diff --git a/Dockerfile b/Dockerfile
index cb3cf09..5d605e1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,15 +5,15 @@ RUN npm ci
 COPY . .
 RUN npm run build
 
-FROM caddy:2-alpine
+FROM node:22-alpine
 LABEL org.opencontainers.image.title="Atmosphere Office"
 LABEL org.opencontainers.image.description="Local-first office suite for the AT Protocol ecosystem"
 LABEL org.opencontainers.image.url="https://tangled.org/scottlanoue.com/atmosphere-office"
 LABEL org.opencontainers.image.source="https://tangled.org/scottlanoue.com/atmosphere-office"
 LABEL org.opencontainers.image.licenses="AGPL-3.0"
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY docker-entrypoint.sh /docker-entrypoint.sh
-COPY --from=builder /app/dist /srv
+WORKDIR /app
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/dist-server ./dist-server
+COPY --from=builder /app/package.json ./
 EXPOSE 8080
-ENTRYPOINT ["/docker-entrypoint.sh"]
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+CMD ["node", "dist-server/index.js"]
diff --git a/package-lock.json b/package-lock.json
index b05a48f..ab1c411 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,6 +10,7 @@
       "dependencies": {
         "@atproto/api": "^0.15.12",
         "@atproto/oauth-client-browser": "^0.3.41",
+        "@hono/node-server": "^2.0.0",
         "@tiptap/core": "^3.22.3",
         "@tiptap/extension-code-block-lowlight": "^3.22.3",
         "@tiptap/extension-collaboration": "^3.22.3",
@@ -35,6 +36,7 @@
         "chart.js": "^4.5.1",
         "dompurify": "^3.3.3",
         "exceljs": "^4.4.0",
+        "hono": "^4.12.14",
         "html2pdf.js": "^0.14.0",
         "katex": "^0.16.45",
         "lib0": "^0.2.99",
@@ -53,6 +55,7 @@
         "@playwright/test": "^1.58.2",
         "@types/dompurify": "^3.0.5",
         "@types/node": "^25.5.0",
+        "esbuild": "^0.28.0",
         "fake-indexeddb": "^6.2.5",
         "jsdom": "^29.0.0",
         "jszip": "^3.10.1",
@@ -598,9 +601,9 @@
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
-      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
+      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
       "cpu": [
         "ppc64"
       ],
@@ -615,9 +618,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
-      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
+      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
       "cpu": [
         "arm"
       ],
@@ -632,9 +635,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
-      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
+      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
       "cpu": [
         "arm64"
       ],
@@ -649,9 +652,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
-      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
+      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
       "cpu": [
         "x64"
       ],
@@ -666,9 +669,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
-      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
+      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
       "cpu": [
         "arm64"
       ],
@@ -683,9 +686,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
-      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
+      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
       "cpu": [
         "x64"
       ],
@@ -700,9 +703,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
       "cpu": [
         "arm64"
       ],
@@ -717,9 +720,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
-      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
+      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
       "cpu": [
         "x64"
       ],
@@ -734,9 +737,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
-      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
+      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
       "cpu": [
         "arm"
       ],
@@ -751,9 +754,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
-      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
+      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
       "cpu": [
         "arm64"
       ],
@@ -768,9 +771,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
-      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
+      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
       "cpu": [
         "ia32"
       ],
@@ -785,9 +788,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
-      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
+      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
       "cpu": [
         "loong64"
       ],
@@ -802,9 +805,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
-      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
+      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
       "cpu": [
         "mips64el"
       ],
@@ -819,9 +822,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
-      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
+      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
       "cpu": [
         "ppc64"
       ],
@@ -836,9 +839,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
-      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
+      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
       "cpu": [
         "riscv64"
