plan

.gitignore

@@ -3,7 +3,3 @@
 /sustenance.db*
 /.env
 /seed.json
-/e2e/node_modules/
-/e2e/test-results/
-/e2e/playwright-report/
-/test-results/

.woodpecker/fmt.yml

@@ -1,9 +0,0 @@
-when:
-  event: [push, pull_request]
-
-steps:
-  fmt:
-    image: rust:1
-    commands:
-      - rustup component add rustfmt
-      - cargo fmt --all -- --check

.woodpecker/release.yml

@@ -1,17 +0,0 @@
-when:
-  - event: tag
-
-steps:
-  build:
-    image: rust:1
-    commands:
-      - cargo build --release
-
-  publish:
-    image: alpine:3.23
-    commands:
-      - apk add --no-cache nodejs
-      - node ci/release.js target/release/sustenance
-    environment:
-      GITEA_RELEASE_TOKEN:
-        from_secret: gitea_release_token

.woodpecker/test.yml

@@ -1,18 +0,0 @@
-when:
-  event: [push, pull_request]
-
-steps:
-  test:
-    image: rust:1
-    commands:
-      - cargo test --all
-      - cargo build --all
-
-  e2e-test:
-    image: node:24
-    directory: e2e
-    commands:
-      - apt-get update
-      - apt-get install -y --no-install-recommends ca-certificates fonts-liberation libasound2 libatk-bridge2.0-0 libatk1.0-0 libcups2 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0 libgtk-3-0 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 xdg-utils
-      - npm install && npx playwright install chromium
-      - npx playwright test

Cargo.toml

@@ -1,34 +1,22 @@
 [package]
 name = "sustenance"
-version = "0.8.0"
+version = "0.1.0"
 edition = "2024"
 
 [dependencies]
 argon2 = "0.5"
 async-trait = "0.1"
 axum = { version = "0.8", features = ["ws"] }
-barcoders = { version = "2.0.0", features = ["svg"] }
-base64 = "0.22"
 futures-util = "0.3"
 hex = "0.4"
 maud = "0.27"
-pulldown-cmark = "0.13"
 rand = "0.8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
-sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "macros", "migrate", "tls-rustls"] }
+sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "sqlite", "macros", "tls-rustls"] }
 thiserror = "2"
 tokio = { version = "1", features = ["full"] }
-tower = "0.5"
+tower-http = { version = "0.6", features = ["fs", "trace"] }
-tower-http = { version = "0.6", features = ["fs", "trace", "set-header"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
-url = "2"
-webauthn-rs = "0.3"
-
-[profile.release]
-opt-level = "z"
-strip = true
-lto = true
-codegen-units = 1

MEAL_PLAN.md

@@ -0,0 +1,163 @@
+# Meal Feature Plan
+
+Status: planning (not yet implemented)
+
+This plan adds the concept of a **meal** to Sustenance. A meal has a name, an
+optional description/recipe (markdown), and a list of ingredients. Meals are
+**global** (not owned by a single user) and **not collaborative** like grocery
+lists. The core action is **"add a meal to a list"**, which expands the meal's
+ingredients into regular list items.
+
+The plan is split into parts so each can be implemented and tested independently.
+
+---
+
+## Part A — Refactor categories to be global
+
+Currently `categories` are per-list (`categories.list_id`, with a
+`UNIQUE (list_id, name)` constraint). Since meals are global and ingredients
+reference categories, categories become global too.
+
+### Schema change (in `migrate` in `src/sqlite.rs`)
+
+```sql
+categories (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
+    position INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL
+)
+```
+
+- Drop `list_id`; `name` becomes globally unique.
+- `items.category_id` stays a FK to `categories(id)` — unchanged.
+- **Migration concern:** the current `CREATE TABLE IF NOT EXISTS` won't alter an
+  existing DB. Need a real migration (or accept recreating the dev DB).
+
+### Repo / port changes (`CategoryRepository` in `src/ports.rs`)
+
+- `categories(txn)` → returns **all** global categories (no `list_id` param).
+- `create_category(txn, name)` → global, no `list_id`, no per-list revision bump.
+- Add `category_by_name(txn, name)` for resolving ingredient categories.
+- `ListRepository::create_list` **no longer seeds** default categories (they're
+  global now). Default categories become a one-time seed at startup instead.
+
+### Service / HTTP changes
+
+- `ListService::categories()` no longer takes `list_id`.
+- `create_category` handler moves from `/lists/{list_id}/categories` to a global
+  `/categories` route (or a categories management page).
+- The list page's categories panel now shows the global category set.
+- `create_category` no longer bumps a list revision (not list-scoped anymore),
+  so no realtime event for it.
+
+---
+
+## Part B — Meal data model
+
+New tables (in `migrate` in `src/sqlite.rs`):
+
+```sql
+meals (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL,
+    description TEXT NOT NULL DEFAULT '',   -- markdown source
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+)
+
+meal_ingredients (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    meal_id INTEGER NOT NULL REFERENCES meals(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    quantity TEXT NOT NULL DEFAULT '',
+    note TEXT NOT NULL DEFAULT '',
+    category_id INTEGER REFERENCES categories(id) ON DELETE SET NULL,  -- global category FK
+    position INTEGER NOT NULL DEFAULT 0
+)
+```
+
+- **No `user_id`** — meals are global (editable/accessible by all), matching lists.
+- Ingredient categories reference the **global** `categories.id` directly
+  (thanks to Part A), no name-string resolution needed.
+
+---
+
+## Part C — Domain models (`src/domain.rs`)
+
+- `Meal { id, name, description, ingredients: Vec<MealIngredient> }`
+- `MealIngredient { id, name, quantity, note, category_id: Option<i64> }`
+
+---
+
+## Part D — Ports (`src/ports.rs`)
+
+One repo per table, matching the existing pattern:
+
+- `MealRepository` — `create_meal`, `get_meal`, `list_meals`, `update_meal`,
+  `delete_meal`
+- `MealIngredientRepository` — `ingredients_for_meal`, `add_ingredient`,
+  `update_ingredient`, `delete_ingredient`
+- Reuse `ListRepository`, `CategoryRepository`, `ItemRepository`.
+
+---
+
+## Part E — Services (`src/services.rs`)
+
+- `MealService` — CRUD for meals + ingredients.
+- **`add_meal_to_list(meal_id, list_id)`** in one unit of work:
+  1. Load the meal.
+  2. Verify the list exists.
+  3. Map each ingredient's `category_id` (already a global category id, so it's
+     valid on the list directly).
+  4. **Bulk-insert** all items via a new `ItemRepository::add_items_bulk`,
+     bumping the list revision **once** → one realtime event.
+
+---
+
+## Part F — HTTP + Views
+
+### Routes (all require `CurrentUser`)
+
+- `GET /meals` — list all meals
+- `GET /meals/new`, `POST /meals` — create
+- `GET /meals/{id}`, `POST /meals/{id}/edit` — view/edit
+- `POST /meals/{id}/delete`
+- `POST /meals/{id}/ingredients` — add ingredient
+- `POST /meals/{id}/ingredients/{iid}/edit`, `.../delete`
+- `POST /lists/{list_id}/add-meal` — add a meal's ingredients to a list
+
+### Add-to-list lookup popup
+
+On the list page, an "Add meal" button opens a modal/popup with a searchable
+meal picker (htmx). Selecting a meal posts to `/lists/{list_id}/add-meal`.
+Implemented as an htmx-powered modal that fetches a meal list/search fragment.
+
+### Views (`src/views.rs`)
+
+- Meals index page (`/meals`) listing all meals.
+- Full-page create/edit forms (matches current htmx style).
+- Meal detail page showing name, rendered description, and ingredients.
+- Markdown rendered server-side with `pulldown-cmark`, no sanitization for now.
+
+---
+
+## Implementation order
+
+1. **Part A** — category refactor (schema, repos, services, HTTP, views, tests).
+   Do this first since meals depend on global categories.
+2. **Part B/C/D** — meal schema + domain + repos + tests.
+3. **Part E** — `MealService` CRUD + `add_meal_to_list` (bulk) + tests.
+4. **Part F** — HTTP routes, views, and the add-meal lookup popup.
+
+---
+
+## Open decisions (to confirm before implementing)
+
+1. **Migration handling for the category refactor** — since `CREATE TABLE IF NOT
+   EXISTS` won't reshape an existing DB, write a proper migration, or is it fine
+   to drop/recreate the dev DB?
+2. **Category management UI** — with categories now global, do we want a
+   dedicated categories page (e.g. `/categories`) to add/rename/delete them, or
+   keep it minimal (just the add form on the list page, now creating global
+   categories)?

README.md

@@ -8,13 +8,7 @@ A small shared grocery list built with Rust, Axum, Maud, htmx, WebSockets, and S
 cargo run
 ```
 
-Open <http://localhost:3000>. The application creates `sustenance.db` in the
+Open <http://127.0.0.1:3000>. The application creates `sustenance.db` in the working directory on first start.
-working directory on first start.
-
-**Note:** use `localhost` (not `127.0.0.1`) when testing passkeys locally —
-browsers reject IP addresses as WebAuthn RP IDs. The app defaults to
-`localhost` for loopback hosts, so passkeys work out of the box when you access
-the site via `http://localhost:3000`.
 
 ## Configuration
 
@@ -26,9 +20,7 @@ the site via `http://localhost:3000`.
 | `COOKIE_SECURE` | `false` | Add the `Secure` attribute to session cookies |
 | `REGISTRATION_MODE` | `invite_only` | Use `open` for local development; otherwise registration requires a valid list invitation after the first account |
 | `SEED_CONFIG` | `seed.json` | Optional JSON file with a default user to create when the database is first initialized |
-| `RP_ID` | derived from `PUBLIC_BASE_URL` | WebAuthn relying party ID (the host users access the site from) |
+| `RUST_LOG` | `sustenance=debug,tower_http=info` | Log filter |
-| `RP_NAME` | `Sustenance` | WebAuthn relying party name shown to users |
-| `RUST_LOG` | `sustenance=info,tower_http=info` | Log filter; HTTP requests are logged at info level |
 
 ### Seeding a default user
 
@@ -49,16 +41,12 @@ The file is optional — if it is missing or invalid, seeding is silently skippe
 ## Current features
 
 - Email/password accounts with Argon2 password hashes
-- Optional WebAuthn passkeys for passwordless sign-in (managed from the account page)
 - Cookie-backed sessions and CSRF tokens for list mutations
 - Shared lists with one-time, seven-day invitation links
 - Invite-only registration by default after the first account
 - Add, edit, check, and delete grocery items
-- Global categories with common defaults seeded at startup and custom category creation
+- List-scoped categories with common defaults and custom category creation
 - Items grouped by category and assigned from the add/edit forms
-- Meals with ingredients, markdown descriptions, and one-click "add meal to list"
-- Rewards cards with store name and number, rendered as scannable Code 128 / Code 39 barcodes
-- Single-card scan view that shows one barcode at a time and keeps the screen awake for scanning
 - Server-authoritative last-write-wins updates
 - Per-list WebSocket updates with server-rendered htmx fragments
 - In-memory presence for members currently viewing a list
@@ -73,23 +61,3 @@ cargo fmt --all -- --check
 cargo check
 cargo test
 ```
-
-### End-to-end tests (Playwright)
-
-The e2e tests live in `e2e/` and use Playwright with a real browser. Each test
-starts its own server against a fresh, throwaway database on a unique port, so
-tests are fully isolated from each other and from your real `sustenance.db`.
-
-The tests launch `target/debug/sustenance`, so build the server first:
-
-```sh
-# one-time setup
-cargo build
-cd e2e
-npm install
-npx playwright install chromium
-
-# run the tests (each test launches its own server against a fresh DB)
-cd e2e
-npx playwright test
-```

ci/release.js

@@ -1,91 +0,0 @@
-import * as fs from 'node:fs/promises';
-import { basename } from 'node:path';
-
-function getEnv(name) {
-    const val = process.env[name];
-    if (!val) {
-        throw new Error(`Environment variable ${name} is empty`);
-    }
-    return val;
-}
-
-async function fetchJSON(url, options) {
-    const resp = await fetch(url, options);
-    if (!resp.ok) {
-        throw new Error(`Unexpected HTTP status: ${resp.status}`, {
-            cause: {
-                status: resp.status,
-                body: await resp.text(),
-            },
-        });
-    }
-    return await resp.json();
-}
-
-async function postJSON(url, token, payload) {
-    return fetchJSON(url, {
-        method: "POST",
-        headers: {
-            "Authorization": `token ${token}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify(payload),
-    });
-}
-
-async function postFile(url, token, files) {
-    const formData = new FormData();
-    for (const [name, path] of Object.entries(files)) {
-        const fileBuffer = await fs.readFile(path);
-        const fileObject = new File([fileBuffer], basename(path), { type: 'application/octet-stream' });
-        formData.append(name, fileObject)
-    }
-    return await fetchJSON(url, {
-        method: "POST",
-        headers: {
-            "Authorization": `token ${token}`,
-        },
-        body: formData,
-    });
-}
-
-async function canRead(path) {
-    try {
-        await fs.access(path, fs.constants.R_OK);
-        return true;
-    } catch {
-        return false;
-    }
-}
-
-async function main() {
-    const path = process.argv[2];
-    if (!path || !canRead(path)) {
-        throw Error(`Path ${path} is undefined or inaccessible, use node release.js <path>`);
-    }
-    const token = getEnv("GITEA_RELEASE_TOKEN");
-    const tag = getEnv("CI_COMMIT_TAG");
-    const repo = getEnv("CI_REPO");
-
-    console.log("Creating release...");
-    const releaseData = await postJSON(`https://git.sbstp.ca/api/v1/repos/${repo}/releases`, token, {
-        name: `Release ${tag}`,
-        tag_name: tag,
-        target_commitish: tag,
-        draft: false,
-        prerelease: false,
-    });
-    console.log(`Created release ID ${releaseData.id}`);
-
-    console.log("Uploading asset...");
-    const assetData = await postFile(`https://git.sbstp.ca/api/v1/repos/${repo}/releases/${releaseData.id}/assets?name=${basename(path)}`, token, {
-        attachment: path,
-    });
-    console.log("Asset uploaded:", assetData);
-}
-
-try {
-    await main();
-} catch (err) {
-    console.error(err);
-}

e2e/fixtures.ts

@@ -1,112 +0,0 @@
-import { test as base, expect, Page } from "@playwright/test";
-import { spawn, ChildProcess } from "child_process";
-import * as os from "os";
-import * as path from "path";
-
-/**
- * Starts a fresh Sustenance server against an in-memory SQLite database on a
- * unique port for each test, and tears it down afterwards. Every test gets a
- * clean DB with no shared state between tests, and nothing is written to disk.
- */
-export const test = base.extend<{ server: { baseURL: string }; page: Page }>({
-  server: [
-    async ({}, use) => {
-      const server = await startServer();
-      await use({ baseURL: server.baseURL });
-      await killTree(server.child);
-    },
-    { scope: "test", auto: true },
-  ],
-
-  // Provide a page whose baseURL points at this test's server.
-  page: async ({ browser, server }, use) => {
-    const context = await browser.newContext({ baseURL: server.baseURL });
-    const page = await context.newPage();
-    await use(page);
-    await context.close();
-  },
-});
-
-/** Starts a server, retrying on a fresh port if the first attempt fails to bind. */
-async function startServer() {
-  for (let attempt = 0; attempt < 5; attempt++) {
-    const port = 20000 + Math.floor(Math.random() * 30000);
-    const baseURL = `http://localhost:${port}`;
-
-    const child = spawn(
-      path.resolve(__dirname, "..", "target", "debug", "sustenance"),
-      [],
-      {
-        env: {
-          ...process.env,
-          DATABASE_IN_MEMORY: "1",
-          REGISTRATION_MODE: "open",
-          BIND_ADDRESS: `127.0.0.1:${port}`,
-          PUBLIC_BASE_URL: baseURL,
-          // WebAuthn requires a valid domain for the RP ID; localhost is allowed.
-          RP_ID: "localhost",
-          // Point SEED_CONFIG at a nonexistent file so no default user is created.
-          SEED_CONFIG: path.join(os.tmpdir(), "sustenance-e2e-no-seed.json"),
-        },
-        stdio: ["ignore", "ignore", "pipe"],
-        // Run in its own process group so we can kill the whole tree.
-        detached: true,
-      },
-    );
-
-    let stderr = "";
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString();
-    });
-
-    try {
-      await waitForServer(baseURL, child);
-      return { baseURL, child };
-    } catch (error) {
-      // The server may have failed to bind (port collision). Clean up and retry.
-      await killTree(child);
-      if (attempt === 4) {
-        throw new Error(
-          `server failed to start after retries; last stderr:\n${stderr}\n${error}`,
-        );
-      }
-    }
-  }
-  throw new Error("unreachable");
-}
-
-async function waitForServer(baseURL: string, child: ChildProcess) {
-  const deadline = Date.now() + 60_000;
-  while (Date.now() < deadline) {
-    if (child.exitCode !== null) {
-      throw new Error(`server exited early with code ${child.exitCode}`);
-    }
-    try {
-      const res = await fetch(baseURL + "/login");
-      if (res.ok) return;
-    } catch {
-      // not up yet
-    }
-    await new Promise((r) => setTimeout(r, 200));
-  }
-  throw new Error("timed out waiting for server to start");
-}
-
-async function killTree(child: ChildProcess) {
-  try {
-    process.kill(-child.pid!, "SIGTERM");
-  } catch {
-    child.kill("SIGTERM");
-  }
-  // Give it a moment to shut down gracefully, then force-kill if needed.
-  const exited = new Promise((resolve) => child.once("exit", resolve));
-  const timeout = new Promise((resolve) => setTimeout(resolve, 5000));
-  await Promise.race([exited, timeout]);
-  try {
-    process.kill(-child.pid!, "SIGKILL");
-  } catch {
-    /* already gone */
-  }
-}
-
-export { expect };

