_c = barcode_svg("code128", number).into_string();
+        // Force set B by using a non-numeric character so the digit-only
+        // fast path doesn't kick in.
+        let set_b = barcode_svg("code128", &format!("{number} ")).into_string();
+        let width_c = svg_width(&set_c);
+        let width_b = svg_width(&set_b);
+        assert!(
+            width_c < width_b,
+            "expected set C ({width_c}) narrower than set B ({width_b})"
+        );
+    }
+
+    #[test]
+    fn code128_odd_digit_number_renders_shorter_than_pure_set_b() {
+        let number = "606171584511340224537";
+        let mixed = barcode_svg("code128", number).into_string();
+        // Force pure set B by appending a non-numeric character.
+        let set_b = barcode_svg("code128", &format!("{number} ")).into_string();
+        let width_mixed = svg_width(&mixed);
+        let width_b = svg_width(&set_b);
+        assert!(
+            width_mixed < width_b,
+            "expected mixed ({width_mixed}) narrower than set B ({width_b})"
+        );
+    }
+
+    #[test]
+    fn barcode_svg_renders_code39_svg() {
+        let html = barcode_svg("code39", "ABC123").into_string();
+        assert!(html.contains("<svg"), "expected svg, got: {html}");
+    }
+
+    #[test]
+    fn barcode_svg_falls_back_to_text_for_invalid_number() {
+        // Code 39 only supports uppercase letters and digits, so lowercase
+        // input cannot be encoded and falls back to plain text.
+        let html = barcode_svg("code39", "abc").into_string();
+        assert!(!html.contains("<svg"), "expected no svg, got: {html}");
+        assert!(html.contains("abc"), "expected fallback text, got: {html}");
+    }
 }
 
 pub fn list_page(
@@ -795,7 +941,7 @@ pub fn list_page(
                         div {
                             p class="eyebrow" { "SHARED LIST" }
                             h1 { (list.name) }
-                            p class="list-meta" { (items.iter().filter(|item| !item.checked).count()) " items to get" }
+                            (list_meta_fragment(items, false))
                         }
                         div class="list-topbar-actions" {
                             @if list.archived_at.is_some() {
@@ -864,7 +1010,7 @@ fn list_content(
                 class="add-item-form"
                 hx-post=(format!("/lists/{}/items", list.id))
                 hx-target="#list-items"
-                hx-swap="outerHTML"
+                hx-swap="morph:outerHTML"
                 hx-on::after-request="if (event.detail.successful) this.reset()"
             {
                 input type="hidden" name="csrf" value=(csrf_token);
@@ -891,7 +1037,7 @@ pub fn list_items_fragment(
 ) -> Markup {
     if out_of_band {
         html! {
-            div id="list-items" class="items" data-revision=(list.revision) hx-swap-oob="outerHTML" {
+            div id="list-items" class="items" data-revision=(list.revision) hx-swap-oob="morph" {
                 (list_items_content(items, categories, csrf_token, editable))
             }
         }
@@ -975,7 +1121,7 @@ fn item_row(item: &Item, categories: &[Category], csrf_token: &str, editable: bo
                     class="check-form"
                     hx-post=(format!("/lists/{}/items/{}/check", item.list_id, item.id))
                     hx-target="#list-items"
-                    hx-swap="outerHTML"
+                    hx-swap="morph:outerHTML"
                 {
                     input type="hidden" name="csrf" value=(csrf_token);
                     input type="hidden" name="checked" value=(next_checked);
@@ -1006,7 +1152,7 @@ fn item_row(item: &Item, categories: &[Category], csrf_token: &str, editable: bo
                         form
                             hx-post=(format!("/lists/{}/items/{}/edit", item.list_id, item.id))
                             hx-target="#list-items"
-                            hx-swap="outerHTML"
+                            hx-swap="morph:outerHTML"
                             class="stack"
                         {
                             input type="hidden" name="csrf" value=(csrf_token);
@@ -1025,7 +1171,7 @@ fn item_row(item: &Item, categories: &[Category], csrf_token: &str, editable: bo
                         form
                             hx-post=(format!("/lists/{}/items/{}/delete", item.list_id, item.id))
                             hx-target="#list-items"
-                            hx-swap="outerHTML"
+                            hx-swap="morph:outerHTML"
                         {
                             input type="hidden" name="csrf" value=(csrf_token);
                             button id=(format!("item-edit-delete-{}", item.id)) class="button button-danger" type="submit" { "Remove item" }
@@ -1095,6 +1241,21 @@ pub fn categories_panel(categories: &[Category], csrf_token: &str, out_of_band:
     }
 }
 