       ],
@@ -853,9 +856,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
-      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
+      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
       "cpu": [
         "s390x"
       ],
@@ -870,9 +873,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
+      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
       "cpu": [
         "x64"
       ],
@@ -887,9 +890,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
       "cpu": [
         "arm64"
       ],
@@ -904,9 +907,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
       "cpu": [
         "x64"
       ],
@@ -921,9 +924,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
       "cpu": [
         "arm64"
       ],
@@ -938,9 +941,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
       "cpu": [
         "x64"
       ],
@@ -955,9 +958,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
-      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
+      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
       "cpu": [
         "arm64"
       ],
@@ -972,9 +975,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
-      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
+      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
       "cpu": [
         "x64"
       ],
@@ -989,9 +992,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
-      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
+      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
       "cpu": [
         "arm64"
       ],
@@ -1006,9 +1009,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
-      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
+      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
       "cpu": [
         "ia32"
       ],
@@ -1023,9 +1026,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
-      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
+      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
       "cpu": [
         "x64"
       ],
@@ -1098,6 +1101,18 @@
       "integrity": "sha512-fAtCfv4jJg+ExtXhvCkCqUKZ+4ok/JQk01qDKhL5BDDoS3AxKXhV5/MAVUZyQnSEd2GT92fkgZl0pz0Q0AzcIQ==",
       "license": "MIT"
     },
+    "node_modules/@hono/node-server": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.0.tgz",
+      "integrity": "sha512-n3GfHwwCvHCkGmOwKfxUPOlbfzuO64Sbc5XC4NGPIXxkuOnJrdgExdRKmHfF924r914WRJPT397GdqLvdYTeyQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "peerDependencies": {
+        "hono": "^4"
+      }
+    },
     "node_modules/@iconify/types": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
@@ -4049,9 +4064,9 @@
       "license": "MIT"
     },
     "node_modules/esbuild": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
+      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -4062,32 +4077,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.25.12",
-        "@esbuild/android-arm": "0.25.12",
-        "@esbuild/android-arm64": "0.25.12",
-        "@esbuild/android-x64": "0.25.12",
-        "@esbuild/darwin-arm64": "0.25.12",
-        "@esbuild/darwin-x64": "0.25.12",
-        "@esbuild/freebsd-arm64": "0.25.12",
-        "@esbuild/freebsd-x64": "0.25.12",
-        "@esbuild/linux-arm": "0.25.12",
-        "@esbuild/linux-arm64": "0.25.12",
-        "@esbuild/linux-ia32": "0.25.12",
-        "@esbuild/linux-loong64": "0.25.12",
-        "@esbuild/linux-mips64el": "0.25.12",
-        "@esbuild/linux-ppc64": "0.25.12",
-        "@esbuild/linux-riscv64": "0.25.12",
-        "@esbuild/linux-s390x": "0.25.12",
-        "@esbuild/linux-x64": "0.25.12",
-        "@esbuild/netbsd-arm64": "0.25.12",
-        "@esbuild/netbsd-x64": "0.25.12",
-        "@esbuild/openbsd-arm64": "0.25.12",
-        "@esbuild/openbsd-x64": "0.25.12",
-        "@esbuild/openharmony-arm64": "0.25.12",
-        "@esbuild/sunos-x64": "0.25.12",
-        "@esbuild/win32-arm64": "0.25.12",
-        "@esbuild/win32-ia32": "0.25.12",
-        "@esbuild/win32-x64": "0.25.12"
+        "@esbuild/aix-ppc64": "0.28.0",
+        "@esbuild/android-arm": "0.28.0",
+        "@esbuild/android-arm64": "0.28.0",
+        "@esbuild/android-x64": "0.28.0",
+        "@esbuild/darwin-arm64": "0.28.0",
+        "@esbuild/darwin-x64": "0.28.0",
+        "@esbuild/freebsd-arm64": "0.28.0",
+        "@esbuild/freebsd-x64": "0.28.0",
+        "@esbuild/linux-arm": "0.28.0",
+        "@esbuild/linux-arm64": "0.28.0",
+        "@esbuild/linux-ia32": "0.28.0",
+        "@esbuild/linux-loong64": "0.28.0",
+        "@esbuild/linux-mips64el": "0.28.0",
+        "@esbuild/linux-ppc64": "0.28.0",
+        "@esbuild/linux-riscv64": "0.28.0",
+        "@esbuild/linux-s390x": "0.28.0",
+        "@esbuild/linux-x64": "0.28.0",
+        "@esbuild/netbsd-arm64": "0.28.0",
+        "@esbuild/netbsd-x64": "0.28.0",
+        "@esbuild/openbsd-arm64": "0.28.0",
+        "@esbuild/openbsd-x64": "0.28.0",
+        "@esbuild/openharmony-arm64": "0.28.0",
+        "@esbuild/sunos-x64": "0.28.0",
+        "@esbuild/win32-arm64": "0.28.0",
+        "@esbuild/win32-ia32": "0.28.0",
+        "@esbuild/win32-x64": "0.28.0"
       }
     },
     "node_modules/escape-string-regexp": {
@@ -4312,6 +4327,16 @@
         "node": ">=12.0.0"
       }
     },
+    "node_modules/hono": {
+      "version": "4.12.14",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.14.tgz",