e2e/helpers.ts

@@ -1,79 +0,0 @@
-import { Page, expect } from "@playwright/test";
-
-/** Registers a fresh account and lands on the lists page. */
-export async function registerAndLogin(page: Page, email: string) {
-  await page.goto("/register");
-  await page.fill("#display-name", "Test User");
-  await page.fill("#email", email);
-  await page.fill("#password", "a-strong-password");
-  await page.click('button[type="submit"]');
-  await expect(page).toHaveURL(/\/lists/);
-}
-
-/** Creates a meal with the given name and markdown description. */
-export async function createMeal(
-  page: Page,
-  name: string,
-  description: string,
-  category?: string,
-) {
-  await page.goto("/meals/new");
-  await page.fill("#meal-name", name);
-  if (category) {
-    await page.selectOption("#meal-category", { label: category });
-  }
-  await page.fill("#meal-description", description);
-  await page.click('button:has-text("Save meal")');
-  await expect(page).toHaveURL(/\/meals\/\d+/);
-}
-
-/** Creates a list and lands on its page. */
-export async function createList(page: Page, name: string) {
-  await page.goto("/lists");
-  await page.fill("#list-name", name);
-  await page.click('button:has-text("Create list")');
-  await expect(page).toHaveURL(/\/lists\/\d+/);
-}
-
-/** Adds an item to the current list page. */
-export async function addItem(page: Page, name: string, quantity = "") {
-  await page.fill("#item-name", name);
-  if (quantity) {
-    await page.fill("#item-quantity", quantity);
-  }
-  await page.click("#add-item-button");
-  await expect(page.locator(".item-row").filter({ hasText: name })).toBeVisible();
-}
-
-/** Adds an ingredient to the current meal page. */
-export async function addIngredient(
-  page: Page,
-  name: string,
-  quantity = "",
-  category?: string,
-) {
-  await page.fill("#ingredient-name", name);
-  if (category) {
-    await page.selectOption("#ingredient-category", { label: category });
-  }
-  if (quantity) {
-    await page.fill("#ingredient-quantity", quantity);
-  }
-  await page.click("#add-ingredient-button");
-  // The form submit is hx-boosted (full body swap to the same URL), so wait for
-  // the new row to appear. This also acts as a settle point so the next action
-  // doesn't race the async body replacement and target a stale form.
-  await expect(page.locator(".ingredient-list").filter({ hasText: name })).toBeVisible();
-}
-
-/** Creates a meal and adds the given ingredients to it. */
-export async function createMealWithIngredients(
-  page: Page,
-  name: string,
-  ingredients: Array<{ name: string; quantity?: string }>,
-) {
-  await createMeal(page, name, "");
-  for (const ingredient of ingredients) {
-    await addIngredient(page, ingredient.name, ingredient.quantity ?? "");
-  }
-}

e2e/package-lock.json

@@ -1,90 +0,0 @@
-{
-  "name": "sustenance-e2e",
-  "version": "1.0.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "sustenance-e2e",
-      "version": "1.0.0",
-      "devDependencies": {
-        "@playwright/test": "^1.45.0",
-        "@types/node": "^26.1.2"
-      }
-    },
-    "node_modules/@playwright/test": {
-      "version": "1.62.1",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.62.1.tgz",
-      "integrity": "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==",
-      "dev": true,
-      "dependencies": {
-        "playwright": "1.62.1"
-      },
-      "bin": {
-        "playwright": "cli.js"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "26.1.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
-      "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
-      "dev": true,
-      "dependencies": {
-        "undici-types": "~8.3.0"
-      }
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/playwright": {
-      "version": "1.62.1",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.62.1.tgz",
-      "integrity": "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==",
-      "dev": true,
-      "dependencies": {
-        "playwright-core": "1.62.1"
-      },
-      "bin": {
-        "playwright": "cli.js"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "optionalDependencies": {
-        "fsevents": "2.3.2"
-      }
-    },
-    "node_modules/playwright-core": {
-      "version": "1.62.1",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
-      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
-      "dev": true,
-      "bin": {
-        "playwright-core": "cli.js"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
-      "dev": true
-    }
-  }
-}

e2e/package.json

@@ -1,13 +0,0 @@
-{
-  "name": "sustenance-e2e",
-  "version": "1.0.0",
-  "private": true,
-  "scripts": {
-    "test": "playwright test",
-    "test:headed": "playwright test --headed"
-  },
-  "devDependencies": {
-    "@playwright/test": "^1.45.0",
-    "@types/node": "^26.1.2"
-  }
-}

e2e/playwright.config.ts

@@ -1,10 +0,0 @@
-import { defineConfig } from "@playwright/test";
-
-export default defineConfig({
-  testDir: "./tests",
-  timeout: 30_000,
-  retries: 2,
-  use: {
-    trace: "on-first-retry",
-  },
-});

e2e/tests/add-meal.spec.ts

@@ -1,98 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createList, createMealWithIngredients } from "../helpers";
-
-test("a user can add a meal's ingredients to a list via the picker", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Spaghetti Bolognese", [
-    { name: "Penne", quantity: "500g" },
-    { name: "Tomato", quantity: "2" },
-  ]);
-  await createList(page, "Weekly shop");
-
-  // Open the add-meal picker.
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await expect(picker).toBeVisible();
-  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
-
-  // Select the meal.
-  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
-
-  // The picker closes and the meal's ingredients appear as items.
-  await expect(picker).toHaveCount(0);
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
-  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toBeVisible();
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" }).locator(".item-qty")).toHaveText("(500g)");
-});
-
-test("the add-meal picker closes via the close button", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Spaghetti Bolognese", [{ name: "Penne" }]);
-  await createList(page, "Weekly shop");
-
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await expect(picker).toBeVisible();
-
-  await picker.locator(".meal-picker-close").click();
-  await expect(picker).toHaveCount(0);
-});
-
-test("the add-meal picker closes when clicking outside", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Spaghetti Bolognese", [{ name: "Penne" }]);
-  await createList(page, "Weekly shop");
-
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await expect(picker).toBeVisible();
-
-  // Click the backdrop itself (outside the modal card), at the viewport corner.
-  await page.mouse.click(10, 10);
-  await expect(picker).toHaveCount(0);
-});
-
-test("a meal added to a list is shown in the meals panel", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Spaghetti Bolognese", [
-    { name: "Penne", quantity: "500g" },
-    { name: "Tomato", quantity: "2" },
-  ]);
-  await createList(page, "Weekly shop");
-
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
-
-  // The meal appears in the "Meals on this list" panel.
-  const panel = page.locator("#list-meals-panel");
-  await expect(panel).toBeVisible();
-  await expect(panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
-});
-
-test("removing a meal from a list removes its ingredients", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Spaghetti Bolognese", [
-    { name: "Penne", quantity: "500g" },
-    { name: "Tomato", quantity: "2" },
-  ]);
-  await createList(page, "Weekly shop");
-
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" }).click();
-
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
-  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toBeVisible();
-
-  // Remove the meal from the list.
-  const panel = page.locator("#list-meals-panel");
-  const row = panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" });
-  await row.locator(".list-meal-remove-button").click();
-
-  // The meal's ingredients are removed from the list.
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toHaveCount(0);
-  await expect(page.locator(".item-row").filter({ hasText: "Tomato" })).toHaveCount(0);
-  await expect(row).toHaveCount(0);
-});

e2e/tests/archive.spec.ts

@@ -1,83 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createList, addItem } from "../helpers";
-
-test("a user can archive a list and it moves to the archive page", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-
-  // Archive from the list page.
-  await page.click('button:has-text("Archive")');
-
-  // Lands back on the lists page; the list is no longer shown.
-  await expect(page).toHaveURL(/\/lists/);
-  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toHaveCount(0);
-
-  // The archived list is reachable from the archive page.
-  await page.goto("/archive");
-  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toBeVisible();
-});
-
-test("the lists frame links to the archive page", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await page.goto("/lists");
-
-  await page.click('a.archive-link');
-  await expect(page).toHaveURL(/\/archive/);
-});
-
-test("an archived list is read-only", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await addItem(page, "Apple");
-  await page.click('button:has-text("Archive")');
-
-  // Open the archived list directly.
-  await page.goto("/archive");
-  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
-  await expect(page).toHaveURL(/\/lists\/\d+/);
-
-  // The item is still visible.
-  await expect(page.locator(".item-row").filter({ hasText: "Apple" })).toBeVisible();
-
-  // No mutation UI is present.
-  await expect(page.locator("#add-item-form")).toHaveCount(0);
-  await expect(page.locator(".item-actions-button")).toHaveCount(0);
-  await expect(page.locator(".check-form")).toHaveCount(0);
-  await expect(page.locator('button:has-text("+ Add meal")')).toHaveCount(0);
-});
-
-test("a user can restore an archived list and edit it again", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await addItem(page, "Apple");
-  await page.click('button:has-text("Archive")');
-
-  // Open the archived list and restore it.
-  await page.goto("/archive");
-  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
-  await page.click('button:has-text("Restore")');
-
-  // Back on the lists page, the list is active again.
-  await expect(page).toHaveURL(/\/lists/);
-  await expect(page.locator(".list-card").filter({ hasText: "Weekly shop" })).toBeVisible();
-
-  // The list is editable again.
-  await page.locator(".list-card").filter({ hasText: "Weekly shop" }).click();
-  await expect(page.locator("#add-item-form")).toBeVisible();
-  await addItem(page, "Banana");
-  await expect(page.locator(".item-row").filter({ hasText: "Banana" })).toBeVisible();
-});
-
-test("the archive page shows the list name and created date", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await page.click('button:has-text("Archive")');
-
-  await page.goto("/archive");
-  const card = page.locator(".list-card").filter({ hasText: "Weekly shop" });
-  await expect(card).toBeVisible();
-  // The card shows a created date (e.g. "Created 7 Aug 2026").
-  await expect(card.locator("small")).toContainText("Created");
-});

e2e/tests/auth.spec.ts

@@ -1,45 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin } from "../helpers";
-
-test("a user can register and log in", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await expect(page.locator("h1")).toContainText("Grocery lists");
-});
-
-test("a user can log out", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await page.click('button:has-text("Sign out")');
-  await expect(page).toHaveURL(/\/login/);
-  await expect(page.locator("h1")).toContainText("Welcome back");
-});
-
-test("a user can change their password", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await page.goto("/account");
-  await page.fill("#new-password", "a-new-strong-password");
-  await page.fill("#confirm-password", "a-new-strong-password");
-  await page.click('button:has-text("Update password")');
-  await expect(page.locator(".alert-success")).toContainText("updated");
-
-  // The old password no longer works; the new one does.
-  await page.click('button:has-text("Sign out")');
-  await page.fill("#email", "alice@example.com");
-  await page.fill("#password", "a-strong-password");
-  await page.click('button[type="submit"]');
-  await expect(page.locator(".alert-error")).toContainText("incorrect");
-
-  await page.fill("#email", "alice@example.com");
-  await page.fill("#password", "a-new-strong-password");
-  await page.click('button[type="submit"]');
-  await expect(page).toHaveURL(/\/lists/);
-});
-
-test("changing password rejects a mismatched confirmation", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await page.goto("/account");
-  await page.fill("#new-password", "a-new-strong-password");
-  await page.fill("#confirm-password", "a-different-password");
-  await page.click('button:has-text("Update password")');
-  await expect(page.locator(".alert-error")).toContainText("do not match");
-});

e2e/tests/carry-over.spec.ts

@@ -1,134 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createList, createMealWithIngredients } from "../helpers";
-
-/**
- * Opens the carry-over modal and waits for htmx to finish swapping it in, so
- * the source `<select>`'s `change` trigger is bound before interacting with it.
- */
-async function openCarryModal(page: import("@playwright/test").Page) {
-  await page.click(".carry-over-button");
-  const carry = page.locator(".meal-picker-backdrop");
-  await expect(carry).toBeVisible();
-  // Let htmx finish processing the freshly-swapped modal before selecting a
-  // source; otherwise the change event can be missed and no hx-get fires.
-  await page.waitForTimeout(300);
-  return carry;
-}
-
-test("a user can carry meals over from a previous list without re-adding ingredients", async ({
-  page,
-}) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Spaghetti Bolognese", [
-    { name: "Penne", quantity: "500g" },
-    { name: "Tomato", quantity: "2" },
-  ]);
-
-  // Last week's list has the meal added (with its ingredients as items).
-  await createList(page, "Last week");
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await picker
-    .locator(".meal-picker-button")
-    .filter({ hasText: "Spaghetti Bolognese" })
-    .click();
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
-
-  // Create this week's (new) list.
-  await createList(page, "This week");
-  await expect(page.locator(".item-row")).toHaveCount(0);
-
-  // Open the carry-over modal and pick the source list.
-  const carry = await openCarryModal(page);
-  await expect(carry.locator(".carry-intro")).toContainText("already purchased");
-  await carry.locator("#carry-source").selectOption({ label: "Last week" });
-
-  // The source list's meals appear as selectable rows.
-  const row = carry.locator(".carry-row").filter({ hasText: "Spaghetti Bolognese" });
-  await expect(row).toBeVisible();
-
-  // Select the meal and finish.
-  await row.locator('input[type="checkbox"]').check();
-  await carry.locator(".carry-submit").click();
-
-  // The modal closes, the meal appears in the meals panel, but no items are added.
-  await expect(carry).toHaveCount(0);
-  const panel = page.locator("#list-meals-panel");
-  await expect(panel.locator(".list-meal-row").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
-  await expect(page.locator(".item-row")).toHaveCount(0);
-});
-
-test("the carry-over modal lists active lists newest first and excludes the current list", async ({
-  page,
-}) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "First list");
-  await createList(page, "Second list");
-
-  // Open carry-over on the second (current) list.
-  await page.click(".carry-over-button");
-  const carry = page.locator(".meal-picker-backdrop");
-  await expect(carry).toBeVisible();
-
-  const options = carry.locator("#carry-source option");
-  // The current list is excluded; only the other list remains.
-  await expect(options).toHaveCount(2); // placeholder + one source
-  await expect(carry.locator("#carry-source")).toContainText("First list");
-  await expect(carry.locator("#carry-source")).not.toContainText("Second list");
-});
-
-test("carrying a meal does not remove it from the source list", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Pasta", [{ name: "Penne" }]);
-  await createList(page, "Last week");
-  await page.click(".add-meal-button");
-  await page
-    .locator(".meal-picker-backdrop .meal-picker-button")
-    .filter({ hasText: "Pasta" })
-    .click();
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
-
-  await createList(page, "This week");
-  const carry = await openCarryModal(page);
-
-  // Select the source list; the meal rows load via hx-get.
-  await carry.locator("#carry-source").selectOption({ label: "Last week" });
-  const row = carry.locator(".carry-row").filter({ hasText: "Pasta" });
-  await expect(row).toBeVisible({ timeout: 10_000 });
-  await row.locator('input[type="checkbox"]').check();
-  await carry.locator(".carry-submit").click();
-  await expect(carry).toHaveCount(0);
-
-  // The source list still has its meal and items.
-  await page.goto("/lists");
-  await page.locator(".list-card").filter({ hasText: "Last week" }).click();
-  await expect(page.locator("#list-meals-panel .list-meal-row").filter({ hasText: "Pasta" })).toBeVisible();
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
-});
-
-test("submitting carry-over with no selection does not add a meal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMealWithIngredients(page, "Pasta", [{ name: "Penne" }]);
-  await createList(page, "Last week");
-  await page.click(".add-meal-button");
-  await page
-    .locator(".meal-picker-backdrop .meal-picker-button")
-    .filter({ hasText: "Pasta" })
-    .click();
-  await expect(page.locator(".item-row").filter({ hasText: "Penne" })).toBeVisible();
-
-  await createList(page, "This week");
-  const carry = await openCarryModal(page);
-
-  // Select the source list; the meal rows load via hx-get.
-  await carry.locator("#carry-source").selectOption({ label: "Last week" });
-  await expect(carry.locator(".carry-row").filter({ hasText: "Pasta" })).toBeVisible({
-    timeout: 10_000,
-  });
-
-  // Submit with nothing selected; the modal stays open and no meal is carried.
-  await carry.locator(".carry-submit").click();
-  await expect(carry).toBeVisible();
-  await expect(page.locator("#list-meals-panel .list-meal-row")).toHaveCount(0);
-});

e2e/tests/lists.spec.ts

@@ -1,93 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createList, addItem } from "../helpers";
-
-test("a user can create a list", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-
-  await createList(page, "Weekly shop");
-
-  await expect(page.locator("h1")).toContainText("Weekly shop");
-  await expect(page.locator(".empty-items")).toBeVisible();
-});
-
-test("a user can add an item with a quantity", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-
-  await addItem(page, "Apple", "2");
-
-  // Quantity renders in parens to the left of the name.
-  const row = page.locator(".item-row").filter({ hasText: "Apple" });
-  await expect(row.locator(".item-qty")).toHaveText("(2)");
-  await expect(row.locator("strong")).toHaveText("Apple");
-});
-
-test("a user can check off an item", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await addItem(page, "Apple");
-
-  const row = page.locator(".item-row").filter({ hasText: "Apple" });
-  await row.locator(".check-button").click();
-
-  await expect(row).toHaveClass(/is-checked/);
-});
-
-test("clicking an item's text toggles the checkbox", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await addItem(page, "Apple");
-
-  const row = page.locator(".item-row").filter({ hasText: "Apple" });
-  await row.locator(".item-copy").click();
-
-  await expect(row).toHaveClass(/is-checked/);
-});
-
-test("a user can edit an item via the actions modal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await addItem(page, "Apple", "2");
-
-  const row = page.locator(".item-row").filter({ hasText: "Apple" });
-  await row.locator(".item-actions-button").click();
-
-  const dialog = row.locator("dialog.item-modal");
-  await expect(dialog).toBeVisible();
-  await dialog.locator('[id^="item-edit-name"]').fill("Banana");
-  await dialog.locator('[id^="item-edit-quantity"]').fill("6");
-  await dialog.locator('[id^="item-edit-save"]').click();
-
-  const updated = page.locator(".item-row").filter({ hasText: "Banana" });
-  await expect(updated).toBeVisible();
-  await expect(updated.locator(".item-qty")).toHaveText("(6)");
-});
-
-test("a user can delete an item via the actions modal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  await addItem(page, "Apple");
-
-  const row = page.locator(".item-row").filter({ hasText: "Apple" });
-  await row.locator(".item-actions-button").click();
-
-  const dialog = row.locator("dialog.item-modal");
-  await expect(dialog).toBeVisible();
-  await dialog.locator('[id^="item-edit-delete"]').click();
-
-  await expect(page.locator(".item-row").filter({ hasText: "Apple" })).toHaveCount(0);
-  await expect(page.locator(".empty-items")).toBeVisible();
-});
-
-test("a user can add a category", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-
-  // Categories are managed from the main lists page.
-  await page.goto("/lists");
-  await page.fill("#category-name", "Bakery");
-  await page.click("#add-category-button");
-
-  await expect(page.locator(".category-chip").filter({ hasText: "Bakery" })).toBeVisible();
-});