+fn list_meta_fragment(items: &[Item], out_of_band: bool) -> Markup {
+    let left = items.iter().filter(|item| !item.checked).count();
+    let total = items.len();
+    let meta = html! {
+        p id="list-meta" class="list-meta" { (left) " items left out of " (total) }
+    };
+    if out_of_band {
+        html! {
+            p id="list-meta" class="list-meta" hx-swap-oob="outerHTML" { (left) " items left out of " (total) }
+        }
+    } else {
+        meta
+    }
+}
+
 pub fn live_list_fragments(
     list: &GroceryList,
     items: &[Item],
@@ -1104,6 +1265,7 @@ pub fn live_list_fragments(
 ) -> Markup {
     let editable = list.archived_at.is_none();
     html! {
+        (list_meta_fragment(items, true))
         (list_items_fragment(list, items, categories, csrf_token, true, editable))
         (list_meals_panel(list_meals, list.id, csrf_token, true, editable))
     }
@@ -1133,7 +1295,7 @@ pub fn list_meals_panel(
                             form
                                 hx-post=(format!("/lists/{}/meals/{}/remove", list_id, meal.id))
                                 hx-target="#list-items"
-                                hx-swap="outerHTML"
+                                hx-swap="morph:outerHTML"
                                 class="list-meal-remove"
                             {
                                 input type="hidden" name="csrf" value=(csrf_token);
@@ -1145,7 +1307,10 @@ pub fn list_meals_panel(
             }
         }
         @if editable {
-            button class="button button-small add-meal-button" hx-get=(format!("/meals?picker={}", list_id)) hx-target="#meal-picker" hx-swap="innerHTML" { "+ Add meal" }
+            div class="list-meals-actions" {
+                button class="button button-small add-meal-button" hx-get=(format!("/meals?picker={}", list_id)) hx-target="#meal-picker" hx-swap="innerHTML" { "+ Add meal" }
+                button class="button button-small carry-over-button" hx-get=(format!("/lists/{}/carry", list_id)) hx-target="#meal-picker" hx-swap="innerHTML" { "Carry over" }
+            }
         }
     };
 
