meals support

make categories global
plan
2026-08-01 20:26:55 -04:00 · 2026-08-01 19:09:22 -04:00 · 2026-08-01 18:53:09 -04:00
53 changed files with 428 additions and 6473 deletions
@@ -3,7 +3,3 @@
 /sustenance.db*
 /.env
 /seed.json
 /e2e/node_modules/
 /e2e/test-results/
 /e2e/playwright-report/
 /test-results/
@@ -1,9 +0,0 @@
 when:
  event: [push, pull_request]
 steps:
  fmt:
    image: rust:1
    commands:
      - rustup component add rustfmt
      - cargo fmt --all -- --check
@@ -1,17 +0,0 @@
 when:
  - event: tag
 steps:
  build:
    image: rust:1
    commands:
      - cargo build --release
  publish:
    image: alpine:3.23
    commands:
      - apk add --no-cache nodejs
      - node ci/release.js target/release/sustenance
    environment:
      GITEA_RELEASE_TOKEN:
        from_secret: gitea_release_token
@@ -1,18 +0,0 @@
 when:
  event: [push, pull_request]
 steps:
  test:
    image: rust:1
    commands:
      - cargo test --all
      - cargo build --all
  e2e-test:
    image: node:24
    directory: e2e
    commands:
      - apt-get update
      - apt-get install -y --no-install-recommends ca-certificates fonts-liberation libasound2 libatk-bridge2.0-0 libatk1.0-0 libcups2 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0 libgtk-3-0 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 xdg-utils
      - npm install && npx playwright install chromium
      - npx playwright test
@@ -68,7 +68,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
 "axum-core",
- "base64 0.22.1",
+ "base64",
 "bytes",
 "form_urlencoded",
 "futures-util",
@@ -116,18 +116,6 @@ dependencies = [
 "tracing",
 ]
 [[package]]
 name = "barcoders"
 version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a3826fb6e98ec72c0c0db8c9a40af4932d16793021027469857e84c1b50a1e8f"
 [[package]]
 name = "base64"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -145,9 +133,6 @@ name = "bitflags"
 version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 dependencies = [
 "serde_core",
 ]
 [[package]]
 name = "blake2"
@@ -167,12 +152,6 @@ dependencies = [
 "generic-array",
 ]
 [[package]]
 name = "byteorder"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 [[package]]
 name = "bytes"
 version = "1.12.1"
@@ -195,12 +174,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 [[package]]
 name = "const-oid"
 version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -256,17 +229,6 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 [[package]]
 name = "der"
 version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
 "const-oid",
 "pem-rfc7468",
 "zeroize",
 ]
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -274,7 +236,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer",
 "const-oid",
 "crypto-common",
 "subtle",
 ]
@@ -321,17 +282,6 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "etcetera"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
 dependencies = [
 "cfg-if",
 "home",
 "windows-sys 0.48.0",
 ]
 [[package]]
 name = "event-listener"
 version = "5.4.2"
@@ -365,21 +315,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
 dependencies = [
 "foreign-types-shared",
 ]
 [[package]]
 name = "foreign-types-shared"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -514,12 +449,6 @@ dependencies = [
 "wasip2",
 ]
 [[package]]
 name = "half"
 version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b43ede17f21864e81be2fa654110bf1e793774238d86ef8555c37e6519c0403"
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -558,33 +487,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 [[package]]
 name = "hkdf"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
 "hmac",
 ]
 [[package]]
 name = "hmac"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
 "digest",
 ]
 [[package]]
 name = "home"
 version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
 dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -795,9 +697,6 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 dependencies = [
 "spin",
 ]
 [[package]]
 name = "libc"
@@ -805,24 +704,6 @@ version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 [[package]]
 name = "libm"
 version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 [[package]]
 name = "libredox"
 version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
 dependencies = [
 "bitflags",
 "libc",
 "plain",
 "redox_syscall 0.9.1",
 ]
 [[package]]
 name = "libsqlite3-sys"
 version = "0.30.1"
@@ -892,16 +773,6 @@ dependencies = [
 "syn 2.0.119",
 ]
 [[package]]
 name = "md-5"
 version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
 dependencies = [
 "cfg-if",
 "digest",
 ]
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -924,12 +795,6 @@ dependencies = [
 "unicase",
 ]
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 [[package]]
 name = "mio"
 version = "1.2.2"
@@ -941,16 +806,6 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "nom"
 version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
 dependencies = [
 "memchr",
 "minimal-lexical",
 ]
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -960,41 +815,6 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "num-bigint-dig"
 version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
 dependencies = [
 "lazy_static",
 "libm",
 "num-integer",
 "num-iter",
 "num-traits",
 "rand 0.8.7",
 "smallvec",
 "zeroize",
 ]
 [[package]]
 name = "num-integer"
 version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
 dependencies = [
 "num-traits",
 ]
 [[package]]
 name = "num-iter"
 version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
 dependencies = [
 "num-integer",
 "num-traits",
 ]
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -1002,7 +822,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
 "autocfg",
 "libm",
 ]
 [[package]]
@@ -1011,43 +830,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 [[package]]
 name = "openssl"
 version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
 "bitflags",
 "cfg-if",
 "foreign-types",
 "libc",
 "openssl-macros",
 "openssl-sys",
 ]
 [[package]]
 name = "openssl-macros"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.119",
 ]
 [[package]]
 name = "openssl-sys"
 version = "0.9.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
 "cc",
 "libc",
 "pkg-config",
 "vcpkg",
 ]
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -1072,7 +854,7 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
 "cfg-if",
 "libc",
- "redox_syscall 0.5.18",
+ "redox_syscall",
 "smallvec",
 "windows-link",
 ]
@@ -1088,15 +870,6 @@ dependencies = [
 "subtle",
 ]
 [[package]]
 name = "pem-rfc7468"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
 dependencies = [
 "base64ct",
 ]
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -1109,39 +882,12 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 [[package]]
 name = "pkcs1"
 version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
 dependencies = [
 "der",
 "pkcs8",
 "spki",
 ]
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
 "der",
 "spki",
 ]
 [[package]]
 name = "pkg-config"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 [[package]]
 name = "plain"
 version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -1283,15 +1029,6 @@ dependencies = [
 "bitflags",
 ]
 [[package]]
 name = "redox_syscall"
 version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07507be7b4a5f9f26eeb41eeaebb1f5a7ff29dfb29739facc21d35bf8b11c21e"
 dependencies = [
 "bitflags",
 ]
 [[package]]
 name = "regex-automata"
 version = "0.4.16"
@@ -1323,26 +1060,6 @@ dependencies = [
 "windows-sys 0.52.0",
 ]
 [[package]]
 name = "rsa"
 version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
 "const-oid",
 "digest",
 "num-bigint-dig",
 "num-integer",
 "num-traits",
 "pkcs1",
 "pkcs8",
 "rand_core 0.6.4",
 "signature",
 "spki",
 "subtle",
 "zeroize",
 ]
 [[package]]
 name = "rustls"
 version = "0.23.43"
@@ -1399,16 +1116,6 @@ dependencies = [
 "serde_derive",
 ]
 [[package]]
 name = "serde_cbor"
 version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bef2ebfde456fb76bbcf9f59315333decc4fda0b2b44b420243c11e0f5ec1f5"
 dependencies = [
 "half",
 "serde",
 ]
 [[package]]
 name = "serde_core"
 version = "1.0.229"
@@ -1512,16 +1219,6 @@ dependencies = [
 "libc",
 ]
 [[package]]
 name = "signature"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
 "digest",
 "rand_core 0.6.4",
 ]
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -1533,9 +1230,6 @@ name = "smallvec"
 version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 dependencies = [
 "serde",
 ]
 [[package]]
 name = "socket2"
@@ -1556,16 +1250,6 @@ dependencies = [
 "lock_api",
 ]
 [[package]]
 name = "spki"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
 "base64ct",
 "der",
 ]
 [[package]]
 name = "sqlx"
 version = "0.8.6"
@@ -1574,8 +1258,6 @@ checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
 dependencies = [
 "sqlx-core",
 "sqlx-macros",
 "sqlx-mysql",
 "sqlx-postgres",
 "sqlx-sqlite",
 ]
@@ -1585,7 +1267,7 @@ version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
 dependencies = [
- "base64 0.22.1",
+ "base64",
 "bytes",
 "crc",
 "crossbeam-queue",
@@ -1604,10 +1286,9 @@ dependencies = [
 "percent-encoding",
 "rustls",
 "serde",
 "serde_json",
 "sha2",
 "smallvec",
- "thiserror 2.0.19",
+ "thiserror",
 "tokio",
 "tokio-stream",
 "tracing",
@@ -1651,84 +1332,6 @@ dependencies = [
 "url",
 ]
 [[package]]
 name = "sqlx-mysql"
 version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
 dependencies = [
 "atoi",
 "base64 0.22.1",
 "bitflags",
 "byteorder",
 "bytes",
 "crc",
 "digest",
 "dotenvy",
 "either",
 "futures-channel",
 "futures-core",
 "futures-io",
 "futures-util",
 "generic-array",
 "hex",
 "hkdf",
 "hmac",
 "itoa",
 "log",
 "md-5",
 "memchr",
 "once_cell",
 "percent-encoding",
 "rand 0.8.7",
 "rsa",
 "sha1",
 "sha2",
 "smallvec",
 "sqlx-core",
 "stringprep",
 "thiserror 2.0.19",
 "tracing",
 "whoami",
 ]
 [[package]]
 name = "sqlx-postgres"
 version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
 dependencies = [
 "atoi",
 "base64 0.22.1",
 "bitflags",
 "byteorder",
 "crc",
 "dotenvy",
 "etcetera",
 "futures-channel",
 "futures-core",
 "futures-util",
 "hex",
 "hkdf",
 "hmac",
 "home",
 "itoa",
 "log",
 "md-5",
 "memchr",
 "once_cell",
 "rand 0.8.7",
 "serde",
 "serde_json",
 "sha2",
 "smallvec",
 "sqlx-core",
 "stringprep",
 "thiserror 2.0.19",
 "tracing",
 "whoami",
 ]
 [[package]]
 name = "sqlx-sqlite"
 version = "0.8.6"
@@ -1748,7 +1351,7 @@ dependencies = [
 "serde",
 "serde_urlencoded",
 "sqlx-core",
- "thiserror 2.0.19",
+ "thiserror",
 "tracing",
 "url",
 ]
@@ -1759,17 +1362,6 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "stringprep"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
 dependencies = [
 "unicode-bidi",
 "unicode-normalization",
 "unicode-properties",
 ]
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -1778,13 +1370,11 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 [[package]]
 name = "sustenance"
-version = "0.8.0"
+version = "0.1.0"
 dependencies = [
 "argon2",
 "async-trait",
 "axum",
 "barcoders",
 "base64 0.22.1",
 "futures-util",
 "hex",
 "maud",
@@ -1794,14 +1384,12 @@ dependencies = [
 "serde_json",
 "sha2",
 "sqlx",
- "thiserror 2.0.19",
+ "thiserror",
 "tokio",
 "tower",
 "tower-http",
 "tracing",
 "tracing-subscriber",
 "url",
 "webauthn-rs",
 ]
 [[package]]
@@ -1843,33 +1431,13 @@ dependencies = [
 "syn 2.0.119",
 ]
 [[package]]
 name = "thiserror"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
 "thiserror-impl 1.0.69",
 ]
 [[package]]
 name = "thiserror"
 version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
- "thiserror-impl 2.0.19",
+ "thiserror-impl",
 ]
 [[package]]
 name = "thiserror-impl"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.119",
 ]
 [[package]]
@@ -1902,21 +1470,6 @@ dependencies = [
 "zerovec",
 ]
 [[package]]
 name = "tinyvec"
 version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
 dependencies = [
 "tinyvec_macros",
 ]
 [[package]]
 name = "tinyvec_macros"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 [[package]]
 name = "tokio"
 version = "1.53.1"
@@ -2110,7 +1663,7 @@ dependencies = [
 "log",
 "rand 0.9.5",
 "sha1",
- "thiserror 2.0.19",
+ "thiserror",
 ]
 [[package]]
@@ -2125,33 +1678,12 @@ version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 [[package]]
 name = "unicode-normalization"
 version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
 dependencies = [
 "tinyvec",
 ]
 [[package]]
 name = "unicode-properties"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
@@ -2174,7 +1706,6 @@ dependencies = [
 "idna",
 "percent-encoding",
 "serde",
 "serde_derive",
 ]
 [[package]]
@@ -2216,31 +1747,6 @@ dependencies = [
 "wit-bindgen",
 ]
 [[package]]
 name = "wasite"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 [[package]]
 name = "webauthn-rs"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90b266eccb4b32595876f5c73ea443b0516da0b1df72ca07bc08ed9ba7f96ec1"
 dependencies = [
 "base64 0.13.1",
 "nom",
 "openssl",
 "rand 0.8.7",
 "serde",
 "serde_cbor",
 "serde_derive",
 "serde_json",
 "thiserror 1.0.69",
 "tracing",
 "url",
 ]
 [[package]]
 name = "webpki-roots"
 version = "0.26.11"
@@ -2259,38 +1765,19 @@ dependencies = [
 "rustls-pki-types",
 ]
 [[package]]
 name = "whoami"
 version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
 dependencies = [
 "libredox",
 "wasite",
 ]
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
 "windows-targets 0.48.5",
 ]
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets 0.52.6",
+ "windows-targets",
 ]
 [[package]]
@@ -2302,67 +1789,34 @@ dependencies = [
 "windows-link",
 ]
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
 dependencies = [
 "windows_aarch64_gnullvm 0.48.5",
 "windows_aarch64_msvc 0.48.5",
 "windows_i686_gnu 0.48.5",
 "windows_i686_msvc 0.48.5",
 "windows_x86_64_gnu 0.48.5",
 "windows_x86_64_gnullvm 0.48.5",
 "windows_x86_64_msvc 0.48.5",
 ]
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_gnullvm",
- "windows_aarch64_msvc 0.52.6",
+ "windows_aarch64_msvc",
- "windows_i686_gnu 0.52.6",
+ "windows_i686_gnu",
 "windows_i686_gnullvm",
- "windows_i686_msvc 0.52.6",
+ "windows_i686_msvc",
- "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnu",
- "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_gnullvm",
- "windows_x86_64_msvc 0.52.6",
+ "windows_x86_64_msvc",
 ]
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -2375,48 +1829,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
@@ -1,14 +1,12 @@
 [package]
 name = "sustenance"
-version = "0.8.0"
+version = "0.1.0"
 edition = "2024"
 [dependencies]
 argon2 = "0.5"
 async-trait = "0.1"
 axum = { version = "0.8", features = ["ws"] }
 barcoders = { version = "2.0.0", features = ["svg"] }
 base64 = "0.22"
 futures-util = "0.3"
 hex = "0.4"
 maud = "0.27"
@@ -17,18 +15,10 @@ rand = "0.8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
-sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "macros", "migrate", "tls-rustls"] }
+sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "macros", "tls-rustls"] }
 thiserror = "2"
 tokio = { version = "1", features = ["full"] }
 tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "set-header"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 url = "2"
 webauthn-rs = "0.3"
 [profile.release]
 opt-level = "z"
 strip = true
 lto = true
 codegen-units = 1
@@ -8,13 +8,7 @@ A small shared grocery list built with Rust, Axum, Maud, htmx, WebSockets, and S
 cargo run
 ```
-Open <http://localhost:3000>. The application creates `sustenance.db` in the
+Open <http://127.0.0.1:3000>. The application creates `sustenance.db` in the working directory on first start.
 working directory on first start.
 **Note:** use `localhost` (not `127.0.0.1`) when testing passkeys locally —
 browsers reject IP addresses as WebAuthn RP IDs. The app defaults to
 `localhost` for loopback hosts, so passkeys work out of the box when you access
 the site via `http://localhost:3000`.
 ## Configuration
@@ -26,9 +20,7 @@ the site via `http://localhost:3000`.
 | `COOKIE_SECURE` | `false` | Add the `Secure` attribute to session cookies |
 | `REGISTRATION_MODE` | `invite_only` | Use `open` for local development; otherwise registration requires a valid list invitation after the first account |
 | `SEED_CONFIG` | `seed.json` | Optional JSON file with a default user to create when the database is first initialized |
-| `RP_ID` | derived from `PUBLIC_BASE_URL` | WebAuthn relying party ID (the host users access the site from) |
+| `RUST_LOG` | `sustenance=debug,tower_http=info` | Log filter |
 | `RP_NAME` | `Sustenance` | WebAuthn relying party name shown to users |
 | `RUST_LOG` | `sustenance=info,tower_http=info` | Log filter; HTTP requests are logged at info level |
 ### Seeding a default user
@@ -49,7 +41,6 @@ The file is optional — if it is missing or invalid, seeding is silently skippe
 ## Current features
 - Email/password accounts with Argon2 password hashes
 - Optional WebAuthn passkeys for passwordless sign-in (managed from the account page)
 - Cookie-backed sessions and CSRF tokens for list mutations
 - Shared lists with one-time, seven-day invitation links
 - Invite-only registration by default after the first account
@@ -57,8 +48,6 @@ The file is optional — if it is missing or invalid, seeding is silently skippe
 - Global categories with common defaults seeded at startup and custom category creation
 - Items grouped by category and assigned from the add/edit forms
 - Meals with ingredients, markdown descriptions, and one-click "add meal to list"
 - Rewards cards with store name and number, rendered as scannable Code 128 / Code 39 barcodes
 - Single-card scan view that shows one barcode at a time and keeps the screen awake for scanning
 - Server-authoritative last-write-wins updates
 - Per-list WebSocket updates with server-rendered htmx fragments
 - In-memory presence for members currently viewing a list
@@ -73,23 +62,3 @@ cargo fmt --all -- --check
 cargo check
 cargo test
 ```
 ### End-to-end tests (Playwright)
 The e2e tests live in `e2e/` and use Playwright with a real browser. Each test
 starts its own server against a fresh, throwaway database on a unique port, so
 tests are fully isolated from each other and from your real `sustenance.db`.
 The tests launch `target/debug/sustenance`, so build the server first:
 ```sh
 # one-time setup
 cargo build
 cd e2e
 npm install
 npx playwright install chromium
 # run the tests (each test launches its own server against a fresh DB)
 cd e2e
 npx playwright test
 ```
@@ -1,91 +0,0 @@
 import * as fs from 'node:fs/promises';
 import { basename } from 'node:path';
 function getEnv(name) {
    const val = process.env[name];
    if (!val) {
        throw new Error(`Environment variable ${name} is empty`);
    }
    return val;
 }
 async function fetchJSON(url, options) {
    const resp = await fetch(url, options);
    if (!resp.ok) {
        throw new Error(`Unexpected HTTP status: ${resp.status}`, {
            cause: {
                status: resp.status,
                body: await resp.text(),
            },
        });
    }
    return await resp.json();
 }
 async function postJSON(url, token, payload) {
    return fetchJSON(url, {
        method: "POST",
        headers: {
            "Authorization": `token ${token}`,
            "Content-Type": "application/json",
        },
        body: JSON.stringify(payload),
    });
 }
 async function postFile(url, token, files) {
    const formData = new FormData();
    for (const [name, path] of Object.entries(files)) {
        const fileBuffer = await fs.readFile(path);
        const fileObject = new File([fileBuffer], basename(path), { type: 'application/octet-stream' });
        formData.append(name, fileObject)
    }
    return await fetchJSON(url, {
        method: "POST",
        headers: {
            "Authorization": `token ${token}`,
        },
        body: formData,
    });
 }
 async function canRead(path) {
    try {
        await fs.access(path, fs.constants.R_OK);
        return true;
    } catch {
        return false;
    }
 }
 async function main() {
    const path = process.argv[2];
    if (!path || !canRead(path)) {
        throw Error(`Path ${path} is undefined or inaccessible, use node release.js <path>`);
    }
    const token = getEnv("GITEA_RELEASE_TOKEN");
    const tag = getEnv("CI_COMMIT_TAG");
    const repo = getEnv("CI_REPO");
    console.log("Creating release...");
    const releaseData = await postJSON(`https://git.sbstp.ca/api/v1/repos/${repo}/releases`, token, {
        name: `Release ${tag}`,
        tag_name: tag,
        target_commitish: tag,
        draft: false,
        prerelease: false,
    });
    console.log(`Created release ID ${releaseData.id}`);
    console.log("Uploading asset...");
    const assetData = await postFile(`https://git.sbstp.ca/api/v1/repos/${repo}/releases/${releaseData.id}/assets?name=${basename(path)}`, token, {
        attachment: path,
    });
    console.log("Asset uploaded:", assetData);
 }
 try {
    await main();
 } catch (err) {
    console.error(err);
 }
@@ -1,112 +0,0 @@
 import { test as base, expect, Page } from "@playwright/test";
 import { spawn, ChildProcess } from "child_process";
 import * as os from "os";
 import * as path from "path";
 /**
 * Starts a fresh Sustenance server against an in-memory SQLite database on a
 * unique port for each test, and tears it down afterwards. Every test gets a
 * clean DB with no shared state between tests, and nothing is written to disk.