+      "integrity": "sha512-am5zfg3yu6sqn5yjKBNqhnTX7Cv+m00ox+7jbaKkrLMRJ4rAdldd1xPd/JzbBWspqaQv6RSTrgFN95EsfhC+7w==",
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=16.9.0"
+      }
+    },
     "node_modules/html-encoding-sniffer": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-6.0.0.tgz",
@@ -6703,6 +6728,490 @@
         }
       }
     },
+    "node_modules/vite/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/android-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/linux-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/@esbuild/win32-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/vite/node_modules/esbuild": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
+      }
+    },
     "node_modules/vitest": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.0.tgz",
diff --git a/package.json b/package.json
index 12ca5b7..cb59e96 100644
--- a/package.json
+++ b/package.json
@@ -5,15 +5,19 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
-    "build": "vite build",
+    "build": "vite build && npm run build:server",
+    "build:client": "vite build",
+    "build:server": "npx esbuild server/index.ts --bundle --platform=node --format=esm --outdir=dist-server",
     "preview": "vite preview",
+    "start": "node dist-server/index.js",
     "test": "vitest run",
     "e2e": "playwright test",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
   },
   "dependencies": {
     "@atproto/api": "^0.15.12",
     "@atproto/oauth-client-browser": "^0.3.41",
+    "@hono/node-server": "^2.0.0",
     "@tiptap/core": "^3.22.3",
     "@tiptap/extension-code-block-lowlight": "^3.22.3",
     "@tiptap/extension-collaboration": "^3.22.3",
@@ -39,6 +43,7 @@
     "chart.js": "^4.5.1",
     "dompurify": "^3.3.3",
     "exceljs": "^4.4.0",
+    "hono": "^4.12.14",
     "html2pdf.js": "^0.14.0",
     "katex": "^0.16.45",
     "lib0": "^0.2.99",
@@ -57,6 +62,7 @@
     "@playwright/test": "^1.58.2",
     "@types/dompurify": "^3.0.5",
     "@types/node": "^25.5.0",
+    "esbuild": "^0.28.0",
     "fake-indexeddb": "^6.2.5",
     "jsdom": "^29.0.0",
     "jszip": "^3.10.1",
diff --git a/server/app.ts b/server/app.ts
new file mode 100644
index 0000000..4ccc056
--- /dev/null
+++ b/server/app.ts
@@ -0,0 +1,119 @@
+import { Hono } from 'hono';
+import { logger } from 'hono/logger';
+import { serveStatic } from '@hono/node-server/serve-static';
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import type { InstanceInfo } from './config.js';
+import {
+  generateSecret,
+  authMiddleware,
+  handleVerify,
+  handleLogout,
+} from './auth.js';
+
+const APP_NAMES = ['docs', 'sheets', 'forms', 'slides', 'diagrams', 'calendar'];
+
+export interface ServerConfig {
+  instanceInfo: InstanceInfo;
+  distPath: string;
+  cookieSecret?: Buffer;
+  version?: string;
+}
+
+export function createApp(config: ServerConfig): Hono {
+  const { instanceInfo, distPath, version = 'dev' } = config;
+  const secret = config.cookieSecret ?? generateSecret();
+  const startTime = Date.now();
+
+  const appHtml: Record<string, string> = {};
+  for (const name of APP_NAMES) {
+    const htmlPath = join(distPath, name, 'index.html');
+    if (existsSync(htmlPath)) {
+      appHtml[name] = readFileSync(htmlPath, 'utf-8');
+    }
+  }
+
+  const landingPath = join(distPath, 'index.html');
+  const landingHtml = existsSync(landingPath)
+    ? readFileSync(landingPath, 'utf-8')
+    : '<html><body>Atmosphere Office</body></html>';
+
+  const app = new Hono();
+
+  app.use('*', logger());
+
+  app.use('*', async (c, next) => {
+    const start = performance.now();
+    await next();
+    const ms = (performance.now() - start).toFixed(1);
+    c.res.headers.set('X-Response-Time', `${ms}ms`);
+    c.res.headers.set('X-Version', version);
+  });
+
+  app.get('/health', (c) =>
+    c.json({
+      status: 'ok',
+      version,
+      uptime: Math.floor((Date.now() - startTime) / 1000),
+      flavor: instanceInfo.flavor,
+      accessMode: instanceInfo.accessControl?.mode ?? 'open',
+    }),
+  );
+
+  app.get('/instance-info.json', (c) => {
+    c.header('Cache-Control', 'no-cache');
+    return c.json(instanceInfo);
+  });
+
+  app.post('/api/auth/verify', async (c) => {
+    try {
+      const body = await c.req.json();
+      return handleVerify(c, body.did, secret, instanceInfo);
+    } catch {
+      return c.json({ error: 'Invalid request body' }, 400);
+    }
+  });
+
+  app.post('/api/auth/logout', (c) => handleLogout(c));
+
+  const needsAuth =
+    instanceInfo.accessControl?.mode === 'allowlist' &&
+    instanceInfo.flavor !== 'self-hosted';
+
+  for (const name of APP_NAMES) {
+    const html = appHtml[name];
+    if (!html) continue;
+
+    const serve = (c: import('hono').Context) => c.html(html);
+
+    if (needsAuth) {
+      const mw = authMiddleware(secret, instanceInfo);
+      app.get(`/${name}`, mw, serve);
+      app.get(`/${name}/*`, mw, serve);
+    } else {
+      app.get(`/${name}`, serve);
+      app.get(`/${name}/*`, serve);
+    }
+  }
+
+  app.use(
+    '/assets/*',
+    async (c, next) => {
+      c.header('Cache-Control', 'public, max-age=31536000, immutable');
+      await next();
+    },
+    serveStatic({ root: distPath }),
+  );
+
+  app.use(
+    '/*',
+    serveStatic({
+      root: distPath,