@@ -1160,6 +1325,91 @@ pub fn list_meals_panel(
     }
 }
 
+/// The carry-over modal: a picker of active source lists (newest first,
+/// excluding the current list) that the user can import meals from.
+pub fn carry_over_modal(sources: &[GroceryList], dest_list_id: i64) -> Markup {
+    html! {
+        div class="meal-picker-backdrop" onclick="if (event.target === this) this.remove()" {
+            div class="meal-picker-modal" role="dialog" aria-modal="true" aria-label="Carry over meals" {
+                div class="meal-picker-header" {
+                    div {
+                        p class="eyebrow" { "CARRY OVER" }
+                        h2 { "Carry over meals" }
+                    }
+                    button class="meal-picker-close" type="button" aria-label="Close" onclick="this.closest('.meal-picker-backdrop').remove()" { "✕" }
+                }
+                p class="muted carry-intro" { "Import meals from another list. Their ingredients are not re-added — they were already purchased." }
+                @if sources.is_empty() {
+                    div class="meal-picker-empty" {
+                        p { "No other lists to carry from." }
+                    }
+                } @else {
+                    div class="carry-source-picker" {
+                        label for="carry-source" { "From list" }
+                        select
+                            id="carry-source"
+                            name="source"
+                            hx-get=(format!("/lists/{}/carry/meals", dest_list_id))
+                            hx-trigger="change"
+                            hx-target="#carry-results"
+                            hx-swap="innerHTML"
+                        {
+                            option value="" selected disabled { "Choose a list…" }
+                            @for source in sources {
+                                option value=(source.id) { (source.name) }
+                            }
+                        }
+                    }
+                    div id="carry-results" class="carry-results" {}
+                }
+            }
+        }
+    }
+}
+
+/// The selectable meal rows for a chosen source list inside the carry modal.
+pub fn carry_source_meals(
+    list_meals: &[ListMeal],
+    source_id: i64,
+    dest_list_id: i64,
+    csrf_token: &str,
+) -> Markup {
+    html! {
+        @if list_meals.is_empty() {
+            div class="meal-picker-empty" {
+                p { "This list has no meals to carry over." }
+            }
+        } @else {
+            form
+                hx-post=(format!("/lists/{}/carry", dest_list_id))
+                hx-target="#list-items"
+                hx-swap="morph:outerHTML"
+                hx-on::after-request="if (event.detail.successful) this.closest('.meal-picker-backdrop').remove()"
+                class="carry-form"
+            {
+                input type="hidden" name="csrf" value=(csrf_token);
+                input type="hidden" name="source_list_id" value=(source_id);
+                // Collected as a comma-separated list by the checkboxes below;
+                // the form extractor does not coalesce repeated keys into a Vec.
+                input id="carry-selected" type="hidden" name="list_meal_ids" value="";
+                div class="carry-list" {
+                    @for meal in list_meals {
+                        label class="carry-row" {
+                            input
+                                type="checkbox"
+                                value=(meal.id)
+                                onchange="var form=this.closest('form'); var box=form.querySelector('#carry-selected'); box.value=Array.from(form.querySelectorAll('input[type=checkbox]:checked')).map(function(c){return c.value}).join(',');";
+                            span class="carry-row-icon" { "🍽" }
+                            span class="carry-row-name" { (meal.name) }
+                        }
+                    }
+                }
+                button class="button button-primary carry-submit" type="submit" { "Carry over" }
+            }
+        }
+    }
+}
+
 pub fn presence_panel(presence: &[PresenceUser], out_of_band: bool) -> Markup {
     if out_of_band {
         html! {
@@ -1244,6 +1494,148 @@ pub fn invite_result(url: &str) -> Markup {
     }
 }
 