 */
 export const test = base.extend<{ server: { baseURL: string }; page: Page }>({
  server: [
    async ({}, use) => {
      const server = await startServer();
      await use({ baseURL: server.baseURL });
      await killTree(server.child);
    },
    { scope: "test", auto: true },
  ],
  // Provide a page whose baseURL points at this test's server.
  page: async ({ browser, server }, use) => {
    const context = await browser.newContext({ baseURL: server.baseURL });
    const page = await context.newPage();
    await use(page);
    await context.close();
  },
 });
 /** Starts a server, retrying on a fresh port if the first attempt fails to bind. */
 async function startServer() {
  for (let attempt = 0; attempt < 5; attempt++) {
    const port = 20000 + Math.floor(Math.random() * 30000);
    const baseURL = `http://localhost:${port}`;
    const child = spawn(
      path.resolve(__dirname, "..", "target", "debug", "sustenance"),
      [],
      {
        env: {
          ...process.env,
          DATABASE_IN_MEMORY: "1",
          REGISTRATION_MODE: "open",
          BIND_ADDRESS: `127.0.0.1:${port}`,
          PUBLIC_BASE_URL: baseURL,
          // WebAuthn requires a valid domain for the RP ID; localhost is allowed.
          RP_ID: "localhost",
          // Point SEED_CONFIG at a nonexistent file so no default user is created.
          SEED_CONFIG: path.join(os.tmpdir(), "sustenance-e2e-no-seed.json"),
        },
        stdio: ["ignore", "ignore", "pipe"],
        // Run in its own process group so we can kill the whole tree.
        detached: true,
      },
    );
    let stderr = "";
    child.stderr?.on("data", (chunk) => {
      stderr += chunk.toString();
    });
    try {
      await waitForServer(baseURL, child);
      return { baseURL, child };
    } catch (error) {
      // The server may have failed to bind (port collision). Clean up and retry.
      await killTree(child);
      if (attempt === 4) {
        throw new Error(
          `server failed to start after retries; last stderr:\n${stderr}\n${error}`,
        );
      }
    }
  }
  throw new Error("unreachable");
 }
 async function waitForServer(baseURL: string, child: ChildProcess) {
  const deadline = Date.now() + 60_000;
  while (Date.now() < deadline) {
    if (child.exitCode !== null) {
      throw new Error(`server exited early with code ${child.exitCode}`);
    }
    try {
      const res = await fetch(baseURL + "/login");
      if (res.ok) return;
    } catch {
      // not up yet
    }
    await new Promise((r) => setTimeout(r, 200));
  }
  throw new Error("timed out waiting for server to start");
 }
 async function killTree(child: ChildProcess) {
  try {
    process.kill(-child.pid!, "SIGTERM");
  } catch {
    child.kill("SIGTERM");
  }
  // Give it a moment to shut down gracefully, then force-kill if needed.
  const exited = new Promise((resolve) => child.once("exit", resolve));
  const timeout = new Promise((resolve) => setTimeout(resolve, 5000));
  await Promise.race([exited, timeout]);
  try {
    process.kill(-child.pid!, "SIGKILL");
  } catch {
    /* already gone */
  }
 }
 export { expect };
@@ -1,79 +0,0 @@
 import { Page, expect } from "@playwright/test";
 /** Registers a fresh account and lands on the lists page. */
 export async function registerAndLogin(page: Page, email: string) {
  await page.goto("/register");
  await page.fill("#display-name", "Test User");
  await page.fill("#email", email);
  await page.fill("#password", "a-strong-password");
  await page.click('button[type="submit"]');
  await expect(page).toHaveURL(/\/lists/);
 }
 /** Creates a meal with the given name and markdown description. */
 export async function createMeal(
  page: Page,
  name: string,
  description: string,
  category?: string,
 ) {
  await page.goto("/meals/new");
  await page.fill("#meal-name", name);
  if (category) {
    await page.selectOption("#meal-category", { label: category });
  }
  await page.fill("#meal-description", description);
  await page.click('button:has-text("Save meal")');
  await expect(page).toHaveURL(/\/meals\/\d+/);
 }
 /** Creates a list and lands on its page. */
 export async function createList(page: Page, name: string) {
  await page.goto("/lists");
  await page.fill("#list-name", name);
  await page.click('button:has-text("Create list")');
  await expect(page).toHaveURL(/\/lists\/\d+/);
 }
 /** Adds an item to the current list page. */
 export async function addItem(page: Page, name: string, quantity = "") {
  await page.fill("#item-name", name);
  if (quantity) {
    await page.fill("#item-quantity", quantity);
  }
  await page.click("#add-item-button");
  await expect(page.locator(".item-row").filter({ hasText: name })).toBeVisible();
 }
 /** Adds an ingredient to the current meal page. */
 export async function addIngredient(
  page: Page,
  name: string,
  quantity = "",
  category?: string,
 ) {
  await page.fill("#ingredient-name", name);
  if (category) {
    await page.selectOption("#ingredient-category", { label: category });
  }
  if (quantity) {
    await page.fill("#ingredient-quantity", quantity);
  }
  await page.click("#add-ingredient-button");
  // The form submit is hx-boosted (full body swap to the same URL), so wait for
  // the new row to appear. This also acts as a settle point so the next action
  // doesn't race the async body replacement and target a stale form.
  await expect(page.locator(".ingredient-list").filter({ hasText: name })).toBeVisible();
 }
 /** Creates a meal and adds the given ingredients to it. */
 export async function createMealWithIngredients(
  page: Page,
  name: string,
  ingredients: Array<{ name: string; quantity?: string }>,
 ) {
  await createMeal(page, name, "");
  for (const ingredient of ingredients) {
    await addIngredient(page, ingredient.name, ingredient.quantity ?? "");
  }
 }
@@ -1,90 +0,0 @@
 {
  "name": "sustenance-e2e",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sustenance-e2e",
      "version": "1.0.0",
      "devDependencies": {
        "@playwright/test": "^1.45.0",
        "@types/node": "^26.1.2"
      }
    },
    "node_modules/@playwright/test": {
      "version": "1.62.1",
      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.62.1.tgz",
      "integrity": "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==",
      "dev": true,
      "dependencies": {
        "playwright": "1.62.1"
      },
      "bin": {
        "playwright": "cli.js"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@types/node": {
      "version": "26.1.2",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
      "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
      "dev": true,
      "dependencies": {
        "undici-types": "~8.3.0"
      }
    },
    "node_modules/fsevents": {
      "version": "2.3.2",
      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
      "dev": true,
      "hasInstallScript": true,
      "optional": true,
      "os": [
        "darwin"
      ],
      "engines": {
        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
      }
    },
    "node_modules/playwright": {
      "version": "1.62.1",
      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.62.1.tgz",
      "integrity": "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==",
      "dev": true,
      "dependencies": {
        "playwright-core": "1.62.1"
      },
      "bin": {
        "playwright": "cli.js"
      },
      "engines": {
        "node": ">=20"
      },
      "optionalDependencies": {
        "fsevents": "2.3.2"
      }
    },
    "node_modules/playwright-core": {
      "version": "1.62.1",
      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
      "dev": true,
      "bin": {
        "playwright-core": "cli.js"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/undici-types": {
      "version": "8.3.0",
      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
      "dev": true
    }
  }
 }
@@ -1,13 +0,0 @@
 {
  "name": "sustenance-e2e",
  "version": "1.0.0",
  "private": true,
  "scripts": {
    "test": "playwright test",
    "test:headed": "playwright test --headed"
  },
  "devDependencies": {
    "@playwright/test": "^1.45.0",
    "@types/node": "^26.1.2"
  }
 }
@@ -1,10 +0,0 @@
 import { defineConfig } from "@playwright/test";
 export default defineConfig({
  testDir: "./tests",
  timeout: 30_000,
  retries: 2,
  use: {
    trace: "on-first-retry",
  },
 });
@@ -1,98 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createList, createMealWithIngredients } from "../helpers";
 test("a user can add a meal's ingredients to a list via the picker", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Spaghetti Bolognese", [
    { name: "Penne", quantity: "500g" },
    { name: "Tomato", quantity: "2" },
  ]);
  await createList(page, "Weekly shop");
  // Open the add-meal picker.
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await expect(picker).toBeVisible();
  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
  // Select the meal.
  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
  // The picker closes and the meal's ingredients appear as items.
  await expect(picker).toHaveCount(0);
  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toBeVisible();
  await expect(page.locator(".item-row").filter({ hasText: "Penne" }).locator(".item-qty")).toHaveText("(500g)");
 });
 test("the add-meal picker closes via the close button", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Spaghetti Bolognese", [{ name: "Penne" }]);
  await createList(page, "Weekly shop");
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await expect(picker).toBeVisible();
  await picker.locator(".meal-picker-close").click();
  await expect(picker).toHaveCount(0);
 });
 test("the add-meal picker closes when clicking outside", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Spaghetti Bolognese", [{ name: "Penne" }]);
  await createList(page, "Weekly shop");
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await expect(picker).toBeVisible();
  // Click the backdrop itself (outside the modal card), at the viewport corner.
  await page.mouse.click(10, 10);
  await expect(picker).toHaveCount(0);
 });
 test("a meal added to a list is shown in the meals panel", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Spaghetti Bolognese", [
    { name: "Penne", quantity: "500g" },
    { name: "Tomato", quantity: "2" },
  ]);
  await createList(page, "Weekly shop");
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
  // The meal appears in the "Meals on this list" panel.
  const panel = page.locator("#list-meals-panel");
  await expect(panel).toBeVisible();
  await expect(panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
 });
 test("removing a meal from a list removes its ingredients", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Spaghetti Bolognese", [
    { name: "Penne", quantity: "500g" },
    { name: "Tomato", quantity: "2" },
  ]);
  await createList(page, "Weekly shop");
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toBeVisible();
  // Remove the meal from the list.
  const panel = page.locator("#list-meals-panel");
  const row = panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" });
  await row.locator(".list-meal-remove-button").click();
  // The meal's ingredients are removed from the list.
  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toHaveCount(0);
  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toHaveCount(0);
  await expect(row).toHaveCount(0);
 });
@@ -1,83 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createList, addItem } from "../helpers";
 test("a user can archive a list and it moves to the archive page", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  // Archive from the list page.
  await page.click('button:has-text("Archive")');
  // Lands back on the lists page; the list is no longer shown.
  await expect(page).toHaveURL(/\/lists/);
  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toHaveCount(0);
  // The archived list is reachable from the archive page.
  await page.goto("/archive");
  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toBeVisible();
 });
 test("the lists frame links to the archive page", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await page.goto("/lists");
  await page.click('a.archive-link');
  await expect(page).toHaveURL(/\/archive/);
 });
 test("an archived list is read-only", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await addItem(page, "Apple");
  await page.click('button:has-text("Archive")');
  // Open the archived list directly.
  await page.goto("/archive");
  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
  await expect(page).toHaveURL(/\/lists\/\d+/);
  // The item is still visible.
  await expect(page.locator(".item-row").filter({ hasText: "Apple" })).toBeVisible();
  // No mutation UI is present.
  await expect(page.locator("#add-item-form")).toHaveCount(0);
  await expect(page.locator(".item-actions-button")).toHaveCount(0);
  await expect(page.locator(".check-form")).toHaveCount(0);
  await expect(page.locator('button:has-text("+ Add meal")')).toHaveCount(0);
 });
 test("a user can restore an archived list and edit it again", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await addItem(page, "Apple");
  await page.click('button:has-text("Archive")');
  // Open the archived list and restore it.
  await page.goto("/archive");
  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
  await page.click('button:has-text("Restore")');
  // Back on the lists page, the list is active again.
  await expect(page).toHaveURL(/\/lists/);
  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toBeVisible();
  // The list is editable again.
  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
  await expect(page.locator("#add-item-form")).toBeVisible();
  await addItem(page, "Banana");
  await expect(page.locator(".item-row").filter({ hasText: "Banana" })).toBeVisible();
 });
 test("the archive page shows the list name and created date", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await page.click('button:has-text("Archive")');
  await page.goto("/archive");
  const card = page.locator(".list-card").filter({ hasText: "Weekly shop" });
  await expect(card).toBeVisible();
  // The card shows a created date (e.g. "Created 7 Aug 2026").
  await expect(card.locator("small")).toContainText("Created");
 });
@@ -1,45 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin } from "../helpers";
 test("a user can register and log in", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await expect(page.locator("h1")).toContainText("Grocery lists");
 });
 test("a user can log out", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await page.click('button:has-text("Sign out")');
  await expect(page).toHaveURL(/\/login/);
  await expect(page.locator("h1")).toContainText("Welcome back");
 });
 test("a user can change their password", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await page.goto("/account");
  await page.fill("#new-password", "a-new-strong-password");
  await page.fill("#confirm-password", "a-new-strong-password");
  await page.click('button:has-text("Update password")');
  await expect(page.locator(".alert-success")).toContainText("updated");
  // The old password no longer works; the new one does.
  await page.click('button:has-text("Sign out")');
  await page.fill("#email", "alice@example.com");
  await page.fill("#password", "a-strong-password");
  await page.click('button[type="submit"]');
  await expect(page.locator(".alert-error")).toContainText("incorrect");
  await page.fill("#email", "alice@example.com");
  await page.fill("#password", "a-new-strong-password");
  await page.click('button[type="submit"]');
  await expect(page).toHaveURL(/\/lists/);
 });
 test("changing password rejects a mismatched confirmation", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await page.goto("/account");
  await page.fill("#new-password", "a-new-strong-password");
  await page.fill("#confirm-password", "a-different-password");
  await page.click('button:has-text("Update password")');
  await expect(page.locator(".alert-error")).toContainText("do not match");
 });
@@ -1,134 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createList, createMealWithIngredients } from "../helpers";
 /**
 * Opens the carry-over modal and waits for htmx to finish swapping it in, so
 * the source `<select>`'s `change` trigger is bound before interacting with it.
 */
 async function openCarryModal(page: import("@playwright/test").Page) {
  await page.click(".carry-over-button");
  const carry = page.locator(".meal-picker-backdrop");
  await expect(carry).toBeVisible();
  // Let htmx finish processing the freshly-swapped modal before selecting a
  // source; otherwise the change event can be missed and no hx-get fires.
  await page.waitForTimeout(300);
  return carry;
 }
 test("a user can carry meals over from a previous list without re-adding ingredients", async ({
  page,
 }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Spaghetti Bolognese", [
    { name: "Penne", quantity: "500g" },
    { name: "Tomato", quantity: "2" },
  ]);
  // Last week's list has the meal added (with its ingredients as items).
  await createList(page, "Last week");
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await picker
    .locator(".meal-picker-button")
    .filter({ hasText: "Spaghetti Bolognese" })
    .click();
  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
  // Create this week's (new) list.
  await createList(page, "This week");
  await expect(page.locator(".item-row")).toHaveCount(0);
  // Open the carry-over modal and pick the source list.
  const carry = await openCarryModal(page);
  await expect(carry.locator(".carry-intro")).toContainText("already purchased");
  await carry.locator("#carry-source").selectOption({ label: "Last week" });
  // The source list's meals appear as selectable rows.
  const row = carry.locator(".carry-row").filter({ hasText: "Spaghetti Bolognese" });
  await expect(row).toBeVisible();
  // Select the meal and finish.
  await row.locator('input[type="checkbox"]').check();
  await carry.locator(".carry-submit").click();
  // The modal closes, the meal appears in the meals panel, but no items are added.
  await expect(carry).toHaveCount(0);
  const panel = page.locator("#list-meals-panel");
  await expect(panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
  await expect(page.locator(".item-row")).toHaveCount(0);
 });
 test("the carry-over modal lists active lists newest first and excludes the current list", async ({
  page,
 }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "First list");
  await createList(page, "Second list");
  // Open carry-over on the second (current) list.
  await page.click(".carry-over-button");
  const carry = page.locator(".meal-picker-backdrop");
  await expect(carry).toBeVisible();
  const options = carry.locator("#carry-source option");
  // The current list is excluded; only the other list remains.
  await expect(options).toHaveCount(2); // placeholder + one source
  await expect(carry.locator("#carry-source")).toContainText("First list");
  await expect(carry.locator("#carry-source")).not.toContainText("Second list");
 });
 test("carrying a meal does not remove it from the source list", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Pasta", [{ name: "Penne" }]);
  await createList(page, "Last week");
  await page.click(".add-meal-button");
  await page
    .locator(".meal-picker-backdrop .meal-picker-button")
    .filter({ hasText: "Pasta" })
    .click();
  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
  await createList(page, "This week");
  const carry = await openCarryModal(page);
  // Select the source list; the meal rows load via hx-get.
  await carry.locator("#carry-source").selectOption({ label: "Last week" });
  const row = carry.locator(".carry-row").filter({ hasText: "Pasta" });
  await expect(row).toBeVisible({ timeout: 10_000 });
  await row.locator('input[type="checkbox"]').check();
  await carry.locator(".carry-submit").click();
  await expect(carry).toHaveCount(0);
  // The source list still has its meal and items.
  await page.goto("/lists");
  await page.locator(".list-card").filter({ hasText: "Last week" }).click();
  await expect(page.locator("#list-meals-panel .list-meal-row").filter({ hasText: "Pasta" })).toBeVisible();
  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
 });
 test("submitting carry-over with no selection does not add a meal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMealWithIngredients(page, "Pasta", [{ name: "Penne" }]);
  await createList(page, "Last week");
  await page.click(".add-meal-button");
  await page
    .locator(".meal-picker-backdrop .meal-picker-button")
    .filter({ hasText: "Pasta" })
    .click();
  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
  await createList(page, "This week");
  const carry = await openCarryModal(page);
  // Select the source list; the meal rows load via hx-get.
  await carry.locator("#carry-source").selectOption({ label: "Last week" });
  await expect(carry.locator(".carry-row").filter({ hasText: "Pasta" })).toBeVisible({
    timeout: 10_000,
  });
  // Submit with nothing selected; the modal stays open and no meal is carried.
  await carry.locator(".carry-submit").click();
  await expect(carry).toBeVisible();
  await expect(page.locator("#list-meals-panel .list-meal-row")).toHaveCount(0);
 });
@@ -1,93 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createList, addItem } from "../helpers";
 test("a user can create a list", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await expect(page.locator("h1")).toContainText("Weekly shop");
  await expect(page.locator(".empty-items")).toBeVisible();
 });
 test("a user can add an item with a quantity", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await addItem(page, "Apple", "2");
  // Quantity renders in parens to the left of the name.