+      onNotFound: () => {},
+    }),
+  );
+
+  app.get('*', (c) => c.html(landingHtml));
+
+  return app;
+}
diff --git a/server/auth.ts b/server/auth.ts
new file mode 100644
index 0000000..b27d20a
--- /dev/null
+++ b/server/auth.ts
@@ -0,0 +1,97 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import type { Context, Next } from 'hono';
+import { getCookie, setCookie, deleteCookie } from 'hono/cookie';
+import type { InstanceInfo } from './config.js';
+
+const COOKIE_NAME = 'atmos-session';
+const COOKIE_MAX_AGE = 7 * 24 * 60 * 60; // 7 days in seconds
+
+export function generateSecret(): Buffer {
+  return randomBytes(32);
+}
+
+export function signCookie(did: string, secret: Buffer): string {
+  const ts = Date.now().toString();
+  const payload = `${did}:${ts}`;
+  const sig = createHmac('sha256', secret).update(payload).digest('hex');
+  return `${payload}:${sig}`;
+}
+
+export function verifyCookie(value: string, secret: Buffer): string | null {
+  const lastColon = value.lastIndexOf(':');
+  if (lastColon === -1) return null;
+
+  const sig = value.slice(lastColon + 1);
+  const payload = value.slice(0, lastColon);
+
+  const secondLastColon = payload.lastIndexOf(':');
+  if (secondLastColon === -1) return null;
+
+  const did = payload.slice(0, secondLastColon);
+  const ts = payload.slice(secondLastColon + 1);
+
+  if (!did.startsWith('did:')) return null;
+
+  const expected = createHmac('sha256', secret).update(payload).digest();
+  const actual = Buffer.from(sig, 'hex');
+  if (actual.length !== expected.length) return null;
+  if (!timingSafeEqual(expected, actual)) return null;
+
+  const age = Date.now() - parseInt(ts, 10);
+  if (isNaN(age) || age < 0 || age > COOKIE_MAX_AGE * 1000) return null;
+
+  return did;
+}
+
+export function authMiddleware(secret: Buffer, config: InstanceInfo) {
+  return async (c: Context, next: Next) => {
+    if (config.flavor === 'self-hosted') return next();
+    if (!config.accessControl || config.accessControl.mode === 'open') return next();
+
+    const cookie = getCookie(c, COOKIE_NAME);
+    if (!cookie) return c.redirect('/');
+
+    const did = verifyCookie(cookie, secret);
+    if (!did) {
+      deleteCookie(c, COOKIE_NAME);
+      return c.redirect('/');
+    }
+
+    const allowed = config.accessControl.allowlist ?? [];
+    if (!allowed.includes(did)) {
+      deleteCookie(c, COOKIE_NAME);
+      return c.redirect('/');
+    }
+
+    return next();
+  };
+}
+
+export function handleVerify(c: Context, did: string, secret: Buffer, config: InstanceInfo) {
+  if (!did || typeof did !== 'string' || !did.startsWith('did:')) {
+    return c.json({ error: 'Invalid DID' }, 400);
+  }
+
+  const ac = config.accessControl;
+  if (ac && ac.mode === 'allowlist') {
+    const allowed = ac.allowlist ?? [];
+    if (!allowed.includes(did)) {
+      return c.json({ error: 'Not on allowlist' }, 403);
+    }
+  }
+
+  const signed = signCookie(did, secret);
+  setCookie(c, COOKIE_NAME, signed, {
+    httpOnly: true,
+    sameSite: 'Strict',
+    maxAge: COOKIE_MAX_AGE,
+    path: '/',
+  });
+
+  return c.json({ ok: true });
+}
+
+export function handleLogout(c: Context) {
+  deleteCookie(c, COOKIE_NAME, { path: '/' });
+  return c.json({ ok: true });
+}
diff --git a/server/config.ts b/server/config.ts
new file mode 100644
index 0000000..58598dc
--- /dev/null
+++ b/server/config.ts
@@ -0,0 +1,67 @@
+export type InstanceFlavor = 'public' | 'pds-operator' | 'self-hosted';
+
+export interface InstanceFeatures {
+  sync: boolean;
+  sharing: boolean;
+  ai: boolean;
+}
+
+export interface AccessControl {
+  mode: 'open' | 'allowlist';
+  allowlist?: string[];
+}
+
+export interface InstanceInfo {
+  flavor: InstanceFlavor;
+  operator: string | null;
+  pds: string | null;
+  features: InstanceFeatures;
+  notice: string | null;
+  accessControl: AccessControl | null;
+}
+
+export function buildInstanceInfo(): InstanceInfo {
+  const flavor = validateFlavor(process.env.INSTANCE_FLAVOR);
+  const features = parseFeatures(process.env.INSTANCE_FEATURES);
+  const accessControl = parseAccessControl(
+    process.env.INSTANCE_ACCESS_MODE,
+    process.env.INSTANCE_ALLOWLIST,
+  );
+
+  return {
+    flavor,
+    operator: process.env.INSTANCE_OPERATOR || null,
+    pds: process.env.INSTANCE_PDS || null,
+    features,
+    notice: process.env.INSTANCE_NOTICE || null,
+    accessControl,
+  };
+}
+
+function validateFlavor(v: string | undefined): InstanceFlavor {
+  if (v === 'pds-operator' || v === 'self-hosted') return v;
+  return 'public';
+}
+
+function parseFeatures(v: string | undefined): InstanceFeatures {
+  const parts = (v || '').split(',').map((s) => s.trim());
+  return {
+    sync: parts.includes('sync'),
+    sharing: parts.includes('sharing'),
+    ai: parts.includes('ai'),
+  };
+}
+
+function parseAccessControl(
+  mode: string | undefined,
+  allowlist: string | undefined,
+): AccessControl | null {
+  if (mode === 'allowlist' && allowlist) {
+    const dids = allowlist.split(',').map((s) => s.trim()).filter(Boolean);
+    return { mode: 'allowlist', allowlist: dids };
+  }
+  if (mode === 'open') {
+    return { mode: 'open' };
+  }
+  return null;
+}
diff --git a/server/index.ts b/server/index.ts
new file mode 100644
index 0000000..052af6d
--- /dev/null
+++ b/server/index.ts