+pub fn rewards_page(user: &User, cards: &[RewardsCard], csrf_token: &str) -> Markup {
+    page(
+        "Rewards cards",
+        Some(user),
+        html! {
+            div class="page-heading" {
+                div {
+                    p class="eyebrow" { "REWARDS CARDS" }
+                    h1 class="page-title" { "Rewards cards" }
+                    p class="lede" { "Your store cards, ready to scan." }
+                }
+            }
+            div class="dashboard-grid" {
+                section class="panel" {
+                    div class="panel-heading" {
+                        h2 { "Your cards" }
+                        span class="count-badge" { (cards.len()) }
+                    }
+                    @if cards.is_empty() {
+                        div class="empty-state" {
+                            div class="empty-mark" { "🏷" }
+                            h3 { "No rewards cards yet" }
+                            p { "Add a card to see its barcode here." }
+                        }
+                    } @else {
+                        div class="rewards-grid" {
+                            @for card in cards {
+                                div class="rewards-card" {
+                                    a class="rewards-card-link" href=(format!("/rewards/{}", card.id)) aria-label=(format!("Show {} barcode", card.store_name)) {}
+                                    div class="rewards-card-heading" {
+                                        strong { (card.store_name) }
+                                        form method="post" action=(format!("/rewards/{}/delete", card.id)) hx-confirm="Remove this rewards card? This cannot be undone." {
+                                            input type="hidden" name="csrf" value=(csrf_token);
+                                            button class="danger-link bordered-delete" type="submit" { "Remove" }
+                                        }
+                                    }
+                                    div class="rewards-barcode" {
+                                        (barcode_svg(&card.symbology, &card.number))
+                                    }
+                                    p class="rewards-number" { (card.number) }
+                                }
+                            }
+                        }
+                    }
+                }
+                section class="panel create-panel" {
+                    div class="panel-heading" { h2 { "Add a card" } }
+                    form method="post" action="/rewards" class="stack" {
+                        input type="hidden" name="csrf" value=(csrf_token);
+                        label for="store-name" { "Store name" }
+                        input id="store-name" name="store_name" type="text" maxlength="60" placeholder="e.g. Kroger" required;
+                        label for="card-number" { "Card number" }
+                        input id="card-number" name="number" type="text" maxlength="80" placeholder="e.g. 6011 2345 6789" required;
+                        label for="symbology" { "Barcode type" }
+                        select id="symbology" name="symbology" {
+                            option value="code128" selected { "Code 128 (recommended)" }
+                            option value="code39" { "Code 39" }
+                        }
+                        button class="button button-primary" type="submit" { "Add card" }
+                    }
+                }
+            }
+        },
+    )
+}
+
+/// A focused, single-barcode view for scanning at the register. Only one
+/// barcode is shown at a time so a scanner can't pick up multiple codes.
+pub fn rewards_scan_page(user: &User, card: &RewardsCard) -> Markup {
+    page(
+        &card.store_name,
+        Some(user),
+        html! {
+            div class="scan-page" {
+                a class="button button-quiet scan-back" href="/rewards" { "← All cards" }
+                div class="scan-card" {
+                    p class="eyebrow" { "REWARDS CARD" }
+                    h1 class="scan-store" { (card.store_name) }
+                    div class="scan-barcode" {
+                        (barcode_svg(&card.symbology, &card.number))
+                    }
+                    p class="rewards-number" { (card.number) }
+                }
+            }
+            script src=(crate::assets::url("rewards.js")) {}
+        },
+    )
+}
+
+/// Renders a rewards-card number as an inline SVG barcode using the given
+/// symbology. Falls back to a plain text label if the number can't be encoded
+/// (for example, a Code 128 number that isn't valid for the chosen symbology).
+fn barcode_svg(symbology: &str, number: &str) -> Markup {
+    let generated = match symbology {
+        "code39" => barcoders::sym::code39::Code39::new(number)
+            .ok()
+            .map(|code| code.encode())
+            .and_then(|encoded| {
+                barcoders::generators::svg::SVG::new(60)
+                    .generate(&encoded)
+                    .ok()
+            }),
+        _ => barcoders::sym::code128::Code128::new(&code128_input(number))
+            .ok()
+            .map(|code| code.encode())
+            .and_then(|encoded| {
+                barcoders::generators::svg::SVG::new(60)
+                    .generate(&encoded)
+                    .ok()
+            }),
+    };
+    match generated {
+        Some(svg) => html! { (maud::PreEscaped(svg)) },
+        None => html! { span class="rewards-unencodable" { (number) } },
+    }
+}
+
+/// Builds the Code 128 input string, choosing the most compact character set.
+///
+/// Code 128 set C packs two digits per symbol, so numeric data renders roughly
+/// half as wide as set B (one character per symbol). Google Wallet (via ZXing)
+/// picks set C automatically for numeric runs, so we do the same to keep the
+/// rendered barcode compact and consistent with it:
+///
+/// - Even-length digit-only numbers: all set C (`Ć` prefix).
+/// - Odd-length digit-only numbers: first digit in set B, then switch to set C
+///   for the remaining even count of digits (e.g. `Ɓ6Ć0171...`).
+/// - Anything else: set B (`Ɓ` prefix).
+fn code128_input(number: &str) -> String {
+    let is_all_digits = !number.is_empty() && number.chars().all(|c| c.is_ascii_digit());
+    if !is_all_digits {
+        return format!("Ɓ{number}");
+    }
+    let len = number.chars().count();
+    if len % 2 == 0 {
+        format!("Ć{number}")
+    } else {
+        let (first, rest) = number.split_at(1);
+        format!("Ɓ{first}Ć{rest}")
+    }
+}
+
 /// Formats a Unix timestamp as a human-readable date (e.g. "7 Aug 2026").
 fn format_date(timestamp: i64) -> String {
     let days = timestamp.div_euclid(86_400);
@@ -1292,17 +1684,22 @@ fn page(title: &str, user: Option<&User>, content: Markup) -> Markup {
                 meta charset="utf-8";
                 meta name="viewport" content="width=device-width, initial-scale=1";
                 title { (title) " · Sustenance" }
-                link rel="stylesheet" href="/static/style.css";
-                script src="https://unpkg.com/htmx.org@2.0.10" {}
-                script src="https://unpkg.com/htmx-ext-ws@2.0.4/ws.js" {}
+                link rel="icon" href=(crate::assets::url("favicon.ico")) sizes="any";
+                link rel="icon" type="image/png" href=(crate::assets::url("favicon-32x32.png")) sizes="32x32";
+                link rel="apple-touch-icon" href=(crate::assets::url("apple-touch-icon.png"));
+                link rel="stylesheet" href=(crate::assets::url("style.css"));
+                script src=(crate::assets::url("htmx.min.js")) {}
+                script src=(crate::assets::url("idiomorph-ext.min.js")) {}
+                script src=(crate::assets::url("htmx-ws.min.js")) {}
             }
-            body hx-boost="true" {
+            body hx-boost="true" hx-ext="morph" {
                 header class="site-header" {
-                    a class="brand" href="/lists" { span class="brand-mark" { "S" } "Sustenance" }
+                    a class="brand" href="/lists" { img class="brand-mark" src=(crate::assets::url("logo.svg")) alt="Sustenance logo"; "Sustenance" }
                     @if let Some(user) = user {
                         nav class="site-nav" {
                             a href="/lists" { "Lists" }
                             a href="/meals" { "Meals" }
+                            a href="/rewards" { "Rewards" }
                         }
                         div class="account-nav" {
                             a class="user-name" href="/account" { (user.display_name) }