  const row = page.locator(".item-row").filter({ hasText: "Apple" });
  await expect(row.locator(".item-qty")).toHaveText("(2)");
  await expect(row.locator("strong")).toHaveText("Apple");
 });
 test("a user can check off an item", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await addItem(page, "Apple");
  const row = page.locator(".item-row").filter({ hasText: "Apple" });
  await row.locator(".check-button").click();
  await expect(row).toHaveClass(/is-checked/);
 });
 test("clicking an item's text toggles the checkbox", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await addItem(page, "Apple");
  const row = page.locator(".item-row").filter({ hasText: "Apple" });
  await row.locator(".item-copy").click();
  await expect(row).toHaveClass(/is-checked/);
 });
 test("a user can edit an item via the actions modal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await addItem(page, "Apple", "2");
  const row = page.locator(".item-row").filter({ hasText: "Apple" });
  await row.locator(".item-actions-button").click();
  const dialog = row.locator("dialog.item-modal");
  await expect(dialog).toBeVisible();
  await dialog.locator('[id^="item-edit-name"]').fill("Banana");
  await dialog.locator('[id^="item-edit-quantity"]').fill("6");
  await dialog.locator('[id^="item-edit-save"]').click();
  const updated = page.locator(".item-row").filter({ hasText: "Banana" });
  await expect(updated).toBeVisible();
  await expect(updated.locator(".item-qty")).toHaveText("(6)");
 });
 test("a user can delete an item via the actions modal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  await addItem(page, "Apple");
  const row = page.locator(".item-row").filter({ hasText: "Apple" });
  await row.locator(".item-actions-button").click();
  const dialog = row.locator("dialog.item-modal");
  await expect(dialog).toBeVisible();
  await dialog.locator('[id^="item-edit-delete"]').click();
  await expect(page.locator(".item-row").filter({ hasText: "Apple" })).toHaveCount(0);
  await expect(page.locator(".empty-items")).toBeVisible();
 });
 test("a user can add a category", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  // Categories are managed from the main lists page.
  await page.goto("/lists");
  await page.fill("#category-name", "Bakery");
  await page.click("#add-category-button");
  await expect(page.locator(".category-chip").filter({ hasText: "Bakery" })).toBeVisible();
 });
@@ -1,111 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createMeal } from "../helpers";
 test("meals are grouped under their category on the meals page", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Beef Stew", "", "Beef");
  await createMeal(page, "Chicken Curry", "", "Chicken");
  await createMeal(page, "Plain Rice", "");
  await page.goto("/meals");
  // Each category appears as a heading with its meals beneath it.
  const beef = page.locator(".category-group").filter({ hasText: "Beef" });
  await expect(beef.locator(".category-heading")).toContainText("Beef");
  await expect(beef.locator(".list-card").filter({ hasText: "Beef Stew" })).toBeVisible();
  const chicken = page.locator(".category-group").filter({ hasText: "Chicken" });
  await expect(chicken.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
  // Uncategorized meals land in their own group.
  const uncategorized = page.locator(".category-group").filter({ hasText: "Uncategorized" });
  await expect(uncategorized.locator(".list-card").filter({ hasText: "Plain Rice" })).toBeVisible();
 });
 test("a user can create a meal category", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await page.goto("/meals");
  await page.fill('form[action="/meals/categories"] input[name="name"]', "Breakfast");
  await page.click('form[action="/meals/categories"] button[type="submit"]');
  await expect(page).toHaveURL(/\/meals$/);
  await expect(page.locator(".meal-category-name").filter({ hasText: "Breakfast" })).toBeVisible();
 });
 test("a user can delete a meal category and its meals become uncategorized", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  // Create a custom category and a meal in it.
  await page.goto("/meals");
  await page.fill('form[action="/meals/categories"] input[name="name"]', "Breakfast");
  await page.click('form[action="/meals/categories"] button[type="submit"]');
  await expect(page).toHaveURL(/\/meals$/);
  await createMeal(page, "Pancakes", "", "Breakfast");
  // Delete the category.
  await page.goto("/meals");
  const row = page.locator(".meal-category-row").filter({ hasText: "Breakfast" });
  await row.locator(".meal-category-delete").click();
  await expect(page).toHaveURL(/\/meals$/);
  // The category is gone and the meal is now uncategorized.
  await expect(page.locator(".meal-category-name").filter({ hasText: "Breakfast" })).toHaveCount(0);
  const uncategorized = page.locator(".category-group").filter({ hasText: "Uncategorized" });
  await expect(uncategorized.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
 });
 test("a user can change a meal's category via the edit modal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Beef Stew", "", "Beef");
  await page.click('button:has-text("Edit")');
  const dialog = page.locator("dialog#meal-edit-modal");
  await expect(dialog).toBeVisible();
  await dialog.locator("#meal-edit-category").selectOption({ label: "Chicken" });
  await dialog.locator("#meal-edit-save").click();
  await expect(page).toHaveURL(/\/meals\/\d+/);
  await page.goto("/meals");
  const chicken = page.locator(".category-group").filter({
    has: page.locator(".category-heading", { hasText: "Chicken" }),
  });
  await expect(chicken.locator(".list-card").filter({ hasText: "Beef Stew" })).toBeVisible();
  const beef = page.locator(".category-group").filter({
    has: page.locator(".category-heading", { hasText: "Beef" }),
  });
  await expect(beef.locator(".list-card").filter({ hasText: "Beef Stew" })).toHaveCount(0);
 });
 test("a meal's category is shown on its page", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Beef Stew", "", "Beef");
  await expect(page.locator(".meal-category-label")).toHaveText("(Beef)");
 });
 test("the add-meal picker groups meals by category", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Beef Stew", "", "Beef");
  await createMeal(page, "Chicken Curry", "", "Chicken");
  // Go to a list to open the picker.
  await page.goto("/lists");
  await page.fill("#list-name", "Weekly shop");
  await page.click('button:has-text("Create list")');
  await expect(page).toHaveURL(/\/lists\/\d+/);
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await expect(picker).toBeVisible();
  const beef = picker.locator(".category-group").filter({ hasText: "Beef" });
  await expect(beef.locator(".meal-picker-button").filter({ hasText: "Beef Stew" })).toBeVisible();
  const chicken = picker.locator(".category-group").filter({ hasText: "Chicken" });
  await expect(chicken.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
 });
@@ -1,57 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createList, createMeal } from "../helpers";
 test("the meals page filters by name as you type", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  await createMeal(page, "Chicken Curry", "");
  await createMeal(page, "Pancakes", "");
  await page.goto("/meals");
  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
  await expect(page.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
  // Type a query; only matching meals remain.
  await page.fill("#meal-search", "chicken");
  await expect(page.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toHaveCount(0);
  // Clearing the search restores all meals.
  await page.fill("#meal-search", "");
  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
 });
 test("the meals page shows an empty state when nothing matches", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  await page.goto("/meals");
  await page.fill("#meal-search", "zzzz");
  await expect(page.locator(".meal-filter-empty")).toBeVisible();
  await expect(page.locator(".list-card")).toHaveCount(0);
 });
 test("the add-meal picker filters meals as you type", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  await createMeal(page, "Chicken Curry", "");
  await createList(page, "Weekly shop");
  await page.click(".add-meal-button");
  const picker = page.locator(".meal-picker-backdrop");
  await expect(picker).toBeVisible();
  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
  await picker.locator(".meal-filter").fill("curry");
  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
  // The search box keeps focus and the modal stays open.
  await expect(picker.locator(".meal-filter")).toBeFocused();
  await expect(picker).toBeVisible();
 });
@@ -1,87 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createMeal, addIngredient } from "../helpers";
 test("a user can add an ingredient to a meal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  await addIngredient(page, "Penne", "500g");
  const row = page.locator(".ingredient-list").filter({ hasText: "Penne" });
  await expect(row.locator(".item-qty")).toHaveText("(500g)");
  await expect(row.locator("strong")).toHaveText("Penne");
 });
 test("a user can edit a meal name and description via the modal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "A classic.");
  await page.click('button:has-text("Edit")');
  const dialog = page.locator("dialog#meal-edit-modal");
  await expect(dialog).toBeVisible();
  await dialog.locator("#meal-edit-name").fill("Pasta al Pomodoro");
  await dialog.locator("#meal-edit-description").fill("## Ingredients\n\nA simple tomato sauce.");
  await dialog.locator("#meal-edit-save").click();
  await expect(page.locator("h1")).toContainText("Pasta al Pomodoro");
  await expect(page.locator(".markdown h2")).toContainText("Ingredients");
 });
 test("a user can delete a meal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  page.on("dialog", (dialog) => dialog.accept());
  await page.click('button:has-text("Delete")');
  await expect(page).toHaveURL(/\/meals$/);
  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
 });
 test("a user can edit an ingredient via the actions modal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  await addIngredient(page, "Penne", "500g");
  const row = page.locator(".ingredient-list").filter({ hasText: "Penne" });
  await row.locator(".item-actions-button").click();
  const dialog = row.locator("dialog.item-modal");
  await expect(dialog).toBeVisible();
  await dialog.locator('[id^="ingredient-edit-name"]').fill("Rigatoni");
  await dialog.locator('[id^="ingredient-edit-quantity"]').fill("400g");
  await dialog.locator('[id^="ingredient-edit-save"]').click();
  const updated = page.locator(".ingredient-list").filter({ hasText: "Rigatoni" });
  await expect(updated).toBeVisible();
  await expect(updated.locator(".item-qty")).toHaveText("(400g)");
 });
 test("a user can delete an ingredient via the actions modal", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  await addIngredient(page, "Penne");
  const row = page.locator(".ingredient-list").filter({ hasText: "Penne" });
  await row.locator(".item-actions-button").click();
  const dialog = row.locator("dialog.item-modal");
  await expect(dialog).toBeVisible();
  await dialog.locator('[id^="ingredient-edit-delete"]').click();
  await expect(page.locator(".ingredient-list").filter({ hasText: "Penne" })).toHaveCount(0);
 });
 test("ingredients are grouped under their categories", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await createMeal(page, "Spaghetti Bolognese", "");
  // Add an ingredient in the default "Produce" category.
  await addIngredient(page, "Tomato", "", "Produce");
  // Add one without a category.
  await addIngredient(page, "Penne");
  await expect(page.locator(".category-heading").filter({ hasText: "Produce" })).toBeVisible();
  await expect(page.locator(".category-heading").filter({ hasText: "Uncategorized" })).toBeVisible();
 });
@@ -1,46 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin } from "../helpers";
 /**
 * Enables a virtual WebAuthn authenticator on the given context so the browser
 * can complete passkey ceremonies without a real device.
 */
 async function enableVirtualAuthenticator(context: any) {
  const cdp = await context.newCDPSession(context.pages()[0]);
  await cdp.send("WebAuthn.enable", { enableUI: false });
  await cdp.send("WebAuthn.addVirtualAuthenticator", {
    options: {
      protocol: "ctap2",
      transport: "internal",
      hasResidentKey: true,
      hasUserVerification: true,
      isUserVerified: true,
    },
  });
 }
 test("a user can register a passkey and sign in with it", async ({ page, browser, server }) => {
  const context = await browser.newContext({ baseURL: server.baseURL });
  const p = await context.newPage();
  await enableVirtualAuthenticator(context);
  // Register with a password first.
  await registerAndLogin(p, "alice@example.com");
  // Add a passkey from the account page.
  await p.goto("/account");
  await p.click("#add-passkey");
  await expect(p.locator(".passkey-row")).toHaveCount(1);
  // Log out.
  await p.click('button:has-text("Sign out")');
  await expect(p).toHaveURL(/\/login/);
  // Sign in with the passkey without entering an email (userless sign-in).
  await p.click("#passkey-login");
  await expect(p).toHaveURL(/\/lists/);
  await context.close();
 });
@@ -1,169 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin } from "../helpers";
 /** Navigates to the rewards cards page. */
 async function gotoRewards(page: import("@playwright/test").Page) {
  await page.goto("/rewards");
  await expect(page.locator("h1")).toContainText("Rewards cards");
 }
 /**
 * Adds a rewards card and lands back on the /rewards page with it rendered.
 */
 async function addCard(
  page: import("@playwright/test").Page,
  storeName: string,
  number: string,
  symbology?: string,
 ) {
  await page.fill("#store-name", storeName);
  await page.fill("#card-number", number);
  if (symbology) {
    await page.selectOption("#symbology", symbology);
  }
  await page.click('button:has-text("Add card")');
  await expect(page).toHaveURL(/\/rewards$/);
  const card = page.locator(".rewards-card").filter({ hasText: storeName });
  await expect(card).toBeVisible();
  return card;
 }
 test("the rewards page shows an empty state before any cards are added", async ({
  page,
 }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  await expect(page.locator(".empty-state")).toContainText("No rewards cards yet");
  await expect(page.locator(".rewards-card")).toHaveCount(0);
 });
 test("the Rewards link is available in the site navigation", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  const nav = page.locator(".site-nav");
  await expect(nav.locator('a[href="/rewards"]')).toHaveText("Rewards");
 });
 test("a user can add a rewards card and see its barcode", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  const card = await addCard(page, "Kroger", "606171584511340224537");
  // The card renders an inline SVG barcode and the store's card number.
  await expect(card.locator(".rewards-barcode svg")).toBeVisible();
  await expect(card.locator(".rewards-number")).toHaveText("606171584511340224537");
  // The barcode should be included via the embedded SVG (Code 128 set B→C mix),
  // not rendered client-side from scratch by an image.
  const svg = card.locator(".rewards-barcode svg");
  await expect(svg).toHaveAttribute("viewBox", /\d+ \d+/);
 });
 test("a user can add a card as Code 39 and see its barcode", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  const card = await addCard(page, "Safeway", "ABC123", "code39");
  await expect(card.locator(".rewards-barcode svg")).toBeVisible();
 });
 test("multiple rewards cards are each rendered with their own barcode", async ({
  page,
 }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  await addCard(page, "Kroger", "606171584511340224537");
  await addCard(page, "Safeway", "012345678901");
  await expect(page.locator(".rewards-card")).toHaveCount(2);
  await expect(page.locator(".rewards-card").filter({ hasText: "Kroger" })).toBeVisible();
  await expect(page.locator(".rewards-card").filter({ hasText: "Safeway" })).toBeVisible();
 });
 test("removing a rewards card prompts for confirmation and deletes on accept", async ({
  page,
 }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  await addCard(page, "Kroger", "606171584511340224537");
  await expect(page).toHaveURL(/\/rewards$/);
  await expect(page.locator(".rewards-card")).toHaveCount(1);
  page.on("dialog", (dialog) => dialog.accept());
  await page.click('button:has-text("Remove")');
  // The card is deleted and the empty state returns.
  await expect(page.locator(".rewards-card")).toHaveCount(0);
  await expect(page.locator(".empty-state")).toContainText("No rewards cards yet");
 });
 test("cancelling the remove confirmation keeps the rewards card", async ({
  page,
 }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  await addCard(page, "Kroger", "606171584511340224537");
  await expect(page.locator(".rewards-card")).toHaveCount(1);
  page.on("dialog", (dialog) => dialog.dismiss());
  await page.click('button:has-text("Remove")');
  // The card must remain after cancelling.
  await expect(page.locator(".rewards-card")).toHaveCount(1);
  await expect(page.locator(".rewards-card").filter({ hasText: "Kroger" })).toBeVisible();
 });
 test("a user can open a single-card scan view with only one barcode", async ({
  page,
 }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  await addCard(page, "Kroger", "606171584511340224537");
  await addCard(page, "Safeway", "012345678901");
  // Click the Kroger card's barcode to open its focused scan view.
  await page
    .locator(".rewards-card")
    .filter({ hasText: "Kroger" })
    .locator(".rewards-card-link")
    .click();
  await expect(page).toHaveURL(/\/rewards\/\d+/);
  // Only one barcode is rendered on the scan page.
  await expect(page.locator(".scan-barcode svg")).toHaveCount(1);
  await expect(page.locator(".scan-store")).toHaveText("Kroger");
  await expect(page.locator(".scan-card .rewards-number")).toHaveText(
    "606171584511340224537",
  );
  // The wake-lock script is loaded on the scan page.
  await expect(page.locator('script[src*="rewards.js"]')).toHaveCount(1);
  // Back link returns to the list.
  await page.click('.scan-back');
  await expect(page).toHaveURL(/\/rewards$/);
 });
 test("a scan view for another user's card is not accessible", async ({ page }) => {
  await registerAndLogin(page, "alice@example.com");
  await gotoRewards(page);
  await addCard(page, "Kroger", "606171584511340224537");
  // Grab the card id from the URL of the scan view.
  await page
    .locator(".rewards-card-link")
    .click();
  const url = page.url();
  const cardId = url.split("/").pop();
  // Sign out and sign in as a different user.
  await page.click('button:has-text("Sign out")');
  await registerAndLogin(page, "bob@example.com");
  // Bob cannot view Alice's card.
  await page.goto(`/rewards/${cardId}`);
  await expect(page.locator(".scan-barcode svg")).toHaveCount(0);
 });
@@ -1,44 +0,0 @@
 import { expect } from "@playwright/test";
 import { test } from "../fixtures";
 import { registerAndLogin, createList, addItem } from "../helpers";
 test("a list updates live for another user via websocket", async ({ page, browser, server }) => {
  // User A registers and creates a list.
  await registerAndLogin(page, "alice@example.com");
  await createList(page, "Weekly shop");
  const listUrl = page.url();
  // User B registers in a separate context (separate session).
  const contextB = await browser.newContext({ baseURL: server.baseURL });
  const pageB = await contextB.newPage();
  await registerAndLogin(pageB, "bob@example.com");
  // Both users open the same list.
  await page.goto(listUrl);
  await pageB.goto(listUrl);
  // Give the websocket connections a moment to establish.
  await page.waitForTimeout(500);
  // Both start with an empty list.
  await expect(pageB.locator("#list-meta")).toHaveText("0 items left out of 0");
  // User A adds an item.
  await addItem(page, "Apple", "2");
  // It should appear on User B's page without any reload.
  await expect(pageB.locator(".item-row").filter({ hasText: "Apple" })).toBeVisible();
  await expect(pageB.locator(".item-row").filter({ hasText: "Apple" }).locator(".item-qty")).toHaveText("(2)");
  // The left/total count should also update live for User B.
  await expect(pageB.locator("#list-meta")).toHaveText("1 items left out of 1");
  // User A removes the item.
  await page.locator(".item-actions-button").first().click();
  await page.locator("[id^='item-edit-delete']").click();
  // The item and the count should update live on User B's page.