e2e/tests/meal-categories.spec.ts

@@ -1,111 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createMeal } from "../helpers";
-
-test("meals are grouped under their category on the meals page", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-
-  await createMeal(page, "Beef Stew", "", "Beef");
-  await createMeal(page, "Chicken Curry", "", "Chicken");
-  await createMeal(page, "Plain Rice", "");
-
-  await page.goto("/meals");
-
-  // Each category appears as a heading with its meals beneath it.
-  const beef = page.locator(".category-group").filter({ hasText: "Beef" });
-  await expect(beef.locator(".category-heading")).toContainText("Beef");
-  await expect(beef.locator(".list-card").filter({ hasText: "Beef Stew" })).toBeVisible();
-
-  const chicken = page.locator(".category-group").filter({ hasText: "Chicken" });
-  await expect(chicken.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
-
-  // Uncategorized meals land in their own group.
-  const uncategorized = page.locator(".category-group").filter({ hasText: "Uncategorized" });
-  await expect(uncategorized.locator(".list-card").filter({ hasText: "Plain Rice" })).toBeVisible();
-});
-
-test("a user can create a meal category", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-
-  await page.goto("/meals");
-  await page.fill('form[action="/meals/categories"] input[name="name"]', "Breakfast");
-  await page.click('form[action="/meals/categories"] button[type="submit"]');
-
-  await expect(page).toHaveURL(/\/meals$/);
-  await expect(page.locator(".meal-category-name").filter({ hasText: "Breakfast" })).toBeVisible();
-});
-
-test("a user can delete a meal category and its meals become uncategorized", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-
-  // Create a custom category and a meal in it.
-  await page.goto("/meals");
-  await page.fill('form[action="/meals/categories"] input[name="name"]', "Breakfast");
-  await page.click('form[action="/meals/categories"] button[type="submit"]');
-  await expect(page).toHaveURL(/\/meals$/);
-
-  await createMeal(page, "Pancakes", "", "Breakfast");
-
-  // Delete the category.
-  await page.goto("/meals");
-  const row = page.locator(".meal-category-row").filter({ hasText: "Breakfast" });
-  await row.locator(".meal-category-delete").click();
-  await expect(page).toHaveURL(/\/meals$/);
-
-  // The category is gone and the meal is now uncategorized.
-  await expect(page.locator(".meal-category-name").filter({ hasText: "Breakfast" })).toHaveCount(0);
-  const uncategorized = page.locator(".category-group").filter({ hasText: "Uncategorized" });
-  await expect(uncategorized.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
-});
-
-test("a user can change a meal's category via the edit modal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Beef Stew", "", "Beef");
-
-  await page.click('button:has-text("Edit")');
-  const dialog = page.locator("dialog#meal-edit-modal");
-  await expect(dialog).toBeVisible();
-  await dialog.locator("#meal-edit-category").selectOption({ label: "Chicken" });
-  await dialog.locator("#meal-edit-save").click();
-
-  await expect(page).toHaveURL(/\/meals\/\d+/);
-  await page.goto("/meals");
-
-  const chicken = page.locator(".category-group").filter({
-    has: page.locator(".category-heading", { hasText: "Chicken" }),
-  });
-  await expect(chicken.locator(".list-card").filter({ hasText: "Beef Stew" })).toBeVisible();
-  const beef = page.locator(".category-group").filter({
-    has: page.locator(".category-heading", { hasText: "Beef" }),
-  });
-  await expect(beef.locator(".list-card").filter({ hasText: "Beef Stew" })).toHaveCount(0);
-});
-
-test("a meal's category is shown on its page", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Beef Stew", "", "Beef");
-
-  await expect(page.locator(".meal-category-label")).toHaveText("(Beef)");
-});
-
-test("the add-meal picker groups meals by category", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Beef Stew", "", "Beef");
-  await createMeal(page, "Chicken Curry", "", "Chicken");
-
-  // Go to a list to open the picker.
-  await page.goto("/lists");
-  await page.fill("#list-name", "Weekly shop");
-  await page.click('button:has-text("Create list")');
-  await expect(page).toHaveURL(/\/lists\/\d+/);
-
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await expect(picker).toBeVisible();
-
-  const beef = picker.locator(".category-group").filter({ hasText: "Beef" });
-  await expect(beef.locator(".meal-picker-button").filter({ hasText: "Beef Stew" })).toBeVisible();
-
-  const chicken = picker.locator(".category-group").filter({ hasText: "Chicken" });
-  await expect(chicken.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
-});

e2e/tests/meal-filter.spec.ts

@@ -1,57 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createList, createMeal } from "../helpers";
-
-test("the meals page filters by name as you type", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-  await createMeal(page, "Chicken Curry", "");
-  await createMeal(page, "Pancakes", "");
-
-  await page.goto("/meals");
-  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
-  await expect(page.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
-  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
-
-  // Type a query; only matching meals remain.
-  await page.fill("#meal-search", "chicken");
-  await expect(page.locator(".list-card").filter({ hasText: "Chicken Curry" })).toBeVisible();
-  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
-  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toHaveCount(0);
-
-  // Clearing the search restores all meals.
-  await page.fill("#meal-search", "");
-  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
-  await expect(page.locator(".list-card").filter({ hasText: "Pancakes" })).toBeVisible();
-});
-
-test("the meals page shows an empty state when nothing matches", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-
-  await page.goto("/meals");
-  await page.fill("#meal-search", "zzzz");
-  await expect(page.locator(".meal-filter-empty")).toBeVisible();
-  await expect(page.locator(".list-card")).toHaveCount(0);
-});
-
-test("the add-meal picker filters meals as you type", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-  await createMeal(page, "Chicken Curry", "");
-  await createList(page, "Weekly shop");
-
-  await page.click(".add-meal-button");
-  const picker = page.locator(".meal-picker-backdrop");
-  await expect(picker).toBeVisible();
-  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toBeVisible();
-  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
-
-  await picker.locator(".meal-filter").fill("curry");
-  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Chicken Curry" })).toBeVisible();
-  await expect(picker.locator(".meal-picker-button").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
-
-  // The search box keeps focus and the modal stays open.
-  await expect(picker.locator(".meal-filter")).toBeFocused();
-  await expect(picker).toBeVisible();
-});

e2e/tests/meals.spec.ts

@@ -1,87 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createMeal, addIngredient } from "../helpers";
-
-test("a user can add an ingredient to a meal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-
-  await addIngredient(page, "Penne", "500g");
-
-  const row = page.locator(".ingredient-list").filter({ hasText: "Penne" });
-  await expect(row.locator(".item-qty")).toHaveText("(500g)");
-  await expect(row.locator("strong")).toHaveText("Penne");
-});
-
-test("a user can edit a meal name and description via the modal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "A classic.");
-
-  await page.click('button:has-text("Edit")');
-  const dialog = page.locator("dialog#meal-edit-modal");
-  await expect(dialog).toBeVisible();
-  await dialog.locator("#meal-edit-name").fill("Pasta al Pomodoro");
-  await dialog.locator("#meal-edit-description").fill("## Ingredients\n\nA simple tomato sauce.");
-  await dialog.locator("#meal-edit-save").click();
-
-  await expect(page.locator("h1")).toContainText("Pasta al Pomodoro");
-  await expect(page.locator(".markdown h2")).toContainText("Ingredients");
-});
-
-test("a user can delete a meal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-
-  page.on("dialog", (dialog) => dialog.accept());
-  await page.click('button:has-text("Delete")');
-  await expect(page).toHaveURL(/\/meals$/);
-  await expect(page.locator(".list-card").filter({ hasText: "Spaghetti Bolognese" })).toHaveCount(0);
-});
-
-test("a user can edit an ingredient via the actions modal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-  await addIngredient(page, "Penne", "500g");
-
-  const row = page.locator(".ingredient-list").filter({ hasText: "Penne" });
-  await row.locator(".item-actions-button").click();
-
-  const dialog = row.locator("dialog.item-modal");
-  await expect(dialog).toBeVisible();
-  await dialog.locator('[id^="ingredient-edit-name"]').fill("Rigatoni");
-  await dialog.locator('[id^="ingredient-edit-quantity"]').fill("400g");
-  await dialog.locator('[id^="ingredient-edit-save"]').click();
-
-  const updated = page.locator(".ingredient-list").filter({ hasText: "Rigatoni" });
-  await expect(updated).toBeVisible();
-  await expect(updated.locator(".item-qty")).toHaveText("(400g)");
-});
-
-test("a user can delete an ingredient via the actions modal", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-  await addIngredient(page, "Penne");
-
-  const row = page.locator(".ingredient-list").filter({ hasText: "Penne" });
-  await row.locator(".item-actions-button").click();
-
-  const dialog = row.locator("dialog.item-modal");
-  await expect(dialog).toBeVisible();
-  await dialog.locator('[id^="ingredient-edit-delete"]').click();
-
-  await expect(page.locator(".ingredient-list").filter({ hasText: "Penne" })).toHaveCount(0);
-});
-
-test("ingredients are grouped under their categories", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await createMeal(page, "Spaghetti Bolognese", "");
-
-  // Add an ingredient in the default "Produce" category.
-  await addIngredient(page, "Tomato", "", "Produce");
-
-  // Add one without a category.
-  await addIngredient(page, "Penne");
-
-  await expect(page.locator(".category-heading").filter({ hasText: "Produce" })).toBeVisible();
-  await expect(page.locator(".category-heading").filter({ hasText: "Uncategorized" })).toBeVisible();
-});

e2e/tests/passkey.spec.ts

@@ -1,46 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin } from "../helpers";
-
-/**
- * Enables a virtual WebAuthn authenticator on the given context so the browser
- * can complete passkey ceremonies without a real device.
- */
-async function enableVirtualAuthenticator(context: any) {
-  const cdp = await context.newCDPSession(context.pages()[0]);
-  await cdp.send("WebAuthn.enable", { enableUI: false });
-  await cdp.send("WebAuthn.addVirtualAuthenticator", {
-    options: {
-      protocol: "ctap2",
-      transport: "internal",
-      hasResidentKey: true,
-      hasUserVerification: true,
-      isUserVerified: true,
-    },
-  });
-}
-
-test("a user can register a passkey and sign in with it", async ({ page, browser, server }) => {
-  const context = await browser.newContext({ baseURL: server.baseURL });
-  const p = await context.newPage();
-
-  await enableVirtualAuthenticator(context);
-
-  // Register with a password first.
-  await registerAndLogin(p, "alice@example.com");
-
-  // Add a passkey from the account page.
-  await p.goto("/account");
-  await p.click("#add-passkey");
-  await expect(p.locator(".passkey-row")).toHaveCount(1);
-
-  // Log out.
-  await p.click('button:has-text("Sign out")');
-  await expect(p).toHaveURL(/\/login/);
-
-  // Sign in with the passkey without entering an email (userless sign-in).
-  await p.click("#passkey-login");
-  await expect(p).toHaveURL(/\/lists/);
-
-  await context.close();
-});

e2e/tests/rewards.spec.ts

@@ -1,169 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin } from "../helpers";
-
-/** Navigates to the rewards cards page. */
-async function gotoRewards(page: import("@playwright/test").Page) {
-  await page.goto("/rewards");
-  await expect(page.locator("h1")).toContainText("Rewards cards");
-}
-
-/**
- * Adds a rewards card and lands back on the /rewards page with it rendered.
- */
-async function addCard(
-  page: import("@playwright/test").Page,
-  storeName: string,
-  number: string,
-  symbology?: string,
-) {
-  await page.fill("#store-name", storeName);
-  await page.fill("#card-number", number);
-  if (symbology) {
-    await page.selectOption("#symbology", symbology);
-  }
-  await page.click('button:has-text("Add card")');
-  await expect(page).toHaveURL(/\/rewards$/);
-  const card = page.locator(".rewards-card").filter({ hasText: storeName });
-  await expect(card).toBeVisible();
-  return card;
-}
-
-test("the rewards page shows an empty state before any cards are added", async ({
-  page,
-}) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-  await expect(page.locator(".empty-state")).toContainText("No rewards cards yet");
-  await expect(page.locator(".rewards-card")).toHaveCount(0);
-});
-
-test("the Rewards link is available in the site navigation", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  const nav = page.locator(".site-nav");
-  await expect(nav.locator('a[href="/rewards"]')).toHaveText("Rewards");
-});
-
-test("a user can add a rewards card and see its barcode", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-
-  const card = await addCard(page, "Kroger", "606171584511340224537");
-
-  // The card renders an inline SVG barcode and the store's card number.
-  await expect(card.locator(".rewards-barcode svg")).toBeVisible();
-  await expect(card.locator(".rewards-number")).toHaveText("606171584511340224537");
-
-  // The barcode should be included via the embedded SVG (Code 128 set B→C mix),
-  // not rendered client-side from scratch by an image.
-  const svg = card.locator(".rewards-barcode svg");
-  await expect(svg).toHaveAttribute("viewBox", /\d+ \d+/);
-});
-
-test("a user can add a card as Code 39 and see its barcode", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-
-  const card = await addCard(page, "Safeway", "ABC123", "code39");
-  await expect(card.locator(".rewards-barcode svg")).toBeVisible();
-});
-
-test("multiple rewards cards are each rendered with their own barcode", async ({
-  page,
-}) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-
-  await addCard(page, "Kroger", "606171584511340224537");
-  await addCard(page, "Safeway", "012345678901");
-
-  await expect(page.locator(".rewards-card")).toHaveCount(2);
-  await expect(page.locator(".rewards-card").filter({ hasText: "Kroger" })).toBeVisible();
-  await expect(page.locator(".rewards-card").filter({ hasText: "Safeway" })).toBeVisible();
-});
-
-test("removing a rewards card prompts for confirmation and deletes on accept", async ({
-  page,
-}) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-  await addCard(page, "Kroger", "606171584511340224537");
-
-  await expect(page).toHaveURL(/\/rewards$/);
-  await expect(page.locator(".rewards-card")).toHaveCount(1);
-
-  page.on("dialog", (dialog) => dialog.accept());
-  await page.click('button:has-text("Remove")');
-
-  // The card is deleted and the empty state returns.
-  await expect(page.locator(".rewards-card")).toHaveCount(0);
-  await expect(page.locator(".empty-state")).toContainText("No rewards cards yet");
-});
-
-test("cancelling the remove confirmation keeps the rewards card", async ({
-  page,
-}) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-  await addCard(page, "Kroger", "606171584511340224537");
-
-  await expect(page.locator(".rewards-card")).toHaveCount(1);
-
-  page.on("dialog", (dialog) => dialog.dismiss());
-  await page.click('button:has-text("Remove")');
-
-  // The card must remain after cancelling.
-  await expect(page.locator(".rewards-card")).toHaveCount(1);
-  await expect(page.locator(".rewards-card").filter({ hasText: "Kroger" })).toBeVisible();
-});
-
-test("a user can open a single-card scan view with only one barcode", async ({
-  page,
-}) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-  await addCard(page, "Kroger", "606171584511340224537");
-  await addCard(page, "Safeway", "012345678901");
-
-  // Click the Kroger card's barcode to open its focused scan view.
-  await page
-    .locator(".rewards-card")
-    .filter({ hasText: "Kroger" })
-    .locator(".rewards-card-link")
-    .click();
-
-  await expect(page).toHaveURL(/\/rewards\/\d+/);
-  // Only one barcode is rendered on the scan page.
-  await expect(page.locator(".scan-barcode svg")).toHaveCount(1);
-  await expect(page.locator(".scan-store")).toHaveText("Kroger");
-  await expect(page.locator(".scan-card .rewards-number")).toHaveText(
-    "606171584511340224537",
-  );
-  // The wake-lock script is loaded on the scan page.
-  await expect(page.locator('script[src*="rewards.js"]')).toHaveCount(1);
-
-  // Back link returns to the list.
-  await page.click('.scan-back');
-  await expect(page).toHaveURL(/\/rewards$/);
-});
-
-test("a scan view for another user's card is not accessible", async ({ page }) => {
-  await registerAndLogin(page, "alice@example.com");
-  await gotoRewards(page);
-  await addCard(page, "Kroger", "606171584511340224537");
-
-  // Grab the card id from the URL of the scan view.
-  await page
-    .locator(".rewards-card-link")
-    .click();
-  const url = page.url();
-  const cardId = url.split("/").pop();
-
-  // Sign out and sign in as a different user.
-  await page.click('button:has-text("Sign out")');
-  await registerAndLogin(page, "bob@example.com");
-
-  // Bob cannot view Alice's card.
-  await page.goto(`/rewards/${cardId}`);
-  await expect(page.locator(".scan-barcode svg")).toHaveCount(0);
-});

e2e/tests/websocket.spec.ts

@@ -1,44 +0,0 @@
-import { expect } from "@playwright/test";
-import { test } from "../fixtures";
-import { registerAndLogin, createList, addItem } from "../helpers";
-
-test("a list updates live for another user via websocket", async ({ page, browser, server }) => {
-  // User A registers and creates a list.
-  await registerAndLogin(page, "alice@example.com");
-  await createList(page, "Weekly shop");
-  const listUrl = page.url();
-
-  // User B registers in a separate context (separate session).
-  const contextB = await browser.newContext({ baseURL: server.baseURL });
-  const pageB = await contextB.newPage();
-  await registerAndLogin(pageB, "bob@example.com");
-
-  // Both users open the same list.
-  await page.goto(listUrl);
-  await pageB.goto(listUrl);
-
-  // Give the websocket connections a moment to establish.
-  await page.waitForTimeout(500);
-
-  // Both start with an empty list.
-  await expect(pageB.locator("#list-meta")).toHaveText("0 items left out of 0");
-
-  // User A adds an item.
-  await addItem(page, "Apple", "2");
-
-  // It should appear on User B's page without any reload.
-  await expect(pageB.locator(".item-row").filter({ hasText: "Apple" })).toBeVisible();
-  await expect(pageB.locator(".item-row").filter({ hasText: "Apple" }).locator(".item-qty")).toHaveText("(2)");
-  // The left/total count should also update live for User B.
-  await expect(pageB.locator("#list-meta")).toHaveText("1 items left out of 1");
-
-  // User A removes the item.
-  await page.locator(".item-actions-button").first().click();
-  await page.locator("[id^='item-edit-delete']").click();
-
-  // The item and the count should update live on User B's page.
-  await expect(pageB.locator(".item-row").filter({ hasText: "Apple" })).toHaveCount(0);
-  await expect(pageB.locator("#list-meta")).toHaveText("0 items left out of 0");
-
-  await contextB.close();
-});

justfile

@@ -1,39 +0,0 @@
-# Set the Cargo.toml version, commit it, and tag the commit with that version.
-# Usage: just tag 1.2.3
-tag ver:
-    #!/usr/bin/env bash
-    set -euo pipefail
-
-    # Validate the version argument.
-    if [[ ! "{{ver}}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-        echo "error: version must be in the form X.Y.Z (got '{{ver}}')" >&2
-        exit 1
-    fi
-
-    # Bump the version in Cargo.toml.
-    sed -i -E "s/^version = \".*\"/version = \"{{ver}}\"/" Cargo.toml
-
-    # Regenerate Cargo.lock so it reflects the new version.
-    cargo build
-
-    # Stage, commit, and tag.
-    git add Cargo.toml Cargo.lock
-    git commit -m "version {{ver}} [skip ci]"
-    git tag "{{ver}}"
-    git push
-    git push --tags
-
-# Run the Rust unit tests.
-# Usage: just test
-test:
-    cargo test --all
-
-# Format the Rust code.
-# Usage: just fmt
-fmt:
-    cargo fmt --all
-
-# Run the end-to-end Playwright tests.
-# Usage: just e2e
-e2e:
-    cd e2e && npm test

migrations/20240101000000_initial.sql

@@ -1,81 +0,0 @@
-CREATE TABLE users (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    email TEXT NOT NULL UNIQUE COLLATE NOCASE,
-    display_name TEXT NOT NULL,
-    password_hash TEXT NOT NULL,
-    user_handle BLOB NOT NULL UNIQUE,
-    created_at INTEGER NOT NULL
-);
-
-CREATE TABLE sessions (
-    token_hash BLOB PRIMARY KEY,
-    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    csrf_token BLOB NOT NULL,
-    expires_at INTEGER NOT NULL
-);
-
-CREATE TABLE passkeys (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    credential_id TEXT NOT NULL UNIQUE,
-    credential TEXT NOT NULL,
-    counter INTEGER NOT NULL DEFAULT 0,
-    created_at INTEGER NOT NULL
-);
-
-CREATE TABLE lists (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    name TEXT NOT NULL,
-    revision INTEGER NOT NULL DEFAULT 0,
-    created_at INTEGER NOT NULL
-);
-
-CREATE TABLE categories (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
-    position INTEGER NOT NULL DEFAULT 0,
-    created_at INTEGER NOT NULL
-);
-
-CREATE TABLE invitations (
-    token_hash BLOB PRIMARY KEY,
-    created_by INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    expires_at INTEGER NOT NULL
-);
-
-CREATE TABLE items (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    list_id INTEGER NOT NULL REFERENCES lists(id) ON DELETE CASCADE,
-    name TEXT NOT NULL,
-    quantity TEXT NOT NULL DEFAULT '',
-    note TEXT NOT NULL DEFAULT '',
-    category_id INTEGER REFERENCES categories(id) ON DELETE SET NULL,
-    checked INTEGER NOT NULL DEFAULT 0,
-    version INTEGER NOT NULL DEFAULT 1,
-    position INTEGER NOT NULL DEFAULT 0,
-    created_at INTEGER NOT NULL,
-    updated_at INTEGER NOT NULL
-);
-
-CREATE TABLE meals (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    name TEXT NOT NULL,
-    description TEXT NOT NULL DEFAULT '',
-    created_at INTEGER NOT NULL,
-    updated_at INTEGER NOT NULL
-);
-
-CREATE TABLE meal_ingredients (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    meal_id INTEGER NOT NULL REFERENCES meals(id) ON DELETE CASCADE,
-    name TEXT NOT NULL,
-    quantity TEXT NOT NULL DEFAULT '',
-    note TEXT NOT NULL DEFAULT '',
-    category_id INTEGER REFERENCES categories(id) ON DELETE SET NULL,
-    position INTEGER NOT NULL DEFAULT 0
-);
-
-CREATE INDEX items_list_idx ON items(list_id);
-CREATE INDEX meal_ingredients_meal_idx ON meal_ingredients(meal_id);
-CREATE INDEX sessions_user_idx ON sessions(user_id);
-CREATE INDEX passkeys_user_idx ON passkeys(user_id);

migrations/20240102000000_meal_categories.sql

@@ -1,10 +0,0 @@
-CREATE TABLE meal_categories (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    name TEXT NOT NULL UNIQUE COLLATE NOCASE,
-    position INTEGER NOT NULL DEFAULT 0,
-    created_at INTEGER NOT NULL
-);
-
-ALTER TABLE meals ADD COLUMN category_id INTEGER REFERENCES meal_categories(id) ON DELETE SET NULL;
-
-CREATE INDEX meals_category_idx ON meals(category_id);

migrations/20240103000000_list_meals.sql

@@ -1,12 +0,0 @@
-CREATE TABLE list_meals (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    list_id INTEGER NOT NULL REFERENCES lists(id) ON DELETE CASCADE,
-    meal_id INTEGER REFERENCES meals(id) ON DELETE SET NULL,
-    name TEXT NOT NULL,
-    created_at INTEGER NOT NULL
-);
-
-ALTER TABLE items ADD COLUMN list_meal_id INTEGER REFERENCES list_meals(id) ON DELETE CASCADE;
-
-CREATE INDEX list_meals_list_idx ON list_meals(list_id);
-CREATE INDEX items_list_meal_idx ON items(list_meal_id);

migrations/20240104000000_archive_lists.sql

@@ -1 +0,0 @@
-ALTER TABLE lists ADD COLUMN archived_at INTEGER;

migrations/20240105000000_rewards_cards.sql

@@ -1,10 +0,0 @@
-CREATE TABLE rewards_cards (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
-    store_name TEXT NOT NULL,
-    number TEXT NOT NULL,
-    symbology TEXT NOT NULL DEFAULT 'code128',
-    created_at INTEGER NOT NULL
-);
-
-CREATE INDEX rewards_cards_user_idx ON rewards_cards(user_id);

src/assets.rs

@@ -1,85 +0,0 @@
-use std::collections::HashMap;
-use std::sync::LazyLock;
-
-use sha2::{Digest, Sha256};
-
-/// A single static asset: its embedded bytes and a content hash used to
-/// version its URL.
-pub struct StaticAsset {
-    pub data: &'static [u8],
-    pub hash: String,
-}
-
-/// A registry of the app's static assets, keyed by filename. Each asset's
-/// content hash is computed once on first use and cached, so the versioned URL
-/// changes automatically whenever the underlying file changes.
-pub struct StaticAssetStore {
-    assets: HashMap<&'static str, StaticAsset>,
-}
-
-impl StaticAssetStore {
-    fn new(entries: &[(&'static str, &'static [u8])]) -> Self {
-        let assets = entries
-            .iter()
-            .map(|(name, data)| {
-                let hash = content_hash(data);
-                (*name, StaticAsset { data, hash })
-            })
-            .collect();
-        Self { assets }
-    }
-
-    /// Looks up an asset by its filename (e.g. `"style.css"`).
-    pub fn get(&self, name: &str) -> Option<&StaticAsset> {
-        self.assets.get(name)
-    }
-
-    /// Returns the versioned URL for an asset, e.g. `/static/style.css?v=<hash>`.
-    pub fn url(&self, name: &str) -> Option<String> {
-        self.assets
-            .get(name)
-            .map(|asset| format!("/static/{name}?v={}", asset.hash))
-    }
-}
-
-fn content_hash(data: &[u8]) -> String {
-    let mut hasher = Sha256::new();
-    hasher.update(data);
-    hex::encode(hasher.finalize())
-}
-
-/// Constructs a `StaticAssetStore` from `name => path` pairs, embedding each
-/// file's bytes at compile time via `include_bytes!`.
-macro_rules! static_assets {
-    ($($name:literal => $path:literal),* $(,)?) => {
-        StaticAssetStore::new(&[
-            $(($name, include_bytes!($path))),*
-        ])
-    };
-}
-
-/// The app's static assets, loaded once on first use.
-pub static STORE: LazyLock<StaticAssetStore> = LazyLock::new(|| {
-    static_assets! {
-        "style.css" => "../static/style.css",
-        "passkey-login.js" => "../static/passkey-login.js",
-        "passkey-register.js" => "../static/passkey-register.js",
-        "password-toggle.js" => "../static/password-toggle.js",
-        "rewards.js" => "../static/rewards.js",
-        "htmx.min.js" => "../static/htmx.min.js",
-        "idiomorph-ext.min.js" => "../static/idiomorph-ext.min.js",
-        "htmx-ws.min.js" => "../static/htmx-ws.min.js",
-        "favicon.ico" => "../static/favicon.ico",
-        "favicon-32x32.png" => "../static/favicon-32x32.png",
-        "apple-touch-icon.png" => "../static/apple-touch-icon.png",
-        "logo.svg" => "../static/logo.svg",
-    }
-});
-
-/// Returns the versioned URL for a known asset, panicking if the name isn't
-/// registered (a programmer error, since these are compile-time constants).
-pub fn url(name: &str) -> String {
-    STORE
-        .url(name)
-        .unwrap_or_else(|| panic!("unknown static asset: {name}"))
-}

src/domain.rs

@@ -19,22 +19,6 @@ pub struct User {
     pub id: i64,
     pub email: String,
     pub display_name: String,
-    /// Opaque, random user handle used as the WebAuthn userHandle. Kept
-    /// high-entropy and unpredictable per the WebAuthn spec to avoid user
-    /// enumeration and cross-site correlation. Stored as raw bytes.
-    pub user_handle: Vec<u8>,
-}
-
-#[derive(Clone, Debug)]
-pub struct Passkey {
-    pub id: i64,
-    pub user_id: i64,
-    pub credential_id: String,
-    pub credential: String,
-    /// WebAuthn sign counter, persisted for future cloned-authenticator
-    /// detection. Not currently read by application logic.
-    #[allow(dead_code)]
-    pub counter: i64,
 }
 
 #[derive(Clone, Debug)]
@@ -48,10 +32,6 @@ pub struct GroceryList {
     pub id: i64,
     pub name: String,
     pub revision: i64,
-    /// Unix timestamp of when the list was created.
-    pub created_at: i64,
-    /// Unix timestamp of when the list was archived; `None` when active.
-    pub archived_at: Option<i64>,
 }
 
 #[derive(Clone, Debug)]
@@ -72,60 +52,8 @@ pub struct Category {
     pub name: String,
 }
 
-#[derive(Clone, Debug)]
-pub struct MealCategory {
-    pub id: i64,
-    pub name: String,
-}
-
-#[derive(Clone, Debug)]
-pub struct Meal {
-    pub id: i64,
-    pub name: String,
-    pub description: String,
-    pub category_id: Option<i64>,
-    pub ingredients: Vec<MealIngredient>,
-}
-
-#[derive(Clone, Debug)]
-pub struct MealIngredient {
-    pub id: i64,
-    pub name: String,
-    pub quantity: String,
-    pub note: String,
-    pub category_id: Option<i64>,
-}
-
-#[derive(Clone, Debug)]
-pub struct ListMeal {
-    pub id: i64,
-    /// The catalog meal this instance came from; `None` once the meal is deleted.
-    #[allow(dead_code)]
-    pub meal_id: Option<i64>,
-    pub name: String,
-    /// When the meal was added to the list.
-    #[allow(dead_code)]
-    pub created_at: i64,
-}
-
 #[derive(Clone, Debug)]
 pub struct PresenceUser {
     pub user_id: i64,
     pub display_name: String,
 }
-
-/// A stored rewards-card number that can be shown as a scannable barcode.
-#[derive(Clone, Debug)]
-pub struct RewardsCard {
-    pub id: i64,
-    /// The owner of this card.
-    #[allow(dead_code)]
-    pub user_id: i64,
-    pub store_name: String,
-    pub number: String,
-    /// Symbology used to render the barcode (e.g. "code128", "code39").
-    pub symbology: String,
-    /// When the card was added.
-    #[allow(dead_code)]
-    pub created_at: i64,
-}

src/hub.rs

@@ -35,7 +35,7 @@ impl RealtimeNotifier for InMemoryHub {
             }
         });
 
-        let connection_id = hex::encode(crate::security::new_secret());
+        let connection_id = crate::security::new_secret();
         let already_present = room
             .connections
             .values()

src/main.rs

@@ -1,4 +1,3 @@
-mod assets;
 mod domain;
 mod http;
 mod hub;
@@ -8,7 +7,6 @@ mod seed;
 mod services;
 mod sqlite;
 mod views;
-mod webauthn;
 
 use std::env;
 use std::path::Path as FilePath;
@@ -20,45 +18,28 @@ use tracing::{info, warn};
 use crate::http::{AppState, build_router};
 use crate::hub::InMemoryHub;
 use crate::ports::{
-    CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
+    CategoryRepository, InvitationRepository, ItemRepository, ListRepository, PasswordHasher,
-    MealCategoryRepository, MealIngredientRepository, MealRepository, PasskeyRepository,
+    RealtimeNotifier, SessionRepository, TokenGenerator, UserRepository,
-    PasswordHasher, RealtimeNotifier, RewardsCardRepository, SessionRepository, TokenGenerator,
-    UserRepository,
 };
 use crate::security::{Argon2PasswordHasher, RandomTokenGenerator};
-use crate::services::{
+use crate::services::{AuthService, InvitationService, ListService, RegistrationMode};
-    AuthService, InvitationService, ListService, MealService, RegistrationMode, RewardsCardService,
-};
 use crate::sqlite::{
-    SqliteCategoryRepository, SqliteDatabase, SqliteInvitationRepository, SqliteItemRepository,
+    SqliteCategoryRepository, SqliteInvitationRepository, SqliteItemRepository,
-    SqliteListMealRepository, SqliteListRepository, SqliteMealCategoryRepository,
+    SqliteListRepository, SqliteSessionRepository, SqliteDatabase, SqliteUserRepository,
-    SqliteMealIngredientRepository, SqliteMealRepository, SqlitePasskeyRepository,
-    SqliteRewardsCardRepository, SqliteSessionRepository, SqliteUserRepository,
 };
-use crate::webauthn::{AppWebauthnConfig, WebAuthnService};
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
     tracing_subscriber::fmt()
         .with_env_filter(
-            env::var("RUST_LOG").unwrap_or_else(|_| "sustenance=info,tower_http=info".into()),
+            env::var("RUST_LOG").unwrap_or_else(|_| "sustenance=debug,tower_http=info".into()),
         )
         .init();
 
     let database_path = env::var("DATABASE_PATH").unwrap_or_else(|_| "sustenance.db".into());
-    let database_in_memory = env::var("DATABASE_IN_MEMORY")
-        .map(|value| value == "1" || value.eq_ignore_ascii_case("true"))
-        .unwrap_or(false);
     let bind_address = env::var("BIND_ADDRESS").unwrap_or_else(|_| "127.0.0.1:3000".into());
-    // For loopback hosts, advertise `localhost` so WebAuthn works locally (browsers
+    let public_base_url =
-    // reject IP addresses as RP IDs). Access the app via http://localhost:PORT.
+        env::var("PUBLIC_BASE_URL").unwrap_or_else(|_| format!("http://{}", bind_address));
-    let bind_host = bind_address.split(':').next().unwrap_or("127.0.0.1");
-    let is_loopback = bind_host == "127.0.0.1" || bind_host == "::1" || bind_host == "localhost";
-    let public_host = if is_loopback { "localhost" } else { bind_host };
-    let public_base_url = env::var("PUBLIC_BASE_URL").unwrap_or_else(|_| {
-        let port = bind_address.rsplit(':').next().unwrap_or("3000");
-        format!("http://{}:{}", public_host, port)
-    });
     let cookie_secure = env::var("COOKIE_SECURE")
         .map(|value| value == "1" || value.eq_ignore_ascii_case("true"))
         .unwrap_or(false);
@@ -76,24 +57,13 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     };
 
     // Build the adapters (ports) and wire them into application services.
-    let db = if database_in_memory {
+    let db = SqliteDatabase::open(&database_path).await?;
-        SqliteDatabase::open_in_memory().await?
-    } else {
-        SqliteDatabase::open(&database_path).await?
-    };
     let users: Arc<dyn UserRepository> = Arc::new(SqliteUserRepository);
     let sessions: Arc<dyn SessionRepository> = Arc::new(SqliteSessionRepository);
     let lists: Arc<dyn ListRepository> = Arc::new(SqliteListRepository);
     let categories: Arc<dyn CategoryRepository> = Arc::new(SqliteCategoryRepository);
     let items: Arc<dyn ItemRepository> = Arc::new(SqliteItemRepository);
-    let list_meals: Arc<dyn ListMealRepository> = Arc::new(SqliteListMealRepository);
-    let meals: Arc<dyn MealRepository> = Arc::new(SqliteMealRepository);
-    let meal_ingredients: Arc<dyn MealIngredientRepository> =
-        Arc::new(SqliteMealIngredientRepository);
-    let meal_categories: Arc<dyn MealCategoryRepository> = Arc::new(SqliteMealCategoryRepository);
     let invitations: Arc<dyn InvitationRepository> = Arc::new(SqliteInvitationRepository);
-    let passkeys: Arc<dyn PasskeyRepository> = Arc::new(SqlitePasskeyRepository);
-    let rewards_cards: Arc<dyn RewardsCardRepository> = Arc::new(SqliteRewardsCardRepository);
     let hasher: Arc<dyn PasswordHasher> = Arc::new(Argon2PasswordHasher);
     let tokens: Arc<dyn TokenGenerator> = Arc::new(RandomTokenGenerator);
     let realtime: Arc<dyn RealtimeNotifier> = Arc::new(InMemoryHub::default());
@@ -118,44 +88,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         Arc::clone(&invitations),
         Arc::clone(&tokens),
     ));
-    let rewards_cards_service = Arc::new(RewardsCardService::new(
-        db.clone(),
-        Arc::clone(&rewards_cards),
-    ));
-    let meals_service = Arc::new(MealService::new(
-        db.clone(),
-        Arc::clone(&meals),
-        Arc::clone(&meal_ingredients),
-        Arc::clone(&meal_categories),
-        Arc::clone(&lists),
-        Arc::clone(&items),
-        Arc::clone(&list_meals),
-        Arc::clone(&realtime),
-    ));
-
-    // WebAuthn config from env vars. RP_ID must match the host users access the site from.
-    let rp_id = env::var("RP_ID").unwrap_or_else(|_| {
-        let host = public_base_url
-            .trim_start_matches("http://")
-            .trim_start_matches("https://")
-            .split('/')
-            .next()
-            .unwrap_or("localhost")
-            .split(':')
-            .next()
-            .unwrap_or("localhost")
-            .to_owned();
-        host
-    });
-    let rp_name = env::var("RP_NAME").unwrap_or_else(|_| "Sustenance".into());
-    let origin =
-        url::Url::parse(&public_base_url).map_err(|e| format!("invalid PUBLIC_BASE_URL: {e}"))?;
-    let webauthn_service = Arc::new(WebAuthnService::new(
-        db.clone(),
-        AppWebauthnConfig::new(rp_id, rp_name, origin),
-        Arc::clone(&users),
-        Arc::clone(&passkeys),
-    ));
 
     let seed_path = env::var("SEED_CONFIG").unwrap_or_else(|_| "seed.json".into());
     seed::seed_if_needed(&db, &users, &hasher, FilePath::new(&seed_path)).await;
@@ -163,10 +95,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let state = AppState {
         auth,
         lists: lists_service,
-        meals: meals_service,
         invitations: invitations_service,
-        rewards_cards: rewards_cards_service,
-        webauthn: webauthn_service,
         realtime,
         cookie_secure,
         public_base_url,
@@ -180,10 +109,6 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         .with_graceful_shutdown(shutdown_signal())
         .await?;
     info!("shutdown complete; closing database");
-    // Explicitly close the pool so SQLite can checkpoint and remove the
-    // WAL/SHM sidecar files. Without this, the pool's background close task
-    // races with process exit and the sidecars can be left behind.
-    db.close().await;
     Ok(())
 }
 

src/ports.rs

@@ -1,10 +1,7 @@
 use async_trait::async_trait;
 use sqlx::SqliteConnection;
 
-use crate::domain::{
+use crate::domain::{Category, DomainResult, GroceryList, Item, PresenceUser, SessionUser, User};
-    Category, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, MealIngredient,
-    Passkey, PresenceUser, RewardsCard, SessionUser, User,
-};
 
 /// Repositories take `&mut SqliteConnection` (which a `Transaction` derefs to),
 /// so several repositories can commit together atomically within a single
@@ -24,48 +21,9 @@ pub trait UserRepository: Send + Sync {
         txn: &mut SqliteConnection,
         email: String,
     ) -> DomainResult<Option<(User, String)>>;
-    async fn find_user_by_handle(
-        &self,
-        txn: &mut SqliteConnection,
-        user_handle: Vec<u8>,
-    ) -> DomainResult<Option<User>>;
-    async fn update_password_hash(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-        password_hash: String,
-    ) -> DomainResult<()>;
     async fn has_users(&self, txn: &mut SqliteConnection) -> DomainResult<bool>;
 }
 
-#[async_trait]
-pub trait PasskeyRepository: Send + Sync {
-    async fn create_passkey(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-        credential_id: String,
-        credential: String,
-        counter: i64,
-    ) -> DomainResult<Passkey>;
-    async fn find_by_credential_id(
-        &self,
-        txn: &mut SqliteConnection,
-        credential_id: String,
-    ) -> DomainResult<Option<Passkey>>;
-    async fn list_for_user(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-    ) -> DomainResult<Vec<Passkey>>;
-    async fn delete_passkey(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-        passkey_id: i64,
-    ) -> DomainResult<()>;
-}
-
 #[async_trait]
 pub trait SessionRepository: Send + Sync {
     async fn create_session(
@@ -88,10 +46,6 @@ pub trait SessionRepository: Send + Sync {
 #[async_trait]
 pub trait ListRepository: Send + Sync {
     async fn list_summaries(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<GroceryList>>;
-    async fn list_archived_summaries(
-        &self,
-        txn: &mut SqliteConnection,
-    ) -> DomainResult<Vec<GroceryList>>;
     async fn create_list(
         &self,
         txn: &mut SqliteConnection,
@@ -102,30 +56,21 @@ pub trait ListRepository: Send + Sync {
         txn: &mut SqliteConnection,
         list_id: i64,
     ) -> DomainResult<Option<GroceryList>>;
-    async fn set_archived(
-        &self,
-        txn: &mut SqliteConnection,
-        list_id: i64,
-        archived: bool,
-    ) -> DomainResult<()>;
 }
 
 #[async_trait]
 pub trait CategoryRepository: Send + Sync {
-    async fn categories(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<Category>>;
+    async fn categories(
-    async fn create_category(&self, txn: &mut SqliteConnection, name: String) -> DomainResult<i64>;
+        &self,
-}
+        txn: &mut SqliteConnection,
-
+        list_id: i64,
-/// A single item to insert in bulk, without a per-item revision bump.
+    ) -> DomainResult<Vec<Category>>;
-#[derive(Clone, Debug)]
+    async fn create_category(
-pub struct NewItem {
+        &self,
-    pub name: String,
+        txn: &mut SqliteConnection,
-    pub quantity: String,
+        list_id: i64,
-    pub note: String,
+        name: String,
-    pub category_id: Option<i64>,
+    ) -> DomainResult<i64>;
-    /// When set, links this item to the `list_meals` row it came from, so the
-    /// item is removed together with that meal instance.
-    pub list_meal_id: Option<i64>,
 }
 
 #[async_trait]
@@ -140,12 +85,6 @@ pub trait ItemRepository: Send + Sync {
         note: String,
         category_id: Option<i64>,
     ) -> DomainResult<i64>;
-    async fn add_items_bulk(
-        &self,
-        txn: &mut SqliteConnection,
-        list_id: i64,
-        items: Vec<NewItem>,
-    ) -> DomainResult<i64>;
     async fn set_item_checked(
         &self,
         txn: &mut SqliteConnection,
@@ -171,38 +110,6 @@ pub trait ItemRepository: Send + Sync {
     ) -> DomainResult<i64>;
 }
 
-#[async_trait]
-pub trait ListMealRepository: Send + Sync {
-    async fn list_meals(
-        &self,
-        txn: &mut SqliteConnection,
-        list_id: i64,
-    ) -> DomainResult<Vec<ListMeal>>;
-    async fn add_meal(
-        &self,
-        txn: &mut SqliteConnection,
-        list_id: i64,
-        meal_id: Option<i64>,
-        name: String,
-    ) -> DomainResult<i64>;
-    async fn remove_meal(
-        &self,
-        txn: &mut SqliteConnection,
-        list_id: i64,
-        list_meal_id: i64,
-    ) -> DomainResult<i64>;
-    /// Copies the given meal instances from one list to another without
-    /// expanding their ingredients into items (they were already purchased).
-    /// Returns the new rows and the destination list's bumped revision.
-    async fn copy_meals_to_list(
-        &self,
-        txn: &mut SqliteConnection,
-        source_list_id: i64,
-        dest_list_id: i64,
-        list_meal_ids: &[i64],
-    ) -> DomainResult<(Vec<ListMeal>, i64)>;
-}
-
 #[async_trait]
 pub trait InvitationRepository: Send + Sync {
     async fn create_invitation(
@@ -219,81 +126,6 @@ pub trait InvitationRepository: Send + Sync {
     ) -> DomainResult<()>;
 }
 
-#[async_trait]
-pub trait MealCategoryRepository: Send + Sync {
-    async fn meal_categories(&self, txn: &mut SqliteConnection) -> DomainResult<Vec<MealCategory>>;
-    async fn create_meal_category(
-        &self,
-        txn: &mut SqliteConnection,
-        name: String,
-    ) -> DomainResult<i64>;
-    async fn delete_meal_category(
-        &self,
-        txn: &mut SqliteConnection,
-        category_id: i64,
-    ) -> DomainResult<()>;
-}
-
-#[async_trait]
-pub trait MealRepository: Send + Sync {
-    async fn create_meal(
-        &self,
-        txn: &mut SqliteConnection,
-        name: String,
-        description: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<Meal>;
-    async fn get_meal(
-        &self,
-        txn: &mut SqliteConnection,
-        meal_id: i64,
-    ) -> DomainResult<Option<Meal>>;
-    async fn list_meals(&self, txn: &mut SqliteConnection, query: &str) -> DomainResult<Vec<Meal>>;
-    async fn update_meal(
-        &self,
-        txn: &mut SqliteConnection,
-        meal_id: i64,
-        name: String,
-        description: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<()>;
-    async fn delete_meal(&self, txn: &mut SqliteConnection, meal_id: i64) -> DomainResult<()>;
-}
-
-#[async_trait]
-pub trait MealIngredientRepository: Send + Sync {
-    async fn ingredients_for_meal(
-        &self,
-        txn: &mut SqliteConnection,
-        meal_id: i64,
-    ) -> DomainResult<Vec<MealIngredient>>;
-    async fn add_ingredient(
-        &self,
-        txn: &mut SqliteConnection,
-        meal_id: i64,
-        name: String,
-        quantity: String,
-        note: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<i64>;
-    async fn update_ingredient(
-        &self,
-        txn: &mut SqliteConnection,
-        meal_id: i64,
-        ingredient_id: i64,
-        name: String,
-        quantity: String,
-        note: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<()>;
-    async fn delete_ingredient(
-        &self,
-        txn: &mut SqliteConnection,
-        meal_id: i64,
-        ingredient_id: i64,
-    ) -> DomainResult<()>;
-}
-
 #[async_trait]
 pub trait PasswordHasher: Send + Sync {
     fn hash(&self, password: &str) -> DomainResult<String>;
@@ -324,33 +156,3 @@ pub enum HubEvent {
     ListChanged { list_id: i64, revision: i64 },
     PresenceChanged { list_id: i64 },
 }
-
-/// Stores and retrieves a user's rewards cards.
-#[async_trait]
-pub trait RewardsCardRepository: Send + Sync {
-    async fn list_cards(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-    ) -> DomainResult<Vec<RewardsCard>>;
-    async fn get_card(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-        card_id: i64,
-    ) -> DomainResult<Option<RewardsCard>>;
-    async fn create_card(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-        store_name: String,
-        number: String,
-        symbology: String,
-    ) -> DomainResult<RewardsCard>;
-    async fn delete_card(
-        &self,
-        txn: &mut SqliteConnection,
-        user_id: i64,
-        card_id: i64,
-    ) -> DomainResult<()>;
-}

src/security.rs

@@ -37,14 +37,12 @@ pub struct RandomTokenGenerator;
 #[async_trait]
 impl TokenGenerator for RandomTokenGenerator {
     fn generate(&self) -> String {
-        hex::encode(new_secret())
+        new_secret()
     }
 }
 
-/// Generates 32 cryptographically random bytes. Callers that need a
+pub fn new_secret() -> String {
-/// client-facing string should hex-encode the result.
-pub fn new_secret() -> Vec<u8> {
     let mut bytes = [0_u8; 32];
     OsRng.fill_bytes(&mut bytes);
-    bytes.to_vec()
+    hex::encode(bytes)
 }

src/services.rs

@@ -1,13 +1,9 @@
 use std::sync::Arc;
 
-use crate::domain::{
+use crate::domain::{DomainError, DomainResult, GroceryList, Item, SessionUser, User};
-    DomainError, DomainResult, GroceryList, Item, ListMeal, Meal, MealCategory, RewardsCard,
-    SessionUser, User,
-};
 use crate::ports::{
-    CategoryRepository, InvitationRepository, ItemRepository, ListMealRepository, ListRepository,
+    CategoryRepository, InvitationRepository, ItemRepository, ListRepository, PasswordHasher,
-    MealCategoryRepository, MealIngredientRepository, MealRepository, NewItem, PasswordHasher,
+    RealtimeNotifier, SessionRepository, TokenGenerator, UserRepository,
-    RealtimeNotifier, RewardsCardRepository, SessionRepository, TokenGenerator, UserRepository,
 };
 use crate::sqlite::SqliteDatabase;
 
@@ -128,20 +124,6 @@ impl AuthService {
             .await
     }
 
-    pub async fn find_user_by_email(&self, email: String) -> DomainResult<Option<(User, String)>> {
-        let users = Arc::clone(&self.users);
-        self.db
-            .run(move |txn| Box::pin(async move { users.find_user_by_email(txn, email).await }))
-            .await
-    }
-
-    pub async fn create_session_for_user(&self, user_id: i64) -> DomainResult<(String, String)> {
-        let sessions = Arc::clone(&self.sessions);
-        self.db
-            .run(move |txn| Box::pin(async move { sessions.create_session(txn, user_id).await }))
-            .await
-    }
-
     pub async fn logout(&self, session_token: String) -> DomainResult<()> {
         let sessions = Arc::clone(&self.sessions);
         self.db
@@ -150,22 +132,6 @@ impl AuthService {
             })
             .await
     }
-
-    /// Replaces the user's password hash with a freshly hashed new password.
-    /// No current-password check is performed because the account page is
-    /// already authenticated and this app has no email capabilities.
-    pub async fn change_password(&self, user_id: i64, new_password: String) -> DomainResult<()> {
-        let users = Arc::clone(&self.users);
-        let hasher = Arc::clone(&self.hasher);
-        self.db
-            .run(move |txn| {
-                Box::pin(async move {
-                    let new_hash = hasher.hash(&new_password)?;
-                    users.update_password_hash(txn, user_id, new_hash).await
-                })
-            })
-            .await
-    }
 }
 
 pub struct ListService {
@@ -200,13 +166,6 @@ impl ListService {
             .await
     }
 
-    pub async fn list_archived_summaries(&self) -> DomainResult<Vec<GroceryList>> {
-        let lists = Arc::clone(&self.lists);
-        self.db
-            .run(move |txn| Box::pin(async move { lists.list_archived_summaries(txn).await }))
-            .await
-    }
-
     pub async fn create_list(&self, name: String) -> DomainResult<GroceryList> {
         let lists = Arc::clone(&self.lists);
         self.db
@@ -221,20 +180,6 @@ impl ListService {
             .await
     }
 
-    pub async fn archive_list(&self, list_id: i64) -> DomainResult<()> {
-        let lists = Arc::clone(&self.lists);
-        self.db
-            .run(move |txn| Box::pin(async move { lists.set_archived(txn, list_id, true).await }))
-            .await
-    }
-
-    pub async fn unarchive_list(&self, list_id: i64) -> DomainResult<()> {
-        let lists = Arc::clone(&self.lists);
-        self.db
-            .run(move |txn| Box::pin(async move { lists.set_archived(txn, list_id, false).await }))
-            .await
-    }
-
     pub async fn items(&self, list_id: i64) -> DomainResult<Vec<Item>> {
         let items = Arc::clone(&self.items);
         self.db
@@ -242,10 +187,10 @@ impl ListService {
             .await
     }
 
-    pub async fn categories(&self) -> DomainResult<Vec<crate::domain::Category>> {
+    pub async fn categories(&self, list_id: i64) -> DomainResult<Vec<crate::domain::Category>> {
         let categories = Arc::clone(&self.categories);
         self.db
-            .run(move |txn| Box::pin(async move { categories.categories(txn).await }))
+            .run(move |txn| Box::pin(async move { categories.categories(txn, list_id).await }))
             .await
     }
 
@@ -325,287 +270,17 @@ impl ListService {
         Ok(revision)
     }
 
-    pub async fn create_category(&self, name: String) -> DomainResult<i64> {
+    pub async fn create_category(&self, list_id: i64, name: String) -> DomainResult<i64> {
         let categories = Arc::clone(&self.categories);
-        self.db
-            .run(move |txn| Box::pin(async move { categories.create_category(txn, name).await }))
-            .await
-    }
-}
-
-pub struct MealService {
-    db: SqliteDatabase,
-    meals: Arc<dyn MealRepository>,
-    ingredients: Arc<dyn MealIngredientRepository>,
-    meal_categories: Arc<dyn MealCategoryRepository>,
-    lists: Arc<dyn ListRepository>,
-    items: Arc<dyn ItemRepository>,
-    list_meals: Arc<dyn ListMealRepository>,
-    realtime: Arc<dyn RealtimeNotifier>,
-}
-
-impl MealService {
-    pub fn new(
-        db: SqliteDatabase,
-        meals: Arc<dyn MealRepository>,
-        ingredients: Arc<dyn MealIngredientRepository>,
-        meal_categories: Arc<dyn MealCategoryRepository>,
-        lists: Arc<dyn ListRepository>,
-        items: Arc<dyn ItemRepository>,
-        list_meals: Arc<dyn ListMealRepository>,
-        realtime: Arc<dyn RealtimeNotifier>,
-    ) -> Self {
-        Self {
-            db,
-            meals,
-            ingredients,
-            meal_categories,
-            lists,
-            items,
-            list_meals,
-            realtime,
-        }
-    }
-
-    pub async fn create_meal(
-        &self,
-        name: String,
-        description: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<Meal> {
-        let meals = Arc::clone(&self.meals);
-        self.db
-            .run(move |txn| {
-                Box::pin(
-                    async move { meals.create_meal(txn, name, description, category_id).await },
-                )
-            })
-            .await
-    }
-
-    pub async fn get_meal(&self, meal_id: i64) -> DomainResult<Option<Meal>> {
-        let meals = Arc::clone(&self.meals);
-        self.db
-            .run(move |txn| Box::pin(async move { meals.get_meal(txn, meal_id).await }))
-            .await
-    }
-
-    pub async fn list_meals(&self, query: &str) -> DomainResult<Vec<Meal>> {
-        let meals = Arc::clone(&self.meals);
-        let query = query.to_owned();
-        self.db
-            .run(move |txn| Box::pin(async move { meals.list_meals(txn, &query).await }))
-            .await
-    }
-
-    pub async fn update_meal(
-        &self,
-        meal_id: i64,
-        name: String,
-        description: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<()> {
-        let meals = Arc::clone(&self.meals);
-        self.db
-            .run(move |txn| {
-                Box::pin(async move {
-                    meals
-                        .update_meal(txn, meal_id, name, description, category_id)
-                        .await
-                })
-            })
-            .await
-    }
-
-    pub async fn list_meal_categories(&self) -> DomainResult<Vec<MealCategory>> {
-        let meal_categories = Arc::clone(&self.meal_categories);
-        self.db
-            .run(move |txn| Box::pin(async move { meal_categories.meal_categories(txn).await }))
-            .await
-    }
-
-    pub async fn create_meal_category(&self, name: String) -> DomainResult<i64> {
-        let meal_categories = Arc::clone(&self.meal_categories);
-        self.db
-            .run(move |txn| {
-                Box::pin(async move { meal_categories.create_meal_category(txn, name).await })
-            })
-            .await
-    }
-
-    pub async fn delete_meal_category(&self, category_id: i64) -> DomainResult<()> {
-        let meal_categories = Arc::clone(&self.meal_categories);
-        self.db
-            .run(move |txn| {
-                Box::pin(
-                    async move { meal_categories.delete_meal_category(txn, category_id).await },
-                )
-            })
-            .await
-    }
-
-    pub async fn delete_meal(&self, meal_id: i64) -> DomainResult<()> {
-        let meals = Arc::clone(&self.meals);
-        self.db
-            .run(move |txn| Box::pin(async move { meals.delete_meal(txn, meal_id).await }))
-            .await
-    }
-
-    pub async fn add_ingredient(
-        &self,
-        meal_id: i64,
-        name: String,
-        quantity: String,
-        note: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<i64> {
-        let ingredients = Arc::clone(&self.ingredients);
-        self.db
-            .run(move |txn| {
-                Box::pin(async move {
-                    ingredients
-                        .add_ingredient(txn, meal_id, name, quantity, note, category_id)
-                        .await
-                })
-            })
-            .await
-    }
-
-    pub async fn update_ingredient(
-        &self,
-        meal_id: i64,
-        ingredient_id: i64,
-        name: String,
-        quantity: String,
-        note: String,
-        category_id: Option<i64>,
-    ) -> DomainResult<()> {
-        let ingredients = Arc::clone(&self.ingredients);
-        self.db
-            .run(move |txn| {
-                Box::pin(async move {
-                    ingredients
-                        .update_ingredient(
-                            txn,
-                            meal_id,
-                            ingredient_id,
-                            name,
-                            quantity,
-                            note,
-                            category_id,
-                        )
-                        .await
-                })
-            })
-            .await
-    }
-
-    pub async fn delete_ingredient(&self, meal_id: i64, ingredient_id: i64) -> DomainResult<()> {
-        let ingredients = Arc::clone(&self.ingredients);
-        self.db
-            .run(move |txn| {
-                Box::pin(async move {
-                    ingredients
-                        .delete_ingredient(txn, meal_id, ingredient_id)
-                        .await
-                })
-            })
-            .await
-    }
-
-    /// Expands a meal's ingredients into items on a list in one unit of work,
-    /// recording the meal on the list and bumping the list revision exactly once.
-    pub async fn add_meal_to_list(&self, meal_id: i64, list_id: i64) -> DomainResult<i64> {
-        let meals = Arc::clone(&self.meals);
-        let lists = Arc::clone(&self.lists);
-        let items = Arc::clone(&self.items);
-        let list_meals = Arc::clone(&self.list_meals);
         let revision = self
             .db
             .run(move |txn| {
-                Box::pin(async move {
+                Box::pin(async move { categories.create_category(txn, list_id, name).await })
-                    let meal = meals
-                        .get_meal(txn, meal_id)
-                        .await?
-                        .ok_or(DomainError::NotFound)?;
-                    if lists.get_list(txn, list_id).await?.is_none() {
-                        return Err(DomainError::NotFound);
-                    }
-                    let list_meal_id = list_meals
-                        .add_meal(txn, list_id, Some(meal.id), meal.name.clone())
-                        .await?;
-                    let new_items = meal
-                        .ingredients
-                        .into_iter()
-                        .map(|ingredient| NewItem {
-                            name: ingredient.name,
-                            quantity: ingredient.quantity,
-                            note: ingredient.note,
-                            category_id: ingredient.category_id,
-                            list_meal_id: Some(list_meal_id),
-                        })
-                        .collect();
-                    items.add_items_bulk(txn, list_id, new_items).await
-                })
             })
             .await?;
         self.realtime.publish_list_changed(list_id, revision).await;
         Ok(revision)
     }
-
-    /// Lists the meals that have been added to a list, most recent first.
-    pub async fn list_meals_on_list(&self, list_id: i64) -> DomainResult<Vec<ListMeal>> {
-        let list_meals = Arc::clone(&self.list_meals);
-        self.db
-            .run(move |txn| Box::pin(async move { list_meals.list_meals(txn, list_id).await }))
-            .await
-    }
-
-    /// Removes a meal instance from a list, deleting the items that came from it
-    /// and bumping the list revision exactly once.
-    pub async fn remove_meal_from_list(
-        &self,
-        list_id: i64,
-        list_meal_id: i64,
-    ) -> DomainResult<i64> {
-        let list_meals = Arc::clone(&self.list_meals);
-        let revision = self
-            .db
-            .run(move |txn| {
-                Box::pin(async move { list_meals.remove_meal(txn, list_id, list_meal_id).await })
-            })
-            .await?;
-        self.realtime.publish_list_changed(list_id, revision).await;
-        Ok(revision)
-    }
-
-    /// Copies the given meal instances from a source list into the destination
-    /// list without re-expanding their ingredients into items (they were already
-    /// purchased). The source list is left untouched. Publishes a realtime update
-    /// for the destination only.
-    pub async fn carry_meals_to_list(
-        &self,
-        source_list_id: i64,
-        dest_list_id: i64,
-        list_meal_ids: &[i64],
-    ) -> DomainResult<Vec<ListMeal>> {
-        let list_meals = Arc::clone(&self.list_meals);
-        let ids = list_meal_ids.to_vec();
-        let (copied, revision) = self
-            .db
-            .run(move |txn| {
-                Box::pin(async move {
-                    list_meals
-                        .copy_meals_to_list(txn, source_list_id, dest_list_id, &ids)
-                        .await
-                })
-            })
-            .await?;
-        self.realtime
-            .publish_list_changed(dest_list_id, revision)
-            .await;
-        Ok(copied)
-    }
 }
 
 pub struct InvitationService {
@@ -658,54 +333,3 @@ impl InvitationService {
             .await
     }
 }
-
-pub struct RewardsCardService {
-    db: SqliteDatabase,
-    cards: Arc<dyn RewardsCardRepository>,
-}
-
-impl RewardsCardService {
-    pub fn new(db: SqliteDatabase, cards: Arc<dyn RewardsCardRepository>) -> Self {
-        Self { db, cards }
-    }
-
-    pub async fn list_cards(&self, user_id: i64) -> DomainResult<Vec<RewardsCard>> {
-        let cards = Arc::clone(&self.cards);
-        self.db
-            .run(move |txn| Box::pin(async move { cards.list_cards(txn, user_id).await }))
-            .await
-    }
-
-    pub async fn get_card(&self, user_id: i64, card_id: i64) -> DomainResult<Option<RewardsCard>> {
-        let cards = Arc::clone(&self.cards);
-        self.db
-            .run(move |txn| Box::pin(async move { cards.get_card(txn, user_id, card_id).await }))
-            .await
-    }
-
-    pub async fn create_card(
-        &self,
-        user_id: i64,
-        store_name: String,
-        number: String,
-        symbology: String,
-    ) -> DomainResult<RewardsCard> {
-        let cards = Arc::clone(&self.cards);
-        self.db
-            .run(move |txn| {
-                Box::pin(async move {
-                    cards
-                        .create_card(txn, user_id, store_name, number, symbology)
-                        .await
-                })
-            })
-            .await
-    }
-
-    pub async fn delete_card(&self, user_id: i64, card_id: i64) -> DomainResult<()> {
-        let cards = Arc::clone(&self.cards);
-        self.db
-            .run(move |txn| Box::pin(async move { cards.delete_card(txn, user_id, card_id).await }))
-            .await
-    }
-}

src/webauthn.rs

@@ -1,340 +0,0 @@
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
-
-use webauthn_rs::{
-    Webauthn,
-    core::{AuthenticationState, RegistrationState, WebauthnConfig},
-    error::WebauthnError as WanError,
-    proto::{
-        CreationChallengeResponse, Credential, PublicKeyCredential, RegisterPublicKeyCredential,
-        RequestChallengeResponse, UserVerificationPolicy,
-    },
-};
-
-use crate::domain::{DomainError, DomainResult, Passkey as DbPasskey, User};
-use crate::ports::{PasskeyRepository, UserRepository};
-use crate::security::new_secret;
-use crate::sqlite::SqliteDatabase;
-
-/// Site-specific WebAuthn configuration, derived from env vars.
-pub struct AppWebauthnConfig {
-    rp_id: String,
-    rp_name: String,
-    origin: url::Url,
-    require_resident_key: bool,
-}
-
-impl AppWebauthnConfig {
-    pub fn new(rp_id: String, rp_name: String, origin: url::Url) -> Self {
-        Self {
-            rp_id,
-            rp_name,
-            origin,
-            // Resident (discoverable) keys let users sign in without typing an
-            // email, because the authenticator can select the credential on its
-            // own and return the user handle.
-            require_resident_key: true,
-        }
-    }
-}
-
-impl WebauthnConfig for AppWebauthnConfig {
-    fn get_relying_party_name(&self) -> &str {
-        &self.rp_name
-    }
-    fn get_origin(&self) -> &url::Url {
-        &self.origin
-    }
-    fn get_relying_party_id(&self) -> &str {
-        &self.rp_id
-    }
-    fn get_require_resident_key(&self) -> bool {
-        self.require_resident_key
-    }
-}
-
-/// A single-use, in-memory challenge store. Registrations are keyed by user id;
-/// authentications are keyed by a random token so that userless (discoverable)
-/// ceremonies can be correlated back to the finish request.
-#[derive(Default)]
-struct ChallengeStore {
-    registrations: HashMap<i64, RegistrationState>,
-    authentications: HashMap<String, AuthenticationState>,
-}
-
-pub struct WebAuthnService {
-    db: SqliteDatabase,
-    webauthn: Webauthn<AppWebauthnConfig>,
-    users: Arc<dyn UserRepository>,
-    passkeys: Arc<dyn PasskeyRepository>,
-    challenges: Mutex<ChallengeStore>,
-}
-
-impl WebAuthnService {
-    pub fn new(
-        db: SqliteDatabase,
-        config: AppWebauthnConfig,
-        users: Arc<dyn UserRepository>,
-        passkeys: Arc<dyn PasskeyRepository>,
-    ) -> Self {
-        let webauthn = Webauthn::new(config);
-        Self {
-            db,
-            webauthn,
-            users,
-            passkeys,
-            challenges: Mutex::new(ChallengeStore::default()),
-        }
-    }
-
-    /// Start a passkey registration ceremony for an authenticated user.
-    pub fn start_registration(&self, user: &User) -> DomainResult<CreationChallengeResponse> {
-        // Use the user's opaque, random user handle as the WebAuthn userHandle
-        // so that userless (discoverable) sign-in can resolve the owning user
-        // from the assertion's userHandle without exposing the numeric id.
-        let (challenge, state) = self
-            .webauthn
-            .generate_challenge_register_options(
-                user.user_handle.clone(),
-                user.email.clone(),
-                user.display_name.clone(),
-                None,
-                Some(UserVerificationPolicy::Required),
-                None,
-            )
-            .map_err(webauthn_error)?;
-        self.challenges
-            .lock()
-            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
-            .registrations
-            .insert(user.id, state);
-        Ok(challenge)
-    }
-
-    /// Finish a passkey registration ceremony and persist the credential.
-    pub async fn finish_registration(
-        &self,
-        user: &User,
-        response: RegisterPublicKeyCredential,
-    ) -> DomainResult<()> {
-        let state = self
-            .challenges
-            .lock()
-            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
-            .registrations
-            .remove(&user.id)
-            .ok_or(DomainError::NotFound)?;
-
-        let passkeys = Arc::clone(&self.passkeys);
-        let credential_id = response.raw_id.0.clone();
-        let user_id = user.id;
-        let credential = self
-            .webauthn
-            .register_credential(&response, &state, |_| Ok(false))
-            .map_err(webauthn_error)?;
-
-        let serialized = serde_json::to_string(&credential.0)
-            .map_err(|e| DomainError::Database(e.to_string()))?;
-        let credential_id_b64 = base64_url(&credential_id);
-        let counter = credential.0.counter as i64;
-
-        self.db
-            .run(move |txn| {
-                let passkeys = passkeys.clone();
-                Box::pin(async move {
-                    passkeys
-                        .create_passkey(txn, user_id, credential_id_b64, serialized, counter)
-                        .await?;
-                    Ok(())
-                })
-            })
-            .await
-    }
-
-    /// Start a passkey authentication ceremony for a user identified by email.
-    /// Returns the challenge and a token used to correlate the finish request.
-    pub async fn start_authentication(
-        &self,
-        user_id: i64,
-    ) -> DomainResult<(RequestChallengeResponse, String)> {
-        let passkeys = Arc::clone(&self.passkeys);
-        let db = self.db.clone();
-        let credentials: Vec<Credential> = db
-            .run(move |txn| {
-                let passkeys = passkeys.clone();
-                Box::pin(async move {
-                    let rows = passkeys.list_for_user(txn, user_id).await?;
-                    let mut creds = Vec::new();
-                    for row in rows {
-                        let cred: Credential = serde_json::from_str(&row.credential)
-                            .map_err(|e| DomainError::Database(e.to_string()))?;
-                        creds.push(cred);
-                    }
-                    Ok(creds)
-                })
-            })
-            .await?;
-        if credentials.is_empty() {
-            return Err(DomainError::NotFound);
-        }
-        let (challenge, state) = self
-            .webauthn
-            .generate_challenge_authenticate(credentials)
-            .map_err(webauthn_error)?;
-        let token = hex::encode(new_secret());
-        self.challenges
-            .lock()
-            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
-            .authentications
-            .insert(token.clone(), state);
-        Ok((challenge, token))
-    }
-
-    /// Start a userless passkey authentication ceremony. No email is required:
-    /// the authenticator selects a discoverable credential and returns a user
-    /// handle that we resolve to the owning user on finish.
-    pub async fn start_userless_authentication(
-        &self,
-    ) -> DomainResult<(RequestChallengeResponse, String)> {
-        let (challenge, mut state) = self
-            .webauthn
-            .generate_challenge_authenticate_options(vec![], None)
-            .map_err(webauthn_error)?;
-        // With no allowCredentials the browser will offer any discoverable
-        // credential for this RP; the credential set is populated from the
-        // user handle once the assertion is received.
-        state.set_allowed_credentials(vec![]);
-        let token = hex::encode(new_secret());
-        self.challenges
-            .lock()
-            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
-            .authentications
-            .insert(token.clone(), state);
-        Ok((challenge, token))
-    }
-
-    /// Finish a passkey authentication ceremony, resolving the owning user from
-    /// the credential id (and, for userless ceremonies, the user handle).
-    pub async fn finish_authentication(
-        &self,
-        token: String,
-        response: PublicKeyCredential,
-    ) -> DomainResult<i64> {
-        let mut state = self
-            .challenges
-            .lock()
-            .map_err(|_| DomainError::Database("challenge lock poisoned".into()))?
-            .authentications
-            .remove(&token)
-            .ok_or(DomainError::NotFound)?;
-
-        // For userless ceremonies the assertion carries a user handle that
-        // identifies the user; load that user's credentials so the signature
-        // can be verified against the correct key.
-        if let Some(user_handle) = response.get_user_handle() {
-            let handle = user_handle.to_vec();
-            let users = Arc::clone(&self.users);
-            let db = self.db.clone();
-            let user_id = db
-                .run(move |txn| {
-                    let users = users.clone();
-                    Box::pin(async move {
-                        let user = users
-                            .find_user_by_handle(txn, handle)
-                            .await?
-                            .ok_or(DomainError::NotFound)?;
-                        Ok(user.id)
-                    })
-                })
-                .await?;
-            let passkeys = Arc::clone(&self.passkeys);
-            let credentials: Vec<Credential> = db
-                .run(move |txn| {
-                    let passkeys = passkeys.clone();
-                    Box::pin(async move {
-                        let rows = passkeys.list_for_user(txn, user_id).await?;
-                        let mut creds = Vec::new();
-                        for row in rows {
-                            let cred: Credential = serde_json::from_str(&row.credential)
-                                .map_err(|e| DomainError::Database(e.to_string()))?;
-                            creds.push(cred);
-                        }
-                        Ok(creds)
-                    })
-                })
-                .await?;
-            state.set_allowed_credentials(credentials);
-        }
-
-        let (cred_id, auth_data) = self
-            .webauthn
-            .authenticate_credential(&response, &state)
-            .map_err(|e| {
-                tracing::error!(%e, "webauthn authenticate_credential failed");
-                webauthn_error(e)
-            })?;
-
-        let passkeys = Arc::clone(&self.passkeys);
-        let db = self.db.clone();
-        let credential_id_b64 = base64_url(cred_id);
-        let user_id = db
-            .run(move |txn| {
-                let passkeys = passkeys.clone();
-                Box::pin(async move {
-                    let stored = passkeys
-                        .find_by_credential_id(txn, credential_id_b64)
-                        .await?
-                        .ok_or(DomainError::NotFound)?;
-                    let mut cred: Credential = serde_json::from_str(&stored.credential)
-                        .map_err(|e| DomainError::Database(e.to_string()))?;
-                    cred.counter = auth_data.counter;
-                    let serialized = serde_json::to_string(&cred)
-                        .map_err(|e| DomainError::Database(e.to_string()))?;
-                    sqlx::query("UPDATE passkeys SET credential = ?1 WHERE id = ?2")
-                        .bind(&serialized)
-                        .bind(stored.id)
-                        .execute(&mut *txn)
-                        .await
-                        .map_err(db_error)?;
-                    Ok(stored.user_id)
-                })
-            })
-            .await?;
-        Ok(user_id)
-    }
-
-    /// List the passkeys registered to a user.
-    pub async fn list_passkeys(&self, user_id: i64) -> DomainResult<Vec<DbPasskey>> {
-        let passkeys = Arc::clone(&self.passkeys);
-        self.db
-            .run(move |txn| {
-                let passkeys = passkeys.clone();
-                Box::pin(async move { passkeys.list_for_user(txn, user_id).await })
-            })
-            .await
-    }
-
-    /// Delete a passkey owned by a user.
-    pub async fn delete_passkey(&self, user_id: i64, passkey_id: i64) -> DomainResult<()> {
-        let passkeys = Arc::clone(&self.passkeys);
-        self.db
-            .run(move |txn| {
-                let passkeys = passkeys.clone();
-                Box::pin(async move { passkeys.delete_passkey(txn, user_id, passkey_id).await })
-            })
-            .await
-    }
-}
-
-fn base64_url(bytes: &[u8]) -> String {
-    use base64::Engine;
-    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(bytes)
-}
-
-fn webauthn_error(error: WanError) -> DomainError {
-    DomainError::Database(error.to_string())
-}
-
-fn db_error(error: sqlx::Error) -> DomainError {
-    DomainError::Database(error.to_string())
-}

static/logo.svg

@@ -1,143 +0,0 @@
-<svg
-  xmlns="http://www.w3.org/2000/svg"
-  viewBox="0 0 64 64"
-  role="img"
-  aria-labelledby="title"
->
-  <title id="title">Sustenance grocery bag with produce</title>
-
-  <!-- Background -->
-  <rect width="64" height="64" rx="12" fill="#286247"/>
-
-  <!-- Back of the paper bag -->
-  <path
-    d="
-      M7 27
-      L16 22
-      L24 26
-      L32 22
-      L40 25
-      L49 21
-      L57 25
-      L47 31
-      L39 28
-      L31 32
-      L23 27
-      L16 31
-      Z
-    "
-    fill="#F2D39B"
-  />
-
-  <!-- Back rim -->
-  <path
-    d="M7 27 16 22 24 26 32 22 40 25 49 21 57 25"
-    fill="none"
-    stroke="#1F4938"
-    stroke-width="2.75"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-  />
-
-  <!-- Leafy greens -->
-  <path
-    d="M42 28C39 21 42 12 49 7c2 3 2 6 1 9 3-2 6-2 8 0-1 5-5 9-12 13Z"
-    fill="#8EC866"
-    stroke="#1F4938"
-    stroke-width="2.5"
-    stroke-linejoin="round"
-  />
-  <path
-    d="M45 27 53 15M47 22l7-1M49 18l-1-5"
-    fill="none"
-    stroke="#1F4938"
-    stroke-width="2"
-    stroke-linecap="round"
-  />
-
-  <!-- Carrot leaves -->
-  <path
-    d="
-      M17 14c-2-4-1-7 0-10 3 3 4 6 3 10
-      m0 0c0-5 2-8 5-10 1 5-1 8-5 11
-    "
-    fill="#8EC866"
-    stroke="#1F4938"
-    stroke-width="2.5"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-  />
-
-  <!-- Carrot -->
-  <path
-    d="M13 18c3-4 9-5 13-2l-3 20-5 2Z"
-    fill="#F29A3F"
-    stroke="#1F4938"
-    stroke-width="2.5"
-    stroke-linejoin="round"
-  />
-  <path
-    d="m16 24 7-2m-6 7 5-2"
-    fill="none"
-    stroke="#1F4938"
-    stroke-width="2"
-    stroke-linecap="round"
-  />
-
-  <!-- Tomato -->
-  <path
-    d="M27 25c0-6 4-10 10-10s10 4 10 10c0 7-4 12-10 12S27 32 27 25Z"
-    fill="#E65A46"
-    stroke="#1F4938"
-    stroke-width="2.5"
-  />
-  <path
-    d="m37 15-4 5 4-1 4 2-1-5"
-    fill="#78B75B"
-    stroke="#1F4938"
-    stroke-width="2"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-  />
-
-  <!-- Front and sides of the paper bag -->
-  <path
-    d="
-      M7 27
-      L16 31
-      L23 27
-      L31 32
-      L39 28
-      L47 31
-      L57 25
-      L55 51
-      L45 59
-      L11 51
-      Z
-    "
-    fill="#F2D39B"
-    stroke="#1F4938"
-    stroke-width="2.75"
-    stroke-linejoin="round"
-  />
-
-  <!-- Front opening edge -->
-  <path
-    d="M7 27 16 31 23 27 31 32 39 28 47 31 57 25"
-    fill="none"
-    stroke="#1F4938"
-    stroke-width="2.75"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-  />
-
-  <!-- Side-panel seam and paper creases -->
-  <path
-    d="M47 31 45 59M45 59l10-8M15 36l1 9"
-    fill="none"
-    stroke="#1F4938"
-    stroke-width="2.25"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-  />
-</svg>

static/passkey-login.js

@@ -1,34 +0,0 @@
-function b64ToBytes(b64) {
-  const bin = atob(b64.replace(/-/g, "+").replace(/_/g, "/"));
-  const bytes = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-  return bytes;
-}
-
-document.getElementById("passkey-login").addEventListener("click", async () => {
-  const email = document.getElementById("email").value.trim();
-  const start = await fetch("/auth/passkey/login/start", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ email }),
-  });
-  if (!start.ok) {
-    alert("No passkey found for that account.");
-    return;
-  }
-  const data = await start.json();
-  const pk = data.publicKey;
-  pk.challenge = b64ToBytes(pk.challenge);
-  if (pk.allowCredentials) {
-    pk.allowCredentials.forEach((c) => (c.id = b64ToBytes(c.id)));
-  }
-  const credential = await navigator.credentials.get({ publicKey: pk });
-  const finish = await fetch("/auth/passkey/login/finish", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ token: data.token, response: credential }),
-  });
-  if (finish.ok) {
-    window.location.href = "/lists";
-  }
-});

static/passkey-register.js

@@ -1,32 +0,0 @@
-function b64ToBytes(b64) {
-  const bin = atob(b64.replace(/-/g, "+").replace(/_/g, "/"));
-  const bytes = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-  return bytes;
-}
-
-document.getElementById("add-passkey").addEventListener("click", async () => {
-  const csrf = document.getElementById("add-passkey").dataset.csrf;
-  const start = await fetch("/auth/passkey/register/start", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ csrf }),
-  });
-  const options = await start.json();
-  const pk = options.publicKey;
-  pk.challenge = b64ToBytes(pk.challenge);
-  pk.user.id = b64ToBytes(pk.user.id);
-  if (pk.excludeCredentials) {
-    pk.excludeCredentials.forEach((c) => (c.id = b64ToBytes(c.id)));
-  }
-  const credential = await navigator.credentials.create(options);
-  const response = { csrf, response: credential };
-  const finish = await fetch("/auth/passkey/register/finish", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(response),
-  });
-  if (finish.ok) {
-    window.location.href = "/account";
-  }
-});

static/password-toggle.js

@@ -1,16 +0,0 @@
-// Toggle password visibility so users can check for typos, especially on mobile.
-document.querySelectorAll(".password-toggle").forEach(function (button) {
-  button.addEventListener("pointerdown", function (event) {
-    // Toggle on press (not click) for an instant response. preventScroll avoids
-    // a scroll-to-input animation that makes rapid toggling feel laggy, and
-    // keeping focus on the input keeps the mobile keyboard open.
-    event.preventDefault();
-    var input = document.getElementById(button.getAttribute("data-toggle-for"));
-    if (!input) return;
-    var showing = input.type === "text";
-    input.type = showing ? "password" : "text";
-    button.textContent = showing ? "Show" : "Hide";
-    button.setAttribute("aria-label", showing ? "Show password" : "Hide password");
-    input.focus({ preventScroll: true });
-  });
-});

static/rewards.js

@@ -1,30 +0,0 @@
-// Keep the screen awake while a rewards barcode is on screen so the cashier
-// can scan it without the display dimming or locking. This mirrors how wallet
-// apps behave when showing a barcode. The Screen Wake Lock API is best-effort:
-// it may be rejected (e.g. low battery) or auto-released when the tab is hidden,
-// so we re-acquire whenever the page becomes visible again.
-(function () {
-  var wakeLock = null;
-
-  function requestWakeLock() {
-    if (!("wakeLock" in navigator)) return;
-    navigator.wakeLock
-      .request("screen")
-      .then(function (sentinel) {
-        wakeLock = sentinel;
-      })
-      .catch(function () {
-        // Best-effort only; ignore failures (unsupported, low battery, etc.).
-      });
-  }
-
-  // Re-acquire if the lock was released (e.g. the tab was hidden) and the user
-  // returns to the page.
-  document.addEventListener("visibilitychange", function () {
-    if (document.visibilityState === "visible" && wakeLock === null) {
-      requestWakeLock();
-    }
-  });
-
-  requestWakeLock();
-})();

static/style.css

@@ -38,21 +38,9 @@ a { color: inherit; }
 }
 
 .brand { display: inline-flex; align-items: center; gap: 10px; text-decoration: none; font-weight: 800; letter-spacing: -.03em; }
-.brand-mark { display: block; width: 34px; height: 34px; border-radius: 9px; object-fit: cover; }
+.brand-mark { display: grid; place-items: center; width: 32px; height: 32px; border-radius: 11px 11px 11px 3px; background: var(--deep-sage); color: white; transform: rotate(-6deg); }
-.site-nav { display: flex; align-items: center; gap: 6px; }
-.site-nav a {
-  padding: 8px 14px;
-  border-radius: 11px;
-  color: var(--muted);
-  text-decoration: none;
-  font-size: .9rem;
-  font-weight: 700;
-  transition: color .16s ease, background .16s ease;
-}
-.site-nav a:hover { color: var(--ink); background: #eef2ea; }
 .account-nav { display: flex; align-items: center; gap: 16px; color: var(--muted); font-size: .9rem; }
-.user-name { color: var(--ink); font-weight: 700; text-decoration: none; }
+.user-name { color: var(--ink); font-weight: 700; }
-.user-name:hover { color: var(--deep-sage); }
 .text-button { border: 0; padding: 0; color: var(--deep-sage); background: transparent; cursor: pointer; font-weight: 700; }
 
 .site-main { width: min(1120px, calc(100% - 40px)); margin: 30px auto 80px; }
@@ -67,27 +55,14 @@ h3 { margin-bottom: 6px; font-size: 1rem; }
 .muted { color: var(--muted); }
 
 .page-heading { display: flex; justify-content: space-between; align-items: end; margin-bottom: 34px; }
-.page-heading h1.page-title { font-size: clamp(1.6rem, 3.2vw, 2.3rem); }
 .dashboard-grid { display: grid; grid-template-columns: minmax(0, 1.5fr) minmax(260px, .8fr); gap: 22px; align-items: start; }
 .panel { padding: 26px; border: 1px solid rgba(221, 225, 210, .9); border-radius: 24px; background: rgba(255, 253, 248, .88); box-shadow: var(--shadow); }
 .panel-heading { display: flex; justify-content: space-between; align-items: center; gap: 12px; margin-bottom: 22px; }
-.archive-link { margin-left: auto; color: var(--muted); font-size: .78rem; font-weight: 700; text-decoration: none; }
-.archive-link:hover { color: var(--deep-sage); }
 .count-badge { display: inline-grid; place-items: center; min-width: 27px; height: 27px; padding: 0 8px; border-radius: 99px; color: var(--deep-sage); background: #e8f0e1; font-size: .78rem; font-weight: 800; }
 .stack { display: grid; gap: 9px; }
 .stack label { color: var(--muted); font-size: .82rem; font-weight: 700; }
 input { width: 100%; min-height: 46px; padding: 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; }
 input:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
-.password-field { position: relative; }
-.password-field input { padding-right: 64px; }
-.password-toggle { position: absolute; top: 50%; right: 8px; transform: translateY(-50%); min-height: 32px; padding: 5px 10px; border: 0; border-radius: 9px; cursor: pointer; color: var(--deep-sage); background: #e7f0e1; font-weight: 800; font-size: .78rem; }
-.password-toggle:hover { background: #dbe9d2; }
-select { width: 100%; min-height: 46px; padding: 10px 34px 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; font: inherit; appearance: none; -webkit-appearance: none; background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='16' height='16' viewBox='0 0 16 16'><path d='M4 6l4 4 4-4' fill='none' stroke='%2355715d' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'/></svg>"); background-repeat: no-repeat; background-position: right 12px center; }
-select:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
-select option { color: var(--ink); background: #fff; }
-select option:checked { color: var(--deep-sage); font-weight: 700; }
-textarea { width: 100%; padding: 10px 13px; border: 1px solid var(--line); border-radius: 12px; outline: none; color: var(--ink); background: #fff; font: inherit; resize: vertical; }
-textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }
 .button { display: inline-flex; align-items: center; justify-content: center; min-height: 44px; padding: 10px 17px; border: 0; border-radius: 12px; cursor: pointer; text-decoration: none; font-weight: 800; transition: transform .16s ease, box-shadow .16s ease, background .16s ease; }
 .button:hover { transform: translateY(-1px); }
 .button-primary { color: #fff; background: var(--deep-sage); box-shadow: 0 8px 18px rgba(85, 113, 93, .2); }
@@ -102,29 +77,16 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .list-card-copy { display: grid; flex: 1; gap: 2px; }
 .list-card-copy small { color: var(--muted); font-size: .75rem; }
 .list-card-arrow { color: var(--muted); font-size: 1.25rem; }
-.archived-list-card { opacity: .72; }
-.archived-list-card .list-card-icon { color: var(--muted); background: #eef0ea; }
-.archived-list-card .list-card-copy { align-items: flex-start; }
-.archived-list-card form { margin-left: auto; }
-.archived-banner { margin-bottom: 18px; padding: 11px 14px; border: 1px solid var(--line); border-radius: 12px; color: var(--muted); background: #f1f3ec; font-size: .82rem; font-weight: 700; }
 .empty-state { padding: 35px 18px 24px; text-align: center; color: var(--muted); }
 .empty-mark { display: grid; place-items: center; width: 50px; height: 50px; margin: 0 auto 15px; border-radius: 18px; color: var(--deep-sage); background: #edf3e8; font-size: 1.8rem; }
 .empty-state h3 { color: var(--ink); }
 
 .auth-card { width: min(100%, 480px); margin: 7vh auto 0; padding: clamp(27px, 6vw, 54px); border: 1px solid var(--line); border-radius: 28px; background: rgba(255, 253, 248, .9); box-shadow: var(--shadow); }
 .auth-card .button { margin-top: 11px; }
-#passkey-login { width: 100%; }
-.auth-divider { display: flex; align-items: center; gap: 12px; margin: 20px 0 4px; color: var(--muted); font-size: .8rem; }
-.auth-divider::before, .auth-divider::after { content: ""; flex: 1; height: 1px; background: var(--line); }
-.passkey-list { display: grid; gap: 8px; margin-bottom: 16px; }
-.passkey-row { display: flex; align-items: center; gap: 12px; padding: 12px; border: 1px solid var(--line); border-radius: 14px; background: #fff; }
-.passkey-row .item-copy { flex: 1; }
-.passkey-row small { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .auth-switch { margin: 25px 0 0; color: var(--muted); font-size: .9rem; text-align: center; }
 .auth-switch a { color: var(--deep-sage); font-weight: 800; }
 .alert { margin-bottom: 18px; padding: 12px 14px; border-radius: 12px; font-size: .9rem; }
 .alert-error { color: #874d40; background: #fbe7e0; }
-.alert-success { color: #3d6b4f; background: #e4f2e6; }
 
 .list-topbar { display: flex; justify-content: space-between; align-items: center; margin-bottom: 27px; }
 .back-link { color: var(--muted); font-size: .85rem; font-weight: 700; text-decoration: none; }
@@ -132,20 +94,12 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .list-topbar-actions { display: flex; align-items: center; gap: 12px; }
 .live-pill { display: inline-flex; align-items: center; gap: 7px; color: var(--deep-sage); font-size: .78rem; font-weight: 800; }
 .live-dot { width: 8px; height: 8px; border-radius: 50%; background: #75ae6e; box-shadow: 0 0 0 4px rgba(117, 174, 110, .15); }
-.add-meal-button {
-  color: #fff;
-  background: var(--deep-sage);
-  box-shadow: 0 8px 18px rgba(85, 113, 93, .25);
-}
-.add-meal-button:hover { transform: translateY(-2px); box-shadow: 0 12px 24px rgba(85, 113, 93, .32); }
-.add-meal-button:active { transform: translateY(0); }
 .list-layout { display: grid; grid-template-columns: minmax(0, 1.5fr) minmax(265px, .72fr); gap: 22px; align-items: start; }
 .list-panel { min-width: 0; }
 .list-heading { display: flex; justify-content: space-between; margin-bottom: 25px; }
 .list-heading h1 { max-width: 100%; margin-bottom: 5px; overflow-wrap: anywhere; font-size: clamp(1.45rem, 2.8vw, 2.05rem); }
 .list-meta { margin: 0; color: var(--muted); font-size: .85rem; }
-.meal-category-label { margin-left: 10px; color: var(--muted); font-size: .8em; font-weight: 500; white-space: nowrap; }
+.add-item-form { display: grid; grid-template-columns: minmax(0, 1fr) 90px 145px auto; gap: 8px; margin-bottom: 19px; }
-.add-item-form { display: grid; grid-template-columns: minmax(0, 1fr) 145px 90px auto; gap: 8px; margin-bottom: 19px; }
 .add-item-form input { min-height: 50px; }
 .add-item-form select { min-height: 50px; }
 .add-button { min-height: 50px; }
@@ -153,86 +107,22 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .item-list { display: grid; gap: 6px; }
 .category-group + .category-group { margin-top: 18px; }
 .category-heading { margin: 0 7px 4px; color: var(--deep-sage); font-size: .72rem; letter-spacing: .12em; text-transform: uppercase; }
-.ingredients-divider { margin: 26px 0 18px; border: 0; border-top: 1px solid var(--line); }
 .item-row { display: flex; align-items: center; gap: 12px; min-height: 66px; padding: 9px 7px 9px 10px; border-bottom: 1px solid #edf0e6; }
 .item-row:last-child { border-bottom: 0; }
 .check-form { flex: 0 0 auto; }
 .check-button { display: grid; place-items: center; width: 28px; height: 28px; padding: 0; border: 2px solid #c8d6c1; border-radius: 9px; color: #fff; background: transparent; cursor: pointer; font-size: .88rem; font-weight: 900; }
 .is-checked .check-button { border-color: var(--deep-sage); background: var(--deep-sage); }
-.check-button-static { cursor: default; }
+.item-copy { display: grid; flex: 1; min-width: 0; gap: 2px; }
-.is-checked .check-button-static { border-color: var(--deep-sage); background: var(--deep-sage); }
+.item-copy strong { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.item-copy { display: grid; grid-template-columns: auto 1fr; flex: 1; min-width: 0; gap: 2px 7px; align-items: baseline; }
+.item-copy small { overflow: hidden; color: var(--muted); text-overflow: ellipsis; white-space: nowrap; font-size: .78rem; }
-.item-copy strong { grid-column: 2; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.item-qty { grid-column: 1; grid-row: 1; color: var(--muted); font-weight: 700; white-space: nowrap; }
-.item-copy small { grid-column: 1 / -1; overflow: hidden; color: var(--muted); text-overflow: ellipsis; white-space: nowrap; font-size: .78rem; }
 .is-checked .item-copy strong { color: var(--muted); text-decoration: line-through; }
-.item-actions-button {
+.item-actions { position: relative; }
-  flex: 0 0 auto;
+.item-actions summary { padding: 7px 5px; color: var(--muted); cursor: pointer; list-style: none; font-size: .78rem; letter-spacing: 2px; }
-  padding: 7px 8px;
+.item-actions summary::-webkit-details-marker { display: none; }
-  border: 0;
+.item-menu { position: absolute; z-index: 2; right: 0; width: min(265px, 80vw); padding: 14px; border: 1px solid var(--line); border-radius: 15px; background: var(--card); box-shadow: var(--shadow); }
-  border-radius: 9px;
-  color: var(--muted);
-  background: transparent;
-  cursor: pointer;
-  font-size: .9rem;
-  letter-spacing: 2px;
-  line-height: 1;
-}
-.item-actions-button:hover { color: var(--ink); background: #f0f3ea; }
-/* Rendered markdown (meal descriptions) */
-.markdown { line-height: 1.6; color: var(--ink); }
-.markdown p { margin: 0 0 12px; }
-.markdown ul, .markdown ol { margin: 0 0 12px; padding-left: 22px; }
-.markdown li { margin-bottom: 4px; }
-.markdown h1, .markdown h2, .markdown h3, .markdown h4 { margin: 18px 0 8px; letter-spacing: -.02em; }
-.markdown h1 { font-size: 1.5rem; }
-.markdown h2 { font-size: 1.25rem; }
-.markdown h3 { font-size: 1.1rem; }
-.markdown code { padding: 2px 5px; border-radius: 6px; background: #eef2ea; font-size: .9em; }
-.markdown pre { padding: 12px; border-radius: 12px; background: #eef2ea; overflow-x: auto; }
-.markdown pre code { padding: 0; background: transparent; }
-.markdown blockquote { margin: 0 0 12px; padding-left: 14px; border-left: 3px solid var(--sage); color: var(--muted); }
-.markdown a { color: var(--deep-sage); text-decoration: underline; }
-/* Meal ingredient list */
-.ingredient-list { display: grid; gap: 6px; margin: 0; padding: 0; list-style: none; }
-.ingredient-list li {
-  display: flex;
-  align-items: center;
-  gap: 12px;
-  min-height: 52px;
-  padding: 8px 6px 8px 4px;
-  border-bottom: 1px solid #edf0e6;
-}
-.ingredient-list li:last-child { border-bottom: 0; }
-/* Item / ingredient edit modal */
-.item-modal {
-  width: min(100%, 420px);
-  padding: 0;
-  border: 1px solid rgba(221, 225, 210, .9);
-  border-radius: 24px;
-  background: rgba(255, 253, 248, .98);
-  box-shadow: var(--shadow);
-}
-.item-modal::backdrop {
-  background: rgba(37, 53, 46, .28);
-}
-.item-modal-card { padding: 22px 24px 24px; }
-.item-modal-header {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 16px;
-  margin-bottom: 18px;
-}
-.item-modal-header h3 { margin: 0; font-size: 1.15rem; letter-spacing: -.02em; }
-.item-modal .stack { margin-bottom: 14px; }
 .edit-form { margin-bottom: 12px; }
 .edit-form input { min-height: 38px; padding: 7px 10px; font-size: .85rem; }
 .danger-link { padding: 0; border: 0; color: var(--coral); background: none; cursor: pointer; font-size: .8rem; font-weight: 800; }
-.bordered-delete { padding: 7px 14px; border: 1px solid var(--coral); border-radius: 10px; background: none; }
-.bordered-delete:hover { background: #fbeae4; }
-.button-danger { width: 100%; color: var(--coral); background: #fbeae4; }
-.button-danger:hover { background: #f7ddd4; }
 .empty-items { padding: 34px 10px 18px; color: var(--muted); text-align: center; }
 .empty-items-icon { display: block; margin-bottom: 7px; color: var(--yellow); font-size: 1.7rem; }
 .empty-items p { margin-bottom: 2px; color: var(--ink); font-weight: 800; }
@@ -243,45 +133,12 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 .category-form input { min-height: 38px; padding: 7px 10px; font-size: .84rem; }
 .category-list { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 14px; }
 .category-chip { padding: 5px 9px; border-radius: 99px; color: var(--deep-sage); background: #edf3e8; font-size: .72rem; font-weight: 800; }
-/* Meal categories side panel */
-.meal-category-list { display: grid; gap: 2px; margin-top: 14px; }
-.meal-category-row { display: flex; align-items: center; justify-content: space-between; gap: 8px; padding: 7px 4px; border-bottom: 1px solid #edf0e6; }
-.meal-category-row:last-child { border-bottom: 0; }
-.meal-category-name { font-size: .9rem; font-weight: 700; }
-.meal-category-delete { padding: 2px 6px; border: 0; border-radius: 7px; color: var(--muted); background: transparent; cursor: pointer; font-size: .8rem; line-height: 1; }
-.meal-category-delete:hover { color: var(--coral); background: #fbeae4; }
 .category-empty { margin: 13px 0 0; font-size: .8rem; }
 .category-result { margin-top: 10px; }
 .category-success { margin: 0; color: var(--deep-sage); font-size: .76rem; font-weight: 800; }
 .presence-list { display: grid; gap: 12px; }
 .presence-person { display: flex; align-items: center; gap: 10px; font-size: .9rem; font-weight: 700; }
 .avatar { display: grid; place-items: center; width: 32px; height: 32px; border-radius: 11px; color: var(--deep-sage); background: #e6f0df; font-size: .7rem; font-weight: 900; }
-.list-meals { display: grid; gap: 8px; }
-.list-meal-row { display: flex; align-items: center; gap: 10px; padding: 6px 4px; border-bottom: 1px solid #edf0e6; }
-.list-meal-row:last-child { border-bottom: 0; }
-.list-meal-icon { display: grid; place-items: center; flex: 0 0 auto; width: 30px; height: 30px; border-radius: 10px; color: var(--deep-sage); background: #eef4e9; font-size: .95rem; }
-.list-meal-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: .9rem; font-weight: 700; }
-.list-meal-remove { margin: 0; flex: 0 0 auto; }
-.list-meal-remove-button { padding: 2px 7px; border: 0; border-radius: 7px; color: var(--muted); background: transparent; cursor: pointer; font-size: .8rem; line-height: 1; }
-.list-meal-remove-button:hover { color: var(--coral); background: #fbeae4; }
-.list-meals-panel .add-meal-button { margin-top: 12px; width: 100%; }
-.list-meals-actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; margin-top: 12px; }
-.list-meals-actions .button { width: 100%; margin: 0; }
-.carry-over-button { color: var(--deep-sage); background: #eef4e9; }
-.carry-over-button:hover { background: #e3eddc; }
-.carry-intro { margin: 14px 24px 4px; font-size: .85rem; }
-.carry-source-picker { padding: 14px 24px 4px; }
-.carry-source-picker label { display: block; margin-bottom: 6px; font-size: .78rem; font-weight: 800; color: var(--muted); text-transform: uppercase; letter-spacing: .04em; }
-.carry-source-picker select { width: 100%; min-height: 42px; padding: 8px 12px; border: 1px solid var(--line); border-radius: 12px; color: var(--ink); background: #fff; font-size: .9rem; }
-.carry-results { padding: 14px 24px 22px; overflow-y: auto; }
-.carry-form { margin: 0; }
-.carry-list { display: grid; gap: 8px; }
-.carry-row { display: flex; align-items: center; gap: 12px; padding: 10px 12px; border: 1px solid var(--line); border-radius: 14px; background: #fff; cursor: pointer; }
-.carry-row:hover { border-color: var(--sage); }
-.carry-row input { accent-color: var(--deep-sage); width: 17px; height: 17px; }
-.carry-row-icon { display: grid; place-items: center; flex: 0 0 auto; width: 34px; height: 34px; border-radius: 11px; color: var(--deep-sage); background: #eef4e9; font-size: .95rem; }
-.carry-row-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: .9rem; font-weight: 700; }
-.carry-submit { margin-top: 14px; width: 100%; }
 .sharing-panel p, .tip-panel p { color: var(--muted); font-size: .86rem; }
 .invite-result { margin-top: 15px; }
 .invite-link-result { padding: 11px; border-radius: 12px; background: #f1f5ec; }
@@ -296,114 +153,9 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 
 .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; border: 0; }
 
-/* Meal picker modal */
-.meal-picker-backdrop {
-  position: fixed;
-  inset: 0;
-  z-index: 50;
-  display: grid;
-  place-items: center;
-  padding: 20px;
-  background: rgba(37, 53, 46, .28);
-  animation: meal-picker-fade .15s ease;
-}
-@keyframes meal-picker-fade { from { opacity: 0; } to { opacity: 1; } }
-.meal-picker-modal {
-  width: min(100%, 460px);
-  max-height: min(78vh, 620px);
-  display: flex;
-  flex-direction: column;
-  overflow: hidden;
-  border: 1px solid rgba(221, 225, 210, .9);
-  border-radius: 24px;
-  background: rgba(255, 253, 248, .98);
-  box-shadow: var(--shadow);
-  animation: meal-picker-pop .18s ease;
-}
-@keyframes meal-picker-pop { from { opacity: 0; transform: translateY(8px); } to { opacity: 1; transform: none; } }
-.meal-picker-header {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 16px;
-  padding: 22px 24px 16px;
-  border-bottom: 1px solid #edf0e6;
-}
-.meal-picker-header .eyebrow { margin-bottom: 5px; }
-.meal-picker-header h2 { margin-bottom: 0; font-size: 1.25rem; letter-spacing: -.02em; }
-.meal-picker-close {
-  display: grid;
-  place-items: center;
-  flex: 0 0 auto;
-  width: 34px;
-  height: 34px;
-  padding: 0;
-  border: 1px solid var(--line);
-  border-radius: 11px;
-  color: var(--muted);
-  background: #fff;
-  cursor: pointer;
-  font-size: .9rem;
-  transition: color .16s ease, border-color .16s ease;
-}
-.meal-picker-close:hover { color: var(--ink); border-color: var(--sage); }
-.meal-picker-list {
-  display: grid;
-  gap: 8px;
-  padding: 16px 24px 22px;
-  overflow-y: auto;
-}
-.meal-picker-row { margin: 0; }
-.meal-picker-button {
-  display: flex;
-  align-items: center;
-  gap: 13px;
-  width: 100%;
-  padding: 12px 13px;
-  border: 1px solid var(--line);
-  border-radius: 16px;
-  color: var(--ink);
-  background: #fff;
-  cursor: pointer;
-  text-align: left;
-  transition: border-color .16s ease, transform .16s ease;
-}
-.meal-picker-button:hover { border-color: var(--sage); transform: translateX(2px); }
-.meal-picker-icon {
-  display: grid;
-  place-items: center;
-  flex: 0 0 auto;
-  width: 38px;
-  height: 38px;
-  border-radius: 13px;
-  color: var(--deep-sage);
-  background: #eef4e9;
-  font-size: 1.1rem;
-}
-.meal-picker-copy { display: grid; flex: 1; min-width: 0; gap: 2px; }
-.meal-picker-copy strong { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: .95rem; }
-.meal-picker-copy small { color: var(--muted); font-size: .76rem; }
-.meal-picker-add {
-  flex: 0 0 auto;
-  padding: 6px 12px;
-  border-radius: 99px;
-  color: var(--deep-sage);
-  background: #e7f0e1;
-  font-size: .74rem;
-  font-weight: 800;
-}
-.meal-picker-empty { padding: 34px 22px 30px; text-align: center; color: var(--muted); }
-.meal-picker-empty h3 { color: var(--ink); }
-.meal-picker-empty p { margin-bottom: 18px; }
-.meal-filter-bar { margin: -6px 0 18px; }
-.meal-filter-bar input { min-height: 40px; padding: 8px 12px; font-size: .9rem; }
-.meal-filter-bar-picker { margin: 14px 24px 4px; }
-.meal-filter-empty { padding: 28px 18px; text-align: center; color: var(--muted); }
-.meal-filter-empty p { margin: 0; }
-
 @media (max-width: 780px) {
   .site-header, .site-main, .site-footer { width: min(100% - 28px, 600px); }
-  .site-header { padding: 18px 0; }
+  .site-header { padding: 20px 0; }
   .site-main { margin-top: 20px; }
   .dashboard-grid, .list-layout { grid-template-columns: 1fr; }
   .side-column { grid-template-columns: repeat(2, minmax(0, 1fr)); }
@@ -411,114 +163,15 @@ textarea:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85,
 }
 
 @media (max-width: 500px) {
-  .site-header { flex-wrap: wrap; gap: 12px 16px; }
-  .site-nav { order: 3; width: 100%; justify-content: center; gap: 8px; }
-  .site-nav a { flex: 1; text-align: center; padding: 10px 8px; }
   .account-nav { gap: 9px; }
   .user-name { max-width: 90px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
   .panel { padding: 20px 16px; border-radius: 20px; }
   .page-heading { margin-bottom: 24px; }
   .list-topbar { margin-bottom: 20px; }
+  .list-topbar-actions .button { display: none; }
   .list-heading h1 { font-size: clamp(1.45rem, 7vw, 1.75rem); }
   .add-item-form { grid-template-columns: minmax(0, 1fr) 75px; }
   .add-button { grid-column: 1 / -1; }
   .side-column { grid-template-columns: 1fr; }
   .site-footer { margin-bottom: 20px; }
 }
-
-/* Rewards cards */
-.rewards-grid { display: grid; gap: 16px; }
-.rewards-card {
-  position: relative;
-  padding: 18px;
-  border: 1px solid var(--line);
-  border-radius: 18px;
-  background: #fff;
-  transition: border-color .16s ease, transform .16s ease;
-}
-.rewards-card:hover { border-color: var(--sage); transform: translateY(-1px); }
-/* Stretched link: makes the whole card clickable to open the scan view. */
-.rewards-card-link {
-  position: absolute;
-  inset: 0;
-  border-radius: inherit;
-  z-index: 1;
-}
-.rewards-card-heading {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  gap: 12px;
-  margin-bottom: 14px;
-}
-.rewards-card-heading strong { font-size: 1.05rem; }
-.rewards-barcode {
-  display: flex;
-  justify-content: center;
-  padding: 14px;
-  border-radius: 12px;
-  background: #fff;
-}
-.rewards-barcode svg { width: 100%; height: auto; max-width: 340px; }
-.rewards-number {
-  margin: 12px 0 0;
-  text-align: center;
-  color: var(--muted);
-  font-size: .85rem;
-  letter-spacing: .08em;
-}
-.rewards-unencodable {
-  display: block;
-  color: var(--coral);
-  font-weight: 700;
-}
-/* Keep the Remove button above the stretched link so it stays clickable. */
-.rewards-card-heading form { position: relative; z-index: 2; }
-
-/* Single-card scan view */
-.scan-page {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 22px;
-  padding: 12px 0 40px;
-}
-.scan-back { align-self: flex-start; }
-.scan-card {
-  width: min(100%, 460px);
-  padding: clamp(24px, 6vw, 42px);
-  border: 1px solid var(--line);
-  border-radius: 28px;
-  background: #fff;
-  box-shadow: var(--shadow);
-  text-align: center;
-}
-.scan-store { margin: 4px 0 26px; font-size: clamp(1.3rem, 4vw, 1.7rem); }
-.scan-barcode {
-  display: flex;
-  justify-content: center;
-  padding: 22px;
-  border-radius: 14px;
-  background: #fff;
-}
-.scan-barcode svg {
-  width: 100%;
-  height: auto;
-  max-width: 420px;
-}
-.scan-card .rewards-number {
-  margin-top: 18px;
-  font-size: 1rem;
-}
-select {
-  width: 100%;
-  min-height: 46px;
-  padding: 10px 13px;
-  border: 1px solid var(--line);
-  border-radius: 12px;
-  outline: none;
-  color: var(--ink);
-  background: #fff;
-  font: inherit;
-}
-select:focus { border-color: var(--deep-sage); box-shadow: 0 0 0 4px rgba(85, 113, 93, .12); }