static/logo.svg

@@ -0,0 +1,143 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 64 64"
+  role="img"
+  aria-labelledby="title"
+>
+  <title id="title">Sustenance grocery bag with produce</title>
+
+  <!-- Background -->
+  <rect width="64" height="64" rx="12" fill="#286247"/>
+
+  <!-- Back of the paper bag -->
+  <path
+    d="
+      M7 27
+      L16 22
+      L24 26
+      L32 22
+      L40 25
+      L49 21
+      L57 25
+      L47 31
+      L39 28
+      L31 32
+      L23 27
+      L16 31
+      Z
+    "
+    fill="#F2D39B"
+  />
+
+  <!-- Back rim -->
+  <path
+    d="M7 27 16 22 24 26 32 22 40 25 49 21 57 25"
+    fill="none"
+    stroke="#1F4938"
+    stroke-width="2.75"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+  />
+
+  <!-- Leafy greens -->
+  <path
+    d="M42 28C39 21 42 12 49 7c2 3 2 6 1 9 3-2 6-2 8 0-1 5-5 9-12 13Z"
+    fill="#8EC866"
+    stroke="#1F4938"
+    stroke-width="2.5"
+    stroke-linejoin="round"
+  />
+  <path
+    d="M45 27 53 15M47 22l7-1M49 18l-1-5"
+    fill="none"
+    stroke="#1F4938"
+    stroke-width="2"
+    stroke-linecap="round"
+  />
+
+  <!-- Carrot leaves -->
+  <path
+    d="
+      M17 14c-2-4-1-7 0-10 3 3 4 6 3 10
+      m0 0c0-5 2-8 5-10 1 5-1 8-5 11
+    "
+    fill="#8EC866"
+    stroke="#1F4938"
+    stroke-width="2.5"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+  />
+
+  <!-- Carrot -->
+  <path
+    d="M13 18c3-4 9-5 13-2l-3 20-5 2Z"
+    fill="#F29A3F"
+    stroke="#1F4938"
+    stroke-width="2.5"
+    stroke-linejoin="round"
+  />
+  <path
+    d="m16 24 7-2m-6 7 5-2"
+    fill="none"
+    stroke="#1F4938"
+    stroke-width="2"
+    stroke-linecap="round"
+  />
+
+  <!-- Tomato -->
+  <path
+    d="M27 25c0-6 4-10 10-10s10 4 10 10c0 7-4 12-10 12S27 32 27 25Z"
+    fill="#E65A46"
+    stroke="#1F4938"
+    stroke-width="2.5"
+  />
+  <path
+    d="m37 15-4 5 4-1 4 2-1-5"
+    fill="#78B75B"
+    stroke="#1F4938"
+    stroke-width="2"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+  />
+
+  <!-- Front and sides of the paper bag -->
+  <path
+    d="
+      M7 27
+      L16 31
+      L23 27
+      L31 32
+      L39 28
+      L47 31
+      L57 25
+      L55 51
+      L45 59
+      L11 51
+      Z
+    "
+    fill="#F2D39B"
+    stroke="#1F4938"
+    stroke-width="2.75"
+    stroke-linejoin="round"
+  />
+
+  <!-- Front opening edge -->
+  <path
+    d="M7 27 16 31 23 27 31 32 39 28 47 31 57 25"
+    fill="none"
+    stroke="#1F4938"
+    stroke-width="2.75"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+  />
+
+  <!-- Side-panel seam and paper creases -->
+  <path
+    d="M47 31 45 59M45 59l10-8M15 36l1 9"
+    fill="none"
+    stroke="#1F4938"
+    stroke-width="2.25"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+  />
+</svg>