  await expect(pageB.locator(".item-row").filter({ hasText: "Apple" })).toHaveCount(0);
  await expect(pageB.locator("#list-meta")).toHaveText("0 items left out of 0");
  await contextB.close();
 });
@@ -1,39 +0,0 @@
 # Set the Cargo.toml version, commit it, and tag the commit with that version.
 # Usage: just tag 1.2.3
 tag ver:
    #!/usr/bin/env bash
    set -euo pipefail
    # Validate the version argument.
    if [[ ! "{{ver}}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
        echo "error: version must be in the form X.Y.Z (got '{{ver}}')" >&2
        exit 1
    fi
    # Bump the version in Cargo.toml.
    sed -i -E "s/^version = \".*\"/version = \"{{ver}}\"/" Cargo.toml
    # Regenerate Cargo.lock so it reflects the new version.
    cargo build
    # Stage, commit, and tag.
    git add Cargo.toml Cargo.lock
    git commit -m "version {{ver}} [skip ci]"
    git tag "{{ver}}"
    git push
    git push --tags
 # Run the Rust unit tests.
 # Usage: just test
 test:
    cargo test --all
 # Format the Rust code.
 # Usage: just fmt
 fmt:
    cargo fmt --all
 # Run the end-to-end Playwright tests.
 # Usage: just e2e
 e2e:
    cd e2e && npm test
@@ -1,81 +0,0 @@
 CREATE TABLE users (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    email TEXT NOT NULL UNIQUE COLLATE NOCASE,
    display_name TEXT NOT NULL,
    password_hash TEXT NOT NULL,
    user_handle BLOB NOT NULL UNIQUE,
    created_at INTEGER NOT NULL
 );
 CREATE TABLE sessions (
    token_hash BLOB PRIMARY KEY,
    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    csrf_token BLOB NOT NULL,
    expires_at INTEGER NOT NULL
 );
 CREATE TABLE passkeys (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    credential_id TEXT NOT NULL UNIQUE,
    credential TEXT NOT NULL,
    counter INTEGER NOT NULL DEFAULT 0,
    created_at INTEGER NOT NULL
 );
 CREATE TABLE lists (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    name TEXT NOT NULL,
    revision INTEGER NOT NULL DEFAULT 0,
    created_at INTEGER NOT NULL
 );
 CREATE TABLE categories (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
    position INTEGER NOT NULL DEFAULT 0,
    created_at INTEGER NOT NULL
 );
 CREATE TABLE invitations (
    token_hash BLOB PRIMARY KEY,
    created_by INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    expires_at INTEGER NOT NULL
 );
 CREATE TABLE items (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    list_id INTEGER NOT NULL REFERENCES lists(id) ON DELETE CASCADE,
    name TEXT NOT NULL,
    quantity TEXT NOT NULL DEFAULT '',
    note TEXT NOT NULL DEFAULT '',
    category_id INTEGER REFERENCES categories(id) ON DELETE SET NULL,
    checked INTEGER NOT NULL DEFAULT 0,
    version INTEGER NOT NULL DEFAULT 1,
    position INTEGER NOT NULL DEFAULT 0,
    created_at INTEGER NOT NULL,
    updated_at INTEGER NOT NULL
 );
 CREATE TABLE meals (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    name TEXT NOT NULL,
    description TEXT NOT NULL DEFAULT '',
    created_at INTEGER NOT NULL,
    updated_at INTEGER NOT NULL
 );
 CREATE TABLE meal_ingredients (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    meal_id INTEGER NOT NULL REFERENCES meals(id) ON DELETE CASCADE,
    name TEXT NOT NULL,
    quantity TEXT NOT NULL DEFAULT '',
    note TEXT NOT NULL DEFAULT '',
    category_id INTEGER REFERENCES categories(id) ON DELETE SET NULL,
    position INTEGER NOT NULL DEFAULT 0
 );
 CREATE INDEX items_list_idx ON items(list_id);
 CREATE INDEX meal_ingredients_meal_idx ON meal_ingredients(meal_id);
 CREATE INDEX sessions_user_idx ON sessions(user_id);
 CREATE INDEX passkeys_user_idx ON passkeys(user_id);
@@ -1,10 +0,0 @@
 CREATE TABLE meal_categories (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
    position INTEGER NOT NULL DEFAULT 0,
    created_at INTEGER NOT NULL
 );
 ALTER TABLE meals ADD COLUMN category_id INTEGER REFERENCES meal_categories(id) ON DELETE SET NULL;
 CREATE INDEX meals_category_idx ON meals(category_id);
@@ -1,12 +0,0 @@
 CREATE TABLE list_meals (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    list_id INTEGER NOT NULL REFERENCES lists(id) ON DELETE CASCADE,
    meal_id INTEGER REFERENCES meals(id) ON DELETE SET NULL,
    name TEXT NOT NULL,
    created_at INTEGER NOT NULL
 );
 ALTER TABLE items ADD COLUMN list_meal_id INTEGER REFERENCES list_meals(id) ON DELETE CASCADE;
 CREATE INDEX list_meals_list_idx ON list_meals(list_id);
 CREATE INDEX items_list_meal_idx ON items(list_meal_id);
@@ -1 +0,0 @@
 ALTER TABLE lists ADD COLUMN archived_at INTEGER;
@@ -1,10 +0,0 @@
 CREATE TABLE rewards_cards (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    store_name TEXT NOT NULL,
    number TEXT NOT NULL,
    symbology TEXT NOT NULL DEFAULT 'code128',
    created_at INTEGER NOT NULL
 );
 CREATE INDEX rewards_cards_user_idx ON rewards_cards(user_id);
@@ -1,85 +0,0 @@
 use std::collections::HashMap;
 use std::sync::LazyLock;
 use sha2::{Digest, Sha256};
 /// A single static asset: its embedded bytes and a content hash used to
 /// version its URL.
 pub struct StaticAsset {
    pub data: &'static [u8],
    pub hash: String,
 }
 /// A registry of the app's static assets, keyed by filename. Each asset's
 /// content hash is computed once on first use and cached, so the versioned URL
 /// changes automatically whenever the underlying file changes.
 pub struct StaticAssetStore {
    assets: HashMap<&'static str, StaticAsset>,
 }
 impl StaticAssetStore {
    fn new(entries: &[(&'static str, &'static [u8])]) -> Self {
        let assets = entries
            .iter()
            .map(|(name, data)| {
                let hash = content_hash(data);
                (*name, StaticAsset { data, hash })
            })
            .collect();
        Self { assets }
    }
    /// Looks up an asset by its filename (e.g. `"style.css"`).
    pub fn get(&self, name: &str) -> Option<&StaticAsset> {
        self.assets.get(name)
    }
    /// Returns the versioned URL for an asset, e.g. `/static/style.css?v=<hash>`.
    pub fn url(&self, name: &str) -> Option<String> {
        self.assets
            .get(name)
            .map(|asset| format!("/static/{name}?v={}", asset.hash))
    }
 }
 fn content_hash(data: &[u8]) -> String {
    let mut hasher = Sha256::new();
    hasher.update(data);
    hex::encode(hasher.finalize())
 }
 /// Constructs a `StaticAssetStore` from `name => path` pairs, embedding each
 /// file's bytes at compile time via `include_bytes!`.
 macro_rules! static_assets {
    ($($name:literal => $path:literal),* $(,)?) => {
        StaticAssetStore::new(&[
            $(($name, include_bytes!($path))),*
        ])
    };
 }
 /// The app's static assets, loaded once on first use.
 pub static STORE: LazyLock<StaticAssetStore> = LazyLock::new(|| {
    static_assets! {
        "style.css" => "../static/style.css",
        "passkey-login.js" => "../static/passkey-login.js",
        "passkey-register.js" => "../static/passkey-register.js",
        "password-toggle.js" => "../static/password-toggle.js",
        "rewards.js" => "../static/rewards.js",
        "htmx.min.js" => "../static/htmx.min.js",
        "idiomorph-ext.min.js" => "../static/idiomorph-ext.min.js",
        "htmx-ws.min.js" => "../static/htmx-ws.min.js",
        "favicon.ico" => "../static/favicon.ico",
        "favicon-32x32.png" => "../static/favicon-32x32.png",
        "apple-touch-icon.png" => "../static/apple-touch-icon.png",
        "logo.svg" => "../static/logo.svg",
    }
 });
 /// Returns the versioned URL for a known asset, panicking if the name isn't
 /// registered (a programmer error, since these are compile-time constants).
 pub fn url(name: &str) -> String {
    STORE
        .url(name)
        .unwrap_or_else(|| panic!("unknown static asset: {name}"))
 }
@@ -19,22 +19,6 @@ pub struct User {
    pub id: i64,
    pub email: String,
    pub display_name: String,
    /// Opaque, random user handle used as the WebAuthn userHandle. Kept
    /// high-entropy and unpredictable per the WebAuthn spec to avoid user
    /// enumeration and cross-site correlation. Stored as raw bytes.
    pub user_handle: Vec<u8>,
 }
 #[derive(Clone, Debug)]
 pub struct Passkey {
    pub id: i64,
    pub user_id: i64,
    pub credential_id: String,
    pub credential: String,
    /// WebAuthn sign counter, persisted for future cloned-authenticator
    /// detection. Not currently read by application logic.
    #[allow(dead_code)]
    pub counter: i64,
 }
 #[derive(Clone, Debug)]
@@ -48,10 +32,6 @@ pub struct GroceryList {
    pub id: i64,
    pub name: String,
    pub revision: i64,
    /// Unix timestamp of when the list was created.
    pub created_at: i64,
    /// Unix timestamp of when the list was archived; `None` when active.
    pub archived_at: Option<i64>,
 }
 #[derive(Clone, Debug)]
@@ -72,18 +52,11 @@ pub struct Category {
    pub name: String,
 }
 #[derive(Clone, Debug)]
 pub struct MealCategory {
    pub id: i64,
    pub name: String,
 }
 #[derive(Clone, Debug)]
 pub struct Meal {
    pub id: i64,
    pub name: String,
    pub description: String,
    pub category_id: Option<i64>,
    pub ingredients: Vec<MealIngredient>,
 }
@@ -96,36 +69,8 @@ pub struct MealIngredient {
    pub category_id: Option<i64>,
 }
 #[derive(Clone, Debug)]
 pub struct ListMeal {
    pub id: i64,
    /// The catalog meal this instance came from; `None` once the meal is deleted.
    #[allow(dead_code)]
    pub meal_id: Option<i64>,
    pub name: String,
    /// When the meal was added to the list.
    #[allow(dead_code)]
    pub created_at: i64,
 }
 #[derive(Clone, Debug)]
 pub struct PresenceUser {
    pub user_id: i64,
    pub display_name: String,
 }
 /// A stored rewards-card number that can be shown as a scannable barcode.
 #[derive(Clone, Debug)]
 pub struct RewardsCard {
    pub id: i64,
    /// The owner of this card.
    #[allow(dead_code)]
    pub user_id: i64,
    pub store_name: String,
    pub number: String,
    /// Symbology used to render the barcode (e.g. "code128", "code39").
    pub symbology: String,
    /// When the card was added.
    #[allow(dead_code)]
    pub created_at: i64,
 }
@@ -5,7 +5,7 @@ use std::time::Duration;
 use axum::{
    Router,
    extract::{
-        Form, FromRequest, FromRequestParts, Json, Path, Query, Request, State,
+        Form, FromRequest, FromRequestParts, Path, Query, Request, State,
        ws::{Message, WebSocket, WebSocketUpgrade},
    },
    http::{HeaderMap, HeaderValue, StatusCode, header, request::Parts},
@@ -14,20 +14,19 @@ use axum::{
    routing::{get, post},
 };
 use futures_util::{SinkExt, StreamExt};
 use maud::PreEscaped;
 use serde::{Deserialize, de::DeserializeOwned};
 use thiserror::Error;
-use tower_http::trace::{DefaultMakeSpan, DefaultOnResponse, TraceLayer};
+use tower_http::{
-use tracing::{Level, error, warn};
+    services::ServeDir,
    set_header::SetResponseHeaderLayer,
    trace::TraceLayer,
 };
 use tracing::{error, warn};
 use crate::assets;
 use crate::domain::{DomainError, SessionUser};
 use crate::ports::{HubEvent, RealtimeNotifier};
-use crate::services::{
+use crate::services::{AuthService, InvitationService, ListService, MealService};
    AuthService, InvitationService, ListService, MealService, RewardsCardService,
 };
 use crate::views;
 use crate::webauthn::WebAuthnService;
 #[derive(Clone)]
 pub struct AppState {
@@ -35,8 +34,6 @@ pub struct AppState {
    pub lists: Arc<ListService>,
    pub meals: Arc<MealService>,
    pub invitations: Arc<InvitationService>,
    pub rewards_cards: Arc<RewardsCardService>,
    pub webauthn: Arc<WebAuthnService>,
    pub realtime: Arc<dyn RealtimeNotifier>,
    pub cookie_secure: bool,
    pub public_base_url: String,
@@ -50,20 +47,15 @@ pub enum AppError {
    BadRequest(String),
    #[error("not found")]
    NotFound,
    #[error("list is archived")]
    Archived,
 }
 impl IntoResponse for AppError {
    fn into_response(self) -> Response {
        match self {
-            AppError::Database(error) => {
+            AppError::Database(_) => status_html_response(
-                error!(%error, "request failed");
+                StatusCode::INTERNAL_SERVER_ERROR,
-                status_html_response(
+                views::error_page("500", "Something went wrong."),
-                    StatusCode::INTERNAL_SERVER_ERROR,
+            ),
                    views::error_page("500", "Something went wrong."),
                )
            }
            AppError::BadRequest(message) => {
                status_html_response(StatusCode::BAD_REQUEST, views::error_page("400", &message))
            }
@@ -71,10 +63,6 @@ impl IntoResponse for AppError {
                StatusCode::NOT_FOUND,
                views::error_page("404", "That page could not be found."),
            ),
            AppError::Archived => status_html_response(
                StatusCode::CONFLICT,
                views::error_page("409", "This list is archived and cannot be modified."),
            ),
        }
    }
 }
@@ -85,24 +73,8 @@ pub fn build_router(state: AppState) -> Router {
        .route("/login", get(login_page).post(login))
        .route("/register", get(register_page).post(register))
        .route("/logout", post(logout))
        .route("/account", get(account_page))
        .route("/auth/passkey/register/start", post(passkey_register_start))
        .route(
            "/auth/passkey/register/finish",
            post(passkey_register_finish),
        )
        .route("/auth/passkey/login/start", post(passkey_login_start))
        .route("/auth/passkey/login/finish", post(passkey_login_finish))
        .route(
            "/account/passkeys/{passkey_id}/delete",
            post(delete_passkey),
        )
        .route("/account/password", post(change_password))
        .route("/lists", get(lists_page).post(create_list))
        .route("/archive", get(archive_page))
        .route("/lists/{list_id}", get(list_page))
        .route("/lists/{list_id}/archive", post(archive_list))
        .route("/lists/{list_id}/unarchive", post(unarchive_list))
        .route("/lists/{list_id}/items", post(add_item))
        .route("/lists/{list_id}/items/{item_id}/check", post(check_item))
        .route("/lists/{list_id}/items/{item_id}/edit", post(edit_item))
@@ -111,45 +83,26 @@ pub fn build_router(state: AppState) -> Router {
        .route("/invitations", post(create_invitation))
        .route("/meals", get(meals_page).post(create_meal))
        .route("/meals/new", get(new_meal_page))
        .route("/meals/categories", post(create_meal_category))
        .route(
            "/meals/categories/{category_id}/delete",
            post(delete_meal_category),
        )
        .route("/meals/{meal_id}", get(meal_page))
        .route("/meals/{meal_id}/edit", post(edit_meal))
        .route("/meals/{meal_id}/delete", post(delete_meal))
        .route("/meals/{meal_id}/ingredients", post(add_ingredient))
-        .route(
+        .route("/meals/{meal_id}/ingredients/{ingredient_id}/edit", post(edit_ingredient))
-            "/meals/{meal_id}/ingredients/{ingredient_id}/edit",
+        .route("/meals/{meal_id}/ingredients/{ingredient_id}/delete", post(delete_ingredient))
            post(edit_ingredient),
        )
        .route(
            "/meals/{meal_id}/ingredients/{ingredient_id}/delete",
            post(delete_ingredient),
        )
        .route("/lists/{list_id}/add-meal", post(add_meal_to_list))
        .route(
            "/lists/{list_id}/meals/{list_meal_id}/remove",
            post(remove_meal_from_list),
        )
        .route(
            "/lists/{list_id}/carry",
            get(carry_over_modal).post(carry_meals),
        )
        .route("/lists/{list_id}/carry/meals", get(carry_source_meals))
        .route("/rewards", get(rewards_page).post(create_rewards_card))
        .route("/rewards/{card_id}", get(rewards_scan_page))
        .route("/rewards/{card_id}/delete", post(delete_rewards_card))
        .route("/lists/{list_id}/stream", get(list_stream))
        .route("/invite/{token}", get(invitation_page))
        .route("/invite/{token}/accept", post(accept_invitation))
-        .route("/static/{path}", get(static_asset))
+        .nest_service(
-        .layer(
+            "/static",
-            TraceLayer::new_for_http()
+            tower::ServiceBuilder::new()
-                .make_span_with(DefaultMakeSpan::new().level(Level::INFO))
+                .layer(SetResponseHeaderLayer::overriding(
-                .on_response(DefaultOnResponse::new().level(Level::INFO)),
+                    header::CACHE_CONTROL,
                    HeaderValue::from_static("public, max-age=0, must-revalidate"),
                ))
                .service(ServeDir::new("static")),
        )
        .layer(TraceLayer::new_for_http())
        .layer(middleware::from_fn(log_response_status))
        .with_state(state)
 }
@@ -272,56 +225,11 @@ struct CategoryForm {
    csrf: String,
 }
 #[derive(Debug, Deserialize)]
 struct RewardsCardForm {
    store_name: String,
    number: String,
    symbology: String,
    csrf: String,
 }
 #[derive(Debug, Deserialize)]
 struct PasskeyRegisterStartForm {
    csrf: String,
 }
 #[derive(Debug, Deserialize)]
 struct PasskeyRegisterFinishForm {
    csrf: String,
    response: webauthn_rs::proto::RegisterPublicKeyCredential,
 }
 #[derive(Debug, Deserialize)]
 struct PasskeyLoginStartForm {
    #[serde(default)]
    email: String,
 }
 #[derive(Debug, Deserialize)]
 struct PasskeyLoginFinishForm {
    token: String,
    response: webauthn_rs::proto::PublicKeyCredential,
 }
 #[derive(Debug, Deserialize)]
 struct DeletePasskeyForm {
    csrf: String,
 }
 #[derive(Debug, Deserialize)]
 struct ChangePasswordForm {
    csrf: String,
    new_password: String,
    confirm_password: String,
 }
 #[derive(Debug, Deserialize)]
 struct MealForm {
    name: String,
    #[serde(default)]
    description: String,
    #[serde(default)]
    category_id: Option<String>,
    csrf: String,
 }
@@ -343,55 +251,15 @@ struct AddMealForm {
    csrf: String,
 }
 #[derive(Debug, Deserialize)]
 struct CarrySourceQuery {
    source: i64,
 }
 #[derive(Debug, Deserialize)]
 struct CarryMealsForm {
    source_list_id: i64,
    /// Selected list_meal ids as a comma-separated string, since the form
    /// extractor does not coalesce repeated keys into a Vec.
    #[serde(default)]
    list_meal_ids: String,
    csrf: String,
 }
 #[derive(Debug, Deserialize)]
 struct MealPickerQuery {
    picker: Option<i64>,
    q: Option<String>,
 }
 async fn home() -> Redirect {
    Redirect::to("/lists")
 }
 /// Serves a file embedded in the binary from the `static/` folder.
 ///
 /// Every asset is served with an immutable, long-lived cache header. Because
 /// the HTML references each asset under a URL that is versioned by its content
 /// hash, a changed file gets a new URL and the cache is never stale.
 async fn static_asset(Path(path): Path<String>) -> Response {
    let Some(asset) = assets::STORE.get(&path) else {
        return StatusCode::NOT_FOUND.into_response();
    };
    let mime = match path.rsplit('.').next() {
        Some("css") => "text/css",
        Some("ico") => "image/x-icon",
        Some("png") => "image/png",
        Some("svg") => "image/svg+xml",
        _ => "application/javascript",
    };
    let mut response = ([(header::CONTENT_TYPE, mime)], asset.data).into_response();
    response.headers_mut().insert(
        header::CACHE_CONTROL,
        HeaderValue::from_static("public, max-age=31536000, immutable"),
    );
    response
 }
 async fn log_response_status(request: Request, next: Next) -> Response {
    let method = request.method().clone();
    let uri = request.uri().clone();
@@ -511,161 +379,18 @@ async fn logout(State(state): State<AppState>, user: CurrentUser) -> Result<Resp
    Ok(response)
 }
 async fn account_page(
    State(state): State<AppState>,
    user: CurrentUser,
 ) -> Result<Response, AppError> {
    let passkeys = state.webauthn.list_passkeys(user.session.user.id).await?;
    Ok(html_response(views::account_page(
        &user.session.user,
        &passkeys,
        &user.session.csrf_token,
        None,
        false,
    )))
 }
 async fn change_password(
    State(state): State<AppState>,
    user: CurrentUser,
    LoggedForm(form): LoggedForm<ChangePasswordForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    let passkeys = state.webauthn.list_passkeys(user.session.user.id).await?;
    let render = |error: Option<&str>, success: bool| {
        html_response(views::account_page(
            &user.session.user,
            &passkeys,
            &user.session.csrf_token,
            error,
            success,
        ))
    };
    if form.new_password != form.confirm_password {
        return Ok(render(
            Some("New password and confirmation do not match."),
            false,
        ));
    }
    state
        .auth
        .change_password(user.session.user.id, form.new_password)
        .await?;
    Ok(render(None, true))
 }
 async fn passkey_register_start(
    State(state): State<AppState>,
    user: CurrentUser,
    Json(form): Json<PasskeyRegisterStartForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    let challenge = state
        .webauthn
        .start_registration(&user.session.user)
        .map_err(AppError::Database)?;
    Ok(Json(challenge).into_response())
 }
 async fn passkey_register_finish(
    State(state): State<AppState>,
    user: CurrentUser,
    Json(form): Json<PasskeyRegisterFinishForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    state
        .webauthn
        .finish_registration(&user.session.user, form.response)
        .await?;
    Ok(Redirect::to("/account").into_response())
 }
 async fn passkey_login_start(
    State(state): State<AppState>,
    Json(form): Json<PasskeyLoginStartForm>,
 ) -> Result<Response, AppError> {
    let email = form.email.trim().to_lowercase();
    let (challenge, token) = if email.is_empty() {
        // Userless sign-in: no email needed, the authenticator selects a
        // discoverable credential and returns a user handle.
        state
            .webauthn
            .start_userless_authentication()
            .await
            .map_err(AppError::Database)?