@@ -0,0 +1,26 @@
+import { serve } from '@hono/node-server';
+import { createApp } from './app.js';
+import { buildInstanceInfo } from './config.js';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const PORT = parseInt(process.env.PORT || '8080', 10);
+const DIST_PATH = resolve(process.env.DIST_PATH || './dist');
+
+let version = 'dev';
+try {
+  const pkg = JSON.parse(readFileSync(resolve('./package.json'), 'utf-8'));
+  version = pkg.version || 'dev';
+} catch {}
+
+const instanceInfo = buildInstanceInfo();
+const app = createApp({ instanceInfo, distPath: DIST_PATH, version });
+
+console.log(`Atmosphere Office v${version}`);
+console.log(`  flavor: ${instanceInfo.flavor}`);
+console.log(`  access: ${instanceInfo.accessControl?.mode ?? 'open'}`);
+console.log(`  port:   ${PORT}`);
+
+serve({ fetch: app.fetch, port: PORT }, (info) => {
+  console.log(`Listening on http://localhost:${info.port}`);
+});
diff --git a/src/css/app.css b/src/css/app.css
index 9e6e541..620a2a0 100644
--- a/src/css/app.css
+++ b/src/css/app.css
@@ -728,10 +728,26 @@ code, pre {
   cursor: pointer;
   transition: background var(--transition-fast);
 }
-.new-menu-item:hover {
+.new-menu-item:hover:not(:disabled) {
   background: var(--color-hover);
 }
 
+.new-menu-item-disabled {
+  opacity: 0.45;
+  cursor: default;
+  pointer-events: auto;
+}
+.new-menu-item-disabled .new-menu-badge {
+  margin-left: auto;
+  font-size: 0.7rem;
+  padding: 1px 6px;
+  border-radius: var(--radius-sm);
+  background: var(--color-border);
+  color: var(--color-text-muted);
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
 .new-menu-icon {
   font-size: 1rem;
   width: 1.25rem;
diff --git a/src/index.html b/src/index.html
index f431e58..8dcded0 100644
--- a/src/index.html
+++ b/src/index.html
@@ -39,9 +39,10 @@
               <span class="new-menu-icon">&#9998;</span>
               <span class="new-menu-label">Document</span>
             </button>
-            <button class="new-menu-item" data-new="sheet" role="menuitem">
+            <button class="new-menu-item new-menu-item-disabled" data-new="sheet" role="menuitem" disabled title="Coming soon">
               <span class="new-menu-icon">&#9638;</span>
               <span class="new-menu-label">Spreadsheet</span>
+              <span class="new-menu-badge">Soon</span>
             </button>
             <button class="new-menu-item" data-new="form" role="menuitem">
               <span class="new-menu-icon">&#9783;</span>
diff --git a/src/landing-events-identity.ts b/src/landing-events-identity.ts
index d9e6c13..d4ad8b7 100644
--- a/src/landing-events-identity.ts
+++ b/src/landing-events-identity.ts
@@ -135,6 +135,18 @@ function attachTypeahead(input: HTMLInputElement, confirmBtn: HTMLButtonElement)
   });
 }
 
+async function notifyServerAuth(did: string): Promise<void> {
+  try {
+    await fetch('/api/auth/verify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ did }),
+    });
+  } catch {
+    // Server auth unavailable (dev mode) — client gate is sufficient
+  }
+}
+
 export async function initUsername(deps: EventDeps): Promise<void> {
   await applyAccessGate();
 
@@ -145,6 +157,7 @@ export async function initUsername(deps: EventDeps): Promise<void> {
       showWaitlistModal(session.handle);
       return;
     }
+    await notifyServerAuth(session.did);
     showUserBadge(deps, session.displayName, session.avatar);
     deps.usernameModal.style.display = 'none';
     return;
@@ -157,6 +170,7 @@ export async function initUsername(deps: EventDeps): Promise<void> {
       showWaitlistModal(restored.handle);
       return;
     }
+    await notifyServerAuth(restored.did);
     showUserBadge(deps, restored.displayName, restored.avatar);
     deps.usernameModal.style.display = 'none';
     return;
@@ -215,6 +229,7 @@ export function attachUsernameListeners(deps: EventDeps): void {
       cancelLabel: 'Close',
     });
     if (confirmed) {
+      try { await fetch('/api/auth/logout', { method: 'POST' }); } catch {}
       await session.signOut();
       window.location.reload();
     }
@@ -227,6 +242,7 @@ export function attachUsernameListeners(deps: EventDeps): void {
         showWaitlistModal(session.handle);
         return;
       }
+      await notifyServerAuth(session.did);
       showUserBadge(deps, session.displayName, session.avatar);
       deps.usernameModal.style.display = 'none';
     } else {
diff --git a/src/landing.ts b/src/landing.ts
index 0aa3052..6fb857c 100644
--- a/src/landing.ts
+++ b/src/landing.ts
@@ -196,6 +196,7 @@ newBtn.addEventListener('click', (e) => {
 newMenu.addEventListener('click', (e) => {
   const target = (e.target as HTMLElement).closest('.new-menu-item') as HTMLElement | null;
   if (!target) return;
+  if ((target as HTMLButtonElement).disabled) return;
   const kind = target.dataset.new;
   if (!kind) return;
   closeNewMenu();
diff --git a/tests/server.test.ts b/tests/server.test.ts
new file mode 100644
index 0000000..b25ef53
--- /dev/null
+++ b/tests/server.test.ts
@@ -0,0 +1,492 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+import { createApp, type ServerConfig } from '../server/app.js';
+import { signCookie, verifyCookie, generateSecret } from '../server/auth.js';
+import { buildInstanceInfo, type InstanceInfo } from '../server/config.js';
+
+function makeDist(): string {
+  const dir = mkdtempSync(join(tmpdir(), 'atmos-test-'));
+  writeFileSync(join(dir, 'index.html'), '<html><body>Landing</body></html>');
+  for (const app of ['docs', 'sheets', 'forms', 'slides', 'diagrams', 'calendar']) {
+    mkdirSync(join(dir, app));
+    writeFileSync(join(dir, app, 'index.html'), `<html><body>${app}</body></html>`);
+  }
+  mkdirSync(join(dir, 'assets'));
+  writeFileSync(join(dir, 'assets', 'main.js'), 'console.log("ok")');
+  writeFileSync(join(dir, 'favicon.svg'), '<svg/>');
+  return dir;
+}
+
+function makeConfig(overrides?: Partial<InstanceInfo>): InstanceInfo {
+  return {
+    flavor: 'public',
+    operator: null,
+    pds: null,
+    features: { sync: false, sharing: false, ai: false },
+    notice: null,
+    accessControl: null,
+    ...overrides,
+  };
+}
+
+function makeServerConfig(
+  instanceInfo: InstanceInfo,
+  distPath: string,
+  cookieSecret?: Buffer,
+): ServerConfig {
+  return {
+    instanceInfo,
+    distPath,
+    cookieSecret: cookieSecret ?? generateSecret(),
+    version: '0.1.0-test',
+  };
+}
+
+// ── Cookie signing ──────────────────────────────────────────
+
+describe('cookie signing', () => {
+  const secret = generateSecret();
+
+  it('signs and verifies a DID cookie', () => {
+    const signed = signCookie('did:plc:abc123', secret);
+    const result = verifyCookie(signed, secret);
+    expect(result).toBe('did:plc:abc123');
+  });
+
+  it('handles DIDs with multiple colons', () => {
+    const signed = signCookie('did:web:example.com', secret);
+    const result = verifyCookie(signed, secret);
+    expect(result).toBe('did:web:example.com');
+  });
+
+  it('rejects tampered signature', () => {
+    const signed = signCookie('did:plc:abc123', secret);
+    const tampered = signed.slice(0, -4) + 'dead';
+    expect(verifyCookie(tampered, secret)).toBeNull();
+  });
+
+  it('rejects tampered DID', () => {
+    const signed = signCookie('did:plc:abc123', secret);
+    const tampered = signed.replace('abc123', 'xyz789');
+    expect(verifyCookie(tampered, secret)).toBeNull();
+  });
+
+  it('rejects wrong secret', () => {
+    const signed = signCookie('did:plc:abc123', secret);
+    const wrongSecret = generateSecret();
+    expect(verifyCookie(signed, wrongSecret)).toBeNull();
+  });
+
+  it('rejects empty string', () => {
+    expect(verifyCookie('', secret)).toBeNull();
+  });
+
+  it('rejects garbage input', () => {
+    expect(verifyCookie('not-a-cookie', secret)).toBeNull();
+  });
+
+  it('rejects non-DID payload', () => {
+    const fake = `notadid:${Date.now()}:${'a'.repeat(64)}`;
+    expect(verifyCookie(fake, secret)).toBeNull();
+  });
+
+  it('rejects expired cookies (> 7 days)', () => {
+    const ts = (Date.now() - 8 * 24 * 60 * 60 * 1000).toString();
+    const payload = `did:plc:abc:${ts}`;
+    const sig = require('node:crypto')
+      .createHmac('sha256', secret)
+      .update(payload)
+      .digest('hex');
+    expect(verifyCookie(`${payload}:${sig}`, secret)).toBeNull();
+  });
+});
+
+// ── Config builder ──────────────────────────────────────────
+
+describe('buildInstanceInfo', () => {
+  const originalEnv = { ...process.env };
+
+  afterEach(() => {
+    for (const key of Object.keys(process.env)) {
+      if (key.startsWith('INSTANCE_')) delete process.env[key];
+    }
+    Object.assign(process.env, originalEnv);
+  });
+
+  it('returns defaults when no env vars set', () => {
+    delete process.env.INSTANCE_FLAVOR;
+    const info = buildInstanceInfo();
+    expect(info.flavor).toBe('public');
+    expect(info.features).toEqual({ sync: false, sharing: false, ai: false });
+    expect(info.accessControl).toBeNull();
+  });
+
+  it('parses pds-operator flavor', () => {
+    process.env.INSTANCE_FLAVOR = 'pds-operator';
+    process.env.INSTANCE_OPERATOR = 'Test Op';
+    process.env.INSTANCE_PDS = 'https://pds.example.com';
+    const info = buildInstanceInfo();
+    expect(info.flavor).toBe('pds-operator');
+    expect(info.operator).toBe('Test Op');
+    expect(info.pds).toBe('https://pds.example.com');
+  });
+
+  it('parses features', () => {
+    process.env.INSTANCE_FEATURES = 'sync,ai';
+    const info = buildInstanceInfo();
+    expect(info.features).toEqual({ sync: true, sharing: false, ai: true });
+  });
+
+  it('parses allowlist', () => {
+    process.env.INSTANCE_ACCESS_MODE = 'allowlist';
+    process.env.INSTANCE_ALLOWLIST = 'did:plc:aaa,did:plc:bbb';
+    const info = buildInstanceInfo();
+    expect(info.accessControl).toEqual({
+      mode: 'allowlist',
+      allowlist: ['did:plc:aaa', 'did:plc:bbb'],
+    });
+  });
+
+  it('parses open mode', () => {
+    process.env.INSTANCE_ACCESS_MODE = 'open';
+    const info = buildInstanceInfo();
+    expect(info.accessControl).toEqual({ mode: 'open' });
+  });
+});
+
+// ── Health endpoint ─────────────────────────────────────────
+
+describe('GET /health', () => {
+  let distPath: string;
+  beforeEach(() => { distPath = makeDist(); });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('returns status, version, uptime, and config info', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath));
+    const res = await app.request('/health');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.status).toBe('ok');
+    expect(body.version).toBe('0.1.0-test');
+    expect(typeof body.uptime).toBe('number');
+    expect(body.flavor).toBe('public');
+    expect(body.accessMode).toBe('open');
+  });
+
+  it('reflects allowlist access mode', async () => {
+    const info = makeConfig({
+      accessControl: { mode: 'allowlist', allowlist: ['did:plc:x'] },
+    });
+    const app = createApp(makeServerConfig(info, distPath));
+    const res = await app.request('/health');
+    const body = await res.json();
+    expect(body.accessMode).toBe('allowlist');
+  });
+});
+
+// ── Instance info endpoint ──────────────────────────────────
+
+describe('GET /instance-info.json', () => {
+  let distPath: string;
+  beforeEach(() => { distPath = makeDist(); });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('returns the instance config', async () => {
+    const info = makeConfig({ flavor: 'pds-operator', operator: 'Test' });
+    const app = createApp(makeServerConfig(info, distPath));
+    const res = await app.request('/instance-info.json');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.flavor).toBe('pds-operator');
+    expect(body.operator).toBe('Test');
+  });
+
+  it('sets no-cache header', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath));
+    const res = await app.request('/instance-info.json');
+    expect(res.headers.get('cache-control')).toBe('no-cache');
+  });
+});
+
+// ── Auth verify endpoint ────────────────────────────────────
+
+describe('POST /api/auth/verify', () => {
+  let distPath: string;
+  let secret: Buffer;
+  beforeEach(() => {
+    distPath = makeDist();
+    secret = generateSecret();
+  });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('sets cookie for allowed DID', async () => {
+    const info = makeConfig({
+      accessControl: { mode: 'allowlist', allowlist: ['did:plc:ok'] },
+    });
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/api/auth/verify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ did: 'did:plc:ok' }),
+    });
+    expect(res.status).toBe(200);
+    const cookie = res.headers.get('set-cookie');
+    expect(cookie).toContain('atmos-session=');
+    expect(cookie).toContain('HttpOnly');
+    expect(cookie).toContain('SameSite=Strict');
+  });
+
+  it('returns 403 for DID not on allowlist', async () => {
+    const info = makeConfig({
+      accessControl: { mode: 'allowlist', allowlist: ['did:plc:ok'] },
+    });
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/api/auth/verify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ did: 'did:plc:nope' }),
+    });
+    expect(res.status).toBe(403);
+  });
+
+  it('returns 400 for missing DID', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath, secret));
+    const res = await app.request('/api/auth/verify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({}),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 for non-DID string', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath, secret));
+    const res = await app.request('/api/auth/verify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ did: 'not-a-did' }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it('returns 400 for invalid JSON', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath, secret));
+    const res = await app.request('/api/auth/verify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: 'not json',
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it('sets cookie in open mode (any DID accepted)', async () => {
+    const info = makeConfig({ accessControl: { mode: 'open' } });
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/api/auth/verify', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ did: 'did:plc:anyone' }),
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get('set-cookie')).toContain('atmos-session=');
+  });
+});
+
+// ── Auth logout endpoint ────────────────────────────────────
+
+describe('POST /api/auth/logout', () => {
+  let distPath: string;
+  beforeEach(() => { distPath = makeDist(); });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('clears the session cookie', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath));
+    const res = await app.request('/api/auth/logout', { method: 'POST' });
+    expect(res.status).toBe(200);
+    const cookie = res.headers.get('set-cookie');
+    expect(cookie).toContain('atmos-session=');
+    expect(cookie).toContain('Max-Age=0');
+  });
+});
+
+// ── Route protection: allowlist mode ────────────────────────
+
+describe('route protection (allowlist mode)', () => {
+  let distPath: string;
+  let secret: Buffer;
+  let info: InstanceInfo;
+
+  beforeEach(() => {
+    distPath = makeDist();
+    secret = generateSecret();
+    info = makeConfig({
+      accessControl: { mode: 'allowlist', allowlist: ['did:plc:allowed'] },
+    });
+  });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('serves landing page without auth', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/');
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('Landing');
+  });
+
+  it('redirects /docs to / without cookie', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/docs/abc123', { redirect: 'manual' });
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toBe('/');
+  });
+
+  it('redirects /sheets to / without cookie', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/sheets/abc123', { redirect: 'manual' });
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toBe('/');
+  });
+
+  it('redirects /forms to / without cookie', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/forms/abc123', { redirect: 'manual' });
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toBe('/');
+  });
+
+  it('serves app HTML with valid cookie', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const cookie = signCookie('did:plc:allowed', secret);
+    const res = await app.request('/docs/abc123', {
+      headers: { Cookie: `atmos-session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('docs');
+  });
+
+  it('serves sheets with valid cookie', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const cookie = signCookie('did:plc:allowed', secret);
+    const res = await app.request('/sheets/abc123', {
+      headers: { Cookie: `atmos-session=${cookie}` },
+    });
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('sheets');
+  });
+
+  it('redirects with cookie for non-allowed DID', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const cookie = signCookie('did:plc:intruder', secret);
+    const res = await app.request('/docs/abc123', {
+      headers: { Cookie: `atmos-session=${cookie}` },
+      redirect: 'manual',
+    });
+    expect(res.status).toBe(302);
+  });
+
+  it('redirects with tampered cookie', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const res = await app.request('/docs/abc123', {
+      headers: { Cookie: 'atmos-session=garbage' },
+      redirect: 'manual',
+    });
+    expect(res.status).toBe(302);
+  });
+
+  it('redirects with expired cookie', async () => {
+    const app = createApp(makeServerConfig(info, distPath, secret));
+    const ts = (Date.now() - 8 * 24 * 60 * 60 * 1000).toString();
+    const payload = `did:plc:allowed:${ts}`;
+    const { createHmac } = require('node:crypto');
+    const sig = createHmac('sha256', secret).update(payload).digest('hex');
+    const cookie = `${payload}:${sig}`;
+    const res = await app.request('/docs/abc123', {
+      headers: { Cookie: `atmos-session=${cookie}` },
+      redirect: 'manual',
+    });
+    expect(res.status).toBe(302);
+  });
+});
+
+// ── Route protection: open mode ─────────────────────────────
+
+describe('route protection (open mode)', () => {
+  let distPath: string;
+
+  beforeEach(() => { distPath = makeDist(); });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('serves app routes without auth', async () => {
+    const info = makeConfig({ accessControl: { mode: 'open' } });
+    const app = createApp(makeServerConfig(info, distPath));
+    const res = await app.request('/docs/abc123');
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('docs');
+  });
+
+  it('serves all app types without auth', async () => {
+    const info = makeConfig({ accessControl: { mode: 'open' } });
+    const app = createApp(makeServerConfig(info, distPath));
+    for (const name of ['docs', 'sheets', 'forms', 'diagrams', 'calendar']) {
+      const res = await app.request(`/${name}/test`);
+      expect(res.status).toBe(200);
+    }
+  });
+});
+
+// ── Route protection: self-hosted ───────────────────────────
+
+describe('route protection (self-hosted)', () => {
+  let distPath: string;
+
+  beforeEach(() => { distPath = makeDist(); });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('serves app routes without auth even with allowlist configured', async () => {
+    const info = makeConfig({
+      flavor: 'self-hosted',
+      accessControl: { mode: 'allowlist', allowlist: ['did:plc:only'] },
+    });
+    const app = createApp(makeServerConfig(info, distPath));
+    const res = await app.request('/docs/abc123');
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('docs');
+  });
+});
+
+// ── Response headers ────────────────────────────────────────
+
+describe('response headers', () => {
+  let distPath: string;
+  beforeEach(() => { distPath = makeDist(); });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('includes X-Response-Time on all responses', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath));
+    const res = await app.request('/health');
+    expect(res.headers.get('x-response-time')).toMatch(/^\d+\.\d+ms$/);
+  });
+
+  it('includes X-Version on all responses', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath));
+    const res = await app.request('/health');
+    expect(res.headers.get('x-version')).toBe('0.1.0-test');
+  });
+});
+
+// ── Landing page fallback ───────────────────────────────────
+
+describe('landing page fallback', () => {
+  let distPath: string;
+  beforeEach(() => { distPath = makeDist(); });
+  afterEach(() => { rmSync(distPath, { recursive: true, force: true }); });
+
+  it('serves landing page for unknown routes', async () => {
+    const app = createApp(makeServerConfig(makeConfig(), distPath));
+    const res = await app.request('/unknown-path');
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('Landing');
+  });
+});
diff --git a/tsconfig.server.json b/tsconfig.server.json
index 34d4a18..451b8d5 100644
--- a/tsconfig.server.json
+++ b/tsconfig.server.json
@@ -4,7 +4,9 @@
     "module": "ES2022",
     "moduleResolution": "bundler",
     "lib": ["ES2022"],
-    "outDir": "./dist-server"
+    "types": ["node"],
+    "outDir": "./dist-server",
+    "noEmit": true
   },
   "include": ["server/**/*.ts"]
 }