static/rewards.js

@@ -0,0 +1,30 @@
+// Keep the screen awake while a rewards barcode is on screen so the cashier
+// can scan it without the display dimming or locking. This mirrors how wallet
+// apps behave when showing a barcode. The Screen Wake Lock API is best-effort:
+// it may be rejected (e.g. low battery) or auto-released when the tab is hidden,
+// so we re-acquire whenever the page becomes visible again.
+(function () {
+  var wakeLock = null;
+
+  function requestWakeLock() {
+    if (!("wakeLock" in navigator)) return;
+    navigator.wakeLock
+      .request("screen")
+      .then(function (sentinel) {
+        wakeLock = sentinel;
+      })
+      .catch(function () {
+        // Best-effort only; ignore failures (unsupported, low battery, etc.).
+      });
+  }
+
+  // Re-acquire if the lock was released (e.g. the tab was hidden) and the user
+  // returns to the page.
+  document.addEventListener("visibilitychange", function () {
+    if (document.visibilityState === "visible" && wakeLock === null) {
+      requestWakeLock();
+    }
+  });
+
+  requestWakeLock();
+})();

static/style.css

@@ -38,7 +38,7 @@ a { color: inherit; }
 }
 
 .brand { display: inline-flex; align-items: center; gap: 10px; text-decoration: none; font-weight: 800; letter-spacing: -.03em; }
-.brand-mark { display: grid; place-items: center; width: 32px; height: 32px; border-radius: 11px 11px 11px 3px; background: var(--deep-sage); color: white; transform: rotate(-6deg); }
+.brand-mark { display: block; width: 34px; height: 34px; border-radius: 9px; object-fit: cover; }
 .site-nav { display: flex; align-items: center; gap: 6px; }
 .site-nav a {
   padding: 8px 14px;
@@ -265,6 +265,23 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .list-meal-remove-button { padding: 2px 7px; border: 0; border-radius: 7px; color: var(--muted); background: transparent; cursor: pointer; font-size: .8rem; line-height: 1; }
 .list-meal-remove-button:hover { color: var(--coral); background: #fbeae4; }
 .list-meals-panel .add-meal-button { margin-top: 12px; width: 100%; }
+.list-meals-actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; margin-top: 12px; }
+.list-meals-actions .button { width: 100%; margin: 0; }
+.carry-over-button { color: var(--deep-sage); background: #eef4e9; }
+.carry-over-button:hover { background: #e3eddc; }
+.carry-intro { margin: 14px 24px 4px; font-size: .85rem; }
+.carry-source-picker { padding: 14px 24px 4px; }
+.carry-source-picker label { display: block; margin-bottom: 6px; font-size: .78rem; font-weight: 800; color: var(--muted); text-transform: uppercase; letter-spacing: .04em; }
+.carry-source-picker select { width: 100%; min-height: 42px; padding: 8px 12px; border: 1px solid var(--line); border-radius: 12px; color: var(--ink); background: #fff; font-size: .9rem; }
+.carry-results { padding: 14px 24px 22px; overflow-y: auto; }
+.carry-form { margin: 0; }
+.carry-list { display: grid; gap: 8px; }
+.carry-row { display: flex; align-items: center; gap: 12px; padding: 10px 12px; border: 1px solid var(--line); border-radius: 14px; background: #fff; cursor: pointer; }
+.carry-row:hover { border-color: var(--sage); }
+.carry-row input { accent-color: var(--deep-sage); width: 17px; height: 17px; }
+.carry-row-icon { display: grid; place-items: center; flex: 0 0 auto; width: 34px; height: 34px; border-radius: 11px; color: var(--deep-sage); background: #eef4e9; font-size: .95rem; }
+.carry-row-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: .9rem; font-weight: 700; }
+.carry-submit { margin-top: 14px; width: 100%; }
 .sharing-panel p, .tip-panel p { color: var(--muted); font-size: .86rem; }
 .invite-result { margin-top: 15px; }
 .invite-link-result { padding: 11px; border-radius: 12px; background: #f1f5ec; }
@@ -378,6 +395,11 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .meal-picker-empty { padding: 34px 22px 30px; text-align: center; color: var(--muted); }
 .meal-picker-empty h3 { color: var(--ink); }
 .meal-picker-empty p { margin-bottom: 18px; }
+.meal-filter-bar { margin: -6px 0 18px; }
+.meal-filter-bar input { min-height: 40px; padding: 8px 12px; font-size: .9rem; }
+.meal-filter-bar-picker { margin: 14px 24px 4px; }
+.meal-filter-empty { padding: 28px 18px; text-align: center; color: var(--muted); }
+.meal-filter-empty p { margin: 0; }
 