    } else {
        let Some((user, _)) = state.auth.find_user_by_email(email).await? else {
            return Err(AppError::NotFound);
        };
        state
            .webauthn
            .start_authentication(user.id)
            .await
            .map_err(AppError::Database)?
    };
    Ok(
        Json(serde_json::json!({ "token": token, "publicKey": challenge.public_key }))
            .into_response(),
    )
 }
 async fn passkey_login_finish(
    State(state): State<AppState>,
    Json(form): Json<PasskeyLoginFinishForm>,
 ) -> Result<Response, AppError> {
    let user_id = state
        .webauthn
        .finish_authentication(form.token, form.response)
        .await?;
    let (session_token, _) = state.auth.create_session_for_user(user_id).await?;
    let mut response = Redirect::to("/lists").into_response();
    set_session_cookie(&mut response, &session_token, state.cookie_secure);
    Ok(response)
 }
 async fn delete_passkey(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(passkey_id): Path<i64>,
    LoggedForm(form): LoggedForm<DeletePasskeyForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    state
        .webauthn
        .delete_passkey(user.session.user.id, passkey_id)
        .await?;
    Ok(Redirect::to("/account").into_response())
 }
 async fn lists_page(
    State(state): State<AppState>,
    user: CurrentUser,
 ) -> Result<Response, AppError> {
    let lists = state.lists.list_summaries().await?;
    let archived = state.lists.list_archived_summaries().await?;
    let categories = state.lists.categories().await?;
    Ok(html_response(views::lists_page(
        &user.session.user,
        &lists,
        archived.len(),
        &categories,
        &user.session.csrf_token,
    )))
 }
 async fn archive_page(
    State(state): State<AppState>,
    user: CurrentUser,
 ) -> Result<Response, AppError> {
    let archived_lists = state.lists.list_archived_summaries().await?;
    Ok(html_response(views::archive_page(
        &user.session.user,
        &archived_lists,
    )))
 }
 async fn create_list(
    State(state): State<AppState>,
    user: CurrentUser,
@@ -690,43 +415,17 @@ async fn list_page(
    let access = require_list(&state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
    let list_meals = state.meals.list_meals_on_list(list_id).await?;
    let presence = state.realtime.presence(list_id).await;
    Ok(html_response(views::list_page(
        &user.session.user,
        &access,
        &items,
        &categories,
        &list_meals,
        &presence,
        &user.session.csrf_token,
    )))
 }
 async fn archive_list(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(list_id): Path<i64>,
    LoggedForm(form): LoggedForm<CsrfForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    require_list(&state, list_id).await?;
    state.lists.archive_list(list_id).await?;
    Ok(Redirect::to("/lists").into_response())
 }
 async fn unarchive_list(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(list_id): Path<i64>,
    LoggedForm(form): LoggedForm<CsrfForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    require_list(&state, list_id).await?;
    state.lists.unarchive_list(list_id).await?;
    Ok(Redirect::to("/lists").into_response())
 }
 async fn add_item(
    State(state): State<AppState>,
    user: CurrentUser,
@@ -734,7 +433,7 @@ async fn add_item(
    LoggedForm(form): LoggedForm<ItemForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_mutable_list(&state, list_id).await?;
+    require_list(&state, list_id).await?;
    let name = form.name.trim().to_owned();
    let quantity = form.quantity.trim().to_owned();
    let note = form.note.trim().to_owned();
@@ -758,7 +457,7 @@ async fn check_item(
    LoggedForm(form): LoggedForm<CheckForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_mutable_list(&state, list_id).await?;
+    require_list(&state, list_id).await?;
    let checked = match form.checked.as_str() {
        "1" | "true" => true,
        "0" | "false" => false,
@@ -778,7 +477,7 @@ async fn edit_item(
    LoggedForm(form): LoggedForm<ItemForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_mutable_list(&state, list_id).await?;
+    require_list(&state, list_id).await?;
    let name = form.name.trim().to_owned();
    if name.is_empty() || name.chars().count() > 120 {
        return Err(AppError::BadRequest(
@@ -806,7 +505,7 @@ async fn delete_item(
    LoggedForm(form): LoggedForm<CsrfForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_mutable_list(&state, list_id).await?;
+    require_list(&state, list_id).await?;
    state.lists.delete_item(list_id, item_id).await?;
    list_fragment_response(&state, &user, list_id).await
 }
@@ -827,178 +526,26 @@ async fn create_category(
    Ok(Redirect::to("/lists").into_response())
 }
 async fn create_meal_category(
    State(state): State<AppState>,
    user: CurrentUser,
    LoggedForm(form): LoggedForm<CategoryForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    let name = form.name.trim().to_owned();
    if name.is_empty() || name.chars().count() > 60 {
        return Err(AppError::BadRequest(
            "Category names must be between 1 and 60 characters.".into(),
        ));
    }
    state.meals.create_meal_category(name).await?;
    Ok(Redirect::to("/meals").into_response())
 }
 async fn delete_meal_category(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(category_id): Path<i64>,
    LoggedForm(form): LoggedForm<CsrfForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    state.meals.delete_meal_category(category_id).await?;
    Ok(Redirect::to("/meals").into_response())
 }
 async fn rewards_page(
    State(state): State<AppState>,
    user: CurrentUser,
 ) -> Result<Response, AppError> {
    let cards = state.rewards_cards.list_cards(user.session.user.id).await?;
    Ok(html_response(views::rewards_page(
        &user.session.user,
        &cards,
        &user.session.csrf_token,
    )))
 }
 async fn rewards_scan_page(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(card_id): Path<i64>,
 ) -> Result<Response, AppError> {
    let card = state
        .rewards_cards
        .get_card(user.session.user.id, card_id)
        .await?
        .ok_or(AppError::NotFound)?;
    Ok(html_response(views::rewards_scan_page(
        &user.session.user,
        &card,
    )))
 }
 async fn create_rewards_card(
    State(state): State<AppState>,
    user: CurrentUser,
    LoggedForm(form): LoggedForm<RewardsCardForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    let store_name = form.store_name.trim().to_owned();
    let number = form.number.trim().to_owned();
    let symbology = normalize_symbology(&form.symbology);
    if store_name.is_empty() || store_name.chars().count() > 60 {
        return Err(AppError::BadRequest(
            "Store names must be between 1 and 60 characters.".into(),
        ));
    }
    if number.is_empty() || number.chars().count() > 80 {
        return Err(AppError::BadRequest(
            "Card numbers must be between 1 and 80 characters.".into(),
        ));
    }
    state
        .rewards_cards
        .create_card(user.session.user.id, store_name, number, symbology)
        .await?;
    Ok(Redirect::to("/rewards").into_response())
 }
 async fn delete_rewards_card(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(card_id): Path<i64>,
    LoggedForm(form): LoggedForm<CsrfForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    state
        .rewards_cards
        .delete_card(user.session.user.id, card_id)
        .await?;
    Ok(Redirect::to("/rewards").into_response())
 }
 /// Normalizes a submitted symbology value to a known barcode type, falling
 /// back to Code 128 for unknown or empty values.
 fn normalize_symbology(value: &str) -> String {
    match value.trim().to_ascii_lowercase().as_str() {
        "code39" => "code39".to_owned(),
        _ => "code128".to_owned(),
    }
 }
 async fn meals_page(
    State(state): State<AppState>,
    user: CurrentUser,
    Query(query): Query<MealPickerQuery>,
    headers: HeaderMap,
 ) -> Result<Response, AppError> {
-    let q = query.q.clone().unwrap_or_default();
+    let meals = state.meals.list_meals().await?;
    let meals = state.meals.list_meals(&q).await?;
    let meal_categories = state.meals.list_meal_categories().await?;
    let is_htmx = headers
        .get("hx-request")
        .and_then(|value| value.to_str().ok())
        .is_some_and(|value| value == "true");
    // A boosted navigation (e.g. the category form's POST redirect) also sends
    // `HX-Request: true`, but must render the full page, not just the results
    // fragment. Only a live search (an `hx-get` on the filter box) swaps the
    // fragment. htmx marks boosted requests with `HX-Boosted: true`.
    let is_boosted = headers
        .get("hx-boosted")
        .and_then(|value| value.to_str().ok())
        .is_some_and(|value| value == "true");
    if let Some(list_id) = query.picker {
-        if query.q.is_some() {
+        return Ok(html_response(views::meal_picker(
            // Live search inside the picker: swap only the grouped rows, keeping
            // the modal and search box focused. The initial picker load has no
            // `q`, so it falls through to the full modal below.
            return Ok(html_response(views::meal_picker_results(
                &meals,
                &meal_categories,
                list_id,
                &user.session.csrf_token,
            )));
        }
        let picker = views::meal_picker(
            &meals,
            &meal_categories,
            list_id,
            &user.session.csrf_token,
            &q,
        );
        return Ok(html_response(picker));
    }
    if is_htmx && !is_boosted {
        // Live search on the meals page: swap only the grouped results.
        return Ok(html_response(views::meal_results(
            &meals,
            &meal_categories,
            &q,
        )));
    }
-    Ok(html_response(views::meals_page(
+    Ok(html_response(views::meals_page(&user.session.user, &meals)))
        &user.session.user,
        &meals,
        &meal_categories,
        &user.session.csrf_token,
        &q,
    )))
 }
-async fn new_meal_page(
+async fn new_meal_page(user: CurrentUser) -> Result<Response, AppError> {
    State(state): State<AppState>,
    user: CurrentUser,
 ) -> Result<Response, AppError> {
    let meal_categories = state.meals.list_meal_categories().await?;
    Ok(html_response(views::meal_form_page(
        &user.session.user,
        None,
        &meal_categories,
        &user.session.csrf_token,
    )))
 }
@@ -1017,11 +564,7 @@ async fn create_meal(
    }
    let meal = state
        .meals
-        .create_meal(
+        .create_meal(name, form.description.trim().to_owned())
            name,
            form.description.trim().to_owned(),
            parse_category_id(form.category_id),
        )
        .await?;
    Ok(Redirect::to(&format!("/meals/{}", meal.id)).into_response())
 }
@@ -1037,12 +580,10 @@ async fn meal_page(
        .await?
        .ok_or(AppError::NotFound)?;
    let categories = state.lists.categories().await?;
    let meal_categories = state.meals.list_meal_categories().await?;
    Ok(html_response(views::meal_page(
        &user.session.user,
        &meal,
        &categories,
        &meal_categories,
        &user.session.csrf_token,
    )))
 }
@@ -1062,12 +603,7 @@ async fn edit_meal(
    }
    state
        .meals
-        .update_meal(
+        .update_meal(meal_id, name, form.description.trim().to_owned())
            meal_id,
            name,
            form.description.trim().to_owned(),
            parse_category_id(form.category_id),
        )
        .await?;
    Ok(Redirect::to(&format!("/meals/{meal_id}")).into_response())
 }
@@ -1157,107 +693,11 @@ async fn add_meal_to_list(
    LoggedForm(form): LoggedForm<AddMealForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
-    require_mutable_list(&state, list_id).await?;
+    require_list(&state, list_id).await?;
    state.meals.add_meal_to_list(form.meal_id, list_id).await?;
    list_fragment_response(&state, &user, list_id).await
 }
 async fn remove_meal_from_list(
    State(state): State<AppState>,
    user: CurrentUser,
    Path((list_id, list_meal_id)): Path<(i64, i64)>,
    LoggedForm(form): LoggedForm<CsrfForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    require_mutable_list(&state, list_id).await?;
    state
        .meals
        .remove_meal_from_list(list_id, list_meal_id)
        .await?;
    list_fragment_response(&state, &user, list_id).await
 }
 /// Renders the carry-over modal: a picker of active source lists (newest first,
 /// excluding the current list) that the user can import meals from.
 async fn carry_over_modal(
    State(state): State<AppState>,
    _user: CurrentUser,
    Path(dest_list_id): Path<i64>,
 ) -> Result<Response, AppError> {
    require_mutable_list(&state, dest_list_id).await?;
    let lists = state.lists.list_summaries().await?;
    let sources: Vec<_> = lists
        .into_iter()
        .filter(|list| list.id != dest_list_id)
        .collect();
    Ok(html_response(views::carry_over_modal(
        &sources,
        dest_list_id,
    )))
 }
 /// Renders the selectable meal rows for a chosen source list inside the carry
 /// modal.
 async fn carry_source_meals(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(dest_list_id): Path<i64>,
    Query(query): Query<CarrySourceQuery>,
 ) -> Result<Response, AppError> {
    require_mutable_list(&state, dest_list_id).await?;
    let source = require_list(&state, query.source).await?;
    if source.id == dest_list_id {
        return Err(AppError::BadRequest(
            "Cannot carry meals from a list into itself.".into(),
        ));
    }
    let list_meals = state.meals.list_meals_on_list(source.id).await?;
    Ok(html_response(views::carry_source_meals(
        &list_meals,
        source.id,
        dest_list_id,
        &user.session.csrf_token,
    )))
 }
 /// Copies the selected meals from a source list into the current list without
 /// re-adding their ingredients.
 async fn carry_meals(
    State(state): State<AppState>,
    user: CurrentUser,
    Path(dest_list_id): Path<i64>,
    LoggedForm(form): LoggedForm<CarryMealsForm>,
 ) -> Result<Response, AppError> {
    verify_csrf(&user, &form.csrf)?;
    require_mutable_list(&state, dest_list_id).await?;
    let source = require_list(&state, form.source_list_id).await?;
    if source.id == dest_list_id {
        return Err(AppError::BadRequest(
            "Cannot carry meals from a list into itself.".into(),
        ));
    }
    if form.list_meal_ids.is_empty() {
        return Err(AppError::BadRequest(
            "Select at least one meal to carry over.".into(),
        ));
    }
    let list_meal_ids: Vec<i64> = form
        .list_meal_ids
        .split(',')
        .filter_map(|id| id.trim().parse().ok())
        .collect();
    if list_meal_ids.is_empty() {
        return Err(AppError::BadRequest(
            "Select at least one meal to carry over.".into(),
        ));
    }
    state
        .meals
        .carry_meals_to_list(source.id, dest_list_id, &list_meal_ids)
        .await?;
    list_fragment_response(&state, &user, dest_list_id).await
 }
 async fn create_invitation(
    State(state): State<AppState>,
    user: CurrentUser,
@@ -1422,16 +862,11 @@ async fn websocket_snapshot(
    let access = require_list(state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
-    let list_meals = state.meals.list_meals_on_list(list_id).await?;
+    Ok(
-    Ok(views::live_list_fragments(
+        views::live_list_fragments(&access, &items, &categories, &user.session.csrf_token)
-        &access,
+            .into_string()
-        &items,
+            + &views::presence_panel(presence, true).into_string(),
        &categories,
        &list_meals,
        &user.session.csrf_token,
    )
    .into_string()
        + &views::presence_panel(presence, true).into_string())
 }
 async fn websocket_list_update(
@@ -1442,15 +877,10 @@ async fn websocket_list_update(
    let access = require_list(state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
-    let list_meals = state.meals.list_meals_on_list(list_id).await?;
+    Ok(
-    Ok(views::live_list_fragments(
+        views::live_list_fragments(&access, &items, &categories, &user.session.csrf_token)
-        &access,
+            .into_string(),
        &items,
        &categories,
        &list_meals,
        &user.session.csrf_token,
    )
    .into_string())
 }
 async fn list_fragment_response(
@@ -1461,26 +891,12 @@ async fn list_fragment_response(
    let access = require_list(state, list_id).await?;
    let items = state.lists.items(list_id).await?;
    let categories = state.lists.categories().await?;
-    let list_meals = state.meals.list_meals_on_list(list_id).await?;
+    Ok(html_response(views::list_items_fragment(
-    let editable = access.archived_at.is_none();
+        &access,
-    Ok(html_response(PreEscaped(
+        &items,
-        views::list_items_fragment(
+        &categories,
-            &access,
+        &user.session.csrf_token,
-            &items,
+        false,
            &categories,
            &user.session.csrf_token,
            false,
            editable,
        )
        .into_string()
            + &views::list_meals_panel(
                &list_meals,
                list_id,
                &user.session.csrf_token,
                true,
                editable,
            )
            .into_string(),
    )))
 }
@@ -1495,19 +911,6 @@ async fn require_list(
        .ok_or(AppError::NotFound)
 }
 /// Like [`require_list`], but also rejects archived lists so they stay
 /// immutable until restored.
 async fn require_mutable_list(
    state: &AppState,
    list_id: i64,
 ) -> Result<crate::domain::GroceryList, AppError> {
    let list = require_list(state, list_id).await?;
    if list.archived_at.is_some() {
        return Err(AppError::Archived);
    }
    Ok(list)
 }
 async fn optional_user(
    state: &AppState,
    headers: &HeaderMap,
@@ -35,7 +35,7 @@ impl RealtimeNotifier for InMemoryHub {
            }
        });
-        let connection_id = hex::encode(crate::security::new_secret());
+        let connection_id = crate::security::new_secret();
        let already_present = room
            .connections
            .values()
@@ -1,4 +1,3 @@
 mod assets;
 mod domain;
 mod http;
 mod hub;
@@ -8,7 +7,6 @@ mod seed;
 mod services;
 mod sqlite;
 mod views;
 mod webauthn;
 use std::env;
 use std::path::Path as FilePath;
@@ -20,45 +18,30 @@ use tracing::{info, warn};
 use crate::http::{AppState, build_router};
 use crate::hub::InMemoryHub;
 use crate::ports::{
-    CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
+    CategoryRepository, InvitationRepository, ItemRepository, ListRepository,
-    MealCategoryRepository, MealIngredientRepository, MealRepository, PasskeyRepository,
+    MealIngredientRepository, MealRepository, PasswordHasher, RealtimeNotifier, SessionRepository,
-    PasswordHasher, RealtimeNotifier, RewardsCardRepository, SessionRepository, TokenGenerator,
+    TokenGenerator, UserRepository,
    UserRepository,
 };
 use crate::security::{Argon2PasswordHasher, RandomTokenGenerator};
-use crate::services::{
+use crate::services::{AuthService, InvitationService, ListService, MealService, RegistrationMode};
    AuthService, InvitationService, ListService, MealService, RegistrationMode, RewardsCardService,
 };
 use crate::sqlite::{
-    SqliteCategoryRepository, SqliteDatabase, SqliteInvitationRepository, SqliteItemRepository,
+    SqliteCategoryRepository, SqliteInvitationRepository, SqliteItemRepository,
-    SqliteListMealRepository, SqliteListRepository, SqliteMealCategoryRepository,
+    SqliteListRepository, SqliteMealIngredientRepository, SqliteMealRepository,
-    SqliteMealIngredientRepository, SqliteMealRepository, SqlitePasskeyRepository,
+    SqliteSessionRepository, SqliteDatabase, SqliteUserRepository,
    SqliteRewardsCardRepository, SqliteSessionRepository, SqliteUserRepository,
 };
 use crate::webauthn::{AppWebauthnConfig, WebAuthnService};
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
    tracing_subscriber::fmt()
        .with_env_filter(
-            env::var("RUST_LOG").unwrap_or_else(|_| "sustenance=info,tower_http=info".into()),
+            env::var("RUST_LOG").unwrap_or_else(|_| "sustenance=debug,tower_http=info".into()),
        )
        .init();
    let database_path = env::var("DATABASE_PATH").unwrap_or_else(|_| "sustenance.db".into());
    let database_in_memory = env::var("DATABASE_IN_MEMORY")
        .map(|value| value == "1" || value.eq_ignore_ascii_case("true"))
        .unwrap_or(false);
    let bind_address = env::var("BIND_ADDRESS").unwrap_or_else(|_| "127.0.0.1:3000".into());
-    // For loopback hosts, advertise `localhost` so WebAuthn works locally (browsers
+    let public_base_url =
-    // reject IP addresses as RP IDs). Access the app via http://localhost:PORT.
+        env::var("PUBLIC_BASE_URL").unwrap_or_else(|_| format!("http://{}", bind_address));
    let bind_host = bind_address.split(':').next().unwrap_or("127.0.0.1");
    let is_loopback = bind_host == "127.0.0.1" || bind_host == "::1" || bind_host == "localhost";
    let public_host = if is_loopback { "localhost" } else { bind_host };
    let public_base_url = env::var("PUBLIC_BASE_URL").unwrap_or_else(|_| {
        let port = bind_address.rsplit(':').next().unwrap_or("3000");
        format!("http://{}:{}", public_host, port)
    });
    let cookie_secure = env::var("COOKIE_SECURE")
        .map(|value| value == "1" || value.eq_ignore_ascii_case("true"))
        .unwrap_or(false);
@@ -76,24 +59,16 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
    };
    // Build the adapters (ports) and wire them into application services.
-    let db = if database_in_memory {
+    let db = SqliteDatabase::open(&database_path).await?;
        SqliteDatabase::open_in_memory().await?
    } else {
        SqliteDatabase::open(&database_path).await?
    };
    let users: Arc<dyn UserRepository> = Arc::new(SqliteUserRepository);
    let sessions: Arc<dyn SessionRepository> = Arc::new(SqliteSessionRepository);
    let lists: Arc<dyn ListRepository> = Arc::new(SqliteListRepository);
    let categories: Arc<dyn CategoryRepository> = Arc::new(SqliteCategoryRepository);
    let items: Arc<dyn ItemRepository> = Arc::new(SqliteItemRepository);
    let list_meals: Arc<dyn ListMealRepository> = Arc::new(SqliteListMealRepository);
    let meals: Arc<dyn MealRepository> = Arc::new(SqliteMealRepository);
    let meal_ingredients: Arc<dyn MealIngredientRepository> =
        Arc::new(SqliteMealIngredientRepository);
    let meal_categories: Arc<dyn MealCategoryRepository> = Arc::new(SqliteMealCategoryRepository);
    let invitations: Arc<dyn InvitationRepository> = Arc::new(SqliteInvitationRepository);
    let passkeys: Arc<dyn PasskeyRepository> = Arc::new(SqlitePasskeyRepository);
    let rewards_cards: Arc<dyn RewardsCardRepository> = Arc::new(SqliteRewardsCardRepository);
    let hasher: Arc<dyn PasswordHasher> = Arc::new(Argon2PasswordHasher);
    let tokens: Arc<dyn TokenGenerator> = Arc::new(RandomTokenGenerator);
    let realtime: Arc<dyn RealtimeNotifier> = Arc::new(InMemoryHub::default());
@@ -118,45 +93,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
        Arc::clone(&invitations),
        Arc::clone(&tokens),
    ));
    let rewards_cards_service = Arc::new(RewardsCardService::new(
        db.clone(),
        Arc::clone(&rewards_cards),
    ));
    let meals_service = Arc::new(MealService::new(
        db.clone(),
        Arc::clone(&meals),
        Arc::clone(&meal_ingredients),
        Arc::clone(&meal_categories),
        Arc::clone(&lists),
        Arc::clone(&items),
        Arc::clone(&list_meals),
        Arc::clone(&realtime),
    ));
    // WebAuthn config from env vars. RP_ID must match the host users access the site from.
    let rp_id = env::var("RP_ID").unwrap_or_else(|_| {
        let host = public_base_url
            .trim_start_matches("http://")
            .trim_start_matches("https://")
            .split('/')
            .next()
            .unwrap_or("localhost")
            .split(':')
            .next()
            .unwrap_or("localhost")
            .to_owned();
        host
    });
    let rp_name = env::var("RP_NAME").unwrap_or_else(|_| "Sustenance".into());
    let origin =
        url::Url::parse(&public_base_url).map_err(|e| format!("invalid PUBLIC_BASE_URL: {e}"))?;
    let webauthn_service = Arc::new(WebAuthnService::new(
        db.clone(),
        AppWebauthnConfig::new(rp_id, rp_name, origin),
        Arc::clone(&users),
        Arc::clone(&passkeys),
    ));
    let seed_path = env::var("SEED_CONFIG").unwrap_or_else(|_| "seed.json".into());
    seed::seed_if_needed(&db, &users, &hasher, FilePath::new(&seed_path)).await;
@@ -165,8 +110,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
        lists: lists_service,
        meals: meals_service,
        invitations: invitations_service,
        rewards_cards: rewards_cards_service,
        webauthn: webauthn_service,
        realtime,
        cookie_secure,
        public_base_url,
@@ -180,10 +123,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
        .with_graceful_shutdown(shutdown_signal())
        .await?;
    info!("shutdown complete; closing database");
    // Explicitly close the pool so SQLite can checkpoint and remove the
    // WAL/SHM sidecar files. Without this, the pool's background close task
    // races with process exit and the sidecars can be left behind.
    db.close().await;
    Ok(())
 }
@@ -2,8 +2,8 @@ use async_trait::async_trait;
 use sqlx::SqliteConnection;
 use crate::domain::{
-    Category, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, MealIngredient,
+    Category, DomainResult, GroceryList, Item, Meal, MealIngredient, PresenceUser, SessionUser,
-    Passkey, PresenceUser, RewardsCard, SessionUser, User,
+    User,
 };
 /// Repositories take `&mut SqliteConnection` (which a `Transaction` derefs to),
@@ -24,48 +24,9 @@ pub trait UserRepository: Send + Sync {
        txn: &mut SqliteConnection,
        email: String,
    ) -> DomainResult<Option<(User, String)>>;
    async fn find_user_by_handle(
        &self,
        txn: &mut SqliteConnection,
        user_handle: Vec<u8>,
    ) -> DomainResult<Option<User>>;
    async fn update_password_hash(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
        password_hash: String,
    ) -> DomainResult<()>;
    async fn has_users(&self, txn: &mut SqliteConnection) -> DomainResult<bool>;
 }
 #[async_trait]
 pub trait PasskeyRepository: Send + Sync {
    async fn create_passkey(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
        credential_id: String,
        credential: String,
        counter: i64,
    ) -> DomainResult<Passkey>;
    async fn find_by_credential_id(
        &self,
        txn: &mut SqliteConnection,
        credential_id: String,
    ) -> DomainResult<Option<Passkey>>;
    async fn list_for_user(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
    ) -> DomainResult<Vec<Passkey>>;
    async fn delete_passkey(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
        passkey_id: i64,
    ) -> DomainResult<()>;
 }
 #[async_trait]
 pub trait SessionRepository: Send + Sync {
    async fn create_session(
@@ -88,10 +49,6 @@ pub trait SessionRepository: Send + Sync {
 #[async_trait]
 pub trait ListRepository: Send + Sync {
    async fn list_summaries(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<GroceryList>>;
    async fn list_archived_summaries(
        &self,
        txn: &mut SqliteConnection,
    ) -> DomainResult<Vec<GroceryList>>;
    async fn create_list(
        &self,
        txn: &mut SqliteConnection,
@@ -102,18 +59,21 @@ pub trait ListRepository: Send + Sync {
        txn: &mut SqliteConnection,
        list_id: i64,
    ) -> DomainResult<Option<GroceryList>>;
    async fn set_archived(
        &self,
        txn: &mut SqliteConnection,
        list_id: i64,
        archived: bool,
    ) -> DomainResult<()>;
 }
 #[async_trait]
 pub trait CategoryRepository: Send + Sync {
    async fn categories(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<Category>>;
-    async fn create_category(&self, txn: &mut SqliteConnection, name: String) -> DomainResult<i64>;
+    async fn create_category(
        &self,
        txn: &mut SqliteConnection,
        name: String,
    ) -> DomainResult<i64>;
    async fn category_by_name(
        &self,
        txn: &mut SqliteConnection,
        name: String,
    ) -> DomainResult<Option<Category>>;
 }
 /// A single item to insert in bulk, without a per-item revision bump.
@@ -123,9 +83,6 @@ pub struct NewItem {
    pub quantity: String,
    pub note: String,
    pub category_id: Option<i64>,
    /// When set, links this item to the `list_meals` row it came from, so the
    /// item is removed together with that meal instance.
    pub list_meal_id: Option<i64>,
 }
 #[async_trait]
@@ -171,38 +128,6 @@ pub trait ItemRepository: Send + Sync {
    ) -> DomainResult<i64>;
 }
 #[async_trait]
 pub trait ListMealRepository: Send + Sync {
    async fn list_meals(
        &self,
        txn: &mut SqliteConnection,
        list_id: i64,
    ) -> DomainResult<Vec<ListMeal>>;
    async fn add_meal(
        &self,
        txn: &mut SqliteConnection,
        list_id: i64,
        meal_id: Option<i64>,
        name: String,
    ) -> DomainResult<i64>;
    async fn remove_meal(
        &self,
        txn: &mut SqliteConnection,
        list_id: i64,
        list_meal_id: i64,
    ) -> DomainResult<i64>;
    /// Copies the given meal instances from one list to another without
    /// expanding their ingredients into items (they were already purchased).
    /// Returns the new rows and the destination list's bumped revision.
    async fn copy_meals_to_list(
        &self,
        txn: &mut SqliteConnection,
        source_list_id: i64,
        dest_list_id: i64,
        list_meal_ids: &[i64],
    ) -> DomainResult<(Vec<ListMeal>, i64)>;
 }
 #[async_trait]
 pub trait InvitationRepository: Send + Sync {
    async fn create_invitation(
@@ -219,21 +144,6 @@ pub trait InvitationRepository: Send + Sync {
    ) -> DomainResult<()>;
 }
 #[async_trait]
 pub trait MealCategoryRepository: Send + Sync {
    async fn meal_categories(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<MealCategory>>;
    async fn create_meal_category(
        &self,
        txn: &mut SqliteConnection,
        name: String,
    ) -> DomainResult<i64>;
    async fn delete_meal_category(
        &self,
        txn: &mut SqliteConnection,
        category_id: i64,
    ) -> DomainResult<()>;
 }
 #[async_trait]
 pub trait MealRepository: Send + Sync {
    async fn create_meal(
@@ -241,21 +151,19 @@ pub trait MealRepository: Send + Sync {
        txn: &mut SqliteConnection,
        name: String,
        description: String,
        category_id: Option<i64>,
    ) -> DomainResult<Meal>;
    async fn get_meal(
        &self,
        txn: &mut SqliteConnection,
        meal_id: i64,
    ) -> DomainResult<Option<Meal>>;
-    async fn list_meals(&self, txn: &mut SqliteConnection, query: &str) -> DomainResult<Vec<Meal>>;
+    async fn list_meals(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<Meal>>;
    async fn update_meal(
        &self,
        txn: &mut SqliteConnection,
        meal_id: i64,
        name: String,
        description: String,
        category_id: Option<i64>,
    ) -> DomainResult<()>;
    async fn delete_meal(&self, txn: &mut SqliteConnection, meal_id: i64) -> DomainResult<()>;
 }
@@ -324,33 +232,3 @@ pub enum HubEvent {
    ListChanged { list_id: i64, revision: i64 },
    PresenceChanged { list_id: i64 },
 }
 /// Stores and retrieves a user's rewards cards.
 #[async_trait]
 pub trait RewardsCardRepository: Send + Sync {
    async fn list_cards(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
    ) -> DomainResult<Vec<RewardsCard>>;
    async fn get_card(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
        card_id: i64,
    ) -> DomainResult<Option<RewardsCard>>;
    async fn create_card(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
        store_name: String,
        number: String,
        symbology: String,
    ) -> DomainResult<RewardsCard>;
    async fn delete_card(
        &self,
        txn: &mut SqliteConnection,
        user_id: i64,
        card_id: i64,
    ) -> DomainResult<()>;
 }
@@ -37,14 +37,12 @@ pub struct RandomTokenGenerator;
 #[async_trait]
 impl TokenGenerator for RandomTokenGenerator {
    fn generate(&self) -> String {
-        hex::encode(new_secret())
+        new_secret()
    }
 }
-/// Generates 32 cryptographically random bytes. Callers that need a
+pub fn new_secret() -> String {
 /// client-facing string should hex-encode the result.
 pub fn new_secret() -> Vec<u8> {
    let mut bytes = [0_u8; 32];
    OsRng.fill_bytes(&mut bytes);
-    bytes.to_vec()
+    hex::encode(bytes)
 }
@@ -1,13 +1,12 @@
 use std::sync::Arc;
 use crate::domain::{
-    DomainError, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, RewardsCard,
+    DomainError, DomainResult, GroceryList, Item, Meal, SessionUser, User,
    SessionUser, User,
 };
 use crate::ports::{
-    CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
+    CategoryRepository, InvitationRepository, ItemRepository, ListRepository, MealIngredientRepository,
-    MealCategoryRepository, MealIngredientRepository, MealRepository, NewItem, PasswordHasher,
+    MealRepository, NewItem, PasswordHasher, RealtimeNotifier, SessionRepository, TokenGenerator,
-    RealtimeNotifier, RewardsCardRepository, SessionRepository, TokenGenerator, UserRepository,
+    UserRepository,
 };
 use crate::sqlite::SqliteDatabase;
@@ -128,20 +127,6 @@ impl AuthService {
            .await
    }
    pub async fn find_user_by_email(&self, email: String) -> DomainResult<Option<(User, String)>> {
        let users = Arc::clone(&self.users);
        self.db
            .run(move |txn| Box::pin(async move { users.find_user_by_email(txn, email).await }))
            .await
    }
    pub async fn create_session_for_user(&self, user_id: i64) -> DomainResult<(String, String)> {
        let sessions = Arc::clone(&self.sessions);
        self.db
            .run(move |txn| Box::pin(async move { sessions.create_session(txn, user_id).await }))
            .await
    }
    pub async fn logout(&self, session_token: String) -> DomainResult<()> {
        let sessions = Arc::clone(&self.sessions);
        self.db
@@ -150,22 +135,6 @@ impl AuthService {
            })
            .await
    }
    /// Replaces the user's password hash with a freshly hashed new password.
    /// No current-password check is performed because the account page is
    /// already authenticated and this app has no email capabilities.
    pub async fn change_password(&self, user_id: i64, new_password: String) -> DomainResult<()> {
        let users = Arc::clone(&self.users);
        let hasher = Arc::clone(&self.hasher);
        self.db
            .run(move |txn| {
                Box::pin(async move {
                    let new_hash = hasher.hash(&new_password)?;
                    users.update_password_hash(txn, user_id, new_hash).await
                })
            })
            .await
    }
 }
 pub struct ListService {
@@ -200,13 +169,6 @@ impl ListService {
            .await
    }
    pub async fn list_archived_summaries(&self) -> DomainResult<Vec<GroceryList>> {
        let lists = Arc::clone(&self.lists);
        self.db
            .run(move |txn| Box::pin(async move { lists.list_archived_summaries(txn).await }))
            .await
    }
    pub async fn create_list(&self, name: String) -> DomainResult<GroceryList> {
        let lists = Arc::clone(&self.lists);
        self.db
@@ -221,20 +183,6 @@ impl ListService {
            .await
    }
    pub async fn archive_list(&self, list_id: i64) -> DomainResult<()> {
        let lists = Arc::clone(&self.lists);
        self.db
            .run(move |txn| Box::pin(async move { lists.set_archived(txn, list_id, true).await }))
            .await
    }
    pub async fn unarchive_list(&self, list_id: i64) -> DomainResult<()> {
        let lists = Arc::clone(&self.lists);
        self.db
            .run(move |txn| Box::pin(async move { lists.set_archived(txn, list_id, false).await }))
            .await
    }
    pub async fn items(&self, list_id: i64) -> DomainResult<Vec<Item>> {
        let items = Arc::clone(&self.items);
        self.db
@@ -337,10 +285,8 @@ pub struct MealService {
    db: SqliteDatabase,
    meals: Arc<dyn MealRepository>,
    ingredients: Arc<dyn MealIngredientRepository>,
    meal_categories: Arc<dyn MealCategoryRepository>,
    lists: Arc<dyn ListRepository>,
    items: Arc<dyn ItemRepository>,
    list_meals: Arc<dyn ListMealRepository>,
    realtime: Arc<dyn RealtimeNotifier>,
 }
@@ -349,37 +295,24 @@ impl MealService {
        db: SqliteDatabase,
        meals: Arc<dyn MealRepository>,
        ingredients: Arc<dyn MealIngredientRepository>,
        meal_categories: Arc<dyn MealCategoryRepository>,
        lists: Arc<dyn ListRepository>,
        items: Arc<dyn ItemRepository>,
        list_meals: Arc<dyn ListMealRepository>,
        realtime: Arc<dyn RealtimeNotifier>,
    ) -> Self {
        Self {
            db,
            meals,
            ingredients,
            meal_categories,
            lists,
            items,
            list_meals,
            realtime,
        }
    }
-    pub async fn create_meal(
+    pub async fn create_meal(&self, name: String, description: String) -> DomainResult<Meal> {
        &self,
        name: String,
        description: String,
        category_id: Option<i64>,
    ) -> DomainResult<Meal> {
        let meals = Arc::clone(&self.meals);
        self.db
-            .run(move |txn| {
+            .run(move |txn| Box::pin(async move { meals.create_meal(txn, name, description).await }))
                Box::pin(
                    async move { meals.create_meal(txn, name, description, category_id).await },
                )
            })
            .await
    }
@@ -390,11 +323,10 @@ impl MealService {
            .await
    }
-    pub async fn list_meals(&self, query: &str) -> DomainResult<Vec<Meal>> {
+    pub async fn list_meals(&self) -> DomainResult<Vec<Meal>> {
        let meals = Arc::clone(&self.meals);
        let query = query.to_owned();
        self.db
-            .run(move |txn| Box::pin(async move { meals.list_meals(txn, &query).await }))
+            .run(move |txn| Box::pin(async move { meals.list_meals(txn).await }))
            .await
    }
@@ -403,43 +335,11 @@ impl MealService {
        meal_id: i64,
        name: String,
        description: String,
        category_id: Option<i64>,
    ) -> DomainResult<()> {
        let meals = Arc::clone(&self.meals);
        self.db
            .run(move |txn| {
-                Box::pin(async move {
+                Box::pin(async move { meals.update_meal(txn, meal_id, name, description).await })
                    meals
                        .update_meal(txn, meal_id, name, description, category_id)
                        .await
                })
            })
            .await
    }
    pub async fn list_meal_categories(&self) -> DomainResult<Vec<MealCategory>> {
        let meal_categories = Arc::clone(&self.meal_categories);
        self.db
            .run(move |txn| Box::pin(async move { meal_categories.meal_categories(txn).await }))
            .await
    }
    pub async fn create_meal_category(&self, name: String) -> DomainResult<i64> {
        let meal_categories = Arc::clone(&self.meal_categories);
        self.db
            .run(move |txn| {
                Box::pin(async move { meal_categories.create_meal_category(txn, name).await })
            })
            .await
    }
    pub async fn delete_meal_category(&self, category_id: i64) -> DomainResult<()> {
        let meal_categories = Arc::clone(&self.meal_categories);
        self.db
            .run(move |txn| {
                Box::pin(
                    async move { meal_categories.delete_meal_category(txn, category_id).await },
                )
            })
            .await
    }
@@ -514,12 +414,11 @@ impl MealService {
    }
    /// Expands a meal's ingredients into items on a list in one unit of work,
-    /// recording the meal on the list and bumping the list revision exactly once.
+    /// bumping the list revision exactly once.
    pub async fn add_meal_to_list(&self, meal_id: i64, list_id: i64) -> DomainResult<i64> {
        let meals = Arc::clone(&self.meals);
        let lists = Arc::clone(&self.lists);
        let items = Arc::clone(&self.items);
        let list_meals = Arc::clone(&self.list_meals);
        let revision = self
            .db
            .run(move |txn| {
@@ -531,9 +430,6 @@ impl MealService {
                    if lists.get_list(txn, list_id).await?.is_none() {
                        return Err(DomainError::NotFound);
                    }
                    let list_meal_id = list_meals
                        .add_meal(txn, list_id, Some(meal.id), meal.name.clone())
                        .await?;
                    let new_items = meal
                        .ingredients
                        .into_iter()
@@ -542,7 +438,6 @@ impl MealService {
                            quantity: ingredient.quantity,
                            note: ingredient.note,
                            category_id: ingredient.category_id,
                            list_meal_id: Some(list_meal_id),
                        })
                        .collect();
                    items.add_items_bulk(txn, list_id, new_items).await
@@ -552,60 +447,6 @@ impl MealService {
        self.realtime.publish_list_changed(list_id, revision).await;
        Ok(revision)
    }
    /// Lists the meals that have been added to a list, most recent first.
    pub async fn list_meals_on_list(&self, list_id: i64) -> DomainResult<Vec<ListMeal>> {
        let list_meals = Arc::clone(&self.list_meals);
        self.db
            .run(move |txn| Box::pin(async move { list_meals.list_meals(txn, list_id).await }))
            .await
    }
    /// Removes a meal instance from a list, deleting the items that came from it
    /// and bumping the list revision exactly once.
    pub async fn remove_meal_from_list(
        &self,
        list_id: i64,
        list_meal_id: i64,
    ) -> DomainResult<i64> {
        let list_meals = Arc::clone(&self.list_meals);
        let revision = self
            .db
            .run(move |txn| {
                Box::pin(async move { list_meals.remove_meal(txn, list_id, list_meal_id).await })
            })
            .await?;
        self.realtime.publish_list_changed(list_id, revision).await;
        Ok(revision)
    }
    /// Copies the given meal instances from a source list into the destination
    /// list without re-expanding their ingredients into items (they were already
    /// purchased). The source list is left untouched. Publishes a realtime update
    /// for the destination only.
    pub async fn carry_meals_to_list(
        &self,
        source_list_id: i64,
        dest_list_id: i64,
        list_meal_ids: &[i64],
    ) -> DomainResult<Vec<ListMeal>> {
        let list_meals = Arc::clone(&self.list_meals);
        let ids = list_meal_ids.to_vec();
        let (copied, revision) = self
            .db
            .run(move |txn| {
                Box::pin(async move {
                    list_meals
                        .copy_meals_to_list(txn, source_list_id, dest_list_id, &ids)
                        .await
                })
            })
            .await?;
        self.realtime
            .publish_list_changed(dest_list_id, revision)
            .await;
        Ok(copied)
    }
 }
 pub struct InvitationService {
@@ -658,54 +499,3 @@ impl InvitationService {
            .await
    }
 }
 pub struct RewardsCardService {
    db: SqliteDatabase,
    cards: Arc<dyn RewardsCardRepository>,
 }
 impl RewardsCardService {
    pub fn new(db: SqliteDatabase, cards: Arc<dyn RewardsCardRepository>) -> Self {
        Self { db, cards }
    }
    pub async fn list_cards(&self, user_id: i64) -> DomainResult<Vec<RewardsCard>> {
        let cards = Arc::clone(&self.cards);
        self.db
            .run(move |txn| Box::pin(async move { cards.list_cards(txn, user_id).await }))
            .await
    }
    pub async fn get_card(&self, user_id: i64, card_id: i64) -> DomainResult<Option<RewardsCard>> {
        let cards = Arc::clone(&self.cards);
        self.db
            .run(move |txn| Box::pin(async move { cards.get_card(txn, user_id, card_id).await }))
            .await
    }
    pub async fn create_card(
        &self,
        user_id: i64,
        store_name: String,
        number: String,
        symbology: String,
    ) -> DomainResult<RewardsCard> {
        let cards = Arc::clone(&self.cards);
        self.db
            .run(move |txn| {
                Box::pin(async move {
                    cards
                        .create_card(txn, user_id, store_name, number, symbology)
                        .await
                })
            })
            .await
    }
    pub async fn delete_card(&self, user_id: i64, card_id: i64) -> DomainResult<()> {
        let cards = Arc::clone(&self.cards);
        self.db
            .run(move |txn| Box::pin(async move { cards.delete_card(txn, user_id, card_id).await }))
            .await
    }
 }
@@ -1,340 +0,0 @@
 use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 use webauthn_rs::{
    Webauthn,
    core::{AuthenticationState, RegistrationState, WebauthnConfig},
    error::WebauthnError as WanError,
    proto::{
        CreationChallengeResponse, Credential, PublicKeyCredential, RegisterPublicKeyCredential,
        RequestChallengeResponse, UserVerificationPolicy,
    },
 };
 use crate::domain::{DomainError, DomainResult, Passkey as DbPasskey, User};
 use crate::ports::{PasskeyRepository, UserRepository};
 use crate::security::new_secret;
 use crate::sqlite::SqliteDatabase;
 /// Site-specific WebAuthn configuration, derived from env vars.
 pub struct AppWebauthnConfig {
    rp_id: String,
    rp_name: String,
    origin: url::Url,
    require_resident_key: bool,
 }
 impl AppWebauthnConfig {
    pub fn new(rp_id: String, rp_name: String, origin: url::Url) -> Self {
        Self {
            rp_id,
            rp_name,
            origin,
            // Resident (discoverable) keys let users sign in without typing an
            // email, because the authenticator can select the credential on its
            // own and return the user handle.
            require_resident_key: true,
        }
    }
 }
 impl WebauthnConfig for AppWebauthnConfig {
    fn get_relying_party_name(&self) -> &str {
        &self.rp_name
    }
    fn get_origin(&self) -> &url::Url {
        &self.origin
    }
    fn get_relying_party_id(&self) -> &str {
        &self.rp_id
    }
    fn get_require_resident_key(&self) -> bool {
        self.require_resident_key
    }
 }
 /// A single-use, in-memory challenge store. Registrations are keyed by user id;
 /// authentications are keyed by a random token so that userless (discoverable)
 /// ceremonies can be correlated back to the finish request.
 #[derive(Default)]
 struct ChallengeStore {
    registrations: HashMap<i64, RegistrationState>,
    authentications: HashMap<String, AuthenticationState>,
 }
 pub struct WebAuthnService {
    db: SqliteDatabase,
    webauthn: Webauthn<AppWebauthnConfig>,
    users: Arc<dyn UserRepository>,
    passkeys: Arc<dyn PasskeyRepository>,
    challenges: Mutex<ChallengeStore>,
 }
 impl WebAuthnService {
    pub fn new(
        db: SqliteDatabase,
        config: AppWebauthnConfig,
        users: Arc<dyn UserRepository>,
        passkeys: Arc<dyn PasskeyRepository>,
    ) -> Self {
        let webauthn = Webauthn::new(config);
        Self {
            db,
            webauthn,
            users,
            passkeys,
            challenges: Mutex::new(ChallengeStore::default()),
        }
    }
    /// Start a passkey registration ceremony for an authenticated user.
    pub fn start_registration(&self, user: &User) -> DomainResult<CreationChallengeResponse> {
        // Use the user's opaque, random user handle as the WebAuthn userHandle
        // so that userless (discoverable) sign-in can resolve the owning user
        // from the assertion's userHandle without exposing the numeric id.
        let (challenge, state) = self
            .webauthn
            .generate_challenge_register_options(
                user.user_handle.clone(),
                user.email.clone(),
                user.display_name.clone(),
                None,
                Some(UserVerificationPolicy::Required),
                None,
            )
            .map_err(webauthn_error)?;
        self.challenges
            .lock()
            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
            .registrations
            .insert(user.id, state);
        Ok(challenge)
    }
    /// Finish a passkey registration ceremony and persist the credential.
    pub async fn finish_registration(
        &self,
        user: &User,
        response: RegisterPublicKeyCredential,
    ) -> DomainResult<()> {
        let state = self
            .challenges
            .lock()
            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
            .registrations
            .remove(&user.id)
            .ok_or(DomainError::NotFound)?;
        let passkeys = Arc::clone(&self.passkeys);
        let credential_id = response.raw_id.0.clone();
        let user_id = user.id;
        let credential = self
            .webauthn
            .register_credential(&response, &state, |_| Ok(false))
            .map_err(webauthn_error)?;
        let serialized = serde_json::to_string(&credential.0)
            .map_err(|e| DomainError::Database(e.to_string()))?;
        let credential_id_b64 = base64_url(&credential_id);
        let counter = credential.0.counter as i64;
        self.db
            .run(move |txn| {
                let passkeys = passkeys.clone();
                Box::pin(async move {
                    passkeys
                        .create_passkey(txn, user_id, credential_id_b64, serialized, counter)
                        .await?;
                    Ok(())
                })
            })
            .await
    }
    /// Start a passkey authentication ceremony for a user identified by email.
    /// Returns the challenge and a token used to correlate the finish request.
    pub async fn start_authentication(
        &self,
        user_id: i64,
    ) -> DomainResult<(RequestChallengeResponse, String)> {
        let passkeys = Arc::clone(&self.passkeys);
        let db = self.db.clone();
        let credentials: Vec<Credential> = db
            .run(move |txn| {
                let passkeys = passkeys.clone();
                Box::pin(async move {
                    let rows = passkeys.list_for_user(txn, user_id).await?;
                    let mut creds = Vec::new();
                    for row in rows {
                        let cred: Credential = serde_json::from_str(&row.credential)
                            .map_err(|e| DomainError::Database(e.to_string()))?;
                        creds.push(cred);
                    }
                    Ok(creds)
                })
            })
            .await?;
        if credentials.is_empty() {
            return Err(DomainError::NotFound);
        }
        let (challenge, state) = self
            .webauthn
            .generate_challenge_authenticate(credentials)
            .map_err(webauthn_error)?;
        let token = hex::encode(new_secret());
        self.challenges
            .lock()
            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
            .authentications
            .insert(token.clone(), state);
        Ok((challenge, token))
    }
    /// Start a userless passkey authentication ceremony. No email is required:
    /// the authenticator selects a discoverable credential and returns a user
    /// handle that we resolve to the owning user on finish.
    pub async fn start_userless_authentication(
        &self,
    ) -> DomainResult<(RequestChallengeResponse, String)> {
        let (challenge, mut state) = self
            .webauthn
            .generate_challenge_authenticate_options(vec![], None)
            .map_err(webauthn_error)?;
        // With no allowCredentials the browser will offer any discoverable
        // credential for this RP; the credential set is populated from the
        // user handle once the assertion is received.
        state.set_allowed_credentials(vec![]);
        let token = hex::encode(new_secret());
        self.challenges
            .lock()
            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
            .authentications
            .insert(token.clone(), state);
        Ok((challenge, token))
    }
    /// Finish a passkey authentication ceremony, resolving the owning user from
    /// the credential id (and, for userless ceremonies, the user handle).
    pub async fn finish_authentication(
        &self,
        token: String,
        response: PublicKeyCredential,
    ) -> DomainResult<i64> {
        let mut state = self
            .challenges
            .lock()
            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
            .authentications
            .remove(&token)
            .ok_or(DomainError::NotFound)?;
        // For userless ceremonies the assertion carries a user handle that
        // identifies the user; load that user's credentials so the signature
        // can be verified against the correct key.
        if let Some(user_handle) = response.get_user_handle() {
            let handle = user_handle.to_vec();
            let users = Arc::clone(&self.users);
            let db = self.db.clone();
            let user_id = db
                .run(move |txn| {
                    let users = users.clone();
                    Box::pin(async move {
                        let user = users
                            .find_user_by_handle(txn, handle)
                            .await?
                            .ok_or(DomainError::NotFound)?;
                        Ok(user.id)
                    })
                })
                .await?;
            let passkeys = Arc::clone(&self.passkeys);
            let credentials: Vec<Credential> = db
                .run(move |txn| {
                    let passkeys = passkeys.clone();
                    Box::pin(async move {
                        let rows = passkeys.list_for_user(txn, user_id).await?;
                        let mut creds = Vec::new();
                        for row in rows {
                            let cred: Credential = serde_json::from_str(&row.credential)
                                .map_err(|e| DomainError::Database(e.to_string()))?;
                            creds.push(cred);
                        }
                        Ok(creds)
                    })
                })
                .await?;
            state.set_allowed_credentials(credentials);
        }
        let (cred_id, auth_data) = self
            .webauthn
            .authenticate_credential(&response, &state)
            .map_err(|e| {
                tracing::error!(%e, "webauthn authenticate_credential failed");
                webauthn_error(e)
            })?;
        let passkeys = Arc::clone(&self.passkeys);
        let db = self.db.clone();
        let credential_id_b64 = base64_url(cred_id);
        let user_id = db
            .run(move |txn| {
                let passkeys = passkeys.clone();
                Box::pin(async move {
                    let stored = passkeys
                        .find_by_credential_id(txn, credential_id_b64)
                        .await?
                        .ok_or(DomainError::NotFound)?;
                    let mut cred: Credential = serde_json::from_str(&stored.credential)
                        .map_err(|e| DomainError::Database(e.to_string()))?;
                    cred.counter = auth_data.counter;
                    let serialized = serde_json::to_string(&cred)
                        .map_err(|e| DomainError::Database(e.to_string()))?;
                    sqlx::query("UPDATE passkeys SET credential = ?1 WHERE id = ?2")
                        .bind(&serialized)
                        .bind(stored.id)
                        .execute(&mut *txn)
                        .await
                        .map_err(db_error)?;
                    Ok(stored.user_id)
                })
            })
            .await?;
        Ok(user_id)
    }
    /// List the passkeys registered to a user.
    pub async fn list_passkeys(&self, user_id: i64) -> DomainResult<Vec<DbPasskey>> {
        let passkeys = Arc::clone(&self.passkeys);
        self.db
            .run(move |txn| {
                let passkeys = passkeys.clone();
                Box::pin(async move { passkeys.list_for_user(txn, user_id).await })
            })
            .await
    }
    /// Delete a passkey owned by a user.
    pub async fn delete_passkey(&self, user_id: i64, passkey_id: i64) -> DomainResult<()> {
        let passkeys = Arc::clone(&self.passkeys);
        self.db
            .run(move |txn| {
                let passkeys = passkeys.clone();
                Box::pin(async move { passkeys.delete_passkey(txn, user_id, passkey_id).await })
            })
            .await
    }
 }
 fn base64_url(bytes: &[u8]) -> String {
    use base64::Engine;
    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes)
 }
 fn webauthn_error(error: WanError) -> DomainError {
    DomainError::Database(error.to_string())
 }
 fn db_error(error: sqlx::Error) -> DomainError {
    DomainError::Database(error.to_string())
 }
@@ -1,143 +0,0 @@
 <svg
  xmlns="http://www.w3.org/2000/svg"
  viewBox="0 0 64 64"
  role="img"
  aria-labelledby="title"
 >
  <title id="title">Sustenance grocery bag with produce</title>
  <!-- Background -->
  <rect width="64" height="64" rx="12" fill="#286247"/>
  <!-- Back of the paper bag -->
  <path
    d="
      M7 27
      L16 22
      L24 26
      L32 22
      L40 25
      L49 21
      L57 25
      L47 31
      L39 28
      L31 32
      L23 27
      L16 31
      Z
    "
    fill="#F2D39B"
  />
  <!-- Back rim -->
  <path
    d="M7 27 16 22 24 26 32 22 40 25 49 21 57 25"
    fill="none"
    stroke="#1F4938"
    stroke-width="2.75"
    stroke-linecap="round"
    stroke-linejoin="round"
  />
  <!-- Leafy greens -->
  <path
    d="M42 28C39 21 42 12 49 7c2 3 2 6 1 9 3-2 6-2 8 0-1 5-5 9-12 13Z"
    fill="#8EC866"
    stroke="#1F4938"
    stroke-width="2.5"
    stroke-linejoin="round"
  />
  <path
    d="M45 27 53 15M47 22l7-1M49 18l-1-5"
    fill="none"
    stroke="#1F4938"
    stroke-width="2"
    stroke-linecap="round"
  />
  <!-- Carrot leaves -->
  <path
    d="
      M17 14c-2-4-1-7 0-10 3 3 4 6 3 10
      m0 0c0-5 2-8 5-10 1 5-1 8-5 11
    "
    fill="#8EC866"
    stroke="#1F4938"
    stroke-width="2.5"
    stroke-linecap="round"
    stroke-linejoin="round"
  />
  <!-- Carrot -->
  <path
    d="M13 18c3-4 9-5 13-2l-3 20-5 2Z"
    fill="#F29A3F"
    stroke="#1F4938"
    stroke-width="2.5"
    stroke-linejoin="round"
  />
  <path
    d="m16 24 7-2m-6 7 5-2"
    fill="none"
    stroke="#1F4938"
    stroke-width="2"
    stroke-linecap="round"
  />
  <!-- Tomato -->
  <path
    d="M27 25c0-6 4-10 10-10s10 4 10 10c0 7-4 12-10 12S27 32 27 25Z"
    fill="#E65A46"
    stroke="#1F4938"
    stroke-width="2.5"
  />
  <path
    d="m37 15-4 5 4-1 4 2-1-5"
    fill="#78B75B"
    stroke="#1F4938"
    stroke-width="2"
    stroke-linecap="round"
    stroke-linejoin="round"
  />
  <!-- Front and sides of the paper bag -->
  <path
    d="
      M7 27
      L16 31
      L23 27
      L31 32
      L39 28
      L47 31
      L57 25
      L55 51
      L45 59
      L11 51
      Z
    "
    fill="#F2D39B"
    stroke="#1F4938"
    stroke-width="2.75"
    stroke-linejoin="round"
  />
  <!-- Front opening edge -->
  <path
    d="M7 27 16 31 23 27 31 32 39 28 47 31 57 25"
    fill="none"
    stroke="#1F4938"
    stroke-width="2.75"
    stroke-linecap="round"
    stroke-linejoin="round"
  />
  <!-- Side-panel seam and paper creases -->
  <path
    d="M47 31 45 59M45 59l10-8M15 36l1 9"
    fill="none"
    stroke="#1F4938"
    stroke-width="2.25"
    stroke-linecap="round"
    stroke-linejoin="round"
  />
 </svg>
@@ -1,34 +0,0 @@
 function b64ToBytes(b64) {
  const bin = atob(b64.replace(/-/g, "+").replace(/_/g, "/"));
  const bytes = new Uint8Array(bin.length);
  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
  return bytes;
 }
 document.getElementById("passkey-login").addEventListener("click", async () => {
  const email = document.getElementById("email").value.trim();
  const start = await fetch("/auth/passkey/login/start", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ email }),
  });
  if (!start.ok) {
    alert("No passkey found for that account.");
    return;
  }
  const data = await start.json();
  const pk = data.publicKey;
  pk.challenge = b64ToBytes(pk.challenge);
  if (pk.allowCredentials) {
    pk.allowCredentials.forEach((c) => (c.id = b64ToBytes(c.id)));
  }
  const credential = await navigator.credentials.get({ publicKey: pk });
  const finish = await fetch("/auth/passkey/login/finish", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ token: data.token, response: credential }),
  });
  if (finish.ok) {
    window.location.href = "/lists";
  }
 });
@@ -1,32 +0,0 @@
 function b64ToBytes(b64) {
  const bin = atob(b64.replace(/-/g, "+").replace(/_/g, "/"));
  const bytes = new Uint8Array(bin.length);
  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
  return bytes;
 }
 document.getElementById("add-passkey").addEventListener("click", async () => {
  const csrf = document.getElementById("add-passkey").dataset.csrf;
  const start = await fetch("/auth/passkey/register/start", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ csrf }),
  });
  const options = await start.json();
  const pk = options.publicKey;
  pk.challenge = b64ToBytes(pk.challenge);
  pk.user.id = b64ToBytes(pk.user.id);
  if (pk.excludeCredentials) {
    pk.excludeCredentials.forEach((c) => (c.id = b64ToBytes(c.id)));
  }
  const credential = await navigator.credentials.create(options);
  const response = { csrf, response: credential };
  const finish = await fetch("/auth/passkey/register/finish", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(response),
  });
  if (finish.ok) {
    window.location.href = "/account";
  }
 });
@@ -1,16 +0,0 @@
 // Toggle password visibility so users can check for typos, especially on mobile.
 document.querySelectorAll(".password-toggle").forEach(function (button) {
  button.addEventListener("pointerdown", function (event) {
    // Toggle on press (not click) for an instant response. preventScroll avoids
    // a scroll-to-input animation that makes rapid toggling feel laggy, and
    // keeping focus on the input keeps the mobile keyboard open.
    event.preventDefault();
    var input = document.getElementById(button.getAttribute("data-toggle-for"));
    if (!input) return;
    var showing = input.type === "text";
    input.type = showing ? "password" : "text";
    button.textContent = showing ? "Show" : "Hide";
    button.setAttribute("aria-label", showing ? "Show password" : "Hide password");
    input.focus({ preventScroll: true });
  });
 });
@@ -1,30 +0,0 @@
 // Keep the screen awake while a rewards barcode is on screen so the cashier
 // can scan it without the display dimming or locking. This mirrors how wallet
 // apps behave when showing a barcode. The Screen Wake Lock API is best-effort:
 // it may be rejected (e.g. low battery) or auto-released when the tab is hidden,
 // so we re-acquire whenever the page becomes visible again.
 (function () {
  var wakeLock = null;
  function requestWakeLock() {
    if (!("wakeLock" in navigator)) return;
    navigator.wakeLock
      .request("screen")
      .then(function (sentinel) {
        wakeLock = sentinel;
      })
      .catch(function () {
        // Best-effort only; ignore failures (unsupported, low battery, etc.).
      });
  }
  // Re-acquire if the lock was released (e.g. the tab was hidden) and the user
  // returns to the page.
  document.addEventListener("visibilitychange", function () {
    if (document.visibilityState === "visible" && wakeLock === null) {
      requestWakeLock();
    }
  });
  requestWakeLock();
 })();
@@ -38,7 +38,7 @@ a { color: inherit; }
 }
 .brand { display: inline-flex; align-items: center; gap: 10px; text-decoration: none; font-weight: 800; letter-spacing: -.03em; }
-.brand-mark { display: block; width: 34px; height: 34px; border-radius: 9px; object-fit: cover; }
+.brand-mark { display: grid; place-items: center; width: 32px; height: 32px; border-radius: 11px 11px 11px 3px; background: var(--deep-sage); color: white; transform: rotate(-6deg); }
 .site-nav { display: flex; align-items: center; gap: 6px; }
 .site-nav a {
  padding: 8px 14px;
@@ -51,8 +51,7 @@ a { color: inherit; }
 }
 .site-nav a:hover { color: var(--ink); background: #eef2ea; }
 .account-nav { display: flex; align-items: center; gap: 16px; color: var(--muted); font-size: .9rem; }
-.user-name { color: var(--ink); font-weight: 700; text-decoration: none; }
+.user-name { color: var(--ink); font-weight: 700; }
 .user-name:hover { color: var(--deep-sage); }
 .text-button { border: 0; padding: 0; color: var(--deep-sage); background: transparent; cursor: pointer; font-weight: 700; }
 .site-main { width: min(1120px, calc(100% - 40px)); margin: 30px auto 80px; }
@@ -67,25 +66,14 @@ h3 { margin-bottom: 6px; font-size: 1rem; }
 .muted { color: var(--muted); }
 .page-heading { display: flex; justify-content: space-between; align-items: end; margin-bottom: 34px; }
 .page-heading h1.page-title { font-size: clamp(1.6rem, 3.2vw, 2.3rem); }
 .dashboard-grid { display: grid; grid-template-columns: minmax(0, 1.5fr) minmax(260px, .8fr); gap: 22px; align-items: start; }
 .panel { padding: 26px; border: 1px solid rgba(221, 225, 210, .9); border-radius: 24px; background: rgba(255, 253, 248, .88); box-shadow: var(--shadow); }
 .panel-heading { display: flex; justify-content: space-between; align-items: center; gap: 12px; margin-bottom: 22px; }
 .archive-link { margin-left: auto; color: var(--muted); font-size: .78rem; font-weight: 700; text-decoration: none; }
 .archive-link:hover { color: var(--deep-sage); }
 .count-badge { display: inline-grid; place-items: center; min-width: 27px; height: 27px; padding: 0 8px; border-radius: 99px; color: var(--deep-sage); background: #e8f0e1; font-size: .78rem; font-weight: 800; }
 .stack { display: grid; gap: 9px; }
 .stack label { color: var(--muted); font-size: .82rem; font-weight: 700; }
 input { width: 100%; min-height: 46px; padding: 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; }
 input:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
 .password-field { position: relative; }
 .password-field input { padding-right: 64px; }
 .password-toggle { position: absolute; top: 50%; right: 8px; transform: translateY(-50%); min-height: 32px; padding: 5px 10px; border: 0; border-radius: 9px; cursor: pointer; color: var(--deep-sage); background: #e7f0e1; font-weight: 800; font-size: .78rem; }
 .password-toggle:hover { background: #dbe9d2; }
 select { width: 100%; min-height: 46px; padding: 10px 34px 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; font: inherit; appearance: none; -webkit-appearance: none; background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16'><path d='M4 6l4 4 4-4' fill='none' stroke='%2355715d' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'/></svg>"); background-repeat: no-repeat; background-position: right 12px center; }
 select:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
 select option { color: var(--ink); background: #fff; }
 select option:checked { color: var(--deep-sage); font-weight: 700; }
 textarea { width: 100%; padding: 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; font: inherit; resize: vertical; }
 textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
 .button { display: inline-flex; align-items: center; justify-content: center; min-height: 44px; padding: 10px 17px; border: 0; border-radius: 12px; cursor: pointer; text-decoration: none; font-weight: 800; transition: transform .16s ease, box-shadow .16s ease, background .16s ease; }
@@ -102,29 +90,16 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .list-card-copy { display: grid; flex: 1; gap: 2px; }
 .list-card-copy small { color: var(--muted); font-size: .75rem; }
 .list-card-arrow { color: var(--muted); font-size: 1.25rem; }
 .archived-list-card { opacity: .72; }
 .archived-list-card .list-card-icon { color: var(--muted); background: #eef0ea; }
 .archived-list-card .list-card-copy { align-items: flex-start; }
 .archived-list-card form { margin-left: auto; }
 .archived-banner { margin-bottom: 18px; padding: 11px 14px; border: 1px solid var(--line); border-radius: 12px; color: var(--muted); background: #f1f3ec; font-size: .82rem; font-weight: 700; }
 .empty-state { padding: 35px 18px 24px; text-align: center; color: var(--muted); }
 .empty-mark { display: grid; place-items: center; width: 50px; height: 50px; margin: 0 auto 15px; border-radius: 18px; color: var(--deep-sage); background: #edf3e8; font-size: 1.8rem; }
 .empty-state h3 { color: var(--ink); }
 .auth-card { width: min(100%, 480px); margin: 7vh auto 0; padding: clamp(27px, 6vw, 54px); border: 1px solid var(--line); border-radius: 28px; background: rgba(255, 253, 248, .9); box-shadow: var(--shadow); }
 .auth-card .button { margin-top: 11px; }
 #passkey-login { width: 100%; }
 .auth-divider { display: flex; align-items: center; gap: 12px; margin: 20px 0 4px; color: var(--muted); font-size: .8rem; }
 .auth-divider::before, .auth-divider::after { content: ""; flex: 1; height: 1px; background: var(--line); }
 .passkey-list { display: grid; gap: 8px; margin-bottom: 16px; }
 .passkey-row { display: flex; align-items: center; gap: 12px; padding: 12px; border: 1px solid var(--line); border-radius: 14px; background: #fff; }
 .passkey-row .item-copy { flex: 1; }
 .passkey-row small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .auth-switch { margin: 25px 0 0; color: var(--muted); font-size: .9rem; text-align: center; }
 .auth-switch a { color: var(--deep-sage); font-weight: 800; }
 .alert { margin-bottom: 18px; padding: 12px 14px; border-radius: 12px; font-size: .9rem; }
 .alert-error { color: #874d40; background: #fbe7e0; }
 .alert-success { color: #3d6b4f; background: #e4f2e6; }
 .list-topbar { display: flex; justify-content: space-between; align-items: center; margin-bottom: 27px; }
 .back-link { color: var(--muted); font-size: .85rem; font-weight: 700; text-decoration: none; }
@@ -144,8 +119,7 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .list-heading { display: flex; justify-content: space-between; margin-bottom: 25px; }
 .list-heading h1 { max-width: 100%; margin-bottom: 5px; overflow-wrap: anywhere; font-size: clamp(1.45rem, 2.8vw, 2.05rem); }
 .list-meta { margin: 0; color: var(--muted); font-size: .85rem; }
-.meal-category-label { margin-left: 10px; color: var(--muted); font-size: .8em; font-weight: 500; white-space: nowrap; }
+.add-item-form { display: grid; grid-template-columns: minmax(0, 1fr) 90px 145px auto; gap: 8px; margin-bottom: 19px; }
 .add-item-form { display: grid; grid-template-columns: minmax(0, 1fr) 145px 90px auto; gap: 8px; margin-bottom: 19px; }
 .add-item-form input { min-height: 50px; }
 .add-item-form select { min-height: 50px; }
 .add-button { min-height: 50px; }
@@ -153,14 +127,11 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .item-list { display: grid; gap: 6px; }
 .category-group + .category-group { margin-top: 18px; }
 .category-heading { margin: 0 7px 4px; color: var(--deep-sage); font-size: .72rem; letter-spacing: .12em; text-transform: uppercase; }
 .ingredients-divider { margin: 26px 0 18px; border: 0; border-top: 1px solid var(--line); }
 .item-row { display: flex; align-items: center; gap: 12px; min-height: 66px; padding: 9px 7px 9px 10px; border-bottom: 1px solid #edf0e6; }
 .item-row:last-child { border-bottom: 0; }
 .check-form { flex: 0 0 auto; }
 .check-button { display: grid; place-items: center; width: 28px; height: 28px; padding: 0; border: 2px solid #c8d6c1; border-radius: 9px; color: #fff; background: transparent; cursor: pointer; font-size: .88rem; font-weight: 900; }
 .is-checked .check-button { border-color: var(--deep-sage); background: var(--deep-sage); }
 .check-button-static { cursor: default; }
 .is-checked .check-button-static { border-color: var(--deep-sage); background: var(--deep-sage); }
 .item-copy { display: grid; grid-template-columns: auto 1fr; flex: 1; min-width: 0; gap: 2px 7px; align-items: baseline; }
 .item-copy strong { grid-column: 2; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .item-qty { grid-column: 1; grid-row: 1; color: var(--muted); font-weight: 700; white-space: nowrap; }
@@ -229,10 +200,6 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .edit-form { margin-bottom: 12px; }
 .edit-form input { min-height: 38px; padding: 7px 10px; font-size: .85rem; }
 .danger-link { padding: 0; border: 0; color: var(--coral); background: none; cursor: pointer; font-size: .8rem; font-weight: 800; }
 .bordered-delete { padding: 7px 14px; border: 1px solid var(--coral); border-radius: 10px; background: none; }
 .bordered-delete:hover { background: #fbeae4; }
 .button-danger { width: 100%; color: var(--coral); background: #fbeae4; }
 .button-danger:hover { background: #f7ddd4; }
 .empty-items { padding: 34px 10px 18px; color: var(--muted); text-align: center; }
 .empty-items-icon { display: block; margin-bottom: 7px; color: var(--yellow); font-size: 1.7rem; }
 .empty-items p { margin-bottom: 2px; color: var(--ink); font-weight: 800; }
@@ -243,45 +210,12 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .category-form input { min-height: 38px; padding: 7px 10px; font-size: .84rem; }
 .category-list { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 14px; }
 .category-chip { padding: 5px 9px; border-radius: 99px; color: var(--deep-sage); background: #edf3e8; font-size: .72rem; font-weight: 800; }
 /* Meal categories side panel */
 .meal-category-list { display: grid; gap: 2px; margin-top: 14px; }
 .meal-category-row { display: flex; align-items: center; justify-content: space-between; gap: 8px; padding: 7px 4px; border-bottom: 1px solid #edf0e6; }
 .meal-category-row:last-child { border-bottom: 0; }
 .meal-category-name { font-size: .9rem; font-weight: 700; }
 .meal-category-delete { padding: 2px 6px; border: 0; border-radius: 7px; color: var(--muted); background: transparent; cursor: pointer; font-size: .8rem; line-height: 1; }
 .meal-category-delete:hover { color: var(--coral); background: #fbeae4; }
 .category-empty { margin: 13px 0 0; font-size: .8rem; }
 .category-result { margin-top: 10px; }
 .category-success { margin: 0; color: var(--deep-sage); font-size: .76rem; font-weight: 800; }
 .presence-list { display: grid; gap: 12px; }
 .presence-person { display: flex; align-items: center; gap: 10px; font-size: .9rem; font-weight: 700; }
 .avatar { display: grid; place-items: center; width: 32px; height: 32px; border-radius: 11px; color: var(--deep-sage); background: #e6f0df; font-size: .7rem; font-weight: 900; }
 .list-meals { display: grid; gap: 8px; }
 .list-meal-row { display: flex; align-items: center; gap: 10px; padding: 6px 4px; border-bottom: 1px solid #edf0e6; }
 .list-meal-row:last-child { border-bottom: 0; }
 .list-meal-icon { display: grid; place-items: center; flex: 0 0 auto; width: 30px; height: 30px; border-radius: 10px; color: var(--deep-sage); background: #eef4e9; font-size: .95rem; }
 .list-meal-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: .9rem; font-weight: 700; }
 .list-meal-remove { margin: 0; flex: 0 0 auto; }
 .list-meal-remove-button { padding: 2px 7px; border: 0; border-radius: 7px; color: var(--muted); background: transparent; cursor: pointer; font-size: .8rem; line-height: 1; }
 .list-meal-remove-button:hover { color: var(--coral); background: #fbeae4; }
 .list-meals-panel .add-meal-button { margin-top: 12px; width: 100%; }
 .list-meals-actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; margin-top: 12px; }
 .list-meals-actions .button { width: 100%; margin: 0; }
 .carry-over-button { color: var(--deep-sage); background: #eef4e9; }
 .carry-over-button:hover { background: #e3eddc; }
 .carry-intro { margin: 14px 24px 4px; font-size: .85rem; }
 .carry-source-picker { padding: 14px 24px 4px; }
 .carry-source-picker label { display: block; margin-bottom: 6px; font-size: .78rem; font-weight: 800; color: var(--muted); text-transform: uppercase; letter-spacing: .04em; }
 .carry-source-picker select { width: 100%; min-height: 42px; padding: 8px 12px; border: 1px solid var(--line); border-radius: 12px; color: var(--ink); background: #fff; font-size: .9rem; }
 .carry-results { padding: 14px 24px 22px; overflow-y: auto; }
 .carry-form { margin: 0; }
 .carry-list { display: grid; gap: 8px; }
 .carry-row { display: flex; align-items: center; gap: 12px; padding: 10px 12px; border: 1px solid var(--line); border-radius: 14px; background: #fff; cursor: pointer; }
 .carry-row:hover { border-color: var(--sage); }
 .carry-row input { accent-color: var(--deep-sage); width: 17px; height: 17px; }
 .carry-row-icon { display: grid; place-items: center; flex: 0 0 auto; width: 34px; height: 34px; border-radius: 11px; color: var(--deep-sage); background: #eef4e9; font-size: .95rem; }
 .carry-row-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: .9rem; font-weight: 700; }
 .carry-submit { margin-top: 14px; width: 100%; }
 .sharing-panel p, .tip-panel p { color: var(--muted); font-size: .86rem; }
 .invite-result { margin-top: 15px; }
 .invite-link-result { padding: 11px; border-radius: 12px; background: #f1f5ec; }
@@ -395,11 +329,6 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .meal-picker-empty { padding: 34px 22px 30px; text-align: center; color: var(--muted); }
 .meal-picker-empty h3 { color: var(--ink); }
 .meal-picker-empty p { margin-bottom: 18px; }
 .meal-filter-bar { margin: -6px 0 18px; }
 .meal-filter-bar input { min-height: 40px; padding: 8px 12px; font-size: .9rem; }
 .meal-filter-bar-picker { margin: 14px 24px 4px; }
 .meal-filter-empty { padding: 28px 18px; text-align: center; color: var(--muted); }
 .meal-filter-empty p { margin: 0; }
@media (max-width: 780px) {
  .site-header, .site-main, .site-footer { width: min(100% - 28px, 600px); }
@@ -425,100 +354,3 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
  .side-column { grid-template-columns: 1fr; }
  .site-footer { margin-bottom: 20px; }
 }
 /* Rewards cards */
 .rewards-grid { display: grid; gap: 16px; }
 .rewards-card {
  position: relative;
  padding: 18px;
  border: 1px solid var(--line);
  border-radius: 18px;
  background: #fff;
  transition: border-color .16s ease, transform .16s ease;
 }
 .rewards-card:hover { border-color: var(--sage); transform: translateY(-1px); }
 /* Stretched link: makes the whole card clickable to open the scan view. */
 .rewards-card-link {
  position: absolute;
  inset: 0;
  border-radius: inherit;
  z-index: 1;
 }
 .rewards-card-heading {
  display: flex;
  justify-content: space-between;
  align-items: center;
  gap: 12px;
  margin-bottom: 14px;
 }
 .rewards-card-heading strong { font-size: 1.05rem; }
 .rewards-barcode {
  display: flex;
  justify-content: center;
  padding: 14px;
  border-radius: 12px;
  background: #fff;
 }
 .rewards-barcode svg { width: 100%; height: auto; max-width: 340px; }
 .rewards-number {
  margin: 12px 0 0;
  text-align: center;
  color: var(--muted);
  font-size: .85rem;
  letter-spacing: .08em;
 }
 .rewards-unencodable {
  display: block;
  color: var(--coral);
  font-weight: 700;
 }
 /* Keep the Remove button above the stretched link so it stays clickable. */
 .rewards-card-heading form { position: relative; z-index: 2; }
 /* Single-card scan view */
 .scan-page {
  display: flex;
  flex-direction: column;
  align-items: center;
  gap: 22px;
  padding: 12px 0 40px;
 }
 .scan-back { align-self: flex-start; }
 .scan-card {
  width: min(100%, 460px);
  padding: clamp(24px, 6vw, 42px);
  border: 1px solid var(--line);
  border-radius: 28px;
  background: #fff;
  box-shadow: var(--shadow);
  text-align: center;
 }
 .scan-store { margin: 4px 0 26px; font-size: clamp(1.3rem, 4vw, 1.7rem); }
 .scan-barcode {
  display: flex;
  justify-content: center;
  padding: 22px;
  border-radius: 14px;
  background: #fff;
 }
 .scan-barcode svg {
  width: 100%;
  height: auto;
  max-width: 420px;
 }
 .scan-card .rewards-number {
  margin-top: 18px;
  font-size: 1rem;
 }
 select {
  width: 100%;
  min-height: 46px;
  padding: 10px 13px;
  border: 1px solid var(--line);
  border-radius: 12px;
  outline: none;
  color: var(--ink);
  background: #fff;
  font: inherit;
 }
 select:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
Author	SHA1	Message	Date
sbstp	4cbd5ef9cb	meals support	2026-08-01 20:26:55 -04:00
sbstp	2542f010b1	make categories global	2026-08-01 19:09:22 -04:00
sbstp	b71bdb2d5d	plan	2026-08-01 18:53:09 -04:00
		`@@ -1 +0,0 @@`
			`ALTER TABLE lists ADD COLUMN archived_at INTEGER;`