 @media (max-width: 780px) {
   .site-header, .site-main, .site-footer { width: min(100% - 28px, 600px); }
@@ -403,3 +425,100 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
   .side-column { grid-template-columns: 1fr; }
   .site-footer { margin-bottom: 20px; }
 }
+
+/* Rewards cards */
+.rewards-grid { display: grid; gap: 16px; }
+.rewards-card {
+  position: relative;
+  padding: 18px;
+  border: 1px solid var(--line);
+  border-radius: 18px;
+  background: #fff;
+  transition: border-color .16s ease, transform .16s ease;
+}
+.rewards-card:hover { border-color: var(--sage); transform: translateY(-1px); }
+/* Stretched link: makes the whole card clickable to open the scan view. */
+.rewards-card-link {
+  position: absolute;
+  inset: 0;
+  border-radius: inherit;
+  z-index: 1;
+}
+.rewards-card-heading {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 12px;
+  margin-bottom: 14px;
+}
+.rewards-card-heading strong { font-size: 1.05rem; }
+.rewards-barcode {
+  display: flex;
+  justify-content: center;
+  padding: 14px;
+  border-radius: 12px;
+  background: #fff;
+}
+.rewards-barcode svg { width: 100%; height: auto; max-width: 340px; }
+.rewards-number {
+  margin: 12px 0 0;
+  text-align: center;
+  color: var(--muted);
+  font-size: .85rem;
+  letter-spacing: .08em;
+}
+.rewards-unencodable {
+  display: block;
+  color: var(--coral);
+  font-weight: 700;
+}
+/* Keep the Remove button above the stretched link so it stays clickable. */
+.rewards-card-heading form { position: relative; z-index: 2; }
+
+/* Single-card scan view */
+.scan-page {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 22px;
+  padding: 12px 0 40px;
+}
+.scan-back { align-self: flex-start; }
+.scan-card {
+  width: min(100%, 460px);
+  padding: clamp(24px, 6vw, 42px);
+  border: 1px solid var(--line);
+  border-radius: 28px;
+  background: #fff;
+  box-shadow: var(--shadow);
+  text-align: center;
+}
+.scan-store { margin: 4px 0 26px; font-size: clamp(1.3rem, 4vw, 1.7rem); }
+.scan-barcode {
+  display: flex;
+  justify-content: center;
+  padding: 22px;
+  border-radius: 14px;
+  background: #fff;
+}
+.scan-barcode svg {
+  width: 100%;
+  height: auto;
+  max-width: 420px;
+}
+.scan-card .rewards-number {
+  margin-top: 18px;
+  font-size: 1rem;
+}
+select {
+  width: 100%;
+  min-height: 46px;
+  padding: 10px 13px;
+  border: 1px solid var(--line);
+  border-radius: 12px;
+  outline: none;
+  color: var(--ink);
+  background: #fff;
+  font: inherit;
+}
+select:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }