diff --git a/.cursor/rules/ultracite.mdc b/.cursor/rules/ultracite.mdc
deleted file mode 100644
index 984955355..000000000
--- a/.cursor/rules/ultracite.mdc
+++ /dev/null
@@ -1,333 +0,0 @@
----
-description: Ultracite Rules - AI-Ready Formatter and Linter
-globs: "**/*.{ts,tsx,js,jsx}"
-alwaysApply: true
----
-
-# Project Context
-Ultracite enforces strict type safety, accessibility standards, and consistent code quality for JavaScript/TypeScript projects using Biome's lightning-fast formatter and linter.
-
-## Key Principles
-- Zero configuration required
-- Subsecond performance
-- Maximum type safety
-- AI-friendly code generation
-
-## Before Writing Code
-1. Analyze existing patterns in the codebase
-2. Consider edge cases and error scenarios
-3. Follow the rules below strictly
-4. Validate accessibility requirements
-
-## Rules
-
-### Accessibility (a11y)
-- Don't use `accessKey` attribute on any HTML element.
-- Don't set `aria-hidden="true"` on focusable elements.
-- Don't add ARIA roles, states, and properties to elements that don't support them.
-- Don't use distracting elements like `<marquee>` or `<blink>`.
-- Only use the `scope` prop on `<th>` elements.
-- Don't assign non-interactive ARIA roles to interactive HTML elements.
-- Make sure label elements have text content and are associated with an input.
-- Don't assign interactive ARIA roles to non-interactive HTML elements.
-- Don't assign `tabIndex` to non-interactive HTML elements.
-- Don't use positive integers for `tabIndex` property.
-- Don't include "image", "picture", or "photo" in img alt prop.
-- Don't use explicit role property that's the same as the implicit/default role.
-- Make static elements with click handlers use a valid role attribute.
-- Always include a `title` element for SVG elements.
-- Give all elements requiring alt text meaningful information for screen readers.
-- Make sure anchors have content that's accessible to screen readers.
-- Assign `tabIndex` to non-interactive HTML elements with `aria-activedescendant`.
-- Include all required ARIA attributes for elements with ARIA roles.
-- Make sure ARIA properties are valid for the element's supported roles.
-- Always include a `type` attribute for button elements.
-- Make elements with interactive roles and handlers focusable.
-- Give heading elements content that's accessible to screen readers (not hidden with `aria-hidden`).
-- Always include a `lang` attribute on the html element.
-- Always include a `title` attribute for iframe elements.
-- Accompany `onClick` with at least one of: `onKeyUp`, `onKeyDown`, or `onKeyPress`.
-- Accompany `onMouseOver`/`onMouseOut` with `onFocus`/`onBlur`.
-- Include caption tracks for audio and video elements.
-- Use semantic elements instead of role attributes in JSX.
-- Make sure all anchors are valid and navigable.
-- Ensure all ARIA properties (`aria-*`) are valid.
-- Use valid, non-abstract ARIA roles for elements with ARIA roles.
-- Use valid ARIA state and property values.
-- Use valid values for the `autocomplete` attribute on input elements.
-- Use correct ISO language/country codes for the `lang` attribute.
-
-### Code Complexity and Quality
-- Don't use consecutive spaces in regular expression literals.
-- Don't use the `arguments` object.
-- Don't use primitive type aliases or misleading types.
-- Don't use the comma operator.
-- Don't use empty type parameters in type aliases and interfaces.
-- Don't write functions that exceed a given Cognitive Complexity score.
-- Don't nest describe() blocks too deeply in test files.
-- Don't use unnecessary boolean casts.
-- Don't use unnecessary callbacks with flatMap.
-- Use for...of statements instead of Array.forEach.
-- Don't create classes that only have static members (like a static namespace).
-- Don't use this and super in static contexts.
-- Don't use unnecessary catch clauses.
-- Don't use unnecessary constructors.
-- Don't use unnecessary continue statements.
-- Don't export empty modules that don't change anything.
-- Don't use unnecessary escape sequences in regular expression literals.
-- Don't use unnecessary fragments.
-- Don't use unnecessary labels.
-- Don't use unnecessary nested block statements.
-- Don't rename imports, exports, and destructured assignments to the same name.
-- Don't use unnecessary string or template literal concatenation.
-- Don't use String.raw in template literals when there are no escape sequences.
-- Don't use useless case statements in switch statements.
-- Don't use ternary operators when simpler alternatives exist.
-- Don't use useless `this` aliasing.
-- Don't use any or unknown as type constraints.
-- Don't initialize variables to undefined.
-- Don't use the void operators (they're not familiar).
-- Use arrow functions instead of function expressions.
-- Use Date.now() to get milliseconds since the Unix Epoch.
-- Use .flatMap() instead of map().flat() when possible.
-- Use literal property access instead of computed property access.
-- Don't use parseInt() or Number.parseInt() when binary, octal, or hexadecimal literals work.
-- Use concise optional chaining instead of chained logical expressions.
-- Use regular expression literals instead of the RegExp constructor when possible.
-- Don't use number literal object member names that aren't base 10 or use underscore separators.
-- Remove redundant terms from logical expressions.
-- Use while loops instead of for loops when you don't need initializer and update expressions.
-- Don't pass children as props.
-- Don't reassign const variables.
-- Don't use constant expressions in conditions.
-- Don't use `Math.min` and `Math.max` to clamp values when the result is constant.
-- Don't return a value from a constructor.
-- Don't use empty character classes in regular expression literals.
-- Don't use empty destructuring patterns.
-- Don't call global object properties as functions.
-- Don't declare functions and vars that are accessible outside their block.
-- Make sure builtins are correctly instantiated.
-- Don't use super() incorrectly inside classes. Also check that super() is called in classes that extend other constructors.
-- Don't use variables and function parameters before they're declared.
-- Don't use 8 and 9 escape sequences in string literals.
-- Don't use literal numbers that lose precision.
-
-### React and JSX Best Practices
-- Don't use the return value of React.render.
-- Make sure all dependencies are correctly specified in React hooks.
-- Make sure all React hooks are called from the top level of component functions.
-- Don't forget key props in iterators and collection literals.
-- Don't destructure props inside JSX components in Solid projects.
-- Don't define React components inside other components.
-- Don't use event handlers on non-interactive elements.
-- Don't assign to React component props.
-- Don't use both `children` and `dangerouslySetInnerHTML` props on the same element.
-- Don't use dangerous JSX props.
-- Don't use Array index in keys.
-- Don't insert comments as text nodes.
-- Don't assign JSX properties multiple times.
-- Don't add extra closing tags for components without children.
-- Use `<>...</>` instead of `<Fragment>...</Fragment>`.
-- Watch out for possible "wrong" semicolons inside JSX elements.
-
-### Correctness and Safety
-- Don't assign a value to itself.
-- Don't return a value from a setter.
-- Don't compare expressions that modify string case with non-compliant values.
-- Don't use lexical declarations in switch clauses.
-- Don't use variables that haven't been declared in the document.
-- Don't write unreachable code.
-- Make sure super() is called exactly once on every code path in a class constructor before this is accessed if the class has a superclass.
-- Don't use control flow statements in finally blocks.
-- Don't use optional chaining where undefined values aren't allowed.
-- Don't have unused function parameters.
-- Don't have unused imports.
-- Don't have unused labels.
-- Don't have unused private class members.
-- Don't have unused variables.
-- Make sure void (self-closing) elements don't have children.
-- Don't return a value from a function with the return type 'void'
-- Use isNaN() when checking for NaN.
-- Make sure "for" loop update clauses move the counter in the right direction.
-- Make sure typeof expressions are compared to valid values.
-- Make sure generator functions contain yield.
-- Don't use await inside loops.
-- Don't use bitwise operators.
-- Don't use expressions where the operation doesn't change the value.
-- Make sure Promise-like statements are handled appropriately.
-- Don't use __dirname and __filename in the global scope.
-- Prevent import cycles.
-- Don't use configured elements.
-- Don't hardcode sensitive data like API keys and tokens.
-- Don't let variable declarations shadow variables from outer scopes.
-- Don't use the TypeScript directive @ts-ignore.
-- Prevent duplicate polyfills from Polyfill.io.
-- Don't use useless backreferences in regular expressions that always match empty strings.
-- Don't use unnecessary escapes in string literals.
-- Don't use useless undefined.
-- Make sure getters and setters for the same property are next to each other in class and object definitions.
-- Make sure object literals are declared consistently (defaults to explicit definitions).
-- Use static Response methods instead of new Response() constructor when possible.
-- Make sure switch-case statements are exhaustive.
-- Make sure the `preconnect` attribute is used when using Google Fonts.
-- Use `Array#{indexOf,lastIndexOf}()` instead of `Array#{findIndex,findLastIndex}()` when looking for the index of an item.
-- Make sure iterable callbacks return consistent values.
-- Use `with { type: "json" }` for JSON module imports.
-- Use numeric separators in numeric literals.
-- Use object spread instead of `Object.assign()` when constructing new objects.
-- Always use the radix argument when using `parseInt()`.
-- Make sure JSDoc comment lines start with a single asterisk, except for the first one.
-- Include a description parameter for `Symbol()`.
-- Don't use spread (`...`) syntax on accumulators.
-- Don't use the `delete` operator.
-- Don't access namespace imports dynamically.
-- Don't use namespace imports.
-- Declare regex literals at the top level.
-- Don't use `target="_blank"` without `rel="noopener"`.
-
-### TypeScript Best Practices
-- Don't use TypeScript enums.
-- Don't export imported variables.
-- Don't add type annotations to variables, parameters, and class properties that are initialized with literal expressions.
-- Don't use TypeScript namespaces.
-- Don't use non-null assertions with the `!` postfix operator.
-- Don't use parameter properties in class constructors.
-- Don't use user-defined types.
-- Use `as const` instead of literal types and type annotations.
-- Use either `T[]` or `Array<T>` consistently.
-- Initialize each enum member value explicitly.
-- Use `export type` for types.
-- Use `import type` for types.
-- Make sure all enum members are literal values.
-- Don't use TypeScript const enum.
-- Don't declare empty interfaces.
-- Don't let variables evolve into any type through reassignments.
-- Don't use the any type.
-- Don't misuse the non-null assertion operator (!) in TypeScript files.
-- Don't use implicit any type on variable declarations.
-- Don't merge interfaces and classes unsafely.
-- Don't use overload signatures that aren't next to each other.
-- Use the namespace keyword instead of the module keyword to declare TypeScript namespaces.
-
-### Style and Consistency
-- Don't use global `eval()`.
-- Don't use callbacks in asynchronous tests and hooks.
-- Don't use negation in `if` statements that have `else` clauses.
-- Don't use nested ternary expressions.
-- Don't reassign function parameters.
-- This rule lets you specify global variable names you don't want to use in your application.
-- Don't use specified modules when loaded by import or require.
-- Don't use constants whose value is the upper-case version of their name.
-- Use `String.slice()` instead of `String.substr()` and `String.substring()`.
-- Don't use template literals if you don't need interpolation or special-character handling.
-- Don't use `else` blocks when the `if` block breaks early.
-- Don't use yoda expressions.
-- Don't use Array constructors.
-- Use `at()` instead of integer index access.
-- Follow curly brace conventions.
-- Use `else if` instead of nested `if` statements in `else` clauses.
-- Use single `if` statements instead of nested `if` clauses.
-- Use `new` for all builtins except `String`, `Number`, and `Boolean`.
-- Use consistent accessibility modifiers on class properties and methods.
-- Use `const` declarations for variables that are only assigned once.
-- Put default function parameters and optional function parameters last.
-- Include a `default` clause in switch statements.
-- Use the `**` operator instead of `Math.pow`.
-- Use `for-of` loops when you need the index to extract an item from the iterated array.
-- Use `node:assert/strict` over `node:assert`.
-- Use the `node:` protocol for Node.js builtin modules.
-- Use Number properties instead of global ones.
-- Use assignment operator shorthand where possible.
-- Use function types instead of object types with call signatures.
-- Use template literals over string concatenation.
-- Use `new` when throwing an error.
-- Don't throw non-Error values.
-- Use `String.trimStart()` and `String.trimEnd()` over `String.trimLeft()` and `String.trimRight()`.
-- Use standard constants instead of approximated literals.
-- Don't assign values in expressions.
-- Don't use async functions as Promise executors.
-- Don't reassign exceptions in catch clauses.
-- Don't reassign class members.
-- Don't compare against -0.
-- Don't use labeled statements that aren't loops.
-- Don't use void type outside of generic or return types.
-- Don't use console.
-- Don't use control characters and escape sequences that match control characters in regular expression literals.
-- Don't use debugger.
-- Don't assign directly to document.cookie.
-- Use `===` and `!==`.
-- Don't use duplicate case labels.
-- Don't use duplicate class members.
-- Don't use duplicate conditions in if-else-if chains.
-- Don't use two keys with the same name inside objects.
-- Don't use duplicate function parameter names.
-- Don't have duplicate hooks in describe blocks.
-- Don't use empty block statements and static blocks.
-- Don't let switch clauses fall through.
-- Don't reassign function declarations.
-- Don't allow assignments to native objects and read-only global variables.
-- Use Number.isFinite instead of global isFinite.
-- Use Number.isNaN instead of global isNaN.
-- Don't assign to imported bindings.
-- Don't use irregular whitespace characters.
-- Don't use labels that share a name with a variable.
-- Don't use characters made with multiple code points in character class syntax.
-- Make sure to use new and constructor properly.
-- Don't use shorthand assign when the variable appears on both sides.
-- Don't use octal escape sequences in string literals.
-- Don't use Object.prototype builtins directly.
-- Don't redeclare variables, functions, classes, and types in the same scope.
-- Don't have redundant "use strict".
-- Don't compare things where both sides are exactly the same.
-- Don't let identifiers shadow restricted names.
-- Don't use sparse arrays (arrays with holes).
-- Don't use template literal placeholder syntax in regular strings.
-- Don't use the then property.
-- Don't use unsafe negation.
-- Don't use var.
-- Don't use with statements in non-strict contexts.
-- Make sure async functions actually use await.
-- Make sure default clauses in switch statements come last.
-- Make sure to pass a message value when creating a built-in error.
-- Make sure get methods always return a value.
-- Use a recommended display strategy with Google Fonts.
-- Make sure for-in loops include an if statement.
-- Use Array.isArray() instead of instanceof Array.
-- Make sure to use the digits argument with Number#toFixed().
-- Make sure to use the "use strict" directive in script files.
-
-### Next.js Specific Rules
-- Don't use `<img>` elements in Next.js projects.
-- Don't use `<head>` elements in Next.js projects.
-- Don't import next/document outside of pages/_document.jsx in Next.js projects.
-- Don't use the next/head module in pages/_document.js on Next.js projects.
-
-### Testing Best Practices
-- Don't use export or module.exports in test files.
-- Don't use focused tests.
-- Make sure the assertion function, like expect, is placed inside an it() function call.
-- Don't use disabled tests.
-
-## Common Tasks
-- `npx ultracite init` - Initialize Ultracite in your project
-- `npx ultracite format` - Format and fix code automatically
-- `npx ultracite lint` - Check for issues without fixing
-
-## Example: Error Handling
-```typescript
-// ✅ Good: Comprehensive error handling
-try {
-  const result = await fetchData();
-  return { success: true, data: result };
-} catch (error) {
-  console.error('API call failed:', error);
-  return { success: false, error: error.message };
-}
-
-// ❌ Bad: Swallowing errors
-try {
-  return await fetchData();
-} catch (e) {
-  console.log(e);
-}
-```
\ No newline at end of file
diff --git a/.dockerignore b/.dockerignore
index c0962f05e..b7f89a072 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -11,3 +11,8 @@
 **/.env
 **/.env.*
 *.log
+**/ios/Pods
+**/ios/build
+**/android/build
+**/android/.gradle
+**/.expo
diff --git a/.env.example b/.env.example
new file mode 100644
index 000000000..68f785e35
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,126 @@
+# `production` for real deployments; `local-evaluation` relaxes credential
+# validation for local development and is what the integration suites expect.
+# Evaluation mode accepts the documented default root credentials; production
+# refuses them. `pnpm stack:up` / `pnpm test:integration` force evaluation mode
+# for the stack they manage, so this value is the one a real deployment gets.
+SELFHOST_MODE=production
+DATABASE_USERNAME=voidhash
+DATABASE_PASSWORD=replace-with-a-random-password
+DATABASE_NAME=voidhash
+DATABASE_SSL=false
+# Direct-TCP overrides for the migration process (`pnpm migrate`) and the local
+# migration CLI (`pnpm db:migrate`). Each one falls back to its DATABASE_*
+# counterpart, so leave them unset unless DATABASE_HOST points at a sandboxed or
+# proxied endpoint — a connection broker, or a
+# Hyperdrive-style local socket — that only resolves inside the runtime serving
+# requests. Migrations run in their own process and need the origin address.
+# DATABASE_DIRECT_HOST=postgres
+# DATABASE_DIRECT_PORT=5432
+# DATABASE_DIRECT_NAME=voidhash
+# DATABASE_DIRECT_USERNAME=voidhash
+# DATABASE_DIRECT_PASSWORD=replace-with-a-random-password
+# DATABASE_DIRECT_SSL=false
+# Overrides for platform state — cluster mailboxes, workflow executions,
+# persisted queues, entity alarms, and the platform key-value store. Each falls
+# back to its DATABASE_* counterpart, so leaving them unset keeps that state
+# beside application data, which is what a deployment wants. They exist because a
+# single-node cluster claims every shard in its database: a process that must not
+# contend with the deployment for shards needs a database of its own, which is
+# how `pnpm test:integration` isolates the suites that build their own cluster.
+# DATABASE_PLATFORM_HOST=postgres
+# DATABASE_PLATFORM_PORT=5432
+# DATABASE_PLATFORM_NAME=voidhash
+# DATABASE_PLATFORM_USERNAME=voidhash
+# DATABASE_PLATFORM_PASSWORD=replace-with-a-random-password
+# DATABASE_PLATFORM_SSL=false
+# Optional analytics profile. Leave CLICKHOUSE_URL unset for the core stack.
+# CLICKHOUSE_URL=http://clickhouse:8123
+CLICKHOUSE_DATABASE=voidhash
+CLICKHOUSE_ADMIN_USERNAME=voidhash_admin
+CLICKHOUSE_ADMIN_PASSWORD=replace-with-a-random-password
+CLICKHOUSE_USERNAME=voidhash_app
+CLICKHOUSE_PASSWORD=replace-with-a-random-password
+CLICKHOUSE_RO_USERNAME=voidhash_ro
+CLICKHOUSE_RO_PASSWORD=replace-with-a-random-password
+CLICKHOUSE_ANALYTICS_QUERY_USERNAME=voidhash_query
+CLICKHOUSE_ANALYTICS_QUERY_PASSWORD=replace-with-a-random-password
+CLICKHOUSE_HTTP_PORT=8123
+MIMIC_ROOT_USERNAME=root
+MIMIC_ROOT_PASSWORD=replace-with-a-random-password
+PUBLIC_BASE_URL=http://localhost:5001
+PUBLIC_FILES_BASE_URL=http://localhost:5001
+MIMIC_CORS_ORIGINS=http://localhost:3000,http://localhost:3003
+MIMIC_DOCUMENT_IDLE_NOTIFY_DEBOUNCE_MS=15000
+MIMIC_PORT=5001
+# The single root account. Voidhash self-host is single-player: these are the
+# only credentials that can sign in, and there is no sign-up. Required in
+# production mode; `local-evaluation` falls back to root / voidhash.
+VOIDHASH_ROOT_USERNAME=root
+VOIDHASH_ROOT_PASSWORD=replace-with-a-random-password
+# Optional; defaults to root@voidhash.local. Used as the root user's address.
+# VOIDHASH_ROOT_EMAIL=
+# Signs the dashboard and API session tokens. Required in production mode.
+VOIDHASH_AUTH_SECRET=replace-with-at-least-32-random-characters
+# Durable agent model access. Configure at least one provider.
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+# OPENAI_BASE_URL=https://your-openai-compatible-host/v1
+# VOIDHASH_AGENT_MODEL_PROVIDER=openai
+# VOIDHASH_AGENT_MODEL_ID=gpt-5.4
+# VOIDHASH_AGENT_VISION_MODEL_PROVIDER=openai
+# VOIDHASH_AGENT_VISION_MODEL_ID=gpt-5.4
+# Required when Google Play RTDN is enabled. These must match the Pub/Sub push subscription.
+GOOGLE_PUBSUB_PUSH_AUDIENCE=
+GOOGLE_PUBSUB_PUSH_SERVICE_ACCOUNT_EMAIL=
+# Optional offline Enterprise activation; configure the token and issuer verification key together.
+VOIDHASH_LICENSE_KEY=
+VOIDHASH_LICENSE_PUBLIC_KEY=
+ENCRYPTION_KEY=
+APNS_DELIVERY_ENABLED=false
+EXCHANGE_RATE_API_KEY=
+S3_ACCESS_KEY_ID=voidhash
+S3_SECRET_ACCESS_KEY=replace-with-a-random-password
+S3_REGION=us-east-1
+S3_PUBLIC_BUCKET=voidhash-public
+S3_ARTIFACT_BUCKET=voidhash-artifacts
+MINIO_API_PORT=9000
+MINIO_CONSOLE_PORT=9001
+SMTP_HOST=mailpit
+SMTP_PORT=1025
+SMTP_SECURE=false
+SMTP_REQUIRE_TLS=false
+SMTP_USERNAME=
+SMTP_PASSWORD=
+SMTP_FROM_ADDRESS=noreply@voidhash.local
+SMTP_FROM_NAME=Voidhash
+SMTP_TLS_REJECT_UNAUTHORIZED=true
+SMTP_VERIFY_ON_START=true
+MAILPIT_SMTP_PORT=1025
+MAILPIT_UI_PORT=8025
+
+# ── Local development & integration tests ────────────────────────────────────
+# Used together with docker-compose.dev.yml:
+#   docker compose -f docker-compose.yml -f docker-compose.dev.yml \
+#     --profile analytics up -d --build
+# `pnpm test:integration` (repo root) reads this file and derives host-side
+# connection settings from the values below, so the whole suite runs against
+# this stack with no additional configuration.
+
+# Host ports published by the dev overlay. Change them only when another local
+# service already owns the default.
+DATABASE_HOST_PORT=5432
+COMPILER_HOST_PORT=5002
+
+# To enable the analytics profile end-to-end (the compose service, migrations,
+# and the ClickHouse integration suite), uncomment CLICKHOUSE_URL above.
+
+# Browser used by the screenshot integration tests on the host. The container
+# ships its own chromium; this is only for host-side test runs.
+# PLATFORM_SELFHOST_CHROMIUM_EXECUTABLE_PATH=/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
+
+# ── Values you must provide ──────────────────────────────────────────────────
+# VOIDHASH_ROOT_PASSWORD / VOIDHASH_AUTH_SECRET — sign-in. Production mode
+#                refuses to start until both hold real values.
+# OPENAI_API_KEY / ANTHROPIC_API_KEY — required only for the AI designer agent.
+# EXCHANGE_RATE_API_KEY — required only for the FX rate sync job.
+# ENCRYPTION_KEY — required for payment-provider credential storage.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad2e7a70e..6215afed0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,11 @@ concurrency:
   group: repository-ci-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
+env:
+  # Keeps turbo within the runner's 4 vCPUs; the scripts stay flag-free so the
+  # local and CI invocations are the same command.
+  TURBO_CONCURRENCY: 2
+
 jobs:
   validate:
     name: Validate
@@ -33,6 +38,9 @@ jobs:
       - name: Check publication boundary
         run: node scripts/check-publication-boundary.mjs
 
+      - name: Check platform seam
+        run: node scripts/check-platform-seam.mjs
+
       - name: Setup Node.js
         if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
         uses: actions/setup-node@v4
@@ -62,10 +70,9 @@ jobs:
         if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
         run: pnpm build --concurrency=2
 
-      - name: Typecheck
-        if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
-        run: pnpm typecheck --concurrency=2
-
-      - name: Test
+      # The same command developers run locally. The stack-backed tiers
+      # (`test:integration`, `test:e2e`) run in the Self-host Compose workflow,
+      # which owns the Compose lifecycle; together they cover `pnpm verify`.
+      - name: Verify (typecheck + unit tier)
         if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
-        run: pnpm test --concurrency=2
+        run: pnpm verify:quick
diff --git a/.github/workflows/selfhost.yml b/.github/workflows/selfhost.yml
index 6cb17f201..077c8f6aa 100644
--- a/.github/workflows/selfhost.yml
+++ b/.github/workflows/selfhost.yml
@@ -40,39 +40,69 @@ jobs:
       - name: Install workspace dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Install Chromium
+        run: pnpm exec playwright-core install --with-deps chromium
+
+      # The stack and the host-side tiers authenticate against each other, so
+      # they have to read one environment: the repo-root `.env` a developer
+      # keeps (and `pnpm test:integration` creates on a first checkout). It must
+      # exist *before* the stack starts — Compose otherwise falls back to the
+      # built-in defaults in the compose file while the tiers read the file, and
+      # every host-side connection fails authentication. Compose consumes it via
+      # `--env-file`; the tiers that read `process.env` rather than the file (the
+      # two smoke tiers) get the same values from the job environment.
+      - name: Prepare the stack environment
+        run: |
+          cp .env.example .env
+          # `.env.example` is a deployment template, so it selects production
+          # mode, which refuses its own placeholder secrets. This is a loopback
+          # CI stack: `pnpm stack:up` forces the same mode locally.
+          sed -i 's|^SELFHOST_MODE=.*|SELFHOST_MODE=local-evaluation|' .env
+          # The thumbnail assertions wait on the idle debounce.
+          sed -i 's|^MIMIC_DOCUMENT_IDLE_NOTIFY_DEBOUNCE_MS=.*|MIMIC_DOCUMENT_IDLE_NOTIFY_DEBOUNCE_MS=250|' .env
+          grep -E '^[A-Z][A-Z0-9_]*=' .env >> "$GITHUB_ENV"
+
       - name: Start stateful stores
-        run: docker compose -f selfhost/docker-compose.yml --profile analytics up -d clickhouse minio --wait --wait-timeout 180
+        run: docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --env-file .env --profile analytics up -d clickhouse minio --wait --wait-timeout 180
 
       - name: Initialize object store
-        run: docker compose -f selfhost/docker-compose.yml --profile analytics run --rm minio-init
-
-      - name: Verify S3-compatible object store
-        env:
-          PLATFORM_NODE_S3_ENDPOINT: http://127.0.0.1:9000
-          PLATFORM_NODE_S3_TEST: 1
-        run: pnpm --filter @voidhash/platform-node exec vp test run -c vitest.mts tests/S3ObjectStore.integration.test.ts
+        run: docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --env-file .env --profile analytics run --rm minio-init
 
+      # The dev overlay publishes Postgres and the compiler, which the
+      # host-side integration tier connects to. `CLICKHOUSE_URL` stays a shell
+      # override rather than an entry in `.env`: it names the compose-internal
+      # endpoint the application dials, while every host-side tier reaches
+      # ClickHouse on the published port instead.
       - name: Build and start Community Compose
         env:
           CLICKHOUSE_URL: http://clickhouse:8123
-          MIMIC_DOCUMENT_IDLE_NOTIFY_DEBOUNCE_MS: 250
-        run: docker compose -f selfhost/docker-compose.yml --profile analytics up --build --wait --wait-timeout 180
+        run: docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --env-file .env --profile analytics up --build --wait --wait-timeout 180
 
       - name: Reclaim image build cache
         run: docker builder prune --all --force
 
-      - name: Run self-host smoke
-        run: pnpm exec tsx selfhost/smoke.mts
+      # Same scripts developers run locally; this workflow owns the stack the
+      # two tiers need. With the unit tier in Repository CI, this completes the
+      # coverage of `pnpm verify`.
+      - name: Integration tier
+        run: pnpm test:integration
+
+      - name: End-to-end tier
+        run: pnpm test:e2e
 
-      - name: Run self-host release smoke
-        run: pnpm exec tsx selfhost/release-smoke.mts
+      - name: End-to-end tier (release)
+        run: pnpm test:e2e:release
 
+      # These two run even when the environment step never did, so they stay off
+      # `--env-file` (a missing file is a hard Compose error). They need no
+      # interpolated value: both address the project by name, and the job
+      # environment already carries what `.env` set.
       - name: Show Compose diagnostics
         if: always()
         run: |
-          docker compose -f selfhost/docker-compose.yml --profile analytics ps || true
-          docker compose -f selfhost/docker-compose.yml --profile analytics logs --no-color || true
+          docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --profile analytics ps || true
+          docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --profile analytics logs --no-color || true
 
       - name: Stop Compose
         if: always()
-        run: docker compose -f selfhost/docker-compose.yml --profile analytics down --volumes --remove-orphans
+        run: docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --profile analytics down --volumes --remove-orphans
diff --git a/.nvmrc b/.nvmrc
index 2fdffdecf..c94711948 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-22.10.0
\ No newline at end of file
+22.23.2
diff --git a/.vscode/settings.json b/.vscode/settings.json
index aebef2e0b..3d3043c7e 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,15 +1,16 @@
 {
   "editor.defaultFormatter": "esbenp.prettier-vscode",
-  "[javascript][typescript][javascriptreact][typescriptreact][json][jsonc][css][graphql]": {
-    "editor.defaultFormatter": "biomejs.biome"
-  },
+  "[javascript]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
+  "[javascriptreact]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
+  "[typescript]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
+  "[typescriptreact]": { "editor.defaultFormatter": "oxc.oxc-vscode" },
+  "npm.scriptRunner": "vp",
   "typescript.tsdk": "node_modules/typescript/lib",
   "editor.formatOnSave": true,
   "editor.formatOnPaste": true,
   "emmet.showExpandedAbbreviation": "never",
   "editor.codeActionsOnSave": {
-    "source.fixAll.biome": "explicit",
-    "source.organizeImports.biome": "explicit"
+    "source.fixAll.oxc": "explicit"
   },
   "files.exclude": {}
 }
diff --git a/.zed/settings.json b/.zed/settings.json
index c8789f748..b88c7bbb4 100644
--- a/.zed/settings.json
+++ b/.zed/settings.json
@@ -5,49 +5,66 @@
     "JavaScript": {
       "formatter": {
         "language_server": {
-          "name": "biome"
+          "name": "oxfmt"
         }
       },
       "code_actions_on_format": {
-        "source.fixAll.biome": true,
-        "source.organizeImports.biome": true
+        "source.fixAll.oxc": true,
+        "source.organizeImports.oxc": true
       }
     },
     "TypeScript": {
       "formatter": {
         "language_server": {
-          "name": "biome"
+          "name": "oxfmt"
         }
       },
       "code_actions_on_format": {
-        "source.fixAll.biome": true,
-        "source.organizeImports.biome": true
+        "source.fixAll.oxc": true,
+        "source.organizeImports.oxc": true
       }
     },
     "JSX": {
       "formatter": {
         "language_server": {
-          "name": "biome"
+          "name": "oxfmt"
         }
       },
       "code_actions_on_format": {
-        "source.fixAll.biome": true,
-        "source.organizeImports.biome": true
+        "source.fixAll.oxc": true,
+        "source.organizeImports.oxc": true
       }
     },
     "TSX": {
       "formatter": {
         "language_server": {
-          "name": "biome"
+          "name": "oxfmt"
         }
       },
       "code_actions_on_format": {
-        "source.fixAll.biome": true,
-        "source.organizeImports.biome": true
+        "source.fixAll.oxc": true,
+        "source.organizeImports.oxc": true
       }
     }
   },
   "lsp": {
+    "oxlint": {
+      "initialization_options": {
+        "settings": {
+          "run": "onType",
+          "fixKind": "safe_fix",
+          "typeAware": true,
+          "unusedDisableDirectives": "deny"
+        }
+      }
+    },
+    "oxfmt": {
+      "initialization_options": {
+        "settings": {
+          "run": "onSave"
+        }
+      }
+    },
     "typescript-language-server": {
       "settings": {
         "typescript": {
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 87569c154..603b98e49 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -42,6 +42,17 @@ Use `pnpm check:publication` to validate license metadata and the public/private
 repository boundary. The [self-hosting guide](selfhost/README.md) documents the
 local Compose environment and its smoke tests.
 
+Linting and formatting go through vite-plus: `pnpm lint` (`vp check`) and
+`pnpm format` (`vp check --fix`).
+
+The steps above describe a **standalone clone** of this repository, which installs
+its own `node_modules` from this repository's lockfile. This repository is also
+consumed as a nested workspace by Voidhash's private monorepo. In that mode the
+superproject's root install is authoritative: it already covers every package here,
+this directory must **not** have its own `node_modules` (two installs give
+`drizzle-orm`/`@types/react` duplicate TypeScript type identities), and all commands
+are run from the superproject root rather than from here.
+
 ## Testing
 
 Run the smallest relevant package tests while iterating, then run the repository
diff --git a/README.md b/README.md
index a6d7b17df..f648f7c98 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ run the Community platform locally, see the [self-hosting guide](selfhost/README
 The [architecture overview](docs/architecture.md) explains the Community,
 Cloud, and Enterprise composition boundaries, and the
 [licensing and self-hosting FAQ](docs/licensing-and-self-hosting-faq.md) covers
-AGPL and the current BYO WorkOS requirement.
+AGPL and the self-hosting model.
 
 ## 🤝 Contributing
 
diff --git a/selfhost/entry/Dockerfile b/apps/backend/Dockerfile
similarity index 79%
rename from selfhost/entry/Dockerfile
rename to apps/backend/Dockerfile
index 017edcb11..6deaceca5 100644
--- a/selfhost/entry/Dockerfile
+++ b/apps/backend/Dockerfile
@@ -9,11 +9,11 @@ RUN apt-get update \
 
 WORKDIR /repo
 COPY . .
-RUN corepack pnpm@11.1.3 install --frozen-lockfile --filter @voidhash/selfhost-entry... --filter @voidhash/www... --ignore-scripts --config.node-linker=isolated
+RUN corepack pnpm@11.1.3 install --frozen-lockfile --filter @voidhash/backend-app... --filter @voidhash/www... --ignore-scripts --config.node-linker=isolated
 RUN VITE_APP_API_URL= VITE_APP_ENV=production VOIDHASH_SELFHOST_BUNDLE=true corepack pnpm@11.1.3 exec turbo build --filter @voidhash/www
-RUN rm -rf /out && corepack pnpm@11.1.3 --config.ignore-scripts=true --config.node-linker=isolated --config.block-exotic-subdeps=false --filter @voidhash/selfhost-entry deploy --prod --legacy /out
+RUN rm -rf /out && corepack pnpm@11.1.3 --config.ignore-scripts=true --config.node-linker=isolated --filter @voidhash/backend-app deploy --prod --legacy /out
 RUN node scripts/check-selfhost-runtime-boundary.mjs /out
-RUN rm -rf /www && corepack pnpm@11.1.3 --config.ignore-scripts=true --config.node-linker=hoisted --config.block-exotic-subdeps=false --config.allow-unused-patches=true --filter @voidhash/www deploy --prod --legacy /www
+RUN rm -rf /www && corepack pnpm@11.1.3 --config.ignore-scripts=true --config.node-linker=hoisted --config.allow-unused-patches=true --filter @voidhash/www deploy --prod --legacy /www
 RUN node scripts/check-selfhost-runtime-boundary.mjs /www
 
 FROM node:22-bookworm-slim AS runtime
diff --git a/apps/backend/package.json b/apps/backend/package.json
index 39041a275..40ed75aba 100644
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -1,49 +1,60 @@
 {
-  "name": "@voidhash/backend",
-  "version": "0.1.0",
+  "name": "@voidhash/backend-app",
+  "version": "0.0.1-alpha.1",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./Backend": "./src/backend/Backend.ts",
+    "./CompilerClient": "./src/compiler/CompilerClient.ts",
+    "./compiler/main": "./src/compiler/main.ts",
+    "./migrations": "./src/migrations.ts",
+    "./MimicNode": "./src/mimic/MimicNode.ts",
+    "./PgControlStore": "./src/mimic/PgControlStore.ts"
+  },
   "scripts": {
-    "test": "vp test run -c vitest.unit.mts",
+    "migrate": "tsx src/migrate.ts",
+    "start": "tsx src/main.ts",
+    "start:compiler": "tsx src/compiler/main.ts",
+    "start:mimic": "tsx src/mimic/main.ts",
     "typecheck": "tsc --noEmit",
-    "typecheck-go": "tsgo --noEmit",
-    "lint": "vp lint .",
-    "format": "vp fmt ."
+    "test": "vp test run -c vitest.mts"
   },
   "dependencies": {
+    "@effect/platform-node": "catalog:",
+    "@effect/sql-pg": "catalog:",
     "@voidhash/agent": "workspace:*",
-    "@voidhash/ai-shared": "workspace:*",
     "@voidhash/api-contracts": "workspace:*",
     "@voidhash/app-store-server-sdk": "workspace:*",
+    "@voidhash/backend": "workspace:*",
     "@voidhash/clickhouse-db": "workspace:*",
     "@voidhash/core": "workspace:*",
     "@voidhash/db": "workspace:*",
-    "@voidhash/google-play-server-sdk": "workspace:*",
+    "@voidhash/mimic-core": "workspace:*",
+    "@voidhash/mimic-db": "workspace:*",
     "@voidhash/mimic-schema": "workspace:*",
-    "@voidhash/paywall-builtins": "workspace:*",
     "@voidhash/paywall-renderer-preact": "workspace:*",
-    "@voidhash/paywall-workspace": "workspace:*",
-    "@voidhash/rpc": "workspace:*",
-    "@workos-inc/node": "9.2.0",
+    "@voidhash/paywall-renderer-web-core": "workspace:*",
+    "@voidhash/paywalls": "workspace:*",
+    "@voidhash/platform": "workspace:*",
+    "@voidhash/platform-selfhost": "workspace:*",
     "effect": "catalog:",
+    "esbuild": "^0.25.10",
     "jose": "catalog:",
-    "just-bash": "3.1.0",
     "preact": "^10.25.4",
-    "zod": "catalog:"
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "srvx": "0.11.15",
+    "tsx": "^4.19.3",
+    "ws": "^8.20.0"
   },
   "devDependencies": {
-    "@effect/platform-bun": "catalog:",
-    "@effect/platform-node": "catalog:",
-    "@types/bun": "latest",
-    "@types/node": "^20",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "@orbian/sdk": "https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526",
+    "@types/node": "^24.0.12",
+    "@types/ws": "^8.18.1",
+    "@voidhash/mimic-core": "workspace:*",
     "@voidhash/tsconfig": "workspace:*",
-    "alchemy": "catalog:",
     "typescript": "catalog:",
-    "vite-plus": "catalog:",
-    "vitest": "catalog:"
+    "vite-plus": "catalog:"
   }
 }
diff --git a/selfhost/entry/src/DurableEntityAlarms.ts b/apps/backend/src/DurableEntityAlarms.ts
similarity index 82%
rename from selfhost/entry/src/DurableEntityAlarms.ts
rename to apps/backend/src/DurableEntityAlarms.ts
index 5859f238f..55160eb9d 100644
--- a/selfhost/entry/src/DurableEntityAlarms.ts
+++ b/apps/backend/src/DurableEntityAlarms.ts
@@ -1,5 +1,7 @@
-import type { DurableEntityAddress } from "@orbian/sdk/DurableEntity";
-import type { NodeDurableEntityControlShape } from "@orbian/node/DurableEntity";
+import type {
+  DurableEntityAddress,
+  DurableEntityAlarmControlShape,
+} from "@voidhash/platform/DurableEntity";
 import { Effect } from "effect";
 
 /** Handler for one durable-entity alarm type. */
@@ -13,7 +15,7 @@ export type DurableEntityAlarmHandler = (
  * When `now` is omitted, the clock is sampled each time the returned effect runs.
  */
 export const dispatchDurableEntityAlarms = (
-  control: NodeDurableEntityControlShape,
+  control: DurableEntityAlarmControlShape,
   handlers: Readonly<Record<string, DurableEntityAlarmHandler>>,
   now?: number,
 ): Effect.Effect<void, unknown> =>
diff --git a/apps/backend/src/McpAuthKit.test.ts b/apps/backend/src/McpAuthKit.test.ts
deleted file mode 100644
index a142d1992..000000000
--- a/apps/backend/src/McpAuthKit.test.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import { Effect } from "effect";
-import { SignJWT, createLocalJWKSet, exportJWK, generateKeyPair, type JWK } from "jose";
-import { describe, expect, it } from "vite-plus/test";
-
-import { makeMcpAuthKit, normalizeAuthKitDomain } from "./McpAuthKit.ts";
-
-const ISSUER = "https://example.authkit.app";
-const AUDIENCE = "https://api.example.com/api/mcp";
-
-const authKitFixture = async () => {
-  const { privateKey, publicKey } = await generateKeyPair("RS256");
-  const publicJwk: JWK = { ...(await exportJWK(publicKey)), alg: "RS256", kid: "test" };
-  const authKit = makeMcpAuthKit(ISSUER, createLocalJWKSet({ keys: [publicJwk] }));
-  const sign = (claims: Record<string, unknown>, audience = AUDIENCE) =>
-    new SignJWT(claims)
-      .setProtectedHeader({ alg: "RS256", kid: "test" })
-      .setIssuer(ISSUER)
-      .setAudience(audience)
-      .setSubject("user_123")
-      .setIssuedAt()
-      .setExpirationTime("5m")
-      .sign(privateKey);
-  return { authKit, sign };
-};
-
-describe("normalizeAuthKitDomain", () => {
-  it("accepts a bare HTTPS issuer and removes its trailing slash", () => {
-    expect(normalizeAuthKitDomain(" https://example.authkit.app/ ")).toBe(ISSUER);
-  });
-
-  it("rejects insecure or path-bearing issuer values", () => {
-    expect(normalizeAuthKitDomain("http://example.authkit.app")).toBeUndefined();
-    expect(normalizeAuthKitDomain("https://example.authkit.app/oauth2")).toBeUndefined();
-  });
-});
-
-describe("McpAuthKit.verifyAccessToken", () => {
-  it("verifies issuer and resource audience and returns the WorkOS identity", async () => {
-    const { authKit, sign } = await authKitFixture();
-    const token = await sign({ org_id: "org_123" });
-
-    await expect(Effect.runPromise(authKit.verifyAccessToken(token, AUDIENCE))).resolves.toEqual({
-      organizationId: "org_123",
-      subject: "user_123",
-    });
-  });
-
-  it("rejects a token issued for another MCP resource", async () => {
-    const { authKit, sign } = await authKitFixture();
-    const token = await sign({ org_id: "org_123" }, "https://other.example.com/api/mcp");
-
-    await expect(
-      Effect.runPromise(authKit.verifyAccessToken(token, AUDIENCE)),
-    ).rejects.toMatchObject({ kind: "invalid_token" });
-  });
-
-  it("requires the organization selected during AuthKit consent", async () => {
-    const { authKit, sign } = await authKitFixture();
-    const token = await sign({});
-
-    await expect(
-      Effect.runPromise(authKit.verifyAccessToken(token, AUDIENCE)),
-    ).rejects.toMatchObject({ kind: "invalid_token" });
-  });
-});
diff --git a/apps/backend/src/McpAuthKit.ts b/apps/backend/src/McpAuthKit.ts
deleted file mode 100644
index 551669a3b..000000000
--- a/apps/backend/src/McpAuthKit.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-import { Context, Data, Effect, Layer } from "effect";
-import { createRemoteJWKSet, jwtVerify, type JWTVerifyGetKey } from "jose";
-
-export class McpAuthKitError extends Data.TaggedError("McpAuthKitError")<{
-  readonly kind: "invalid_token" | "misconfigured" | "upstream";
-  readonly message: string;
-  readonly cause?: unknown;
-}> {}
-
-export interface McpAuthKitClaims {
-  readonly organizationId: string;
-  readonly subject: string;
-}
-
-/** Normalizes the HTTPS AuthKit issuer configured for MCP OAuth discovery. */
-export const normalizeAuthKitDomain = (value: string | undefined): string | undefined => {
-  const trimmed = value?.trim();
-  if (!trimmed) return undefined;
-  try {
-    const url = new URL(trimmed);
-    if (
-      url.protocol !== "https:" ||
-      url.username ||
-      url.password ||
-      url.search ||
-      url.hash ||
-      (url.pathname !== "/" && url.pathname !== "")
-    ) {
-      return undefined;
-    }
-    return url.origin;
-  } catch {
-    return undefined;
-  }
-};
-
-/** Builds AuthKit MCP verification against the supplied issuer and JWKS resolver. */
-export const makeMcpAuthKit = (
-  authorizationServer: string | undefined,
-  jwks: JWTVerifyGetKey | undefined,
-) => {
-  const requireConfiguration = () =>
-    authorizationServer && jwks
-      ? Effect.succeed({ authorizationServer, jwks })
-      : Effect.fail(
-          new McpAuthKitError({
-            kind: "misconfigured",
-            message: "WORKOS_AUTHKIT_DOMAIN must be set to the HTTPS AuthKit issuer.",
-          }),
-        );
-
-  const verifyAccessToken = (token: string, audience: string) =>
-    Effect.gen(function* () {
-      const configured = yield* requireConfiguration();
-      const verified = yield* Effect.tryPromise({
-        try: () =>
-          jwtVerify(token, configured.jwks, {
-            audience,
-            issuer: configured.authorizationServer,
-          }),
-        catch: (cause) =>
-          new McpAuthKitError({
-            cause,
-            kind: "invalid_token",
-            message:
-              "The AuthKit access token is invalid, expired, or intended for another resource.",
-          }),
-      });
-      const subject = verified.payload.sub;
-      const organizationId = verified.payload.org_id;
-      if (typeof subject !== "string" || typeof organizationId !== "string") {
-        return yield* Effect.fail(
-          new McpAuthKitError({
-            kind: "invalid_token",
-            message: "The AuthKit access token is missing its subject or organization claim.",
-          }),
-        );
-      }
-      return { organizationId, subject } satisfies McpAuthKitClaims;
-    });
-
-  const fetchAuthorizationServerMetadata = () =>
-    Effect.gen(function* () {
-      const configured = yield* requireConfiguration();
-      return yield* Effect.tryPromise({
-        try: async () => {
-          const response = await fetch(
-            `${configured.authorizationServer}/.well-known/oauth-authorization-server`,
-          );
-          if (!response.ok) throw new Error(`AuthKit metadata returned HTTP ${response.status}`);
-          return (await response.json()) as unknown;
-        },
-        catch: (cause) =>
-          new McpAuthKitError({
-            cause,
-            kind: "upstream",
-            message: "Failed to load AuthKit authorization-server metadata.",
-          }),
-      });
-    });
-
-  return {
-    authorizationServer,
-    fetchAuthorizationServerMetadata,
-    verifyAccessToken,
-  } as const;
-};
-
-/** AuthKit MCP issuer discovery and resource-audience JWT verification. */
-export class McpAuthKit extends Context.Service<McpAuthKit>()("backend/McpAuthKit", {
-  make: Effect.sync(() => {
-    const authorizationServer = normalizeAuthKitDomain(process.env.WORKOS_AUTHKIT_DOMAIN);
-    const jwks = authorizationServer
-      ? createRemoteJWKSet(new URL(`${authorizationServer}/oauth2/jwks`), {
-          cacheMaxAge: 5 * 60_000,
-          cooldownDuration: 30_000,
-        })
-      : undefined;
-    return makeMcpAuthKit(authorizationServer, jwks);
-  }),
-}) {
-  static layer = Layer.effect(McpAuthKit)(McpAuthKit.make);
-}
diff --git a/selfhost/entry/src/agent/AgentNodeWebSocket.ts b/apps/backend/src/agent/AgentNodeWebSocket.ts
similarity index 93%
rename from selfhost/entry/src/agent/AgentNodeWebSocket.ts
rename to apps/backend/src/agent/AgentNodeWebSocket.ts
index 9dc9e00eb..a2e8a01d4 100644
--- a/selfhost/entry/src/agent/AgentNodeWebSocket.ts
+++ b/apps/backend/src/agent/AgentNodeWebSocket.ts
@@ -9,18 +9,22 @@ import {
   type EffectRunner,
   type Model,
 } from "@voidhash/agent";
-import { makeAgentSessionIndex } from "@voidhash/backend/src/ai/AgentSessionIndexAdapter.ts";
+import { makeAgentSessionIndex } from "@voidhash/backend/ai/AgentSessionIndexAdapter";
 import {
   makeWorkspaceAgentSessionFactory,
   type WorkspaceAgentDeps,
-} from "@voidhash/backend/src/ai/WorkspaceAgentSessionFactory.ts";
-import { resolveWorkosSession } from "@voidhash/backend/src/AuthSessionResolver.ts";
+} from "@voidhash/backend/ai/WorkspaceAgentSessionFactory";
+import { resolveUserSession } from "@voidhash/backend/AuthSessionResolver";
 import { AuthSession } from "@voidhash/core/domain/auth/Auth";
-import { AgentSessionIndexService, LocalUserSessionService, Workos } from "@voidhash/core/services";
+import {
+  AgentSessionIndexService,
+  IdentityProvider,
+  LocalUserSessionService,
+} from "@voidhash/core/services";
 import type { AuthTokenVerifier } from "@voidhash/core/services/auth/AuthTokenVerifier";
 import { Db } from "@voidhash/db";
-import type { DurableEntityHostShape } from "@orbian/sdk/DurableEntity";
-import { makeNodeDurableEntitySession } from "@orbian/node/NodeDurableEntitySession";
+import type { DurableEntityHostShape } from "@voidhash/platform/DurableEntity";
+import { makeNodeDurableEntitySession } from "@voidhash/platform-selfhost/NodeDurableEntitySession";
 import { Context, Effect, Redacted } from "effect";
 import * as HttpHeaders from "effect/unstable/http/Headers";
 import { WebSocketServer, type RawData } from "ws";
@@ -32,11 +36,11 @@ type AgentNodeServices =
   | Exclude<WorkspaceAgentDeps, AuthSession>
   | AgentSessionIndexService
   | Db
-  | Workos
+  | IdentityProvider
   | LocalUserSessionService;
 
 interface AgentConnectionData {
-  readonly authSession: Effect.Success<ReturnType<typeof resolveWorkosSession>>;
+  readonly authSession: Effect.Success<ReturnType<typeof resolveUserSession>>;
 }
 
 interface AgentRoute {
@@ -212,7 +216,7 @@ export const installAgentNodeWebSocketServer = (
     }
     const route = parsed.route;
     void Effect.runPromise(
-      resolveWorkosSession(headersOf(request), authTokenVerifier).pipe(Effect.provide(services)),
+      resolveUserSession(headersOf(request), authTokenVerifier).pipe(Effect.provide(services)),
     )
       .then((session) => {
         if (session.method !== "user" || session.user === null) {
diff --git a/selfhost/entry/src/backend/Analytics.ts b/apps/backend/src/backend/Analytics.ts
similarity index 91%
rename from selfhost/entry/src/backend/Analytics.ts
rename to apps/backend/src/backend/Analytics.ts
index afa108347..a12056356 100644
--- a/selfhost/entry/src/backend/Analytics.ts
+++ b/apps/backend/src/backend/Analytics.ts
@@ -22,15 +22,13 @@ import {
 import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
 import { PersonIdentityService } from "@voidhash/core/services/personIdentity/PersonIdentityService";
 import { Db } from "@voidhash/db";
-import { KeyValueStore } from "@orbian/sdk/KeyValueStore";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
-import { QueueDriver } from "@orbian/sdk/Queue";
-import { PgKeyValueStoreLive } from "@orbian/node/KeyValueStore";
-import { NodePlatformRuntimeLive } from "@orbian/node/PlatformRuntime";
-import { PgQueueLive } from "@orbian/node/Queue";
-import { Context, Effect, Layer, Redacted } from "effect";
+import { KeyValueStore } from "@voidhash/platform/KeyValueStore";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { QueueDriver } from "@voidhash/platform/Queue";
+import { Context, Effect, Layer } from "effect";
 
 import type { SelfhostRuntimeConfig } from "../config.ts";
+import { makeSelfhostPlatformLive } from "./PlatformProfile.ts";
 
 const analyticsQueueName = "analytics-ingest";
 const analyticsDeadLetterQueueName = "analytics-ingest-dlq";
@@ -140,21 +138,13 @@ const makeCaptureIngressLive = Layer.effect(
   }),
 );
 
-/** Builds the PostgreSQL queue, policy counter, and capture service runtime. */
+/**
+ * Builds the process-wide platform primitives — queue, key-value store, cron
+ * scheduler, and runtime marker — plus the policy counter and capture services
+ * layered on top of them.
+ */
 export const makeSelfhostAnalyticsRuntimeLive = (config: SelfhostRuntimeConfig) => {
-  const postgres = {
-    database: config.database.databaseName,
-    host: config.database.host,
-    password: Redacted.make(config.database.password),
-    port: config.database.port,
-    ...(config.database.ssl === undefined ? {} : { ssl: config.database.ssl }),
-    username: config.database.username,
-  };
-  const platform = Layer.mergeAll(
-    PgQueueLive(postgres),
-    PgKeyValueStoreLive(postgres),
-    NodePlatformRuntimeLive,
-  );
+  const platform = makeSelfhostPlatformLive(config);
   const database = Db.layer(config.database);
   const dlq = AnalyticsIngestDlqService.layer.pipe(Layer.provide(database));
   const policy = makePolicyCounterStoreLive.pipe(Layer.provide(platform));
diff --git a/selfhost/entry/src/backend/Backend.ts b/apps/backend/src/backend/Backend.ts
similarity index 54%
rename from selfhost/entry/src/backend/Backend.ts
rename to apps/backend/src/backend/Backend.ts
index 9a9038d8b..65f02ab8b 100644
--- a/selfhost/entry/src/backend/Backend.ts
+++ b/apps/backend/src/backend/Backend.ts
@@ -3,18 +3,25 @@ import {
   BackendPaymentProviderStubsLive,
   BackendSnapshotImageRendererStubLive,
   type InfraServices,
-} from "@voidhash/backend/src/BackendApp.ts";
+} from "@voidhash/backend/BackendApp";
 import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
-import { Workos } from "@voidhash/core/services/auth/Workos";
+import type { AuthTokenVerifier } from "@voidhash/core/services/auth/AuthTokenVerifier";
+import { IdentityProvider } from "@voidhash/core/services/auth/IdentityProvider";
+import {
+  StandaloneAuthTokenVerifierLive,
+  StandaloneIdentityProviderLive,
+} from "@voidhash/core/services/auth/StandaloneIdentityProvider";
+import { StandaloneOrgDirectoryLive } from "@voidhash/core/services/organizations/StandaloneOrgDirectory";
+import { OrgDirectoryPort } from "@voidhash/core/services/organizations/OrgDirectoryPort";
 import { SnapshotImageRenderer } from "@voidhash/core/services/paywallThumbnails/SnapshotImageRenderer";
 import type { PublicFileStore } from "@voidhash/core/services/storage/PublicFileStore";
 import { PaywallAssetConfig } from "@voidhash/core/services/paywallLocations/PaywallAssetConfig";
 import { Db } from "@voidhash/db";
 import { HostServiceTag } from "@voidhash/mimic-db/app/hostService";
-import { NodePlatformRuntimeLive } from "@orbian/node/PlatformRuntime";
-import { Effect, Layer } from "effect";
+import { SelfhostPlatformRuntimeLive } from "@voidhash/platform-selfhost/PlatformRuntime";
+import { Effect, Layer, Redacted } from "effect";
 
-import type { SelfhostRuntimeConfig, SelfhostWorkosConfig } from "../config.ts";
+import type { SelfhostAuthConfig, SelfhostRuntimeConfig } from "../config.ts";
 import { makeHttpComponentCompilerLive } from "../compiler/CompilerClient.ts";
 import { makeBackendMimicHostLive } from "./MimicHost.ts";
 import {
@@ -22,22 +29,30 @@ import {
   makePublicFileStoreLive,
 } from "./ObjectStores.ts";
 import { MemoryProjectSchemaCacheLive } from "./ProjectSchemaCache.ts";
-import { WorkosOrgPortLive } from "./Workos.ts";
 
-/** Builds the WorkOS SDK service from operator-provided credentials. */
-export const makeSelfhostWorkosLive = (config: SelfhostWorkosConfig): Layer.Layer<Workos> =>
-  Workos.layer({
-    apiKey: Effect.succeed(config.apiKey),
-    clientId: Effect.succeed(config.clientId),
-    cookieName: Effect.succeed(config.cookieName),
-    cookiePassword: Effect.succeed(config.cookiePassword),
-    webhookSecret: Effect.succeed(config.webhookSecret),
-  });
+/**
+ * The identity-provider half of the infrastructure graph: the HS256 token
+ * provider for the root identity plus a database-only organization directory.
+ * Self-host has no external directory, so there is nothing else to wire.
+ */
+export interface SelfhostAuthLayers {
+  readonly authTokenVerifier: Layer.Layer<AuthTokenVerifier>;
+  readonly identity: Layer.Layer<IdentityProvider | OrgDirectoryPort, never, Db>;
+}
+
+/** Builds the auth layers for the standalone identity provider. */
+export const makeSelfhostAuthLayers = (config: SelfhostAuthConfig): SelfhostAuthLayers => {
+  const secret = Redacted.value(config.secret);
+  return {
+    authTokenVerifier: StandaloneAuthTokenVerifierLive(secret),
+    identity: Layer.mergeAll(StandaloneIdentityProviderLive(secret), StandaloneOrgDirectoryLive),
+  };
+};
 
 /** Builds the provider-neutral backend infrastructure for the Node runtime. */
 export const makeBackendInfrastructureLive = (
   config: SelfhostRuntimeConfig,
-  workos: Layer.Layer<Workos>,
+  identity: SelfhostAuthLayers["identity"],
   clickhouse?: Layer.Layer<ClickhouseWebClient.ClickhouseWebClient>,
   snapshotImageRenderer: Layer.Layer<
     SnapshotImageRenderer,
@@ -48,18 +63,18 @@ export const makeBackendInfrastructureLive = (
   const publicFileStore = makePublicFileStoreLive(
     config.publicObjectStore,
     config.publicFilesBaseUrl,
-  ).pipe(Layer.provide(NodePlatformRuntimeLive));
+  ).pipe(Layer.provide(SelfhostPlatformRuntimeLive));
+  const db = Db.layer(config.database);
 
   return Layer.mergeAll(
-    Db.layer(config.database),
-    workos,
-    WorkosOrgPortLive.pipe(Layer.provide(workos)),
+    db,
+    identity.pipe(Layer.provide(db)),
     Layer.succeed(PaywallAssetConfig, {
       cdnUrl: config.publicBaseUrl,
       publicBaseUrl: config.publicBaseUrl,
     }),
     makePaywallArtifactStoreLive(config.artifactObjectStore).pipe(
-      Layer.provide(NodePlatformRuntimeLive),
+      Layer.provide(SelfhostPlatformRuntimeLive),
     ),
     publicFileStore,
     BackendPaymentProviderStubsLive,
diff --git a/apps/backend/src/backend/Background.ts b/apps/backend/src/backend/Background.ts
new file mode 100644
index 000000000..786578d67
--- /dev/null
+++ b/apps/backend/src/backend/Background.ts
@@ -0,0 +1,59 @@
+import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
+import { AnalyticsJanitorService } from "@voidhash/core/services/analyticsIngest/AnalyticsJanitorService";
+import { FxRateSync } from "@voidhash/core/workflows/definitions";
+import { backendWorkflows } from "@voidhash/core/workflows/registry";
+import { CronJob, CronScheduler } from "@voidhash/platform/CronScheduler";
+import type { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import type { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
+import { Context, Effect, Layer } from "effect";
+
+/** Builds the persisted jobs enabled by the current self-host configuration. */
+export const makeSelfhostCronJobs = (
+  clickhouse?: Layer.Layer<ClickhouseWebClient.ClickhouseWebClient>,
+) =>
+  Effect.gen(function* () {
+    const exchangeRateApiKey = process.env.EXCHANGE_RATE_API_KEY?.trim();
+    const jobs: Array<CronJob<PlatformRuntime | WorkflowRunner>> = backendWorkflows.flatMap(
+      (registration) => {
+        if (registration.cron === undefined) return [];
+        if (registration.workflow === FxRateSync && !exchangeRateApiKey) return [];
+        return [
+          CronJob.define({
+            expression: registration.cron.schedule,
+            name: registration.workflow.name,
+            run: ({ scheduledTime }) => registration.cron!.dispatch(scheduledTime),
+          }),
+        ];
+      },
+    );
+
+    if (clickhouse) {
+      const janitorContext = yield* Layer.build(
+        AnalyticsJanitorService.layer.pipe(Layer.provide(clickhouse)),
+      );
+      const janitor = Context.get(janitorContext, AnalyticsJanitorService);
+      jobs.push(
+        CronJob.define({
+          expression: "*/5 * * * *",
+          name: "analytics-janitor",
+          run: () =>
+            janitor.squash({ batchSize: 1000, safetyWindowSeconds: 120 }).pipe(Effect.asVoid),
+        }),
+      );
+    }
+
+    return jobs;
+  });
+
+/** Runs every enabled persisted cron job until the enclosing scope closes. */
+export const runSelfhostCronJobs = (
+  clickhouse?: Layer.Layer<ClickhouseWebClient.ClickhouseWebClient>,
+) =>
+  Effect.gen(function* () {
+    const scheduler = yield* CronScheduler;
+    const jobs = yield* makeSelfhostCronJobs(clickhouse);
+    return yield* Effect.all(
+      jobs.map((job) => scheduler.run(job, { pollIntervalMillis: 1_000 })),
+      { concurrency: "unbounded" },
+    );
+  });
diff --git a/selfhost/entry/src/backend/Clickhouse.ts b/apps/backend/src/backend/Clickhouse.ts
similarity index 100%
rename from selfhost/entry/src/backend/Clickhouse.ts
rename to apps/backend/src/backend/Clickhouse.ts
diff --git a/selfhost/entry/src/backend/MimicHost.ts b/apps/backend/src/backend/MimicHost.ts
similarity index 100%
rename from selfhost/entry/src/backend/MimicHost.ts
rename to apps/backend/src/backend/MimicHost.ts
diff --git a/selfhost/entry/src/backend/ObjectStores.ts b/apps/backend/src/backend/ObjectStores.ts
similarity index 94%
rename from selfhost/entry/src/backend/ObjectStores.ts
rename to apps/backend/src/backend/ObjectStores.ts
index 0b38c4f97..bd4ee914b 100644
--- a/selfhost/entry/src/backend/ObjectStores.ts
+++ b/apps/backend/src/backend/ObjectStores.ts
@@ -6,12 +6,12 @@ import {
   PublicFileStore,
   PublicFileStoreError,
 } from "@voidhash/core/services/storage/PublicFileStore";
-import { ObjectStore, ObjectStoreError } from "@orbian/sdk/ObjectStore";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import { ObjectStore, ObjectStoreError } from "@voidhash/platform/ObjectStore";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 import {
   S3ObjectStoreLive,
   type S3ObjectStoreConfig,
-} from "@orbian/node/ObjectStore";
+} from "@voidhash/platform-selfhost/ObjectStore";
 import { Effect, Layer, Option } from "effect";
 
 const objectStoreCause = (cause: unknown): string =>
diff --git a/apps/backend/src/backend/PlatformProfile.ts b/apps/backend/src/backend/PlatformProfile.ts
new file mode 100644
index 000000000..4d097e858
--- /dev/null
+++ b/apps/backend/src/backend/PlatformProfile.ts
@@ -0,0 +1,165 @@
+import * as PgClient from "@effect/sql-pg/PgClient";
+import type { DbConfig } from "@voidhash/db/db";
+import type { CronScheduler } from "@voidhash/platform/CronScheduler";
+import type {
+  DurableEntityAlarmControl,
+  DurableEntityHost,
+} from "@voidhash/platform/DurableEntity";
+import type { KeyValueStore } from "@voidhash/platform/KeyValueStore";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import type { QueueDriver } from "@voidhash/platform/Queue";
+import type { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
+import {
+  ClusterDurableEntityControlLive,
+  ClusterDurableEntityHostLive,
+} from "@voidhash/platform-selfhost/ClusterDurableEntity";
+import { ClusterCronSchedulerLive } from "@voidhash/platform-selfhost/CronScheduler";
+import { PgEntityAlarmStoreLive } from "@voidhash/platform-selfhost/EntityAlarmStore";
+import { PgKeyValueStoreLive } from "@voidhash/platform-selfhost/KeyValueStore";
+import { SelfhostPlatformRuntimeLive } from "@voidhash/platform-selfhost/PlatformRuntime";
+import type { PgPlatformConfig } from "@voidhash/platform-selfhost/Postgres";
+import { ClusterQueueLive } from "@voidhash/platform-selfhost/Queue";
+import { SingleNodeClusterLive } from "@voidhash/platform-selfhost/Topology";
+import * as ClusterWorkflowRunner from "@voidhash/platform-selfhost/Workflow";
+import { Layer, Redacted } from "effect";
+import {
+  KeyValueStore as PersistenceKeyValueStore,
+  PersistedQueue,
+} from "effect/unstable/persistence";
+
+import type { SelfhostRuntimeConfig } from "../config.ts";
+
+/**
+ * The swappable platform primitives a self-host deployment installs.
+ *
+ * The mailer, the object store, and the screenshot renderer are deliberately
+ * absent: they are plain clients configured per process rather than parts of
+ * the shared cluster composition.
+ */
+export interface SelfhostPlatformLayers {
+  readonly queue: Layer.Layer<QueueDriver>;
+  readonly keyValueStore: Layer.Layer<KeyValueStore>;
+  readonly cronScheduler: Layer.Layer<CronScheduler>;
+  /**
+   * The entity host and the control plane the alarm dispatcher polls. Entity
+   * sessions are process-local, so this layer only serves entities whose shard
+   * this runner owns — true by construction for the single-runner topology.
+   */
+  readonly durableEntities: Layer.Layer<DurableEntityHost | DurableEntityAlarmControl>;
+  readonly workflowRunner: Layer.Layer<WorkflowRunner>;
+  readonly runtime: Layer.Layer<PlatformRuntime>;
+}
+
+/**
+ * The slice of runtime configuration a platform composition needs.
+ *
+ * Entrypoints that never read the full {@link SelfhostRuntimeConfig} — the
+ * mimic process reads its own — still have to resolve their platform through
+ * this module, so the input is declared narrowly.
+ */
+export type SelfhostPlatformSelection = Pick<SelfhostRuntimeConfig, "platformDatabase">;
+
+/**
+ * Converts an application-shaped connection into the platform's Postgres
+ * parameters. Exported because the migration entrypoint builds the entity host
+ * directly to create its tables.
+ */
+export const selfhostPlatformPostgres = (database: DbConfig): PgPlatformConfig => ({
+  database: database.databaseName,
+  host: database.host,
+  password: Redacted.make(database.password),
+  port: database.port,
+  ...(database.ssl === undefined ? {} : { ssl: database.ssl }),
+  username: database.username,
+});
+
+const platformLayers = (postgres: PgPlatformConfig): SelfhostPlatformLayers => {
+  const sql = PgClient.layer({
+    database: postgres.database,
+    host: postgres.host,
+    password: postgres.password,
+    port: postgres.port,
+    username: postgres.username,
+    ...(postgres.ssl === undefined ? {} : { ssl: postgres.ssl }),
+  }).pipe(Layer.orDie);
+
+  // Every cluster-backed primitive shares this one topology value so a single
+  // build installs a single runner. Two runners in one process would compete
+  // for the same shard leases.
+  const topology = SingleNodeClusterLive({ runnerStorage: "memory" }).pipe(
+    Layer.provide(sql),
+    Layer.orDie,
+  );
+
+  // The SQL store polls for new rows on an interval that has to stay shorter
+  // than the driver's claim window, or a non-empty queue reads as empty.
+  const persistedQueueStore = PersistedQueue.layerStoreSql({ pollInterval: "50 millis" }).pipe(
+    Layer.provide(sql),
+    Layer.orDie,
+  );
+
+  // Shared by the cron scheduler and entity values so both read one table.
+  const persistenceKeyValueStore = PersistenceKeyValueStore.layerSql().pipe(
+    Layer.provide(sql),
+    Layer.orDie,
+  );
+
+  return {
+    queue: ClusterQueueLive.pipe(
+      Layer.provide(PersistedQueue.layer),
+      Layer.provide(persistedQueueStore),
+    ),
+    // No cluster adapter implements the typed key-value contract's atomic
+    // counters, so the analytics policy store stays on Postgres.
+    keyValueStore: PgKeyValueStoreLive(postgres),
+    cronScheduler: ClusterCronSchedulerLive.pipe(
+      Layer.provide(persistenceKeyValueStore),
+      Layer.provide(topology),
+    ),
+    durableEntities: Layer.mergeAll(
+      ClusterDurableEntityHostLive,
+      ClusterDurableEntityControlLive,
+    ).pipe(
+      Layer.provide(PgEntityAlarmStoreLive.pipe(Layer.provide(sql))),
+      Layer.provide(persistenceKeyValueStore),
+      Layer.provide(topology),
+    ),
+    workflowRunner: ClusterWorkflowRunner.layer.pipe(Layer.provide(topology)),
+    runtime: SelfhostPlatformRuntimeLive,
+  };
+};
+
+let cached: SelfhostPlatformLayers | undefined;
+
+/**
+ * Resolves the process-wide platform composition.
+ *
+ * The result is memoized for the lifetime of the process, and deliberately so:
+ * every call site has to receive the *same* layer values, because Effect
+ * memoizes a layer per build by reference. Handing out fresh values would give
+ * one build two cluster topologies and two queue drivers, and a queue whose
+ * producer and consumer are different driver instances never delivers.
+ */
+export const makeSelfhostPlatformLayers = (
+  config: SelfhostPlatformSelection,
+): SelfhostPlatformLayers => {
+  cached ??= platformLayers(selfhostPlatformPostgres(config.platformDatabase));
+  return cached;
+};
+
+/**
+ * The process-wide platform layer: every swappable primitive except the
+ * workflow runner, which the server root builds once before registering the
+ * shared workflow registry.
+ */
+export const makeSelfhostPlatformLive = (
+  config: SelfhostRuntimeConfig,
+): Layer.Layer<QueueDriver | KeyValueStore | CronScheduler | PlatformRuntime> => {
+  const platform = makeSelfhostPlatformLayers(config);
+  return Layer.mergeAll(
+    platform.queue,
+    platform.keyValueStore,
+    platform.cronScheduler,
+    platform.runtime,
+  );
+};
diff --git a/selfhost/entry/src/backend/ProjectSchemaCache.ts b/apps/backend/src/backend/ProjectSchemaCache.ts
similarity index 100%
rename from selfhost/entry/src/backend/ProjectSchemaCache.ts
rename to apps/backend/src/backend/ProjectSchemaCache.ts
diff --git a/selfhost/entry/src/backend/Push.ts b/apps/backend/src/backend/Push.ts
similarity index 96%
rename from selfhost/entry/src/backend/Push.ts
rename to apps/backend/src/backend/Push.ts
index 9f130b236..454b93ed2 100644
--- a/selfhost/entry/src/backend/Push.ts
+++ b/apps/backend/src/backend/Push.ts
@@ -13,8 +13,8 @@ import {
 } from "@voidhash/core/services/notifications/PushDeliveryDispatch";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import { Db } from "@voidhash/db";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
-import { QueueDriver } from "@orbian/sdk/Queue";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { QueueDriver } from "@voidhash/platform/Queue";
 import { Context, Effect, Layer } from "effect";
 
 import type { SelfhostRuntimeConfig } from "../config.ts";
diff --git a/selfhost/entry/src/backend/Thumbnails.ts b/apps/backend/src/backend/Thumbnails.ts
similarity index 94%
rename from selfhost/entry/src/backend/Thumbnails.ts
rename to apps/backend/src/backend/Thumbnails.ts
index e080e6a3b..132e410ad 100644
--- a/selfhost/entry/src/backend/Thumbnails.ts
+++ b/apps/backend/src/backend/Thumbnails.ts
@@ -16,14 +16,14 @@ import type {
   PreviewTree,
   SnapshotNode,
 } from "@voidhash/paywall-renderer-web-core";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
-import { QueueDriver } from "@orbian/sdk/Queue";
-import { Screenshot } from "@orbian/sdk/Screenshot";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { QueueDriver } from "@voidhash/platform/Queue";
+import { Screenshot } from "@voidhash/platform/Screenshot";
 import {
   ChromiumScreenshotLive,
   type ChromiumScreenshotConfig,
-} from "@orbian/node/Screenshot";
-import { NodePlatformRuntimeLive } from "@orbian/node/PlatformRuntime";
+} from "@voidhash/platform-selfhost/Screenshot";
+import { SelfhostPlatformRuntimeLive } from "@voidhash/platform-selfhost/PlatformRuntime";
 import { Cause, Effect, Layer } from "effect";
 
 import { mimicDocumentIdleQueueName } from "../mimic/MimicDocumentIdleQueue.ts";
@@ -141,7 +141,7 @@ export const makeSelfhostSnapshotImageRendererLive = (
         Layer.provide(
           Layer.merge(
             ChromiumScreenshotLive(screenshotConfig),
-            NodePlatformRuntimeLive,
+            SelfhostPlatformRuntimeLive,
           ),
         ),
       ),
diff --git a/selfhost/entry/src/compiler/CompilerClient.ts b/apps/backend/src/compiler/CompilerClient.ts
similarity index 100%
rename from selfhost/entry/src/compiler/CompilerClient.ts
rename to apps/backend/src/compiler/CompilerClient.ts
diff --git a/selfhost/entry/src/compiler/CompilerCore.ts b/apps/backend/src/compiler/CompilerCore.ts
similarity index 100%
rename from selfhost/entry/src/compiler/CompilerCore.ts
rename to apps/backend/src/compiler/CompilerCore.ts
diff --git a/selfhost/entry/src/compiler/CompilerProtocol.ts b/apps/backend/src/compiler/CompilerProtocol.ts
similarity index 100%
rename from selfhost/entry/src/compiler/CompilerProtocol.ts
rename to apps/backend/src/compiler/CompilerProtocol.ts
diff --git a/selfhost/entry/src/compiler/main.ts b/apps/backend/src/compiler/main.ts
similarity index 100%
rename from selfhost/entry/src/compiler/main.ts
rename to apps/backend/src/compiler/main.ts
diff --git a/selfhost/entry/src/config.ts b/apps/backend/src/config.ts
similarity index 63%
rename from selfhost/entry/src/config.ts
rename to apps/backend/src/config.ts
index ee18bedb2..5196829bb 100644
--- a/selfhost/entry/src/config.ts
+++ b/apps/backend/src/config.ts
@@ -1,6 +1,11 @@
 import type { DbConfig } from "@voidhash/db/db";
-import type { SmtpMailerConfig } from "@orbian/node/Mailer";
-import type { S3ObjectStoreConfig } from "@orbian/node/ObjectStore";
+import type { SmtpMailerConfig } from "@voidhash/platform-selfhost/Mailer";
+import type { S3ObjectStoreConfig } from "@voidhash/platform-selfhost/ObjectStore";
+import {
+  isPlaceholderSecret,
+  resolveStandaloneAuthConfig,
+  standaloneAuthConfigIssues,
+} from "@voidhash/core/services/auth/StandaloneAuthConfig";
 import { Redacted } from "effect";
 
 const positiveIntegerFromEnv = (name: string, fallback: number): number => {
@@ -21,15 +26,6 @@ const optionalBooleanFromEnv = (name: string): boolean | undefined => {
   throw new Error(`${name} must be true or false`);
 };
 
-const requiredInProduction = (name: string, developmentFallback: string): string => {
-  const value = process.env[name]?.trim();
-  if (value) return value;
-  if (readSelfhostMode() === "production") {
-    throw new Error(`${name} is required in production`);
-  }
-  return developmentFallback;
-};
-
 export type SelfhostMode = "local-evaluation" | "production";
 
 const readSelfhostMode = (): SelfhostMode => {
@@ -38,18 +34,6 @@ const readSelfhostMode = (): SelfhostMode => {
   throw new Error("SELFHOST_MODE must be explicitly set to local-evaluation or production");
 };
 
-const isExampleSecret = (value: string | undefined): boolean => {
-  const normalized = value?.trim().toLowerCase();
-  return (
-    !normalized ||
-    normalized === "password" ||
-    normalized.includes("not_configured") ||
-    normalized.includes("change-me") ||
-    normalized.includes("replace-me") ||
-    normalized.startsWith("replace-with-")
-  );
-};
-
 const isHttpsUrl = (value: string | undefined): boolean => {
   if (!value) return false;
   try {
@@ -59,21 +43,19 @@ const isHttpsUrl = (value: string | undefined): boolean => {
   }
 };
 
-/** Refuses evaluation credentials and insecure public URLs in production mode. */
+/**
+ * Refuses evaluation credentials and insecure public URLs in production mode.
+ *
+ * The standalone identity provider is production-grade, so unlike the earlier
+ * development provider it is not refused here — what is refused is running it on
+ * the documented evaluation defaults, which are public knowledge.
+ */
 export const validateSelfhostSecurityConfig = (): SelfhostMode => {
   const mode = readSelfhostMode();
   if (mode === "local-evaluation") return mode;
 
-  const unsafeSettings: Array<string> = [];
-  const requiredSecrets = [
-    "DATABASE_PASSWORD",
-    "MIMIC_ROOT_PASSWORD",
-    "S3_SECRET_ACCESS_KEY",
-    "WORKOS_API_KEY",
-    "WORKOS_CLIENT_ID",
-    "WORKOS_COOKIE_PASSWORD",
-    "WORKOS_WEBHOOK_SECRET",
-  ];
+  const unsafeSettings: Array<string> = [...standaloneAuthConfigIssues()];
+  const requiredSecrets = ["DATABASE_PASSWORD", "MIMIC_ROOT_PASSWORD", "S3_SECRET_ACCESS_KEY"];
   if (process.env.CLICKHOUSE_URL?.trim()) {
     requiredSecrets.push(
       "CLICKHOUSE_ADMIN_PASSWORD",
@@ -83,18 +65,13 @@ export const validateSelfhostSecurityConfig = (): SelfhostMode => {
     );
   }
   for (const name of requiredSecrets) {
-    if (isExampleSecret(process.env[name])) unsafeSettings.push(name);
+    if (isPlaceholderSecret(process.env[name])) unsafeSettings.push(name);
   }
   if (!process.env.OPENAI_API_KEY?.trim() && !process.env.ANTHROPIC_API_KEY?.trim()) {
     unsafeSettings.push("OPENAI_API_KEY or ANTHROPIC_API_KEY");
   }
 
-  for (const name of [
-    "PUBLIC_BASE_URL",
-    "PUBLIC_FILES_BASE_URL",
-    "MIMIC_PUBLIC_BASE_URL",
-    "WORKOS_REDIRECT_URI",
-  ]) {
+  for (const name of ["PUBLIC_BASE_URL", "PUBLIC_FILES_BASE_URL", "MIMIC_PUBLIC_BASE_URL"]) {
     if (!isHttpsUrl(process.env[name])) unsafeSettings.push(name);
   }
 
@@ -106,15 +83,34 @@ export const validateSelfhostSecurityConfig = (): SelfhostMode => {
   return mode;
 };
 
-/** WorkOS credentials supplied by a Community Edition operator. */
-export interface SelfhostWorkosConfig {
-  readonly apiKey: string;
-  readonly clientId: string;
-  readonly cookieName: string;
-  readonly cookiePassword: string;
-  readonly webhookSecret: string;
+/**
+ * The single root identity and the key its session tokens are signed with.
+ *
+ * Self-host is single-player: these credentials are the only way in, and there
+ * is no code path that can create a second user.
+ */
+export interface SelfhostAuthConfig {
+  readonly rootUsername: string;
+  readonly rootPassword: Redacted.Redacted<string>;
+  readonly rootEmail: string;
+  readonly secret: Redacted.Redacted<string>;
 }
 
+/**
+ * Reads the standalone identity configuration. Evaluation defaults apply when
+ * the variables are unset; {@link validateSelfhostSecurityConfig} is what
+ * refuses those defaults in production.
+ */
+export const getSelfhostAuthConfig = (): SelfhostAuthConfig => {
+  const resolved = resolveStandaloneAuthConfig();
+  return {
+    rootEmail: resolved.rootEmail,
+    rootPassword: Redacted.make(resolved.rootPassword),
+    rootUsername: resolved.rootUsername,
+    secret: Redacted.make(resolved.secret),
+  };
+};
+
 /** A named ClickHouse connection used by the self-host analytics runtime. */
 export interface SelfhostClickhouseConnection {
   readonly database: string;
@@ -145,17 +141,23 @@ export interface SelfhostAgentConfig {
 /** Configuration for the single-process self-host runtime. */
 export interface SelfhostRuntimeConfig {
   readonly agent: SelfhostAgentConfig;
+  readonly auth: SelfhostAuthConfig;
   readonly clickhouse?: SelfhostClickhouseConfig;
   readonly componentCompilerUrl: string;
   readonly database: DbConfig;
   readonly host: string;
   readonly mailer: SmtpMailerConfig;
+  /**
+   * Where platform state lives: cluster mailboxes, workflow executions,
+   * persisted queues, entity alarms, and the key-value store. Defaults to
+   * {@link SelfhostRuntimeConfig.database}.
+   */
+  readonly platformDatabase: DbConfig;
   readonly port: number;
   readonly publicBaseUrl: string;
   readonly publicFilesBaseUrl: string;
   readonly publicObjectStore: S3ObjectStoreConfig;
   readonly artifactObjectStore: S3ObjectStoreConfig;
-  readonly workos: SelfhostWorkosConfig;
 }
 
 /** Reads optional ClickHouse configuration, returning undefined when analytics is disabled. */
@@ -202,6 +204,62 @@ export const getSelfhostDatabaseConfig = (): DbConfig => {
   };
 };
 
+/**
+ * Reads the application database connection used by out-of-band tooling that
+ * opens its own TCP socket — currently the migration entrypoint, which runs as
+ * a separate process before the server starts.
+ *
+ * Every `DATABASE_DIRECT_*` variable falls back to its `DATABASE_*` counterpart,
+ * so operators whose application already dials Postgres directly never set them.
+ * They exist for deployments where `DATABASE_HOST` names a sandboxed or proxied
+ * endpoint (a connection broker, a Hyperdrive-style local socket) that only
+ * resolves inside the runtime serving requests. Migrations need multi-statement
+ * SQL and a session-scoped advisory lock, so they always take the origin.
+ */
+export const getSelfhostMigrationDatabaseConfig = (): DbConfig => {
+  const fallback = getSelfhostDatabaseConfig();
+  const ssl = optionalBooleanFromEnv("DATABASE_DIRECT_SSL");
+  return {
+    ...fallback,
+    databaseName: process.env.DATABASE_DIRECT_NAME?.trim() || fallback.databaseName,
+    host: process.env.DATABASE_DIRECT_HOST?.trim() || fallback.host,
+    password: process.env.DATABASE_DIRECT_PASSWORD ?? fallback.password,
+    port: positiveIntegerFromEnv("DATABASE_DIRECT_PORT", fallback.port),
+    ...(ssl === undefined ? {} : { ssl }),
+    username: process.env.DATABASE_DIRECT_USERNAME?.trim() || fallback.username,
+  };
+};
+
+/**
+ * Reads the database that holds platform state — cluster mailboxes, workflow
+ * executions, persisted queues, entity alarms, and the platform key-value store.
+ *
+ * Every `DATABASE_PLATFORM_*` variable falls back to its `DATABASE_*`
+ * counterpart, so a deployment that leaves them unset keeps platform state
+ * beside application data in one database, which is the supported shape.
+ *
+ * Setting `DATABASE_PLATFORM_NAME` moves that state into its own database. The
+ * reason it is separable is shard ownership: a single-runner cluster claims
+ * *every* shard in the database it is built over, so two processes sharing one
+ * database steal each other's messages. That is exactly what a test process does
+ * to a running deployment, so `pnpm test:integration` points the suites that
+ * build their own topology at a database of their own.
+ */
+export const getSelfhostPlatformDatabaseConfig = (
+  fallback: DbConfig = getSelfhostDatabaseConfig(),
+): DbConfig => {
+  const ssl = optionalBooleanFromEnv("DATABASE_PLATFORM_SSL");
+  return {
+    ...fallback,
+    databaseName: process.env.DATABASE_PLATFORM_NAME?.trim() || fallback.databaseName,
+    host: process.env.DATABASE_PLATFORM_HOST?.trim() || fallback.host,
+    password: process.env.DATABASE_PLATFORM_PASSWORD ?? fallback.password,
+    port: positiveIntegerFromEnv("DATABASE_PLATFORM_PORT", fallback.port),
+    ...(ssl === undefined ? {} : { ssl }),
+    username: process.env.DATABASE_PLATFORM_USERNAME?.trim() || fallback.username,
+  };
+};
+
 /** Reads the SMTP transport and default sender configuration. */
 export const getSelfhostSmtpConfig = (): SmtpMailerConfig => {
   const username = process.env.SMTP_USERNAME?.trim() || undefined;
@@ -259,11 +317,13 @@ export const getSelfhostRuntimeConfig = (): SelfhostRuntimeConfig => {
       ...objectStore,
       bucketName: process.env.S3_ARTIFACT_BUCKET?.trim() || "voidhash-artifacts",
     },
+    auth: getSelfhostAuthConfig(),
     database: getSelfhostDatabaseConfig(),
     ...(clickhouse === undefined ? {} : { clickhouse }),
     componentCompilerUrl: process.env.COMPONENT_COMPILER_URL?.trim() || "http://127.0.0.1:5002",
     host: process.env.HOST?.trim() || "0.0.0.0",
     mailer: getSelfhostSmtpConfig(),
+    platformDatabase: getSelfhostPlatformDatabaseConfig(),
     port: positiveIntegerFromEnv("PORT", 5001),
     publicBaseUrl,
     publicFilesBaseUrl: process.env.PUBLIC_FILES_BASE_URL?.trim() || publicBaseUrl,
@@ -271,15 +331,5 @@ export const getSelfhostRuntimeConfig = (): SelfhostRuntimeConfig => {
       ...objectStore,
       bucketName: process.env.S3_PUBLIC_BUCKET?.trim() || "voidhash-public",
     },
-    workos: {
-      apiKey: requiredInProduction("WORKOS_API_KEY", "sk_test_selfhost_not_configured"),
-      clientId: requiredInProduction("WORKOS_CLIENT_ID", "client_selfhost_not_configured"),
-      cookieName: process.env.WORKOS_COOKIE_NAME?.trim() || "wos-session",
-      cookiePassword: requiredInProduction(
-        "WORKOS_COOKIE_PASSWORD",
-        "selfhost-development-cookie-password-change-me",
-      ),
-      webhookSecret: requiredInProduction("WORKOS_WEBHOOK_SECRET", "whsec_selfhost_not_configured"),
-    },
   };
 };
diff --git a/apps/backend/src/index.ts b/apps/backend/src/index.ts
new file mode 100644
index 000000000..f863480ec
--- /dev/null
+++ b/apps/backend/src/index.ts
@@ -0,0 +1,18 @@
+export { makeBackendInfrastructureLive, makeSelfhostAuthLayers } from "./backend/Backend.ts";
+export { makeBackendMimicHostLive } from "./backend/MimicHost.ts";
+export {
+  getSelfhostDatabaseConfig,
+  getSelfhostMigrationDatabaseConfig,
+  getSelfhostPlatformDatabaseConfig,
+  getSelfhostRuntimeConfig,
+} from "./config.ts";
+export { getMimicNodeConfig } from "./mimic/config.ts";
+export { runSelfhostMigrations, type SelfhostMigrationOptions } from "./migrations.ts";
+export { makeMimicNodeHostLive, type MimicNodeConfig } from "./mimic/MimicNode.ts";
+export { installMimicNodeWebSocketServer } from "./mimic/MimicNodeWebSocket.ts";
+export { makePgControlStore, PgControlStoreLive } from "./mimic/PgControlStore.ts";
+export {
+  runSelfhostServer,
+  type SelfhostServerOptions,
+  type SelfhostServerRuntime,
+} from "./server.ts";
diff --git a/apps/backend/src/main.ts b/apps/backend/src/main.ts
new file mode 100644
index 000000000..3dae94f6c
--- /dev/null
+++ b/apps/backend/src/main.ts
@@ -0,0 +1,15 @@
+import { NodeRuntime } from "@effect/platform-node";
+import {
+  NoBackendFeatures,
+  NoBackendRpcExtension,
+} from "@voidhash/backend/BackendApp";
+
+import { runSelfhostServer } from "./server.ts";
+
+NodeRuntime.runMain(
+  runSelfhostServer({
+    edition: "Community Edition",
+    features: NoBackendFeatures,
+    rpcExtension: () => NoBackendRpcExtension,
+  }) as never,
+);
diff --git a/apps/backend/src/migrate.ts b/apps/backend/src/migrate.ts
new file mode 100644
index 000000000..0ac81c2fe
--- /dev/null
+++ b/apps/backend/src/migrate.ts
@@ -0,0 +1,6 @@
+import { NodeRuntime } from "@effect/platform-node";
+import { Effect } from "effect";
+
+import { runSelfhostMigrations } from "./migrations.ts";
+
+NodeRuntime.runMain(Effect.scoped(runSelfhostMigrations()) as never);
diff --git a/apps/backend/src/migrations.ts b/apps/backend/src/migrations.ts
new file mode 100644
index 000000000..b0be83062
--- /dev/null
+++ b/apps/backend/src/migrations.ts
@@ -0,0 +1,52 @@
+import { runAppDatabaseMigrations } from "@voidhash/db/migrations";
+import { PgClusterDurableEntityLive } from "@voidhash/platform-selfhost/ClusterDurableEntity";
+import { Effect, Layer } from "effect";
+
+import { migrateSelfhostClickhouse } from "./backend/Clickhouse.ts";
+import { selfhostPlatformPostgres } from "./backend/PlatformProfile.ts";
+import {
+  getSelfhostClickhouseConfig,
+  getSelfhostMigrationDatabaseConfig,
+  getSelfhostPlatformDatabaseConfig,
+  validateSelfhostSecurityConfig,
+} from "./config.ts";
+import { getMimicNodeConfig } from "./mimic/config.ts";
+import { makeMimicNodeHostLive } from "./mimic/MimicNode.ts";
+
+/** Extra migration sources a private composition owns alongside the OSS schema. */
+export interface SelfhostMigrationOptions {
+  /**
+   * Directories holding `<timestamp>_<name>/migration.sql` folders, applied
+   * after the OSS schema into the same `__alchemy_migrations` ledger.
+   */
+  readonly additionalDirectories?: ReadonlyArray<URL>;
+}
+
+/**
+ * Applies every migration the self-host runtime needs: the application schema,
+ * the mimic document control tables, and — when analytics is configured — the
+ * ClickHouse schema.
+ */
+export const runSelfhostMigrations = (options: SelfhostMigrationOptions = {}) =>
+  Effect.gen(function* () {
+    validateSelfhostSecurityConfig();
+    const connection = getSelfhostMigrationDatabaseConfig();
+    const result = yield* runAppDatabaseMigrations(connection);
+    let applied = result.applied.length;
+    let skipped = result.skipped;
+    for (const directory of options.additionalDirectories ?? []) {
+      const extra = yield* runAppDatabaseMigrations(connection, { directory });
+      applied += extra.applied.length;
+      skipped += extra.skipped;
+    }
+    // Building the host is what creates the self-managed tables: the mimic
+    // control and document tables in the application database, plus the entity
+    // value and alarm stores in whichever database holds platform state.
+    const mimicConfig = getMimicNodeConfig(connection);
+    const platform = selfhostPlatformPostgres(getSelfhostPlatformDatabaseConfig(connection));
+    yield* Layer.build(
+      makeMimicNodeHostLive(mimicConfig, PgClusterDurableEntityLive(platform)),
+    );
+    yield* migrateSelfhostClickhouse(getSelfhostClickhouseConfig());
+    yield* Effect.logInfo("Self-host database migrations are ready", { applied, skipped });
+  });
diff --git a/selfhost/entry/src/mimic/MimicDocumentIdleQueue.ts b/apps/backend/src/mimic/MimicDocumentIdleQueue.ts
similarity index 86%
rename from selfhost/entry/src/mimic/MimicDocumentIdleQueue.ts
rename to apps/backend/src/mimic/MimicDocumentIdleQueue.ts
index b617f2e07..660fc9941 100644
--- a/selfhost/entry/src/mimic/MimicDocumentIdleQueue.ts
+++ b/apps/backend/src/mimic/MimicDocumentIdleQueue.ts
@@ -2,8 +2,8 @@ import {
   MimicDocumentIdleMessage,
   type MimicDocumentIdleMessageType,
 } from "@voidhash/mimic-db/ws/idle-notify";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
-import { QueueDriver } from "@orbian/sdk/Queue";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { QueueDriver } from "@voidhash/platform/Queue";
 import { Effect } from "effect";
 
 /** Logical PostgreSQL queue carrying idle Mimic document revisions. */
diff --git a/selfhost/entry/src/mimic/MimicNode.ts b/apps/backend/src/mimic/MimicNode.ts
similarity index 69%
rename from selfhost/entry/src/mimic/MimicNode.ts
rename to apps/backend/src/mimic/MimicNode.ts
index 6eed75ac7..c4467c91d 100644
--- a/selfhost/entry/src/mimic/MimicNode.ts
+++ b/apps/backend/src/mimic/MimicNode.ts
@@ -11,29 +11,34 @@ import {
   makePgDocumentStore,
   type PgDocumentConfig,
 } from "@voidhash/mimic-db/core/pg-store";
-import { DurableEntityHost } from "@orbian/sdk/DurableEntity";
-import {
-  NodeDurableEntityControl,
-  type PgDurableEntityConfig,
-  PgDurableEntityHostLive,
-} from "@orbian/node/DurableEntity";
+import type {
+  DurableEntityAlarmControl,
+  DurableEntityHost,
+} from "@voidhash/platform/DurableEntity";
+import type { PgPlatformConfig } from "@voidhash/platform-selfhost/Postgres";
 import { Effect, Layer } from "effect";
 
 import { PgControlStoreLive } from "./PgControlStore.ts";
 
 /** Database-backed configuration for the standalone mimic Node composition. */
 export interface MimicNodeConfig {
-  readonly database: PgDurableEntityConfig;
+  readonly database: PgPlatformConfig;
   readonly documents: PgDocumentConfig;
 }
 
 /**
  * Builds the persistent single-node mimic host. Control state, document logs,
- * snapshots, entity KV, and alarms all survive process restarts in Postgres.
+ * snapshots, entity values, and alarms all survive process restarts in
+ * Postgres.
+ *
+ * The entity layer is supplied by the caller rather than built here: it carries
+ * the process-wide cluster topology, and a second topology in one process would
+ * compete with the first for the same shard leases.
  */
 export const makeMimicNodeHostLive = (
   config: MimicNodeConfig,
-): Layer.Layer<HostServiceTag | DurableEntityHost | NodeDurableEntityControl> => {
+  entities: Layer.Layer<DurableEntityHost | DurableEntityAlarmControl>,
+): Layer.Layer<HostServiceTag | DurableEntityHost | DurableEntityAlarmControl> => {
   const documentStores = Layer.effect(
     DocumentStoreFactory,
     ensureDocumentTables(config.documents).pipe(
@@ -45,7 +50,6 @@ export const makeMimicNodeHostLive = (
     ),
   );
 
-  const entities = PgDurableEntityHostLive(config.database);
   const host = LocalHostServiceLive.pipe(
     Layer.provide(PgControlStoreLive(config.database)),
     Layer.provide(entities),
diff --git a/selfhost/entry/src/mimic/MimicNodeWebSocket.ts b/apps/backend/src/mimic/MimicNodeWebSocket.ts
similarity index 91%
rename from selfhost/entry/src/mimic/MimicNodeWebSocket.ts
rename to apps/backend/src/mimic/MimicNodeWebSocket.ts
index 60150652b..ba8843dc1 100644
--- a/selfhost/entry/src/mimic/MimicNodeWebSocket.ts
+++ b/apps/backend/src/mimic/MimicNodeWebSocket.ts
@@ -17,11 +17,12 @@ import { encodeServerMessage } from "@voidhash/mimic-db/ws/protocol";
 import { makeSessionRegistry } from "@voidhash/mimic-db/ws/session-registry";
 import {
   DurableEntityHost,
+  type DurableEntityAlarmControlShape,
   type DurableEntityContext,
+  type DurableEntitySession,
   makeDurableEntityAddress,
-} from "@orbian/sdk/DurableEntity";
-import type { NodeDurableEntityControlShape } from "@orbian/node/DurableEntity";
-import { makeNodeDurableEntitySession } from "@orbian/node/NodeDurableEntitySession";
+} from "@voidhash/platform/DurableEntity";
+import { makeNodeDurableEntitySession } from "@voidhash/platform-selfhost/NodeDurableEntitySession";
 import { Duration, Effect, Fiber, Semaphore } from "effect";
 import WebSocket, { WebSocketServer, type RawData } from "ws";
 
@@ -32,6 +33,11 @@ import {
 
 interface NodeDocumentSocket {
   readonly webSocket: WebSocket;
+  /**
+   * The entity-side handle for this socket. Host-side broadcasts read their
+   * attachment from here, so every attachment write has to reach it.
+   */
+  readonly entitySession: DurableEntitySession;
   attachment: SessionAttachment | null;
 }
 
@@ -43,7 +49,7 @@ interface NodeDocumentRuntime {
 
 /** Persisted idle-notification settings for the Node WebSocket host. */
 export interface MimicNodeIdleNotificationOptions {
-  readonly control: NodeDurableEntityControlShape;
+  readonly control: DurableEntityAlarmControlShape;
   readonly debounceMs: number;
   readonly publish: (message: MimicDocumentIdleMessageType) => Effect.Effect<void, unknown>;
   readonly pollIntervalMs?: number;
@@ -219,7 +225,14 @@ export const installMimicNodeWebSocketServer = (
           ),
       },
       getAttachment: (socket) => socket.attachment,
-      setAttachment: (socket, attachment) => void (socket.attachment = attachment),
+      // Authentication replaces the attachment object rather than mutating it,
+      // so the entity session has to be updated too. Without this write-through
+      // the host-side broadcast keeps reading the pre-auth attachment and
+      // silently skips every authenticated browser socket.
+      setAttachment: (socket, attachment) => {
+        socket.attachment = attachment;
+        Effect.runSync(socket.entitySession.setAttachment(attachment));
+      },
       send: (socket, message) =>
         Effect.sync(() => void socket.webSocket.send(encodeServerMessage(message))),
       close: (socket, code, reason) => Effect.sync(() => void socket.webSocket.close(code, reason)),
@@ -270,25 +283,14 @@ export const installMimicNodeWebSocketServer = (
     }
     webSockets.handleUpgrade(request, socket, head, (webSocket) => {
       const runtime = runtimeFor(address.collectionId, address.documentId);
-      const nodeSocket: NodeDocumentSocket = {
-        webSocket,
-        attachment: {
-          connectionId: crypto.randomUUID(),
-          collectionId: address.collectionId,
-          documentId: address.documentId,
-          origin: request.headers.origin ?? null,
-          connectedAt: Date.now(),
-          authenticated: false,
-        },
+      const attachment: SessionAttachment = {
+        connectionId: crypto.randomUUID(),
+        collectionId: address.collectionId,
+        documentId: address.documentId,
+        origin: request.headers.origin ?? null,
+        connectedAt: Date.now(),
+        authenticated: false,
       };
-      const attachment = nodeSocket.attachment;
-      if (!attachment) {
-        webSocket.close(1011, "Session initialization failed");
-        return;
-      }
-      runtime.connections.add(nodeSocket);
-      runtime.context.registry.trackPending(attachment.connectionId, nodeSocket);
-      const entityAddress = documentEntityAddress(address.collectionId, address.documentId);
       const entitySession = makeNodeDurableEntitySession(
         attachment.connectionId,
         {
@@ -297,6 +299,10 @@ export const installMimicNodeWebSocketServer = (
         },
         attachment,
       );
+      const nodeSocket: NodeDocumentSocket = { webSocket, entitySession, attachment };
+      runtime.connections.add(nodeSocket);
+      runtime.context.registry.trackPending(attachment.connectionId, nodeSocket);
+      const entityAddress = documentEntityAddress(address.collectionId, address.documentId);
       const ready = Effect.runPromise(
         entities.run(entityAddress, (entity) => entity.sessions.attach(entitySession)),
       );
diff --git a/selfhost/entry/src/mimic/PgControlStore.ts b/apps/backend/src/mimic/PgControlStore.ts
similarity index 98%
rename from selfhost/entry/src/mimic/PgControlStore.ts
rename to apps/backend/src/mimic/PgControlStore.ts
index 423b16088..4c1efcf24 100644
--- a/selfhost/entry/src/mimic/PgControlStore.ts
+++ b/apps/backend/src/mimic/PgControlStore.ts
@@ -10,7 +10,7 @@ import type {
   UserRecord,
 } from "@voidhash/mimic-db/core/store";
 import { ControlStore } from "@voidhash/mimic-db/core/store";
-import type { PgDurableEntityConfig } from "@orbian/node/DurableEntity";
+import type { PgPlatformConfig } from "@voidhash/platform-selfhost/Postgres";
 import { Effect, Layer } from "effect";
 import { SqlClient } from "effect/unstable/sql";
 
@@ -262,7 +262,7 @@ export const makePgControlStore = (sql: SqlClient.SqlClient): ControlStoreApi =>
 };
 
 /** Persistent Postgres control-store layer for the single-node mimic host. */
-export const PgControlStoreLive = (config: PgDurableEntityConfig): Layer.Layer<ControlStore> =>
+export const PgControlStoreLive = (config: PgPlatformConfig): Layer.Layer<ControlStore> =>
   Layer.effect(
     ControlStore,
     Effect.gen(function* () {
diff --git a/apps/backend/src/mimic/config.ts b/apps/backend/src/mimic/config.ts
new file mode 100644
index 000000000..97e4e23d2
--- /dev/null
+++ b/apps/backend/src/mimic/config.ts
@@ -0,0 +1,33 @@
+import type { DbConfig } from "@voidhash/db/db";
+import { makePgDocumentConfig } from "@voidhash/mimic-db/core/pg-store";
+import type { PgPlatformConfig } from "@voidhash/platform-selfhost/Postgres";
+import { Redacted } from "effect";
+
+import { getSelfhostDatabaseConfig } from "../config.ts";
+import type { MimicNodeConfig } from "./MimicNode.ts";
+
+/**
+ * Reads the self-host mimic database configuration. Defaults to the shared
+ * application connection; the migration entrypoint passes the direct-TCP
+ * connection instead, because building this host also issues DDL.
+ */
+export const getMimicNodeConfig = (
+  connection: DbConfig = getSelfhostDatabaseConfig(),
+): MimicNodeConfig => {
+  const { databaseName: database, host, port, username } = connection;
+  const databaseConfig: PgPlatformConfig = {
+    host,
+    port,
+    database,
+    username,
+    password: Redacted.make(connection.password),
+  };
+  const documents = makePgDocumentConfig({
+    host,
+    port,
+    database,
+    username,
+    password: connection.password,
+  });
+  return { database: databaseConfig, documents };
+};
diff --git a/selfhost/entry/src/mimic/main.ts b/apps/backend/src/mimic/main.ts
similarity index 74%
rename from selfhost/entry/src/mimic/main.ts
rename to apps/backend/src/mimic/main.ts
index 96bc16d4e..19792c84b 100644
--- a/selfhost/entry/src/mimic/main.ts
+++ b/apps/backend/src/mimic/main.ts
@@ -4,15 +4,15 @@ import { NodeHttpServer, NodeRuntime } from "@effect/platform-node";
 import { HostServiceTag } from "@voidhash/mimic-db/app/hostService";
 import { getConfig } from "@voidhash/mimic-db/config";
 import { makeRoutesLive } from "@voidhash/mimic-db/http/rpc-app";
-import { DurableEntityHost } from "@orbian/sdk/DurableEntity";
 import {
-  NodeDurableEntityControl,
-} from "@orbian/node/DurableEntity";
-import { NodePlatformRuntimeLive } from "@orbian/node/PlatformRuntime";
-import { PgQueueLive } from "@orbian/node/Queue";
+  DurableEntityAlarmControl,
+  DurableEntityHost,
+} from "@voidhash/platform/DurableEntity";
 import { Context, Effect, Layer } from "effect";
 import { HttpRouter } from "effect/unstable/http";
 
+import { makeSelfhostPlatformLayers } from "../backend/PlatformProfile.ts";
+import { getSelfhostPlatformDatabaseConfig } from "../config.ts";
 import { getMimicNodeConfig } from "./config.ts";
 import { makeSelfhostMimicDocumentIdlePublisher } from "./MimicDocumentIdleQueue.ts";
 import { makeMimicNodeHostLive } from "./MimicNode.ts";
@@ -20,7 +20,14 @@ import { installMimicNodeWebSocketServer } from "./MimicNodeWebSocket.ts";
 
 const port = Number(process.env.PORT ?? "5001");
 const config = getMimicNodeConfig();
-const hostLayer = makeMimicNodeHostLive(config);
+// Idle-document notifications are produced here and consumed by the backend, so
+// this process has to publish onto the same queue the backend installs there.
+// Resolving the composition through the shared module is what keeps a split
+// deployment from silently dropping every message.
+const platform = makeSelfhostPlatformLayers({
+  platformDatabase: getSelfhostPlatformDatabaseConfig(),
+});
+const hostLayer = makeMimicNodeHostLive(config, platform.durableEntities);
 
 NodeRuntime.runMain(
   Effect.scoped(
@@ -28,10 +35,8 @@ NodeRuntime.runMain(
       const hostContext = yield* Layer.build(hostLayer);
       const host = Context.get(hostContext, HostServiceTag);
       const entities = Context.get(hostContext, DurableEntityHost);
-      const entityControl = Context.get(hostContext, NodeDurableEntityControl);
-      const queueContext = yield* Layer.build(
-        Layer.merge(PgQueueLive(config.database), NodePlatformRuntimeLive),
-      );
+      const entityControl = Context.get(hostContext, DurableEntityAlarmControl);
+      const queueContext = yield* Layer.build(Layer.merge(platform.queue, platform.runtime));
       const publishIdleDocument = yield* makeSelfhostMimicDocumentIdlePublisher.pipe(
         Effect.provide(queueContext),
       );
diff --git a/selfhost/entry/src/release-smoke.ts b/apps/backend/src/release-smoke.ts
similarity index 90%
rename from selfhost/entry/src/release-smoke.ts
rename to apps/backend/src/release-smoke.ts
index a9f57ee83..1fa6368c4 100644
--- a/selfhost/entry/src/release-smoke.ts
+++ b/apps/backend/src/release-smoke.ts
@@ -1,5 +1,5 @@
 import { NodeRuntime } from "@effect/platform-node";
-import { BackendSnapshotHtmlRendererLive } from "@voidhash/backend/src/PaywallSnapshotHtmlRenderer.ts";
+import { BackendSnapshotHtmlRendererLive } from "@voidhash/backend/PaywallSnapshotHtmlRenderer";
 import type { AnyAuthSession } from "@voidhash/core/domain/auth/Auth";
 import { AuthSession } from "@voidhash/core/domain/auth/Auth";
 import {
@@ -11,8 +11,9 @@ import { Context, Effect, Layer } from "effect";
 
 import {
   makeBackendInfrastructureLive,
-  makeSelfhostWorkosLive,
+  makeSelfhostAuthLayers,
 } from "./backend/Backend.ts";
+import { makeSelfhostPlatformLayers } from "./backend/PlatformProfile.ts";
 import { getSelfhostRuntimeConfig } from "./config.ts";
 import { makeMimicNodeHostLive } from "./mimic/MimicNode.ts";
 import { getMimicNodeConfig } from "./mimic/config.ts";
@@ -65,14 +66,17 @@ NodeRuntime.runMain(
       const userId = requiredEnv("SELFHOST_RELEASE_USER_ID");
       const config = getSelfhostRuntimeConfig();
       const hostContext = yield* Layer.build(
-        makeMimicNodeHostLive(getMimicNodeConfig()),
+        makeMimicNodeHostLive(
+          getMimicNodeConfig(),
+          makeSelfhostPlatformLayers(config).durableEntities,
+        ),
       );
       const hostLayer = Layer.succeed(
         HostServiceTag,
         Context.get(hostContext, HostServiceTag),
       );
-      const workos = makeSelfhostWorkosLive(config.workos);
-      const infrastructure = makeBackendInfrastructureLive(config, workos).pipe(
+      const authLayers = makeSelfhostAuthLayers(config.auth);
+      const infrastructure = makeBackendInfrastructureLive(config, authLayers.identity).pipe(
         Layer.provide(hostLayer),
       );
       const dependencies = Layer.mergeAll(
diff --git a/apps/backend/src/routes/webhooks/workos.ts b/apps/backend/src/routes/webhooks/workos.ts
deleted file mode 100644
index cd1250296..000000000
--- a/apps/backend/src/routes/webhooks/workos.ts
+++ /dev/null
@@ -1,314 +0,0 @@
-/**
- * WorkOS webhook endpoint — `POST /api/webhooks/workos`.
- *
- * WorkOS is the source of truth for users and organizations. The handler
- * verifies the WorkOS signature, persists the raw event for idempotency, and
- * applies public user/organization mutations locally. Optional multi-user
- * membership projection is delegated through an extension port.
- *
- * - Bad signature → 400.
- * - Idempotent duplicate (same `event.id` already recorded) → 200.
- * - Processing failure → 500 (WorkOS retries on the same `event.id`).
- */
-import type {
-  Event as WorkosEvent,
-  Organization as WorkosOrganization,
-  User as WorkosUser,
-} from "@workos-inc/node";
-import { LocalUserSessionService } from "@voidhash/core/services/auth/LocalUserSessionService";
-import { Workos } from "@voidhash/core/services/auth/Workos";
-import { OrganizationMembershipWebhookPort } from "@voidhash/core/services/organizations/OrganizationMembershipWebhookPort";
-import { generateId } from "@voidhash/core/utils";
-import {
-  Db,
-  eq,
-  organization,
-  user,
-  workosWebhookEvents,
-  type InsertOrganization,
-  type InsertWorkosWebhookEvent,
-} from "@voidhash/db";
-import { Cause, Context, Effect, Layer } from "effect";
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
-
-type DbService = Context.Service.Shape<typeof Db>;
-type WorkosShape = Context.Service.Shape<typeof Workos>;
-type LocalUserSessionShape = Context.Service.Shape<typeof LocalUserSessionService>;
-type MembershipWebhookShape = Context.Service.Shape<typeof OrganizationMembershipWebhookPort>;
-
-class WebhookProcessingError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "WebhookProcessingError";
-  }
-}
-
-const describeFailure = (failure: unknown): string => {
-  const message = failure instanceof Error ? failure.message : String(failure);
-  const cause = (failure as { readonly cause?: unknown } | null)?.cause;
-  if (!cause) return message;
-  const causeMessage =
-    cause instanceof Error
-      ? cause.message
-      : (() => {
-          try {
-            return typeof cause === "object" ? JSON.stringify(cause) : String(cause);
-          } catch {
-            return String(cause);
-          }
-        })();
-  return causeMessage && causeMessage !== message ? `${message}: ${causeMessage}` : message;
-};
-
-const recordWebhookReceived = (db: DbService, event: InsertWorkosWebhookEvent) =>
-  db.insert(workosWebhookEvents).values(event);
-
-const findWebhookRecordByExternalId = (db: DbService, externalEventId: string) =>
-  db.query.workosWebhookEvents.findFirst({
-    where: { externalEventId },
-  });
-
-const refreshWebhookRecordForRetry = (
-  db: DbService,
-  input: Pick<InsertWorkosWebhookEvent, "eventType" | "payload"> & { readonly id: string },
-) =>
-  db
-    .update(workosWebhookEvents)
-    .set({
-      error: null,
-      eventType: input.eventType,
-      payload: input.payload,
-    })
-    .where(eq(workosWebhookEvents.id, input.id));
-
-const markWebhookProcessed = (db: DbService, id: string) =>
-  db
-    .update(workosWebhookEvents)
-    .set({ error: null, processedAt: new Date() })
-    .where(eq(workosWebhookEvents.id, id));
-
-const markWebhookError = (db: DbService, id: string, error: string) =>
-  db.update(workosWebhookEvents).set({ error }).where(eq(workosWebhookEvents.id, id));
-
-const isOrganizationEvent = (
-  e: WorkosEvent,
-): e is Extract<WorkosEvent, { event: `organization.${string}` }> =>
-  e.event === "organization.created" ||
-  e.event === "organization.updated" ||
-  e.event === "organization.deleted";
-
-const isMembershipEvent = (
-  e: WorkosEvent,
-): e is Extract<WorkosEvent, { event: `organization_membership.${string}` }> =>
-  e.event === "organization_membership.created" ||
-  e.event === "organization_membership.updated" ||
-  e.event === "organization_membership.deleted";
-
-const isUserEvent = (e: WorkosEvent): e is Extract<WorkosEvent, { event: `user.${string}` }> =>
-  e.event === "user.created" || e.event === "user.updated" || e.event === "user.deleted";
-
-const upsertOrganizationFromWorkos = (db: DbService, org: WorkosOrganization) =>
-  Effect.gen(function* () {
-    const existing = yield* db.query.organization.findFirst({
-      where: { workosOrganizationId: org.id },
-    });
-    if (existing) {
-      yield* db
-        .update(organization)
-        .set({ name: org.name })
-        .where(eq(organization.workosOrganizationId, org.id));
-      return;
-    }
-
-    // `externalId` carries the local id we stamped on WorkOS at create time.
-    // Re-link a row that already exists under that id (a direct existence
-    // check, not a length heuristic); never adopt the external id as a fresh
-    // primary key, so a foreign external id can't leak into ours.
-    if (org.externalId) {
-      const existingByExternalId = yield* db.query.organization.findFirst({
-        where: { id: org.externalId },
-      });
-      if (existingByExternalId) {
-        yield* db
-          .update(organization)
-          .set({ name: org.name, workosOrganizationId: org.id })
-          .where(eq(organization.id, existingByExternalId.id));
-        return;
-      }
-    }
-
-    // We weren't the creator (e.g., org created in the WorkOS Admin Portal
-    // directly). Mint a local row from scratch with our own generated id.
-    const newOrg: InsertOrganization = {
-      createdAt: new Date(),
-      id: generateId("organization"),
-      logo: null,
-      metadata: null,
-      name: org.name,
-      slug: `${(org.externalId ?? org.id).slice(0, 12)}-${crypto.randomUUID().slice(0, 6)}`,
-      workosOrganizationId: org.id,
-    };
-    yield* db.insert(organization).values(newOrg);
-  });
-
-const deleteOrganizationByWorkosId = (db: DbService, workosOrganizationId: string) =>
-  db.delete(organization).where(eq(organization.workosOrganizationId, workosOrganizationId));
-
-const deleteUserByWorkosUser = (db: DbService, workosUser: WorkosUser) =>
-  Effect.gen(function* () {
-    const existing = yield* db.query.user.findFirst({
-      where: { workosUserId: workosUser.id },
-    });
-    if (existing) {
-      yield* db.delete(user).where(eq(user.id, existing.id));
-      return;
-    }
-    yield* db.delete(user).where(eq(user.email, workosUser.email));
-  });
-
-const processEvent = (
-  db: DbService,
-  workosAuth: WorkosShape,
-  localUserSessions: LocalUserSessionShape,
-  membershipWebhooks: MembershipWebhookShape,
-  event: WorkosEvent,
-): Effect.Effect<void, unknown, Db> => {
-  if (isOrganizationEvent(event)) {
-    if (event.event === "organization.deleted") {
-      return deleteOrganizationByWorkosId(db, event.data.id);
-    }
-    return upsertOrganizationFromWorkos(db, event.data);
-  }
-  if (isMembershipEvent(event)) {
-    if (event.event === "organization_membership.deleted") {
-      return membershipWebhooks.processEvent({
-        _tag: "Delete",
-        externalMembershipId: event.data.id,
-      });
-    }
-    const role =
-      typeof event.data.role === "string"
-        ? event.data.role
-        : (event.data.role?.slug ?? "member");
-    return membershipWebhooks.processEvent({
-      _tag: "Upsert",
-      membership: {
-        externalId: event.data.id,
-        externalOrganizationId: event.data.organizationId,
-        externalUserId: event.data.userId,
-        role,
-      },
-    });
-  }
-  if (isUserEvent(event)) {
-    if (event.event === "user.deleted") {
-      return deleteUserByWorkosUser(db, event.data);
-    }
-    return localUserSessions.resolveLocalUser(event.data).pipe(Effect.asVoid);
-  }
-  return Effect.void;
-};
-
-const handleWebhook = Effect.gen(function* () {
-  const db = yield* Db;
-  const workosAuth = yield* Workos;
-  const localUserSessions = yield* LocalUserSessionService;
-  const membershipWebhooks = yield* OrganizationMembershipWebhookPort;
-  const request = yield* HttpServerRequest.HttpServerRequest;
-
-  const rawBody = yield* request.text;
-  const signatureHeader = request.headers["workos-signature"] ?? "";
-
-  if (!signatureHeader) {
-    return yield* HttpServerResponse.json(
-      { error: "Missing workos-signature header" },
-      { status: 400 },
-    );
-  }
-
-  const event = yield* workosAuth.verifyWebhook({ rawBody, signatureHeader }).pipe(
-    Effect.catch((error) => {
-      // Surface the underlying SDK reason (e.g. "Signature hash does not match
-      // …", "Timestamp outside the tolerance zone") rather than the generic
-      // wrapper message, so signature/secret problems are diagnosable.
-      const detail =
-        error.cause instanceof Error ? error.cause.message : String(error.cause ?? error.message);
-      return Effect.logError(`WorkOS webhook signature verification failed: ${detail}`).pipe(
-        Effect.andThen(Effect.fail(new WebhookProcessingError(detail))),
-      );
-    }),
-  );
-
-  const rowId = generateId("workosWebhookEvent");
-  const insertResult = yield* Effect.result(
-    recordWebhookReceived(db, {
-      createdAt: new Date(),
-      eventType: event.event,
-      externalEventId: event.id,
-      id: rowId,
-      payload: event as unknown as object,
-    }),
-  );
-
-  let eventRowId: string = rowId;
-  if (insertResult._tag === "Failure") {
-    const existing = yield* findWebhookRecordByExternalId(db, event.id);
-    if (!existing) {
-      const message = describeFailure(insertResult.failure);
-      return yield* Effect.fail(new WebhookProcessingError(message));
-    }
-
-    if (existing.processedAt) {
-      yield* Effect.logInfo(`WorkOS webhook ${event.id} already processed; skipping`);
-      return yield* HttpServerResponse.json({ received: true, duplicate: true });
-    }
-
-    eventRowId = existing.id;
-    yield* refreshWebhookRecordForRetry(db, {
-      eventType: event.event,
-      id: existing.id,
-      payload: event as unknown as object,
-    });
-  }
-
-  const processed = yield* Effect.result(
-    processEvent(db, workosAuth, localUserSessions, membershipWebhooks, event),
-  );
-  if (processed._tag === "Failure") {
-    const message = describeFailure(processed.failure);
-    yield* markWebhookError(db, eventRowId, message.slice(0, 500)).pipe(
-      Effect.catch(() => Effect.void),
-    );
-    return yield* Effect.fail(new WebhookProcessingError(message));
-  }
-
-  yield* markWebhookProcessed(db, eventRowId);
-  return yield* HttpServerResponse.json({ received: true });
-});
-
-const registerWorkosWebhookRoute = Effect.gen(function* () {
-  const router = yield* HttpRouter.HttpRouter;
-
-  yield* router.add(
-    "POST",
-    "/api/webhooks/workos",
-    handleWebhook.pipe(
-      // catchCause (not catch) so defects — a raw driver/crypto throw, not just
-      // the typed error channel — are logged with their full cause instead of
-      // escaping the worker as an opaque exception ("[object Object]").
-      Effect.catchCause((cause) =>
-        Effect.gen(function* () {
-          // Stringify the cause into the message — passing the cause object as a
-          // second arg renders as "[object Object]" in the Workers log pipeline.
-          yield* Effect.logError(`WorkOS webhook error: ${Cause.pretty(cause)}`);
-          return yield* HttpServerResponse.json(
-            { error: "Webhook processing failed" },
-            { status: 500 },
-          );
-        }),
-      ),
-    ),
-  );
-});
-
-export const WorkosWebhookRouteLayer = Layer.effectDiscard(registerWorkosWebhookRoute);
diff --git a/selfhost/entry/src/main.ts b/apps/backend/src/server.ts
similarity index 63%
rename from selfhost/entry/src/main.ts
rename to apps/backend/src/server.ts
index a2c40c729..ad6cd70af 100644
--- a/selfhost/entry/src/main.ts
+++ b/apps/backend/src/server.ts
@@ -1,36 +1,40 @@
 import { createServer } from "node:http";
 
-import { NodeHttpServer, NodeRuntime } from "@effect/platform-node";
+import { NodeHttpServer } from "@effect/platform-node";
 import { EventCaptureApi } from "@voidhash/api-contracts/event-capture";
 import {
   buildBackendFetch,
   buildBackendAgentServices,
-  NoBackendFeatures,
-  NoBackendRpcExtension,
-} from "@voidhash/backend/src/BackendApp.ts";
-import { RpcAuthLive } from "@voidhash/backend/src/RpcMiddlewares.ts";
+  type BackendFeatureComposition,
+  type BackendRpcExtension,
+  type BackendRuntimeLayers,
+} from "@voidhash/backend/BackendApp";
+import type { McpOAuth } from "@voidhash/backend/McpOAuth";
+import { RpcAuthLive } from "@voidhash/backend/RpcMiddlewares";
 import { AuthTokenVerifier } from "@voidhash/core/services/auth/AuthTokenVerifier";
 import { EventCaptureService } from "@voidhash/core/services/analyticsIngest/EventCaptureService";
+import { AnalyticsDispatchService } from "@voidhash/core/services/analyticsIngest/AnalyticsDispatchService";
 import { PushDeliveryDispatch } from "@voidhash/core/services/notifications/PushDeliveryDispatch";
 import { PaywallThumbnailService } from "@voidhash/core/services/paywallThumbnails/PaywallThumbnailService";
+import { backendWorkflows } from "@voidhash/core/workflows/registry";
+import { Db } from "@voidhash/db";
 import { HostServiceTag } from "@voidhash/mimic-db/app/hostService";
 import { getConfig as getMimicConfig } from "@voidhash/mimic-db/config";
 import { makeRoutesLive } from "@voidhash/mimic-db/http/rpc-app";
-import { DurableEntityHost } from "@orbian/sdk/DurableEntity";
-import { NodeDurableEntityControl } from "@orbian/node/DurableEntity";
-import { SmtpMailerLive } from "@orbian/node/Mailer";
+import { DurableEntityAlarmControl, DurableEntityHost } from "@voidhash/platform/DurableEntity";
+import { SmtpMailerLive } from "@voidhash/platform-selfhost/Mailer";
 import { Context, Effect, Layer } from "effect";
 import { HttpRouter } from "effect/unstable/http";
 import { HttpApiBuilder } from "effect/unstable/httpapi";
+import type * as Rpc from "effect/unstable/rpc/Rpc";
 
-import { EventCaptureGroupLive } from "@voidhash/backend/src/routes/event-capture.ts";
+import { EventCaptureGroupLive } from "@voidhash/backend/routes/event-capture";
 import {
   makeSelfhostAnalyticsRuntimeLive,
   runSelfhostAnalyticsConsumers,
 } from "./backend/Analytics.ts";
-import { WorkosAuthTokenVerifierLive } from "./backend/AuthTokenVerifier.ts";
 import { runSelfhostCronJobs } from "./backend/Background.ts";
-import { makeBackendInfrastructureLive, makeSelfhostWorkosLive } from "./backend/Backend.ts";
+import { makeBackendInfrastructureLive, makeSelfhostAuthLayers } from "./backend/Backend.ts";
 import { makeSelfhostClickhouseLayers } from "./backend/Clickhouse.ts";
 import {
   runSelfhostPushDeliveryConsumers,
@@ -41,11 +45,8 @@ import {
   makeSelfhostSnapshotImageRendererLive,
   runSelfhostPaywallThumbnailConsumer,
 } from "./backend/Thumbnails.ts";
-import {
-  makeSelfhostWorkflowRuntimeLive,
-  registerSelfhostWorkflows,
-} from "./backend/WorkflowPorts.ts";
-import { getSelfhostRuntimeConfig } from "./config.ts";
+import { makeSelfhostPlatformLayers } from "./backend/PlatformProfile.ts";
+import { getSelfhostRuntimeConfig, type SelfhostRuntimeConfig } from "./config.ts";
 import { installAgentNodeWebSocketServer } from "./agent/AgentNodeWebSocket.ts";
 import { makeSelfhostMimicDocumentIdlePublisher } from "./mimic/MimicDocumentIdleQueue.ts";
 import { installMimicNodeWebSocketServer } from "./mimic/MimicNodeWebSocket.ts";
@@ -63,18 +64,84 @@ const isCaptureRequest = (url: string | undefined): boolean => {
   return pathname === "/i" || pathname.startsWith("/i/");
 };
 
-NodeRuntime.runMain(
+/**
+ * The runtime values a composition root can only obtain from inside the server
+ * boot sequence, handed to the option factories that need them.
+ */
+export interface SelfhostServerRuntime {
+  readonly authTokenVerifier: AuthTokenVerifier["Service"];
+  readonly config: SelfhostRuntimeConfig;
+}
+
+/**
+ * Everything a composition root chooses about a self-host process.
+ *
+ * The Community entrypoint passes the core-only defaults; a private
+ * distribution passes its own feature bundle, admin RPC surface, identity
+ * directory, webhook routes, and MCP authorization server. No application code
+ * differs between the two — only the values below.
+ */
+export interface SelfhostServerOptions<
+  RFeatureRpcs extends Rpc.Any = never,
+  RFeatureServices = never,
+  RExtensionRpcs extends Rpc.Any = never,
+  RIdentityDirectory = never,
+> {
+  /** Edition name logged once at boot, e.g. `"Community Edition"`. */
+  readonly edition: string;
+  readonly features: BackendFeatureComposition<RFeatureRpcs, RFeatureServices>;
+  /**
+   * Built after the identity layers resolve, because an admin RPC surface
+   * typically authenticates against the same token verifier the transport uses.
+   */
+  readonly rpcExtension: (runtime: SelfhostServerRuntime) => BackendRpcExtension<RExtensionRpcs>;
+  /**
+   * External directory merged into the infrastructure graph so raw routes and
+   * feature ports can resolve it at request time. Self-host's own identity
+   * provider is always the standalone one; this is the *directory* a private
+   * composition projects users and organizations from.
+   */
+  readonly identityDirectory?: Layer.Layer<RIdentityDirectory>;
+  readonly routeExtension?: BackendRuntimeLayers["routeExtension"];
+  readonly mcpOAuth?: Layer.Layer<McpOAuth>;
+}
+
+/**
+ * Boots the single-process self-host runtime: HTTP transport, mimic document
+ * host, analytics capture, background consumers, and WebSocket upgrades.
+ *
+ * Runs until interrupted; the returned effect owns every resource in its scope.
+ */
+export const runSelfhostServer = <
+  RFeatureRpcs extends Rpc.Any = never,
+  RFeatureServices = never,
+  RExtensionRpcs extends Rpc.Any = never,
+  RIdentityDirectory = never,
+>(
+  options: SelfhostServerOptions<
+    RFeatureRpcs,
+    RFeatureServices,
+    RExtensionRpcs,
+    RIdentityDirectory
+  >,
+) =>
   Effect.scoped(
     Effect.gen(function* () {
       const config = getSelfhostRuntimeConfig();
-      yield* Effect.logInfo("Community Edition active");
+      yield* Effect.logInfo(`${options.edition} active`);
       const mimicConfig = getMimicConfig();
-      const hostContext = yield* Layer.build(makeMimicNodeHostLive(getMimicNodeConfig()));
+      const platform = makeSelfhostPlatformLayers(config);
+      const hostContext = yield* Layer.build(
+        makeMimicNodeHostLive(getMimicNodeConfig(), platform.durableEntities),
+      );
       const host = Context.get(hostContext, HostServiceTag);
       const entities = Context.get(hostContext, DurableEntityHost);
-      const entityControl = Context.get(hostContext, NodeDurableEntityControl);
+      const entityControl = Context.get(hostContext, DurableEntityAlarmControl);
       const hostLayer = Layer.succeed(HostServiceTag, host);
-      const workos = makeSelfhostWorkosLive(config.workos);
+      const authLayers = makeSelfhostAuthLayers(config.auth);
+      yield* Effect.logInfo(
+        `Identity provider: standalone (root user ${config.auth.rootUsername})`,
+      );
       const clickhouse = config.clickhouse
         ? makeSelfhostClickhouseLayers(config.clickhouse)
         : undefined;
@@ -85,19 +152,21 @@ NodeRuntime.runMain(
             executablePath: chromiumExecutablePath,
           }
         : undefined;
-      const infrastructure = makeBackendInfrastructureLive(
-        config,
-        workos,
-        clickhouse?.readOnly,
-        chromiumConfig === undefined
-          ? undefined
-          : makeSelfhostSnapshotImageRendererLive(chromiumConfig),
+      const infrastructure = Layer.mergeAll(
+        makeBackendInfrastructureLive(
+          config,
+          authLayers.identity,
+          clickhouse?.readOnly,
+          chromiumConfig === undefined
+            ? undefined
+            : makeSelfhostSnapshotImageRendererLive(chromiumConfig),
+        ),
+        options.identityDirectory ?? Layer.empty,
       ).pipe(Layer.provide(hostLayer));
-      const authContext = yield* Layer.build(
-        WorkosAuthTokenVerifierLive.pipe(Layer.provide(workos)),
-      );
+      const authContext = yield* Layer.build(authLayers.authTokenVerifier);
       const authTokenVerifier = Context.get(authContext, AuthTokenVerifier);
-      const workflowRuntime = makeSelfhostWorkflowRuntimeLive(config);
+      const rpcExtension = options.rpcExtension({ authTokenVerifier, config });
+      const workflowRuntime = Layer.merge(platform.workflowRunner, platform.runtime);
       const analyticsRuntime = makeSelfhostAnalyticsRuntimeLive(config);
       const runtimeContext = yield* Layer.build(
         Layer.mergeAll(
@@ -120,14 +189,26 @@ NodeRuntime.runMain(
       const agentServices = yield* Layer.build(
         Layer.mergeAll(
           buildBackendAgentServices({
-            features: NoBackendFeatures,
+            features: options.features,
             infrastructure,
             pushDeliveryDispatch,
+            ...(options.mcpOAuth === undefined ? {} : { mcpOAuth: options.mcpOAuth }),
           }),
           infrastructure,
         ),
       );
-      yield* registerSelfhostWorkflows(config).pipe(Effect.provide(runtimeContext));
+      const workflowInfra = Layer.mergeAll(
+        Db.layer(config.database),
+        Layer.succeed(
+          AnalyticsDispatchService,
+          Context.get(runtimeContext, AnalyticsDispatchService),
+        ),
+      );
+      yield* Effect.forEach(
+        backendWorkflows,
+        (registration) => registration.register(workflowInfra),
+        { discard: true },
+      ).pipe(Effect.provide(runtimeContext), Effect.orDie);
       yield* Effect.forkScoped(
         runSelfhostAnalyticsConsumers(config, clickhouse?.readWrite).pipe(
           Effect.provide(runtimeContext),
@@ -137,7 +218,7 @@ NodeRuntime.runMain(
         runSelfhostPushDeliveryConsumers(config).pipe(Effect.provide(runtimeContext)),
       );
       yield* Effect.forkScoped(
-        runSelfhostCronJobs(config, clickhouse?.readWrite).pipe(Effect.provide(runtimeContext)),
+        runSelfhostCronJobs(clickhouse?.readWrite).pipe(Effect.provide(runtimeContext)),
       );
       if (chromiumConfig !== undefined) {
         const thumbnailContext = yield* Layer.build(
@@ -158,11 +239,13 @@ NodeRuntime.runMain(
 
       const backendEffect = yield* buildBackendFetch({
         auth: RpcAuthLive(authTokenVerifier),
-        features: NoBackendFeatures,
-        rpcExtension: NoBackendRpcExtension,
+        features: options.features,
+        rpcExtension,
         infrastructure,
         ...(clickhouse === undefined ? {} : { analyticsQueryClient: clickhouse.analyticsQuery }),
         pushDeliveryDispatch,
+        ...(options.routeExtension === undefined ? {} : { routeExtension: options.routeExtension }),
+        ...(options.mcpOAuth === undefined ? {} : { mcpOAuth: options.mcpOAuth }),
       }).pipe(Effect.provide(runtimeContext));
       const mimicEffect = yield* makeRoutesLive(hostLayer).pipe(
         Layer.provide(NodeHttpServer.layerHttpServices),
@@ -260,5 +343,4 @@ NodeRuntime.runMain(
       yield* Effect.logInfo(`Self-host runtime listening on ${config.publicBaseUrl}`);
       yield* Effect.never;
     }),
-  ) as never,
-);
+  );
diff --git a/selfhost/entry/src/www/Www.ts b/apps/backend/src/www/Www.ts
similarity index 100%
rename from selfhost/entry/src/www/Www.ts
rename to apps/backend/src/www/Www.ts
diff --git a/selfhost/entry/tests/AgentNodeWebSocket.integration.test.ts b/apps/backend/tests/AgentNodeWebSocket.integration.test.ts
similarity index 93%
rename from selfhost/entry/tests/AgentNodeWebSocket.integration.test.ts
rename to apps/backend/tests/AgentNodeWebSocket.integration.test.ts
index 454a884f5..6ae5feb6d 100644
--- a/selfhost/entry/tests/AgentNodeWebSocket.integration.test.ts
+++ b/apps/backend/tests/AgentNodeWebSocket.integration.test.ts
@@ -2,13 +2,13 @@ import { createServer, type Server } from "node:http";
 
 import {
   AgentSessionIndexService,
+  IdentityProvider,
   LocalUserSessionService,
   PaywallService,
   PaywallWorkspaceService,
-  Workos,
 } from "@voidhash/core/services";
 import { Db } from "@voidhash/db";
-import { makeMemoryDurableEntityHost } from "@orbian/node/MemoryDurableEntity";
+import { makeMemoryDurableEntityHost } from "@voidhash/platform-selfhost/MemoryDurableEntity";
 import { Context, Effect, Redacted } from "effect";
 import { WebSocket } from "ws";
 import { afterEach, describe, expect, it } from "vite-plus/test";
@@ -89,13 +89,19 @@ const authSession = {
   },
 };
 
+const identity = {
+  email: "user@example.com",
+  emailVerified: true,
+  externalId: "user_1",
+  firstName: "Probe",
+  id: "workos_user_1",
+  lastName: "user",
+  profilePictureUrl: null,
+};
+
 const makeServices = () => {
   let context = Context.empty() as Context.Context<never>;
   context = Context.add(context, Db, {} as never);
-  context = Context.add(context, Workos, {
-    getUser: () => Effect.succeed({ id: "workos_user_1" }),
-    setUserExternalId: () => Effect.void,
-  } as unknown as Workos["Service"]);
   context = Context.add(context, LocalUserSessionService, {
     resolveLocalUser: () => Effect.succeed(authSession.user),
     loadUserAccess: () =>
@@ -105,6 +111,13 @@ const makeServices = () => {
       }),
     toUserSession: () => authSession,
   } as unknown as LocalUserSessionService["Service"]);
+  context = Context.add(context, IdentityProvider, {
+    cookieName: "voidhash-session",
+    authenticateSessionCookie: () => Effect.succeed(null),
+    resolveIdentity: () => Effect.succeed(identity),
+    resolveIdentityById: () => Effect.succeed(identity),
+    linkExternalId: () => Effect.void,
+  } as IdentityProvider["Service"]);
   context = Context.add(context, AgentSessionIndexService, {
     touch: () => Effect.succeed(undefined),
   } as unknown as AgentSessionIndexService["Service"]);
diff --git a/selfhost/entry/tests/AgentNodeWebSocket.test.ts b/apps/backend/tests/AgentNodeWebSocket.test.ts
similarity index 100%
rename from selfhost/entry/tests/AgentNodeWebSocket.test.ts
rename to apps/backend/tests/AgentNodeWebSocket.test.ts
diff --git a/selfhost/entry/tests/Analytics.integration.test.ts b/apps/backend/tests/Analytics.integration.test.ts
similarity index 84%
rename from selfhost/entry/tests/Analytics.integration.test.ts
rename to apps/backend/tests/Analytics.integration.test.ts
index 8c007d1cf..638302379 100644
--- a/selfhost/entry/tests/Analytics.integration.test.ts
+++ b/apps/backend/tests/Analytics.integration.test.ts
@@ -17,9 +17,7 @@ import {
 } from "../src/backend/Analytics.ts";
 import { getSelfhostRuntimeConfig } from "../src/config.ts";
 
-const describePg = process.env.SELFHOST_PG_TEST === "1" ? describe : describe.skip;
-
-describePg("self-host analytics queue", () => {
+describe("self-host analytics queue", () => {
   it("captures, processes, and acknowledges an event without ClickHouse", async () => {
     const config = getSelfhostRuntimeConfig();
     const suffix = crypto.randomUUID();
@@ -92,11 +90,19 @@ describePg("self-host analytics queue", () => {
           yield* db.delete(personIdentities).where(eq(personIdentities.projectId, projectId));
           yield* db.delete(persons).where(eq(persons.projectId, projectId));
           yield* db.delete(projects).where(eq(projects.id, projectId));
+        }).pipe(Effect.provide(database)),
+      );
+      await Effect.runPromise(
+        Effect.gen(function* () {
+          const db = yield* Db;
+          // The cluster queue driver hands the store a JSON string, which the
+          // store then JSON-encodes into `element`, so the body is doubly
+          // encoded: unwrap the outer JSON scalar before reading its fields.
           yield* db.execute(sql`
-            DELETE FROM platform_queue_messages
-            WHERE body_json -> 'envelope' ->> 'projectId' = ${projectId}
+            DELETE FROM effect_queue
+            WHERE (element::jsonb #>> '{}')::jsonb -> 'envelope' ->> 'projectId' = ${projectId}
           `);
-        }).pipe(Effect.provide(database)),
+        }).pipe(Effect.provide(Db.layer(config.platformDatabase))),
       );
     }
 
diff --git a/selfhost/entry/tests/BackendAdapters.test.ts b/apps/backend/tests/BackendAdapters.test.ts
similarity index 69%
rename from selfhost/entry/tests/BackendAdapters.test.ts
rename to apps/backend/tests/BackendAdapters.test.ts
index 432de8d32..b60c77e17 100644
--- a/selfhost/entry/tests/BackendAdapters.test.ts
+++ b/apps/backend/tests/BackendAdapters.test.ts
@@ -3,7 +3,7 @@ import { Effect, Redacted } from "effect";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { MemoryProjectSchemaCacheLive } from "../src/backend/ProjectSchemaCache.ts";
-import { getSelfhostRuntimeConfig } from "../src/config.ts";
+import { getSelfhostMigrationDatabaseConfig, getSelfhostRuntimeConfig } from "../src/config.ts";
 
 const originalEnvironment = { ...process.env };
 
@@ -55,7 +55,7 @@ describe("self-host runtime configuration", () => {
       port: 1025,
       verifyOnStart: false,
     });
-    expect(config.workos.clientId).toBe("client_selfhost_not_configured");
+    expect(config.auth.rootUsername).toBe("root");
   });
 
   it("reads BYO agent provider and model settings", () => {
@@ -105,12 +105,26 @@ describe("self-host runtime configuration", () => {
     expect(Redacted.value(mailer.password!)).toBe("secret");
   });
 
-  it("requires BYO WorkOS credentials in production", () => {
+  it("accepts real root credentials in production", () => {
+    process.env.VOIDHASH_ROOT_USERNAME = "operator";
+    process.env.VOIDHASH_ROOT_PASSWORD = "a-real-root-password";
+    process.env.VOIDHASH_AUTH_SECRET = "a-real-session-signing-secret";
+
+    const auth = getSelfhostRuntimeConfig().auth;
+
+    expect(auth.rootUsername).toBe("operator");
+    expect(auth.rootEmail).toBe("root@voidhash.local");
+    expect(Redacted.value(auth.rootPassword)).toBe("a-real-root-password");
+  });
+
+  it("names every unconfigured standalone credential when production starts", () => {
     process.env.NODE_ENV = "production";
     process.env.SELFHOST_MODE = "production";
-    delete process.env.WORKOS_API_KEY;
+    delete process.env.VOIDHASH_ROOT_USERNAME;
+    delete process.env.VOIDHASH_ROOT_PASSWORD;
+    delete process.env.VOIDHASH_AUTH_SECRET;
 
-    expect(() => getSelfhostRuntimeConfig()).toThrow("WORKOS_API_KEY");
+    expect(() => getSelfhostRuntimeConfig()).toThrow(/VOIDHASH_ROOT_USERNAME/);
   });
 
   it("supports an explicit plaintext connection for an internal Compose database", () => {
@@ -120,6 +134,47 @@ describe("self-host runtime configuration", () => {
     expect(getSelfhostRuntimeConfig().database).toMatchObject({ host: "postgres", ssl: false });
   });
 
+  it("falls back to the application connection for migrations", () => {
+    process.env.DATABASE_HOST = "postgres";
+    process.env.DATABASE_PORT = "6543";
+    process.env.DATABASE_NAME = "voidhash";
+    process.env.DATABASE_USERNAME = "voidhash";
+    process.env.DATABASE_PASSWORD = "application-secret";
+    process.env.DATABASE_SSL = "false";
+    delete process.env.DATABASE_DIRECT_HOST;
+
+    expect(getSelfhostMigrationDatabaseConfig()).toEqual({
+      databaseName: "voidhash",
+      host: "postgres",
+      password: "application-secret",
+      port: 6543,
+      ssl: false,
+      username: "voidhash",
+    });
+  });
+
+  it("overrides only the direct-TCP fields migrations need", () => {
+    process.env.DATABASE_HOST = "broker.internal.local";
+    process.env.DATABASE_PORT = "5432";
+    process.env.DATABASE_NAME = "voidhash";
+    process.env.DATABASE_USERNAME = "voidhash";
+    process.env.DATABASE_PASSWORD = "application-secret";
+    process.env.DATABASE_SSL = "false";
+    process.env.DATABASE_DIRECT_HOST = "postgres";
+    process.env.DATABASE_DIRECT_PORT = "6543";
+    process.env.DATABASE_DIRECT_SSL = "true";
+
+    expect(getSelfhostRuntimeConfig().database.host).toBe("broker.internal.local");
+    expect(getSelfhostMigrationDatabaseConfig()).toEqual({
+      databaseName: "voidhash",
+      host: "postgres",
+      password: "application-secret",
+      port: 6543,
+      ssl: true,
+      username: "voidhash",
+    });
+  });
+
   it("enables ClickHouse only when its URL is configured", () => {
     process.env.CLICKHOUSE_URL = "http://clickhouse:8123";
     process.env.CLICKHOUSE_DATABASE = "analytics";
diff --git a/apps/backend/tests/Background.integration.test.ts b/apps/backend/tests/Background.integration.test.ts
new file mode 100644
index 000000000..249500c6d
--- /dev/null
+++ b/apps/backend/tests/Background.integration.test.ts
@@ -0,0 +1,85 @@
+import { type CronJob, CronScheduler } from "@voidhash/platform/CronScheduler";
+import type { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
+import * as TestWorkflowRunner from "@voidhash/platform/TestWorkflowRunner";
+import { Effect, Layer } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { makeSelfhostAnalyticsRuntimeLive } from "../src/backend/Analytics.ts";
+import { makeSelfhostCronJobs } from "../src/backend/Background.ts";
+import { getSelfhostRuntimeConfig } from "../src/config.ts";
+
+const requiredJobNames = [
+  "AppStoreExpireParkedNotificationsWorkflow",
+  "PurchaseLedgerDrainWorkflow",
+] as const;
+
+const twoDaysMillis = 2 * 24 * 60 * 60 * 1000;
+
+/**
+ * Drives a job through the {@link CronScheduler} port and reports how many times
+ * its body executed.
+ *
+ * The job runs under a probe name so the slot state the adapter persists cannot
+ * collide with the schedule a running deployment owns. Both adapters arm an
+ * unseen slot on first sight rather than firing it, so the first tick arms and
+ * the second one — far enough ahead that every enabled expression is due —
+ * claims and runs it.
+ *
+ * The probe name is unique per run because both adapters persist slot progress
+ * durably. Reusing one name would let the first run's recorded position survive:
+ * every later run ticks at or behind it, nothing is ever due again, and the test
+ * would pass exactly once per database and fail from then on.
+ */
+const runThroughScheduler = <R>(job: CronJob<R>) =>
+  Effect.gen(function* () {
+    const scheduler = yield* CronScheduler;
+    let executions = 0;
+    const probe: CronJob<R> = {
+      ...job,
+      name: `${job.name}-probe-${crypto.randomUUID()}`,
+      run: (context) =>
+        job.run(context).pipe(
+          Effect.tap(() =>
+            Effect.sync(() => {
+              executions += 1;
+            }),
+          ),
+        ),
+    };
+    const now = Date.now();
+    yield* scheduler.tick(probe, new Date(now));
+    yield* scheduler.tick(probe, new Date(now + twoDaysMillis));
+    return executions;
+  });
+
+describe("self-host scheduled jobs", () => {
+  it("registers the required background jobs and executes them through the scheduler", async () => {
+    const testRunner = TestWorkflowRunner.make();
+
+    const outcome = await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const jobs: ReadonlyArray<CronJob<PlatformRuntime | WorkflowRunner>> =
+            yield* makeSelfhostCronJobs();
+          const registered = jobs.map((job) => job.name);
+          const executions: Record<string, number> = {};
+          for (const name of requiredJobNames) {
+            const job = jobs.find((candidate) => candidate.name === name);
+            if (job === undefined) continue;
+            executions[name] = yield* runThroughScheduler(job);
+          }
+          return { executions, registered };
+        }).pipe(
+          Effect.provide(Layer.succeed(WorkflowRunner, testRunner)),
+          Effect.provide(makeSelfhostAnalyticsRuntimeLive(getSelfhostRuntimeConfig())),
+        ),
+      ),
+    );
+
+    expect(outcome.registered).toEqual(expect.arrayContaining([...requiredJobNames]));
+    for (const name of requiredJobNames) {
+      expect(outcome.executions[name]).toBeGreaterThanOrEqual(1);
+    }
+  });
+});
diff --git a/selfhost/entry/tests/Clickhouse.integration.test.ts b/apps/backend/tests/Clickhouse.integration.test.ts
similarity index 91%
rename from selfhost/entry/tests/Clickhouse.integration.test.ts
rename to apps/backend/tests/Clickhouse.integration.test.ts
index ca117ce1b..7861e217c 100644
--- a/selfhost/entry/tests/Clickhouse.integration.test.ts
+++ b/apps/backend/tests/Clickhouse.integration.test.ts
@@ -29,9 +29,6 @@ import {
 } from "../src/backend/Clickhouse.ts";
 import { getSelfhostRuntimeConfig } from "../src/config.ts";
 
-const describeClickhouse =
-  process.env.SELFHOST_CLICKHOUSE_TEST === "1" ? describe : describe.skip;
-
 const analyticsTables = [
   CLICKHOUSE_EVENTS_TABLE,
   CLICKHOUSE_PERSONS_TABLE,
@@ -60,7 +57,7 @@ const countEvents = (
     }).pipe(Effect.provide(layer), Effect.scoped),
   );
 
-describeClickhouse("self-host ClickHouse analytics", () => {
+describe("self-host ClickHouse analytics", () => {
   it("writes captured events and enforces the runtime access split", async () => {
     const config = getSelfhostRuntimeConfig();
     if (!config.clickhouse) throw new Error("CLICKHOUSE_URL is required for this test");
@@ -167,11 +164,19 @@ describeClickhouse("self-host ClickHouse analytics", () => {
           yield* db.delete(personIdentities).where(eq(personIdentities.projectId, projectId));
           yield* db.delete(persons).where(eq(persons.projectId, projectId));
           yield* db.delete(projects).where(eq(projects.id, projectId));
+        }).pipe(Effect.provide(database)),
+      );
+      await Effect.runPromise(
+        Effect.gen(function* () {
+          const db = yield* Db;
+          // The cluster queue driver hands the store a JSON string, which the
+          // store then JSON-encodes into `element`, so the body is doubly
+          // encoded: unwrap the outer JSON scalar before reading its fields.
           yield* db.execute(pgSql`
-            DELETE FROM platform_queue_messages
-            WHERE body_json -> 'envelope' ->> 'projectId' = ${projectId}
+            DELETE FROM effect_queue
+            WHERE (element::jsonb #>> '{}')::jsonb -> 'envelope' ->> 'projectId' = ${projectId}
           `);
-        }).pipe(Effect.provide(database)),
+        }).pipe(Effect.provide(Db.layer(config.platformDatabase))),
       );
     }
   }, 30_000);
diff --git a/selfhost/entry/tests/Compiler.test.ts b/apps/backend/tests/Compiler.test.ts
similarity index 100%
rename from selfhost/entry/tests/Compiler.test.ts
rename to apps/backend/tests/Compiler.test.ts
diff --git a/selfhost/entry/tests/CompilerClient.integration.test.ts b/apps/backend/tests/CompilerClient.integration.test.ts
similarity index 80%
rename from selfhost/entry/tests/CompilerClient.integration.test.ts
rename to apps/backend/tests/CompilerClient.integration.test.ts
index 9e15f8cd0..47470e025 100644
--- a/selfhost/entry/tests/CompilerClient.integration.test.ts
+++ b/apps/backend/tests/CompilerClient.integration.test.ts
@@ -4,10 +4,11 @@ import { describe, expect, it } from "vitest";
 
 import { makeHttpComponentCompilerLive } from "../src/compiler/CompilerClient.ts";
 
-const compilerUrl = process.env.SELFHOST_COMPILER_URL;
-const describeCompiler = compilerUrl ? describe : describe.skip;
+// The compiler is part of the provisioned stack, so a missing URL is a broken
+// environment rather than a reason to skip.
+const compilerUrl = process.env.SELFHOST_COMPILER_URL ?? "http://127.0.0.1:5002";
 
-describeCompiler("self-host component compiler client", () => {
+describe("self-host component compiler client", () => {
   it("round-trips compile and extraction results through HTTP", async () => {
     const result = await Effect.runPromise(
       Effect.gen(function* () {
diff --git a/selfhost/entry/tests/MimicDocumentIdle.test.ts b/apps/backend/tests/MimicDocumentIdle.test.ts
similarity index 92%
rename from selfhost/entry/tests/MimicDocumentIdle.test.ts
rename to apps/backend/tests/MimicDocumentIdle.test.ts
index e11b14d6f..ee03d0983 100644
--- a/selfhost/entry/tests/MimicDocumentIdle.test.ts
+++ b/apps/backend/tests/MimicDocumentIdle.test.ts
@@ -3,9 +3,11 @@ import {
   IDLE_NOTIFIED_SEQ_KEY,
   type MimicDocumentIdleMessageType,
 } from "@voidhash/mimic-db/ws/idle-notify";
-import { makeDurableEntityAddress } from "@orbian/sdk/DurableEntity";
-import type { NodeDurableEntityControlShape } from "@orbian/node/DurableEntity";
-import { makeMemoryDurableEntityHost } from "@orbian/node/MemoryDurableEntity";
+import {
+  type DurableEntityAlarmControlShape,
+  makeDurableEntityAddress,
+} from "@voidhash/platform/DurableEntity";
+import { makeMemoryDurableEntityHost } from "@voidhash/platform-selfhost/MemoryDurableEntity";
 import { Effect } from "effect";
 import { describe, expect, it, vi } from "vitest";
 
@@ -16,7 +18,7 @@ const address = makeDurableEntityAddress(
   "collection-1:document-1",
 );
 
-const control: NodeDurableEntityControlShape = {
+const control: DurableEntityAlarmControlShape = {
   listDueAlarms: () => Effect.succeed([{ address, scheduledTime: 0 }]),
 };
 
diff --git a/selfhost/entry/tests/MimicNode.integration.test.ts b/apps/backend/tests/MimicNode.integration.test.ts
similarity index 82%
rename from selfhost/entry/tests/MimicNode.integration.test.ts
rename to apps/backend/tests/MimicNode.integration.test.ts
index 06d7f7f5b..e47667437 100644
--- a/selfhost/entry/tests/MimicNode.integration.test.ts
+++ b/apps/backend/tests/MimicNode.integration.test.ts
@@ -4,10 +4,12 @@ import type { AddressInfo } from "node:net";
 import { HostServiceTag } from "@voidhash/mimic-db/app/hostService";
 import type { SchemaObject, Value } from "@voidhash/mimic-core";
 import {
+  DurableEntityAlarmControl,
   DurableEntityHost,
   makeDurableEntityAddress,
-} from "@orbian/sdk/DurableEntity";
-import { NodeDurableEntityControl } from "@orbian/node/DurableEntity";
+} from "@voidhash/platform/DurableEntity";
+import { PgClusterDurableEntityLive } from "@voidhash/platform-selfhost/ClusterDurableEntity";
+import type { PgPlatformConfig } from "@voidhash/platform-selfhost/Postgres";
 import { Effect, ManagedRuntime, Redacted } from "effect";
 import { describe, expect, it } from "vitest";
 import WebSocket from "ws";
@@ -32,6 +34,18 @@ const config: MimicNodeConfig = {
   },
 };
 
+// The entity host runs a single-node cluster, which claims every shard in the
+// database it is built over. Pointing it at the platform test database keeps it
+// from stealing messages addressed to the deployment this suite runs against;
+// control and document state stay in the application database above.
+const platformConfig: PgPlatformConfig = {
+  host: process.env.PLATFORM_SELFHOST_PG_HOST ?? "127.0.0.1",
+  port: Number(process.env.PLATFORM_SELFHOST_PG_PORT ?? "5432"),
+  database: process.env.PLATFORM_SELFHOST_PG_DATABASE ?? "voidhash",
+  username: process.env.PLATFORM_SELFHOST_PG_USERNAME ?? "voidhash",
+  password: Redacted.make(process.env.PLATFORM_SELFHOST_PG_PASSWORD ?? "password"),
+};
+
 const schema: SchemaObject = {
   kind: "object",
   fields: {
@@ -43,17 +57,20 @@ const value: Value = {
   fields: { title: { kind: "string", value: "persistent" } },
 };
 
-const describePg = process.env.SELFHOST_PG_TEST === "1" ? describe : describe.skip;
+// Every build owns its own single-node cluster, which is what makes the
+// restart assertions meaningful: nothing process-local carries over.
+const hostLayer = () =>
+  makeMimicNodeHostLive(config, PgClusterDurableEntityLive(platformConfig));
 
 const runHost = <A, E>(program: Effect.Effect<A, E, any>): Promise<A> =>
   Effect.runPromise(
-    program.pipe(Effect.provide(makeMimicNodeHostLive(config))) as Effect.Effect<A, E>,
+    Effect.scoped(program.pipe(Effect.provide(hostLayer()))) as Effect.Effect<A, E>,
   );
 
 const runStandalone = <A, E>(program: Effect.Effect<A, E, any>): Promise<A> =>
   Effect.runPromise(program as Effect.Effect<A, E>);
 
-describePg("self-host mimic Node composition", () => {
+describe("self-host mimic Node composition", () => {
   it("restores control and document state after the host layer restarts", async () => {
     const suffix = crypto.randomUUID();
     const created = await runHost(
@@ -86,10 +103,10 @@ describePg("self-host mimic Node composition", () => {
   });
 
   it("serves the document auth and snapshot protocol over a real Node WebSocket", async () => {
-    const runtime = ManagedRuntime.make(makeMimicNodeHostLive(config));
+    const runtime = ManagedRuntime.make(hostLayer());
     const host = await runtime.runPromise(HostServiceTag);
     const entities = await runtime.runPromise(DurableEntityHost);
-    const entityControl = await runtime.runPromise(NodeDurableEntityControl);
+    const entityControl = await runtime.runPromise(DurableEntityAlarmControl);
     const server = createServer();
     const closeWebSockets = installMimicNodeWebSocketServer(server, host, entities, {
       control: entityControl,
diff --git a/apps/backend/tests/MimicNodeWebSocket.test.ts b/apps/backend/tests/MimicNodeWebSocket.test.ts
new file mode 100644
index 000000000..7d6fed53a
--- /dev/null
+++ b/apps/backend/tests/MimicNodeWebSocket.test.ts
@@ -0,0 +1,106 @@
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+
+import type { HostService } from "@voidhash/mimic-db/app/hostService";
+import type { SessionAttachment } from "@voidhash/mimic-db/ws/document-session";
+import { makeDurableEntityAddress } from "@voidhash/platform/DurableEntity";
+import { makeMemoryDurableEntityHost } from "@voidhash/platform-selfhost/MemoryDurableEntity";
+import { Effect } from "effect";
+import { afterEach, describe, expect, it } from "vitest";
+import WebSocket from "ws";
+
+import { installMimicNodeWebSocketServer } from "../src/mimic/MimicNodeWebSocket.ts";
+
+const collectionId = "collection-1";
+const documentId = "document-1";
+
+/**
+ * The slice of the host the document socket protocol touches while a client
+ * authenticates. Everything else stays unimplemented on purpose: reaching for
+ * it in this test would mean the socket path grew a dependency it should not
+ * have.
+ */
+const stubHost = {
+  authenticateDocumentToken: () =>
+    Effect.succeed({ tokenId: "token-1", permission: "write" as const }),
+  getDocument: () =>
+    Effect.succeed({
+      value: { kind: "object" as const, fields: {} },
+      version: 1,
+    }),
+  getPresenceSnapshot: () => Effect.succeed({ presences: {} }),
+  setPresence: () => Effect.void,
+  removePresence: () => Effect.void,
+} as unknown as HostService;
+
+const cleanups: Array<() => Promise<void> | void> = [];
+
+afterEach(async () => {
+  for (const cleanup of cleanups.splice(0).reverse()) await cleanup();
+});
+
+const listen = (server: Server): Promise<number> =>
+  new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve((server.address() as AddressInfo).port);
+    });
+  });
+
+describe("mimic Node WebSocket sessions", () => {
+  it("keeps the entity session attachment in step with authentication", async () => {
+    const entities = makeMemoryDurableEntityHost();
+    const server = createServer();
+    const close = installMimicNodeWebSocketServer(server, stubHost, entities, {
+      control: { listDueAlarms: () => Effect.succeed([]) },
+      debounceMs: 15_000,
+      pollIntervalMs: 60_000,
+      publish: () => Effect.void,
+    });
+    cleanups.push(() => {
+      close();
+      return new Promise<void>((resolve) => server.close(() => resolve()));
+    });
+    const port = await listen(server);
+
+    const socket = new WebSocket(
+      `ws://127.0.0.1:${port}/ws/v1/databases/database-1/collections/${collectionId}/documents/${documentId}`,
+    );
+    cleanups.push(() => void socket.close());
+    await new Promise<void>((resolve, reject) => {
+      const timeout = setTimeout(() => reject(new Error("timed out waiting for a snapshot")), 5_000);
+      socket.once("error", reject);
+      socket.once("open", () =>
+        socket.send(JSON.stringify({ type: "auth", token: "token-1" })),
+      );
+      socket.on("message", (data) => {
+        const message = JSON.parse(data.toString()) as { readonly type?: string };
+        if (message.type === "snapshot") {
+          clearTimeout(timeout);
+          resolve();
+        }
+      });
+    });
+
+    const address = makeDurableEntityAddress(
+      "mimic-document",
+      `${collectionId}:${documentId}`,
+    );
+    const attachments = await Effect.runPromise(
+      entities.run(address, (entity) =>
+        entity.sessions.list.pipe(
+          Effect.flatMap((sessions) =>
+            Effect.forEach(sessions, (session) => session.getAttachment),
+          ),
+        ),
+      ),
+    );
+
+    // Host-side broadcasts filter on this exact flag, so a stale attachment
+    // here means every authenticated browser socket is silently skipped.
+    expect(attachments).toHaveLength(1);
+    expect((attachments[0] as SessionAttachment).authenticated).toBe(true);
+    expect((attachments[0] as SessionAttachment).permission).toBe("write");
+  });
+});
diff --git a/selfhost/entry/tests/PaywallRelease.integration.test.ts b/apps/backend/tests/PaywallRelease.integration.test.ts
similarity index 97%
rename from selfhost/entry/tests/PaywallRelease.integration.test.ts
rename to apps/backend/tests/PaywallRelease.integration.test.ts
index b023608b3..0a130b3cf 100644
--- a/selfhost/entry/tests/PaywallRelease.integration.test.ts
+++ b/apps/backend/tests/PaywallRelease.integration.test.ts
@@ -14,8 +14,6 @@ import { describe, expect, it } from "vitest";
 
 import { getSelfhostRuntimeConfig } from "../src/config.ts";
 
-const describePg = process.env.SELFHOST_PG_TEST === "1" ? describe : describe.skip;
-
 const makeSession = (projectId: string, userId: string): AnyAuthSession => {
   const now = new Date();
   return {
@@ -48,7 +46,7 @@ const makeSession = (projectId: string, userId: string): AnyAuthSession => {
   };
 };
 
-describePg("self-host paywall releases", () => {
+describe("self-host paywall releases", () => {
   it("creates, publishes, and advances a visual paywall release", async () => {
     const config = getSelfhostRuntimeConfig();
     const suffix = crypto.randomUUID();
diff --git a/selfhost/entry/tests/Push.integration.test.ts b/apps/backend/tests/Push.integration.test.ts
similarity index 65%
rename from selfhost/entry/tests/Push.integration.test.ts
rename to apps/backend/tests/Push.integration.test.ts
index 4465d7c22..e60eb2a02 100644
--- a/selfhost/entry/tests/Push.integration.test.ts
+++ b/apps/backend/tests/Push.integration.test.ts
@@ -10,21 +10,24 @@ import {
 } from "../src/backend/Push.ts";
 import { getSelfhostRuntimeConfig } from "../src/config.ts";
 
-const describePg = process.env.SELFHOST_PG_TEST === "1" ? describe : describe.skip;
-
-describePg("self-host push-delivery queue", () => {
+describe("self-host push-delivery queue", () => {
   it("dispatches and acknowledges a delivery pointer through the consumer", async () => {
     const config = getSelfhostRuntimeConfig();
     const deliveryId = `pushDelivery_${crypto.randomUUID()}`;
-    const database = Db.layer(config.database);
 
     const remaining = await Effect.runPromise(
       Effect.scoped(
         Effect.gen(function* () {
-          const db = yield* Db;
+          // The queue rows live in the platform database, which is a different
+          // connection from the application tables the consumer reads.
+          const platformContext = yield* Layer.build(Db.layer(config.platformDatabase));
+          const db = Context.get(platformContext, Db);
+          // The cluster queue driver hands the store a JSON string, which the
+          // store then JSON-encodes into `element`, so the body is doubly
+          // encoded: unwrap the outer JSON scalar before reading its fields.
           yield* db.execute(sql`
-            DELETE FROM platform_queue_messages
-            WHERE body_json ->> 'pushNotificationDeliveryId' = ${deliveryId}
+            DELETE FROM effect_queue
+            WHERE (element::jsonb #>> '{}')::jsonb ->> 'pushNotificationDeliveryId' = ${deliveryId}
           `);
           const dispatchContext = yield* Layer.build(SelfhostPushDeliveryDispatchLive);
           const dispatch = Context.get(dispatchContext, PushDeliveryDispatch);
@@ -42,18 +45,16 @@ describePg("self-host push-delivery queue", () => {
           while (Date.now() < deadline) {
             const rows = yield* db.execute(sql`
               SELECT COUNT(*)::integer AS total
-              FROM platform_queue_messages
-              WHERE body_json ->> 'pushNotificationDeliveryId' = ${deliveryId}
+              FROM effect_queue
+              WHERE completed = FALSE
+                AND (element::jsonb #>> '{}')::jsonb ->> 'pushNotificationDeliveryId' = ${deliveryId}
             `);
             const total = Number((rows[0] as { readonly total?: number } | undefined)?.total ?? 0);
             if (total === 0) return total;
             yield* Effect.sleep("25 millis");
           }
           return 1;
-        }).pipe(
-          Effect.provide(database),
-          Effect.provide(makeSelfhostAnalyticsRuntimeLive(config)),
-        ),
+        }).pipe(Effect.provide(makeSelfhostAnalyticsRuntimeLive(config))),
       ),
     );
 
diff --git a/selfhost/entry/tests/SecurityConfig.test.ts b/apps/backend/tests/SecurityConfig.test.ts
similarity index 80%
rename from selfhost/entry/tests/SecurityConfig.test.ts
rename to apps/backend/tests/SecurityConfig.test.ts
index 6f42b866b..8476f862d 100644
--- a/selfhost/entry/tests/SecurityConfig.test.ts
+++ b/apps/backend/tests/SecurityConfig.test.ts
@@ -12,11 +12,9 @@ const validProductionEnvironment = {
   PUBLIC_FILES_BASE_URL: "https://files.example.test",
   S3_SECRET_ACCESS_KEY: "object-store-secret",
   SELFHOST_MODE: "production",
-  WORKOS_API_KEY: "configured-workos-key",
-  WORKOS_CLIENT_ID: "client_configured",
-  WORKOS_COOKIE_PASSWORD: "cookie-secret-with-sufficient-entropy",
-  WORKOS_REDIRECT_URI: "https://app.example.test/api/auth/callback",
-  WORKOS_WEBHOOK_SECRET: "whsec_configured",
+  VOIDHASH_AUTH_SECRET: "session-signing-secret-with-entropy",
+  VOIDHASH_ROOT_PASSWORD: "root-secret-with-sufficient-entropy",
+  VOIDHASH_ROOT_USERNAME: "operator",
 } as const;
 
 const stubEnvironment = (environment: Record<string, string>) => {
@@ -55,20 +53,24 @@ describe("validateSelfhostSecurityConfig", () => {
     "DATABASE_PASSWORD",
     "MIMIC_ROOT_PASSWORD",
     "S3_SECRET_ACCESS_KEY",
-    "WORKOS_API_KEY",
-    "WORKOS_CLIENT_ID",
-    "WORKOS_COOKIE_PASSWORD",
-    "WORKOS_WEBHOOK_SECRET",
+    "VOIDHASH_ROOT_PASSWORD",
+    "VOIDHASH_AUTH_SECRET",
   ])("rejects an absent or example %s in production mode", (name) => {
     stubEnvironment(validProductionEnvironment);
     vi.stubEnv(name, "password");
     expect(() => validateSelfhostSecurityConfig()).toThrow(name);
   });
 
-  it("rejects the local-evaluation cookie placeholder in production mode", () => {
+  it("rejects an unset root username in production mode", () => {
     stubEnvironment(validProductionEnvironment);
-    vi.stubEnv("WORKOS_COOKIE_PASSWORD", "selfhost-development-cookie-password-change-me");
-    expect(() => validateSelfhostSecurityConfig()).toThrow("WORKOS_COOKIE_PASSWORD");
+    vi.stubEnv("VOIDHASH_ROOT_USERNAME", "");
+    expect(() => validateSelfhostSecurityConfig()).toThrow("VOIDHASH_ROOT_USERNAME");
+  });
+
+  it("rejects a placeholder root password in production mode", () => {
+    stubEnvironment(validProductionEnvironment);
+    vi.stubEnv("VOIDHASH_ROOT_PASSWORD", "replace-with-a-random-password");
+    expect(() => validateSelfhostSecurityConfig()).toThrow("VOIDHASH_ROOT_PASSWORD");
   });
 
   it("requires every enabled ClickHouse role to have a non-example password", () => {
@@ -85,7 +87,6 @@ describe("validateSelfhostSecurityConfig", () => {
     "PUBLIC_BASE_URL",
     "PUBLIC_FILES_BASE_URL",
     "MIMIC_PUBLIC_BASE_URL",
-    "WORKOS_REDIRECT_URI",
   ])("rejects a non-HTTPS %s in production mode", (name) => {
     stubEnvironment(validProductionEnvironment);
     vi.stubEnv(name, "http://localhost:5001");
diff --git a/apps/backend/tests/StandaloneAuth.integration.test.ts b/apps/backend/tests/StandaloneAuth.integration.test.ts
new file mode 100644
index 000000000..29f8d2ff5
--- /dev/null
+++ b/apps/backend/tests/StandaloneAuth.integration.test.ts
@@ -0,0 +1,130 @@
+import { resolveUserSession } from "@voidhash/backend/AuthSessionResolver";
+import { AuthTokenVerifier } from "@voidhash/core/services/auth/AuthTokenVerifier";
+import { LocalUserSessionService } from "@voidhash/core/services/auth/LocalUserSessionService";
+import {
+  STANDALONE_AUTH_COOKIE_NAME,
+  STANDALONE_ROOT_SUBJECT,
+  signStandaloneAuthToken,
+} from "@voidhash/core/utils/crypto/standalone-auth-token";
+import { Db, eq, sql, user } from "@voidhash/db";
+import { Context, Effect, Layer, Redacted } from "effect";
+import * as HttpHeaders from "effect/unstable/http/Headers";
+import { afterAll, describe, expect, it } from "vitest";
+
+import { makeSelfhostAuthLayers } from "../src/backend/Backend.ts";
+import { getSelfhostDatabaseConfig } from "../src/config.ts";
+
+const secret = "integration-test-standalone-secret";
+const rootEmail = "standalone-auth-root@integration.test";
+
+/**
+ * Builds the auth layers directly rather than through `getSelfhostAuthConfig`,
+ * so the suite does not depend on the ambient root credentials of the machine
+ * running it.
+ */
+const authLayers = makeSelfhostAuthLayers({
+  rootEmail,
+  rootPassword: Redacted.make("integration-test-root-password"),
+  rootUsername: "root",
+  secret: Redacted.make(secret),
+});
+
+const database = Db.layer(getSelfhostDatabaseConfig());
+
+const cleanup = Effect.gen(function* () {
+  const db = yield* Db;
+  yield* db.execute(
+    sql`DELETE FROM "user" WHERE email = ${rootEmail} OR workos_user_id = ${STANDALONE_ROOT_SUBJECT}`,
+  );
+}).pipe(Effect.provide(database), Effect.scoped);
+
+const resolve = (headers: Record<string, string>) =>
+  Effect.gen(function* () {
+    const verifierContext = yield* Layer.build(authLayers.authTokenVerifier);
+    const verifier = Context.get(verifierContext, AuthTokenVerifier);
+    return yield* resolveUserSession(HttpHeaders.fromInput(headers), verifier).pipe(
+      Effect.provide(authLayers.identity.pipe(Layer.provide(database))),
+      Effect.provide(LocalUserSessionService.layer),
+      Effect.provide(database),
+    );
+  }).pipe(Effect.scoped, Effect.runPromise);
+
+const token = (email: string, name?: string) =>
+  Effect.runPromise(signStandaloneAuthToken({ email, secret, ...(name ? { name } : {}) }));
+
+describe("standalone identity provider against Postgres", () => {
+  afterAll(async () => {
+    await Effect.runPromise(cleanup);
+  });
+
+  it("creates the root user row on first cookie authentication", async () => {
+    await Effect.runPromise(cleanup);
+    const session = await resolve({
+      cookie: `${STANDALONE_AUTH_COOKIE_NAME}=${await token(rootEmail, "Root Operator")}`,
+    });
+
+    expect(session.method).toBe("user");
+    expect(session.user?.email).toBe(rootEmail);
+    expect(session.user?.workosUserId).toBe(STANDALONE_ROOT_SUBJECT);
+    expect(session.user?.name).toBe("Root Operator");
+  });
+
+  it("resolves the same single user through the bearer path", async () => {
+    const bearer = await token(rootEmail, "Root Operator");
+
+    const first = await resolve({ authorization: `Bearer ${bearer}` });
+    const second = await resolve({ cookie: `${STANDALONE_AUTH_COOKIE_NAME}=${bearer}` });
+
+    expect(first.user?.id).toBe(second.user?.id);
+    expect(first.user?.email).toBe(rootEmail);
+  });
+
+  it("rejects a token signed with a different secret", async () => {
+    const forged = await Effect.runPromise(
+      signStandaloneAuthToken({ email: rootEmail, secret: "not-the-secret" }),
+    );
+
+    await expect(resolve({ authorization: `Bearer ${forged}` })).rejects.toBeDefined();
+  });
+
+  it("rejects a request with no credentials", async () => {
+    await expect(resolve({})).rejects.toBeDefined();
+  });
+
+  it("adopts an existing row for the same email instead of creating a second user", async () => {
+    await Effect.runPromise(cleanup);
+    await Effect.runPromise(
+      Effect.gen(function* () {
+        const db = yield* Db;
+        yield* db.insert(user).values({
+          banned: false,
+          banExpires: null,
+          banReason: null,
+          createdAt: new Date(),
+          customImageUrl: null,
+          email: rootEmail,
+          emailVerified: true,
+          id: "user_standaloneadopt00000000",
+          image: null,
+          name: "Previously Provisioned",
+          role: null,
+          updatedAt: new Date(),
+          workosUserId: "user_external_previous",
+        });
+      }).pipe(Effect.provide(database), Effect.scoped),
+    );
+
+    const session = await resolve({ authorization: `Bearer ${await token(rootEmail)}` });
+
+    expect(session.user?.id).toBe("user_standaloneadopt00000000");
+    expect(session.user?.workosUserId).toBe(STANDALONE_ROOT_SUBJECT);
+
+    const rows = await Effect.runPromise(
+      Effect.gen(function* () {
+        const db = yield* Db;
+        return yield* db.select().from(user).where(eq(user.email, rootEmail));
+      }).pipe(Effect.provide(database), Effect.scoped),
+    );
+    expect(rows).toHaveLength(1);
+  });
+});
diff --git a/apps/backend/tests/StandaloneOrgDirectory.integration.test.ts b/apps/backend/tests/StandaloneOrgDirectory.integration.test.ts
new file mode 100644
index 000000000..dc8de8c22
--- /dev/null
+++ b/apps/backend/tests/StandaloneOrgDirectory.integration.test.ts
@@ -0,0 +1,129 @@
+import { StandaloneOrgDirectoryLive } from "@voidhash/core/services/organizations/StandaloneOrgDirectory";
+import { OrgDirectoryPort } from "@voidhash/core/services/organizations/OrgDirectoryPort";
+import { generateId } from "@voidhash/core/utils/generate-id";
+import { Db, eq, member, organization, user } from "@voidhash/db";
+import { Effect } from "effect";
+import { afterAll, describe, expect, it } from "vitest";
+
+import { getSelfhostDatabaseConfig } from "../src/config.ts";
+
+const database = Db.layer(getSelfhostDatabaseConfig());
+
+const userId = generateId("user");
+const orgId = generateId("organization");
+const memberId = generateId("member");
+const email = "local-org-directory@integration.test";
+
+const withServices = <A, E>(effect: Effect.Effect<A, E, Db | OrgDirectoryPort>) =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provide(StandaloneOrgDirectoryLive),
+      Effect.provide(database),
+      Effect.scoped,
+    ),
+  );
+
+describe("local organization directory", () => {
+  afterAll(async () => {
+    await withServices(
+      Effect.gen(function* () {
+        const db = yield* Db;
+        yield* db.delete(member).where(eq(member.id, memberId));
+        yield* db.delete(organization).where(eq(organization.id, orgId));
+        yield* db.delete(user).where(eq(user.id, userId));
+      }),
+    );
+  });
+
+  it("synthesizes provider ids that satisfy the NOT NULL workos columns", async () => {
+    await withServices(
+      Effect.gen(function* () {
+        const port = yield* OrgDirectoryPort;
+        const db = yield* Db;
+
+        yield* db.insert(user).values({
+          banned: false,
+          banExpires: null,
+          banReason: null,
+          createdAt: new Date(),
+          customImageUrl: null,
+          email,
+          emailVerified: true,
+          id: userId,
+          image: null,
+          name: "Directory Dev",
+          role: null,
+          updatedAt: new Date(),
+          workosUserId: `local_${"a".repeat(24)}`,
+        });
+
+        const createdOrg = yield* port.createOrganization({
+          externalId: orgId,
+          name: "Directory Org",
+        });
+        expect(createdOrg.id).toBe(`local_org_${orgId}`);
+        // `organization.workos_organization_id` is varchar(64).
+        expect(createdOrg.id.length).toBeLessThanOrEqual(64);
+
+        const membership = yield* port.createMembership({
+          roleSlug: "admin",
+          workosOrganizationId: createdOrg.id,
+          workosUserId: `local_${"a".repeat(24)}`,
+        });
+        expect(membership.id.startsWith("local_mem_")).toBe(true);
+        expect(membership.id.length).toBeLessThanOrEqual(64);
+
+        // The real INSERTs OrganizationService performs — proof the synthesized
+        // ids actually satisfy the constraints.
+        yield* db.insert(organization).values({
+          createdAt: new Date(),
+          id: orgId,
+          logo: null,
+          metadata: null,
+          name: "Directory Org",
+          slug: `directory-org-${orgId.slice(-8)}`,
+          workosOrganizationId: createdOrg.id,
+        });
+        yield* db.insert(member).values({
+          createdAt: new Date(),
+          id: memberId,
+          organizationId: orgId,
+          role: "admin",
+          userId,
+          workosMembershipId: membership.id,
+        });
+      }),
+    );
+  });
+
+  it("reads users and memberships back out of the local tables", async () => {
+    await withServices(
+      Effect.gen(function* () {
+        const port = yield* OrgDirectoryPort;
+
+        const found = yield* port.findUserByEmail(email);
+        expect(found?.email).toBe(email);
+        expect(found?.firstName).toBe("Directory");
+        expect(found?.lastName).toBe("Dev");
+        expect(found?.externalId).toBe(userId);
+
+        const memberships = yield* port.listMembershipsForUser(found?.id ?? "");
+        expect(memberships).toHaveLength(1);
+        expect(memberships[0]?.organizationId).toBe(`local_org_${orgId}`);
+        expect(memberships[0]?.role).toBe("admin");
+
+        const org = yield* port.getOrganizationByExternalId(orgId);
+        expect(org?.name).toBe("Directory Org");
+      }),
+    );
+  });
+
+  it("returns null for an unknown email", async () => {
+    await withServices(
+      Effect.gen(function* () {
+        const port = yield* OrgDirectoryPort;
+        expect(yield* port.findUserByEmail("nobody@integration.test")).toBeNull();
+      }),
+    );
+  });
+});
diff --git a/selfhost/entry/tests/ThumbnailQueue.integration.test.ts b/apps/backend/tests/ThumbnailQueue.integration.test.ts
similarity index 82%
rename from selfhost/entry/tests/ThumbnailQueue.integration.test.ts
rename to apps/backend/tests/ThumbnailQueue.integration.test.ts
index 8b8f56589..50e49c15a 100644
--- a/selfhost/entry/tests/ThumbnailQueue.integration.test.ts
+++ b/apps/backend/tests/ThumbnailQueue.integration.test.ts
@@ -11,9 +11,7 @@ import {
   mimicDocumentIdleQueueName,
 } from "../src/mimic/MimicDocumentIdleQueue.ts";
 
-const describePg = process.env.SELFHOST_PG_TEST === "1" ? describe : describe.skip;
-
-describePg("self-host thumbnail queue", () => {
+describe("self-host thumbnail queue", () => {
   it("delivers and acknowledges an idle-document revision", async () => {
     const config = getSelfhostRuntimeConfig();
     const documentId = `thumbnail-${crypto.randomUUID()}`;
@@ -50,12 +48,15 @@ describePg("self-host thumbnail queue", () => {
       await Effect.runPromise(
         Effect.gen(function* () {
           const db = yield* Db;
+          // The cluster queue driver hands the store a JSON string, which the
+          // store then JSON-encodes into `element`, so the body is doubly
+          // encoded: unwrap the outer JSON scalar before reading its fields.
           yield* db.execute(sql`
-            DELETE FROM platform_queue_messages
+            DELETE FROM effect_queue
             WHERE queue_name = ${mimicDocumentIdleQueueName}
-              AND body_json ->> 'documentId' = ${documentId}
+              AND (element::jsonb #>> '{}')::jsonb ->> 'documentId' = ${documentId}
           `);
-        }).pipe(Effect.provide(Db.layer(config.database))),
+        }).pipe(Effect.provide(Db.layer(config.platformDatabase))),
       );
     }
 
diff --git a/selfhost/entry/tests/Thumbnails.test.ts b/apps/backend/tests/Thumbnails.test.ts
similarity index 100%
rename from selfhost/entry/tests/Thumbnails.test.ts
rename to apps/backend/tests/Thumbnails.test.ts
diff --git a/selfhost/entry/tests/WorkflowComposition.integration.test.ts b/apps/backend/tests/WorkflowComposition.integration.test.ts
similarity index 65%
rename from selfhost/entry/tests/WorkflowComposition.integration.test.ts
rename to apps/backend/tests/WorkflowComposition.integration.test.ts
index 30a6e2f56..55b3e1c06 100644
--- a/selfhost/entry/tests/WorkflowComposition.integration.test.ts
+++ b/apps/backend/tests/WorkflowComposition.integration.test.ts
@@ -1,7 +1,8 @@
 import { createServer } from "node:http";
 import type { AddressInfo } from "node:net";
 
-import { WebhookDeliveryWorkflow } from "@voidhash/core/services/webhookDispatch/WebhookDeliveryWorkflow";
+import { DeliverWebhookRegistration } from "@voidhash/core/workflows/DeliverWebhook";
+import { DeliverWebhook } from "@voidhash/core/workflows/definitions";
 import {
   Db,
   WebhookDeliveryStatus,
@@ -11,19 +12,15 @@ import {
   webhookDeliveryAttempts,
   webhookEndpoints,
 } from "@voidhash/db";
-import { Effect } from "effect";
+import { Effect, Layer } from "effect";
+import * as Workflow from "@voidhash/platform/Workflow";
 import { describe, expect, it } from "vitest";
 
-import {
-  makeSelfhostWorkflowRuntimeLive,
-  registerSelfhostWorkflows,
-} from "../src/backend/WorkflowPorts.ts";
+import { makeSelfhostPlatformLayers } from "../src/backend/PlatformProfile.ts";
 import { getSelfhostRuntimeConfig } from "../src/config.ts";
 
-const describePg = process.env.SELFHOST_PG_TEST === "1" ? describe : describe.skip;
-
-describePg("self-host workflow composition", () => {
-  it("delivers a webhook through the durable Postgres runner", async () => {
+describe("self-host workflow composition", () => {
+  it("delivers a webhook through the durable cluster runner", async () => {
     const receivedBodies: string[] = [];
     const server = createServer((request, response) => {
       const chunks: Buffer[] = [];
@@ -44,6 +41,9 @@ describePg("self-host workflow composition", () => {
     const endpointId = `webhookEndpoint_${suffix}`;
     const deliveryId = `webhookDelivery_${suffix}`;
     const database = Db.layer(config.database);
+    const platformDatabase = Db.layer(config.platformDatabase);
+    const platform = makeSelfhostPlatformLayers(config);
+    const workflowRuntime = Layer.merge(platform.workflowRunner, platform.runtime);
 
     try {
       await Effect.runPromise(
@@ -71,9 +71,8 @@ describePg("self-host workflow composition", () => {
       const attempts = await Effect.runPromise(
         Effect.scoped(
           Effect.gen(function* () {
-            yield* registerSelfhostWorkflows(config);
-            const delivery = yield* WebhookDeliveryWorkflow;
-            yield* delivery.dispatch({
+            yield* DeliverWebhookRegistration.register(database);
+            yield* Workflow.execute(DeliverWebhook, {
               attemptNumber: 1,
               deliveryId,
               endpointId,
@@ -97,10 +96,7 @@ describePg("self-host workflow composition", () => {
               yield* Effect.sleep("25 millis");
             }
             return yield* Effect.die("webhook workflow timed out");
-          }).pipe(
-            Effect.provide(database),
-            Effect.provide(makeSelfhostWorkflowRuntimeLive(config)),
-          ),
+          }).pipe(Effect.provide(database), Effect.provide(workflowRuntime)),
         ),
       );
 
@@ -116,32 +112,36 @@ describePg("self-host workflow composition", () => {
             .where(eq(webhookDeliveryAttempts.webhookDeliveryId, deliveryId));
           yield* db.delete(webhookDeliveries).where(eq(webhookDeliveries.id, deliveryId));
           yield* db.delete(webhookEndpoints).where(eq(webhookEndpoints.id, endpointId));
+        }).pipe(Effect.provide(database)),
+      );
+      await Effect.runPromise(
+        Effect.gen(function* () {
+          const db = yield* Db;
+          // The cluster workflow engine keeps no tables of its own: an
+          // execution, its activities, its deferreds, and its durable clocks
+          // are all rows in `cluster_messages` addressed to the same
+          // `entity_id` (the hashed execution ID). Only the `run` row carries
+          // the workflow payload, so it is what maps a delivery back to an
+          // execution. Those rows live in the platform database, which is a
+          // different connection from the application tables above.
           yield* db.execute(sql`
-            DELETE FROM platform_workflow_activity
-            WHERE execution_id IN (
-              SELECT execution_id FROM platform_workflow_execution
-              WHERE payload_json ->> 'deliveryId' = ${deliveryId}
-            )
-          `);
-          yield* db.execute(sql`
-            DELETE FROM platform_workflow_deferred
-            WHERE execution_id IN (
-              SELECT execution_id FROM platform_workflow_execution
-              WHERE payload_json ->> 'deliveryId' = ${deliveryId}
+            DELETE FROM cluster_replies
+            WHERE request_id IN (
+              SELECT request_id FROM cluster_messages
+              WHERE entity_id IN (
+                SELECT entity_id FROM cluster_messages
+                WHERE tag = 'run' AND payload::jsonb ->> 'deliveryId' = ${deliveryId}
+              )
             )
           `);
           yield* db.execute(sql`
-            DELETE FROM platform_workflow_clock
-            WHERE execution_id IN (
-              SELECT execution_id FROM platform_workflow_execution
-              WHERE payload_json ->> 'deliveryId' = ${deliveryId}
+            DELETE FROM cluster_messages
+            WHERE entity_id IN (
+              SELECT entity_id FROM cluster_messages
+              WHERE tag = 'run' AND payload::jsonb ->> 'deliveryId' = ${deliveryId}
             )
           `);
-          yield* db.execute(sql`
-            DELETE FROM platform_workflow_execution
-            WHERE payload_json ->> 'deliveryId' = ${deliveryId}
-          `);
-        }).pipe(Effect.provide(database)),
+        }).pipe(Effect.provide(platformDatabase)),
       );
       await new Promise<void>((resolve) => server.close(() => resolve()));
     }
diff --git a/apps/backend/tests/WorkflowRegistry.integration.test.ts b/apps/backend/tests/WorkflowRegistry.integration.test.ts
new file mode 100644
index 000000000..f6c19f562
--- /dev/null
+++ b/apps/backend/tests/WorkflowRegistry.integration.test.ts
@@ -0,0 +1,390 @@
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+
+import { AnalyticsDispatchService } from "@voidhash/core/services/analyticsIngest/AnalyticsDispatchService";
+import {
+  AppStoreExpireParkedNotifications,
+  AppStoreReconcileOriginalTransaction,
+  AppStoreReplayParkedNotifications,
+  AppStoreReplayParkedSdkNotifications,
+  DeliverWebhook,
+  FxRateSync,
+  GooglePlayReplayParkedNotifications,
+  PurchaseLedgerDrain,
+  StripeReplayParkedNotifications,
+} from "@voidhash/core/workflows/definitions";
+import { backendWorkflows } from "@voidhash/core/workflows/registry";
+import {
+  Db,
+  type InsertPurchaseLedger,
+  PurchaseLedgerStatus,
+  WebhookDeliveryStatus,
+  and,
+  eq,
+  fxRates,
+  inArray,
+  paymentProviderNotificationProcessed,
+  purchaseLedger,
+  sql,
+  webhookDeliveries,
+  webhookDeliveryAttempts,
+  webhookEndpoints,
+} from "@voidhash/db";
+import * as Workflow from "@voidhash/platform/Workflow";
+import { Effect, Exit, Layer } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { makeSelfhostPlatformLayers } from "../src/backend/PlatformProfile.ts";
+import { getSelfhostRuntimeConfig } from "../src/config.ts";
+
+const FX_UPDATE_UNIX = 1_767_225_600;
+const FX_AS_OF_DATE = new Date(FX_UPDATE_UNIX * 1_000);
+const FX_CURRENCY = "XTS";
+const DAY_MS = 24 * 60 * 60 * 1_000;
+
+describe("self-host workflow registry", () => {
+  it("executes every workflow through the Postgres-backed cluster runner", async () => {
+    const marker = `workflow-coverage-${crypto.randomUUID()}`;
+    const webhookEndpointId = `${marker}-endpoint`;
+    const webhookDeliveryId = `${marker}-delivery`;
+    const ledgerId = `${marker}-ledger`;
+    const expireId = `${marker}-expire`;
+    const appProductId = `${marker}-app-product`;
+    const appSdkId = `${marker}-app-sdk`;
+    const googleId = `${marker}-google`;
+    const stripeId = `${marker}-stripe`;
+    const expireTriggeredAt = new Date().toISOString();
+    const notificationIds = [expireId, appProductId, appSdkId, googleId, stripeId];
+    const receivedWebhookBodies: string[] = [];
+    let fxRequests = 0;
+
+    const server = createServer((request, response) => {
+      if (request.url?.endsWith("/latest/USD")) {
+        fxRequests++;
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(
+          JSON.stringify({
+            base_code: "USD",
+            conversion_rates: { [FX_CURRENCY]: 2 },
+            result: "success",
+            time_last_update_unix: FX_UPDATE_UNIX,
+          }),
+        );
+        return;
+      }
+
+      const chunks: Buffer[] = [];
+      request.on("data", (chunk: Buffer) => chunks.push(chunk));
+      request.on("end", () => {
+        receivedWebhookBodies.push(Buffer.concat(chunks).toString("utf8"));
+        response.writeHead(204).end();
+      });
+    });
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", resolve);
+    });
+
+    const address = server.address() as AddressInfo;
+    const originalFxBaseUrl = process.env.EXCHANGE_RATE_API_BASE_URL;
+    const originalFxApiKey = process.env.EXCHANGE_RATE_API_KEY;
+    process.env.EXCHANGE_RATE_API_BASE_URL = `http://127.0.0.1:${address.port}/fx`;
+    process.env.EXCHANGE_RATE_API_KEY = "integration";
+
+    const config = getSelfhostRuntimeConfig();
+    const database = Db.layer(config.database);
+    const platformDatabase = Db.layer(config.platformDatabase);
+    const platform = makeSelfhostPlatformLayers(config);
+    const workflowRuntime = Layer.merge(platform.workflowRunner, platform.runtime);
+    const workflowInfra = Layer.merge(database, AnalyticsDispatchService.noop);
+
+    const cleanupApplicationRows = Effect.gen(function* () {
+      const db = yield* Db;
+      yield* db
+        .delete(webhookDeliveryAttempts)
+        .where(eq(webhookDeliveryAttempts.webhookDeliveryId, webhookDeliveryId))
+        .pipe(Effect.ignore);
+      yield* db
+        .delete(webhookDeliveries)
+        .where(eq(webhookDeliveries.id, webhookDeliveryId))
+        .pipe(Effect.ignore);
+      yield* db
+        .delete(webhookEndpoints)
+        .where(eq(webhookEndpoints.id, webhookEndpointId))
+        .pipe(Effect.ignore);
+      yield* db
+        .delete(paymentProviderNotificationProcessed)
+        .where(inArray(paymentProviderNotificationProcessed.id, notificationIds))
+        .pipe(Effect.ignore);
+      yield* db.delete(purchaseLedger).where(eq(purchaseLedger.id, ledgerId)).pipe(Effect.ignore);
+      yield* db
+        .delete(fxRates)
+        .where(and(eq(fxRates.currency, FX_CURRENCY), eq(fxRates.asOfDate, FX_AS_OF_DATE)))
+        .pipe(Effect.ignore);
+    }).pipe(Effect.provide(database));
+
+    const cleanupWorkflowRows = Effect.gen(function* () {
+      const db = yield* Db;
+      const markerPattern = `%${marker}%`;
+      yield* db.execute(sql`
+          DELETE FROM cluster_replies
+          WHERE request_id IN (
+            SELECT request_id FROM cluster_messages
+            WHERE entity_id IN (
+              SELECT entity_id FROM cluster_messages
+              WHERE tag = 'run'
+                AND (
+                  payload::jsonb::text LIKE ${markerPattern}
+                  OR payload::jsonb ->> 'triggeredAt' = ${expireTriggeredAt}
+                )
+            )
+          )
+        `);
+      yield* db.execute(sql`
+          DELETE FROM cluster_messages
+          WHERE entity_id IN (
+            SELECT entity_id FROM cluster_messages
+            WHERE tag = 'run'
+              AND (
+                payload::jsonb::text LIKE ${markerPattern}
+                OR payload::jsonb ->> 'triggeredAt' = ${expireTriggeredAt}
+              )
+          )
+        `);
+    }).pipe(Effect.provide(platformDatabase), Effect.ignore);
+
+    try {
+      await Effect.runPromise(cleanupApplicationRows);
+      await Effect.runPromise(
+        Effect.scoped(
+          Effect.gen(function* () {
+            const db = yield* Db;
+
+            yield* db.insert(webhookEndpoints).values({
+              events: ["person.created"],
+              id: webhookEndpointId,
+              name: "workflow registry integration",
+              projectId: `${marker}-project`,
+              secret: "whsec_integration",
+              url: `http://127.0.0.1:${address.port}/webhook`,
+            });
+            yield* db.insert(webhookDeliveries).values({
+              eventOccurredAt: new Date(),
+              eventType: "person.created",
+              id: webhookDeliveryId,
+              payload: { marker },
+              projectId: `${marker}-project`,
+              webhookEndpointId,
+            });
+
+            const ledgerRow: InsertPurchaseLedger = {
+              attemptCount: 0,
+              claimedAt: null,
+              claimedBy: null,
+              eventsPayload: [],
+              id: ledgerId,
+              idempotencyKey: `${marker}-ledger-key`,
+              lastError: null,
+              nextAttemptAt: null,
+              organizationId: `${marker}-organization`,
+              personId: `${marker}-person`,
+              projectId: `${marker}-project`,
+              providerEventType: "integration-test",
+              providerId: "stripe",
+              publishedAt: null,
+              rawProviderPayload: null,
+              resultPayload: {},
+              source: "webhook",
+              status: PurchaseLedgerStatus.Pending,
+            };
+            yield* db.insert(purchaseLedger).values(ledgerRow);
+
+            yield* db.insert(paymentProviderNotificationProcessed).values([
+              {
+                id: expireId,
+                notificationType: "integration-test",
+                notificationUuid: `${expireId}-uuid`,
+                parkedRawPayload: null,
+                parkedUntilOriginalTransactionId: `${expireId}-original`,
+                paymentProviderConfigurationId: `${expireId}-config`,
+                processedAt: new Date(Date.now() - 91 * DAY_MS),
+                providerId: "apple-app-store",
+                result: "parked_pending_sdk_confirmation",
+                source: "webhook",
+              },
+              {
+                id: appProductId,
+                notificationType: "integration-test",
+                notificationUuid: `${appProductId}-uuid`,
+                parkedRawPayload: null,
+                parkedUntilProviderProductKey: `${appProductId}-key`,
+                paymentProviderConfigurationId: `${appProductId}-config`,
+                providerId: "apple-app-store",
+                result: "parked_pending_product_mapping",
+                source: "webhook",
+              },
+              {
+                id: appSdkId,
+                notificationType: "integration-test",
+                notificationUuid: `${appSdkId}-uuid`,
+                parkedRawPayload: null,
+                parkedUntilOriginalTransactionId: `${appSdkId}-original`,
+                paymentProviderConfigurationId: `${appSdkId}-config`,
+                providerId: "apple-app-store",
+                result: "parked_pending_sdk_confirmation",
+                source: "webhook",
+              },
+              {
+                id: googleId,
+                notificationType: "integration-test",
+                notificationUuid: `${googleId}-uuid`,
+                parkedRawPayload: null,
+                parkedUntilProviderProductKey: `${googleId}-key`,
+                paymentProviderConfigurationId: `${googleId}-config`,
+                providerId: "google-play",
+                result: "parked_pending_product_mapping",
+                source: "webhook",
+              },
+              {
+                id: stripeId,
+                notificationType: "integration-test",
+                notificationUuid: `${stripeId}-uuid`,
+                parkedRawPayload: null,
+                parkedUntilProviderProductKey: `${stripeId}-key`,
+                paymentProviderConfigurationId: `${stripeId}-config`,
+                providerId: "stripe",
+                result: "parked_pending_product_mapping",
+                source: "webhook",
+              },
+            ]);
+
+            yield* Effect.forEach(
+              backendWorkflows,
+              (registration) => registration.register(workflowInfra),
+              { discard: true },
+            );
+
+            const webhookResult = yield* Workflow.execute(DeliverWebhook, {
+              attemptNumber: 1,
+              deliveryId: webhookDeliveryId,
+              endpointId: webhookEndpointId,
+              eventType: "person.created",
+              payload: { marker },
+              secret: "whsec_integration",
+              url: `http://127.0.0.1:${address.port}/webhook`,
+            });
+            expect(webhookResult).toBeUndefined();
+            expect(receivedWebhookBodies).toEqual([JSON.stringify({ marker })]);
+            expect(
+              (yield* db.query.webhookDeliveries.findFirst({ where: { id: webhookDeliveryId } }))
+                ?.status,
+            ).toBe(WebhookDeliveryStatus.Succeeded);
+
+            const fxPayload = { runId: `${marker}-fx` };
+            expect(yield* Workflow.execute(FxRateSync, fxPayload)).toEqual({ refreshedCount: 1 });
+            expect(yield* Workflow.execute(FxRateSync, fxPayload)).toEqual({ refreshedCount: 1 });
+            expect(fxRequests).toBe(1);
+            expect(
+              yield* db.query.fxRates.findFirst({
+                where: { asOfDate: { eq: FX_AS_OF_DATE }, currency: FX_CURRENCY },
+              }),
+            ).toMatchObject({
+              currency: FX_CURRENCY,
+              source: `exchange-rate-api:latest:${FX_UPDATE_UNIX}`,
+              usdRate: 500_000,
+            });
+
+            const drain = yield* Workflow.execute(PurchaseLedgerDrain, {
+              runId: `${marker}-drain`,
+            });
+            expect(drain.batches).toBeGreaterThanOrEqual(1);
+            expect(drain.batches).toBeLessThanOrEqual(10);
+            expect(
+              (yield* db.query.purchaseLedger.findFirst({ where: { id: ledgerId } }))?.status,
+            ).toBe(PurchaseLedgerStatus.Published);
+
+            const expiry = yield* Workflow.execute(AppStoreExpireParkedNotifications, {
+              triggeredAt: expireTriggeredAt,
+            });
+            expect(expiry.expired).toBeGreaterThanOrEqual(1);
+            expect(
+              (yield* db.query.paymentProviderNotificationProcessed.findFirst({
+                where: { id: expireId },
+              }))?.result,
+            ).toBe("expired");
+
+            const replayExpected = { appliedCount: 0, failedCount: 1, totalParked: 1 };
+            expect(
+              yield* Workflow.execute(AppStoreReplayParkedNotifications, {
+                paymentProviderConfigurationId: `${appProductId}-config`,
+                paymentProviderProductId: `${appProductId}-product`,
+                providerProductKey: `${appProductId}-key`,
+                requestedAt: `${marker}-app-product-request`,
+              }),
+            ).toEqual(replayExpected);
+            expect(
+              yield* Workflow.execute(AppStoreReplayParkedSdkNotifications, {
+                originalTransactionId: `${appSdkId}-original`,
+                paymentProviderConfigurationId: `${appSdkId}-config`,
+                requestedAt: `${marker}-app-sdk-request`,
+              }),
+            ).toEqual(replayExpected);
+            expect(
+              yield* Workflow.execute(GooglePlayReplayParkedNotifications, {
+                paymentProviderConfigurationId: `${googleId}-config`,
+                paymentProviderProductId: `${googleId}-product`,
+                providerProductKey: `${googleId}-key`,
+                requestedAt: `${marker}-google-request`,
+              }),
+            ).toEqual(replayExpected);
+            expect(
+              yield* Workflow.execute(StripeReplayParkedNotifications, {
+                paymentProviderConfigurationId: `${stripeId}-config`,
+                paymentProviderProductId: `${stripeId}-product`,
+                providerProductKey: `${stripeId}-key`,
+                requestedAt: `${marker}-stripe-request`,
+              }),
+            ).toEqual(replayExpected);
+
+            for (const [id, note] of [
+              [appProductId, "parked_raw_payload missing or not a string"],
+              [appSdkId, "parked_raw_payload missing or not a string"],
+              [googleId, "parked_raw_payload missing"],
+              [stripeId, "parked_raw_payload missing or not a string"],
+            ] as const) {
+              expect(
+                yield* db.query.paymentProviderNotificationProcessed.findFirst({
+                  where: { id },
+                }),
+              ).toMatchObject({
+                parkedRawPayload: null,
+                parkedUntilOriginalTransactionId: null,
+                parkedUntilProviderProductKey: null,
+                result: "failed",
+                resultNote: note,
+              });
+            }
+
+            const reconcileExit = yield* Effect.exit(
+              Workflow.execute(AppStoreReconcileOriginalTransaction, {
+                originalTransactionId: `${marker}-missing-original`,
+                paymentProviderConfigurationId: `${marker}-missing-config`,
+                reason: "admin_repair",
+                triggeredAt: new Date().toISOString(),
+              }),
+            );
+            expect(Exit.isFailure(reconcileExit)).toBe(true);
+          }).pipe(Effect.provide(database), Effect.provide(workflowRuntime)),
+        ),
+      );
+    } finally {
+      await Effect.runPromise(cleanupApplicationRows);
+      await Effect.runPromise(cleanupWorkflowRows);
+      if (originalFxBaseUrl === undefined) delete process.env.EXCHANGE_RATE_API_BASE_URL;
+      else process.env.EXCHANGE_RATE_API_BASE_URL = originalFxBaseUrl;
+      if (originalFxApiKey === undefined) delete process.env.EXCHANGE_RATE_API_KEY;
+      else process.env.EXCHANGE_RATE_API_KEY = originalFxApiKey;
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  }, 240_000);
+});
diff --git a/selfhost/entry/tests/Www.test.ts b/apps/backend/tests/Www.test.ts
similarity index 98%
rename from selfhost/entry/tests/Www.test.ts
rename to apps/backend/tests/Www.test.ts
index 6ea8f9d9c..f47a4df5d 100644
--- a/selfhost/entry/tests/Www.test.ts
+++ b/apps/backend/tests/Www.test.ts
@@ -67,7 +67,6 @@ describe("WWW route ownership", () => {
     "/rpc/users",
     "/i/v1/capture",
     "/api/v1/users",
-    "/api/webhooks/workos",
     "/files/avatar.png",
     "/p/hash/index.html",
     "/c/hash/runtime.js",
diff --git a/apps/backend/tsconfig.json b/apps/backend/tsconfig.json
index b9da6a8e5..f040f8ac8 100644
--- a/apps/backend/tsconfig.json
+++ b/apps/backend/tsconfig.json
@@ -1,17 +1,12 @@
 {
-  "extends": "@voidhash/tsconfig/alchemy-base.json",
+  "extends": "@voidhash/tsconfig/typescript-6.json",
   "compilerOptions": {
-    "types": ["bun"],
-    "allowImportingTsExtensions": true,
-    "composite": true,
-    "stripInternal": true,
-    "noEmit": false,
-    "outDir": "./lib",
-    "rootDir": "./src",
-    "paths": {
-      "@/*": ["./src/*"]
-    }
+    "types": ["node"],
+    "noEmit": true,
+    "strict": true,
+    "noFallthroughCasesInSwitch": true,
+    "noImplicitOverride": true
   },
-  "include": ["src"],
+  "include": ["src", "tests", "vitest.mts"],
   "exclude": ["**/node_modules/**"]
 }
diff --git a/apps/backend/vitest.integration.mts b/apps/backend/vitest.integration.mts
new file mode 100644
index 000000000..0353a4ffb
--- /dev/null
+++ b/apps/backend/vitest.integration.mts
@@ -0,0 +1,22 @@
+import { defineConfig } from "vite-plus";
+
+// Integration tier: runs against the provisioned self-host stack via
+// `pnpm test:integration`. Timeouts are generous because these tests wait on
+// real containers rather than fakes.
+//
+// Files run one at a time. Most of them build a single-node cluster, and a
+// single-node cluster claims every shard in its database: two files running at
+// once would take each other's messages exactly the way a test process and a
+// running deployment do.
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["./**/*.integration.test.ts"],
+    exclude: ["./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
+    fileParallelism: false,
+    hookTimeout: 300_000,
+    teardownTimeout: 300_000,
+    testTimeout: 120_000,
+  },
+});
diff --git a/apps/backend/vitest.mts b/apps/backend/vitest.mts
new file mode 100644
index 000000000..4d8eb60c4
--- /dev/null
+++ b/apps/backend/vitest.mts
@@ -0,0 +1,12 @@
+import { defineConfig } from "vite-plus";
+
+// Unit tier: every `*.test.ts` except the stack-backed integration files.
+// `scripts/check-test-tiers.mjs` enforces this split across the repository.
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["./**/*.test.ts"],
+    exclude: ["./**/*.integration.test.ts", "./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
+  },
+});
diff --git a/apps/backend/vitest.unit.mts b/apps/backend/vitest.unit.mts
deleted file mode 100644
index 7f23222f6..000000000
--- a/apps/backend/vitest.unit.mts
+++ /dev/null
@@ -1,9 +0,0 @@
-import { defineConfig } from "vite-plus";
-
-export default defineConfig({
-  test: {
-    exclude: ["./**/*.integration.test.ts", "./node_modules/**"],
-    include: ["./**/*.test.ts"],
-    reporters: ["verbose"],
-  },
-});
diff --git a/apps/cli/build.ts b/apps/cli/build.ts
index dc64c9037..e0585d706 100644
--- a/apps/cli/build.ts
+++ b/apps/cli/build.ts
@@ -45,7 +45,7 @@ const main = async () => {
 };
 
 main().catch((error) => {
-  // biome-ignore lint/suspicious/noConsole: User facing console error.
+  // User facing console error.
   console.error(error);
   process.exit(1);
 });
diff --git a/apps/cli/src/domain/services/auth.ts b/apps/cli/src/domain/services/auth.ts
index bcb7ab708..21b8fdf30 100644
--- a/apps/cli/src/domain/services/auth.ts
+++ b/apps/cli/src/domain/services/auth.ts
@@ -183,7 +183,6 @@ const make = Effect.gen(function* effect() {
       yield* Effect.logDebug(`Starting callback server on ${host}:${port}`);
       yield* Effect.forkChild(
         Effect.catch(runCallbackServer(callbackEventsPubSub), (error) => {
-          // biome-ignore lint/suspicious/noConsole: Error logging
           console.log(error);
           return Effect.die(error);
         }),
diff --git a/apps/cli/src/utils/js-loading/js-file-loading.ts b/apps/cli/src/utils/js-loading/js-file-loading.ts
index 0f6c2d6c5..38378dbaa 100644
--- a/apps/cli/src/utils/js-loading/js-file-loading.ts
+++ b/apps/cli/src/utils/js-loading/js-file-loading.ts
@@ -10,11 +10,9 @@ export class FailedToLoadJsFileError extends Data.TaggedError("FailedToLoadJsFil
 const assertES5 = ({ unregister }: { unregister: () => void }) =>
   Effect.try({
     try: () => require("./_es5.ts"),
-    // biome-ignore lint/suspicious/noExplicitAny: yolo
     catch: (e: any) => {
       unregister();
       if ("errors" in e && Array.isArray(e.errors) && e.errors.length > 0) {
-        // biome-ignore lint/suspicious/noExplicitAny: yolo
         const es5Error = (e.errors as any[]).some((it) =>
           it.text?.includes(`("es5") is not supported yet`),
         );
@@ -57,7 +55,7 @@ export const safeRegister = () =>
     }).pipe(
       Effect.catch(() =>
         Effect.succeed({
-          // biome-ignore lint/suspicious/noEmptyBlockStatements: it is on purpose an empty function. It is here instead of try-catch due to tsx.
+          // it is on purpose an empty function. It is here instead of try-catch due to tsx.
           unregister(): void {},
         }),
       ),
diff --git a/apps/cli/sst-env.d.ts b/apps/cli/sst-env.d.ts
index f2ed71576..b3584169c 100644
--- a/apps/cli/sst-env.d.ts
+++ b/apps/cli/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../../sst-env.d.ts" />
 
diff --git a/apps/mimic-admin/src/styles/globals.css b/apps/mimic-admin/src/styles/globals.css
index 688cf5367..cbe66d68d 100644
--- a/apps/mimic-admin/src/styles/globals.css
+++ b/apps/mimic-admin/src/styles/globals.css
@@ -1,4 +1,3 @@
-/** biome-ignore-all lint/nursery/noUnknownAtRule: tailwind */
 @import "tailwindcss";
 
 @import "tw-animate-css";
diff --git a/apps/mimic-db/REWRITE.md b/apps/mimic-db/REWRITE.md
index 01226039d..5a599c60d 100644
--- a/apps/mimic-db/REWRITE.md
+++ b/apps/mimic-db/REWRITE.md
@@ -17,7 +17,7 @@ document load** instead of an eager "migration push" over every document.
 | `node:vm` (`Script`/`createContext`) migration sandbox | in-process `evaluateBundledMigration` (`new Function`, **no `node:vm`/quickjs**) — see "Migration execution" below |
 | eager "migration push" iterates every document         | `MimicHostObject` records new schema versions; each document **migrates itself on load**                           |
 | standalone/gateway/worker Node entrypoints             | `MimicDbWorker` Cloudflare Worker (one fetch entrypoint)                                                           |
-| deployed standalone; backend points at external URL    | **provisioned from `apps/backend`** alchemy stack; service binding + `MIMIC_HOST_URL`                              |
+| deployed standalone; backend points at external URL    | **provisioned from `packages/backend`** alchemy stack; service binding + `MIMIC_HOST_URL`                              |
 
 ## Preserved contracts (so clients/backend keep working)
 
diff --git a/apps/mimic-db/package.json b/apps/mimic-db/package.json
index cac383a6d..a66e8f2be 100644
--- a/apps/mimic-db/package.json
+++ b/apps/mimic-db/package.json
@@ -26,7 +26,7 @@
     "@effect/sql-pg": "catalog:",
     "@voidhash/mimic-core": "workspace:*",
     "@voidhash/mimic-server": "workspace:*",
-    "@orbian/sdk": "https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526",
+    "@voidhash/platform": "workspace:*",
     "effect": "catalog:"
   },
   "devDependencies": {
diff --git a/apps/mimic-db/src/core/local-entity-host.ts b/apps/mimic-db/src/core/local-entity-host.ts
index 956d06f83..00a03d4d6 100644
--- a/apps/mimic-db/src/core/local-entity-host.ts
+++ b/apps/mimic-db/src/core/local-entity-host.ts
@@ -3,7 +3,7 @@ import {
   type DurableEntityContext,
   type DurableEntityHostShape,
   type DurableEntitySession,
-} from "@orbian/sdk/DurableEntity";
+} from "@voidhash/platform/DurableEntity";
 import { Effect, Layer, Semaphore } from "effect";
 
 interface MemoryEntityState {
diff --git a/apps/mimic-db/src/core/local-host-service.ts b/apps/mimic-db/src/core/local-host-service.ts
index 2b675c190..8258880e9 100644
--- a/apps/mimic-db/src/core/local-host-service.ts
+++ b/apps/mimic-db/src/core/local-host-service.ts
@@ -2,7 +2,7 @@ import {
   type DurableEntityContext,
   DurableEntityHost,
   makeDurableEntityAddress,
-} from "@orbian/sdk/DurableEntity";
+} from "@voidhash/platform/DurableEntity";
 import { Effect, Layer } from "effect";
 import type { MigrationRegistry } from "@voidhash/mimic-server/migrate";
 import { NotFoundError } from "@voidhash/mimic-server/rpc";
diff --git a/apps/mimic-db/tests/durable-entity-host.test.ts b/apps/mimic-db/tests/durable-entity-host.test.ts
index e17bc6936..14d6ffb82 100644
--- a/apps/mimic-db/tests/durable-entity-host.test.ts
+++ b/apps/mimic-db/tests/durable-entity-host.test.ts
@@ -1,4 +1,4 @@
-import { makeDurableEntityAddress, type DurableEntitySession } from "@orbian/sdk/DurableEntity";
+import { makeDurableEntityAddress, type DurableEntitySession } from "@voidhash/platform/DurableEntity";
 import { Effect } from "effect";
 import { describe, expect, test } from "vitest";
 
diff --git a/apps/mimic-db/tests/unit/direct-migration.test.ts b/apps/mimic-db/tests/unit/direct-migration.test.ts
index eca48b8f4..2af9647cc 100644
--- a/apps/mimic-db/tests/unit/direct-migration.test.ts
+++ b/apps/mimic-db/tests/unit/direct-migration.test.ts
@@ -4,7 +4,7 @@ import {
   defineMigrationRegistry,
   type AnyDirectMigration,
 } from "@voidhash/mimic-server/migrate";
-import { makeDurableEntityAddress } from "@orbian/sdk/DurableEntity";
+import { makeDurableEntityAddress } from "@voidhash/platform/DurableEntity";
 import { Effect } from "effect";
 import { describe, expect, it } from "vitest";
 
diff --git a/apps/mimic-db/vitest.mts b/apps/mimic-db/vitest.mts
index 51b79bb1e..d8c77b4e5 100644
--- a/apps/mimic-db/vitest.mts
+++ b/apps/mimic-db/vitest.mts
@@ -4,6 +4,8 @@ import { dirname, resolve } from "node:path";
 
 const rootDir = dirname(fileURLToPath(import.meta.url));
 
+// Unit tier: every `*.test.ts` except the stack-backed integration files.
+// `scripts/check-test-tiers.mjs` enforces this split across the repository.
 export default defineConfig({
   resolve: {
     alias: {
@@ -15,8 +17,8 @@ export default defineConfig({
   },
   test: {
     environment: "node",
-    include: ["./tests/**/*.test.ts"],
-    exclude: ["./node_modules/**"],
+    include: ["./**/*.test.ts"],
+    exclude: ["./**/*.integration.test.ts", "./node_modules/**", "./dist/**"],
     reporters: ["verbose"],
   },
 });
diff --git a/apps/studio/src/components/PreviewErrorBoundary.tsx b/apps/studio/src/components/PreviewErrorBoundary.tsx
index 3b3782961..224ff0547 100644
--- a/apps/studio/src/components/PreviewErrorBoundary.tsx
+++ b/apps/studio/src/components/PreviewErrorBoundary.tsx
@@ -26,7 +26,7 @@ export class PreviewErrorBoundary extends Component<
   }
 
   componentDidCatch(error: Error, info: ErrorInfo): void {
-    // biome-ignore lint/suspicious/noConsole: surface author errors in the dev console.
+    // surface author errors in the dev console.
     console.error("[voidhash-studio] preview render error", error, info);
   }
 
diff --git a/apps/www/.source/browser.ts b/apps/www/.source/browser.ts
index a20e34d72..f8c66bc1b 100644
--- a/apps/www/.source/browser.ts
+++ b/apps/www/.source/browser.ts
@@ -15,12 +15,5 @@ const browserCollections = {
     },
     "eager": false
   })),
-  design: create.doc("design", import.meta.glob(["./**/*.{mdx,md}"], {
-    "base": "./../src/features/design/content/docs",
-    "query": {
-      "collection": "design"
-    },
-    "eager": false
-  })),
 };
 export default browserCollections;
\ No newline at end of file
diff --git a/apps/www/.source/server.ts b/apps/www/.source/server.ts
index 25501242d..0b72d6d61 100644
--- a/apps/www/.source/server.ts
+++ b/apps/www/.source/server.ts
@@ -21,19 +21,4 @@ export const docs = await create.docs("docs", "src/features/docs/content/docs",
     "collection": "docs"
   },
   "eager": true
-}));
-
-export const design = await create.docs("design", "src/features/design/content/docs", import.meta.glob(["./**/*.{json,yaml}"], {
-  "base": "./../src/features/design/content/docs",
-  "query": {
-    "collection": "design"
-  },
-  "import": "default",
-  "eager": true
-}), import.meta.glob(["./**/*.{mdx,md}"], {
-  "base": "./../src/features/design/content/docs",
-  "query": {
-    "collection": "design"
-  },
-  "eager": true
 }));
\ No newline at end of file
diff --git a/apps/www/package.json b/apps/www/package.json
index 4f1072071..a763a05cc 100644
--- a/apps/www/package.json
+++ b/apps/www/package.json
@@ -62,9 +62,6 @@
     "@voidhash/paywalls": "workspace:*",
     "@voidhash/rpc": "workspace:*",
     "@voidhash/ui": "workspace:*",
-    "@workos-inc/node": "8.13.0",
-    "@workos/authkit-session": "0.5.2",
-    "@workos/authkit-tanstack-react-start": "0.8.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cross-fetch": "catalog:",
@@ -75,7 +72,7 @@
     "fractional-indexing-jittered": "^1.0.0",
     "fumadocs-core": "16.11.5",
     "fumadocs-mdx": "15.2.0",
-    "fumadocs-openapi": "^11.2.2",
+    "fumadocs-openapi": "11.2.2",
     "fumadocs-ui": "16.11.5",
     "h3-v2": "npm:h3@2.0.1-rc.18",
     "lucide-react": "catalog:",
diff --git a/apps/www/src/features/www/hero/hero-shader.tsx b/apps/www/src/components/hero-shader.tsx
similarity index 100%
rename from apps/www/src/features/www/hero/hero-shader.tsx
rename to apps/www/src/components/hero-shader.tsx
diff --git a/apps/www/src/components/voidhash-gradient-background.tsx b/apps/www/src/components/voidhash-gradient-background.tsx
deleted file mode 100644
index 9450994f6..000000000
--- a/apps/www/src/components/voidhash-gradient-background.tsx
+++ /dev/null
@@ -1,224 +0,0 @@
-"use client";
-
-import { lazy, Suspense, useCallback, useEffect, useMemo, useState, type CSSProperties } from "react";
-
-import { cn } from "@/lib/utils";
-
-import { VoidhashGradientControls } from "./voidhash-gradient-controls";
-import {
-  DEFAULT_VOIDHASH_GRADIENT_SETTINGS,
-  mergeVoidhashGradientSettings,
-  VOIDHASH_GRADIENT_CONTROLS_STORAGE_KEY,
-  VOIDHASH_GRADIENT_STORAGE_KEY,
-  type VoidhashGradientSettings,
-} from "./voidhash-gradient-settings";
-
-const VoidhashGradientCanvas = lazy(async () => {
-  const module = await import("./voidhash-gradient-canvas");
-
-  return {
-    default: module.VoidhashGradientCanvas,
-  };
-});
-
-type VoidhashGradientPlacement = "bottom" | "top";
-type ReadyPlacements = Record<VoidhashGradientPlacement, boolean>;
-
-function getFadeMask(settings: VoidhashGradientSettings, placement: VoidhashGradientPlacement) {
-  const start = Math.min(settings.fadeStart, settings.fadeEnd - 1);
-  const end = Math.max(settings.fadeEnd, start + 1);
-  const mid = start + (end - start) * 0.35;
-  const direction = placement === "top" ? "to top" : "to bottom";
-
-  return `linear-gradient(${direction}, transparent 0%, transparent ${start}%, rgba(0, 0, 0, 0.12) ${mid}%, black ${end}%, black 100%)`;
-}
-
-function getLayerStyle(settings: VoidhashGradientSettings, placement: VoidhashGradientPlacement): CSSProperties {
-  return {
-    [placement]: `${placement === "top" ? settings.topOffset : settings.bottomOffset}%`,
-    filter: `blur(${settings.blur}px)`,
-    height: `${settings.effectHeight}%`,
-    maskImage: getFadeMask(settings, placement),
-    WebkitMaskImage: getFadeMask(settings, placement),
-  };
-}
-
-function VoidhashGradientEntryVeil({ isVisible }: { isVisible: boolean }) {
-  return (
-    <div
-      aria-hidden
-      className={cn(
-        "pointer-events-none absolute inset-0 z-20 bg-black transition-opacity duration-1000 ease-out motion-reduce:transition-none",
-        isVisible ? "opacity-100" : "opacity-0",
-      )}
-    />
-  );
-}
-
-function VoidhashGradientLayer({
-  isRevealed,
-  onReady,
-  placement,
-  settings,
-}: {
-  isRevealed: boolean;
-  onReady: (placement: VoidhashGradientPlacement) => void;
-  placement: VoidhashGradientPlacement;
-  settings: VoidhashGradientSettings;
-}) {
-  const [isCanvasReady, setIsCanvasReady] = useState(false);
-
-  return (
-    <div aria-hidden className="absolute inset-x-[-10%] overflow-hidden" style={getLayerStyle(settings, placement)}>
-      <div
-        className={cn(
-          "absolute inset-0 transition-[opacity,transform] duration-1000 ease-out will-change-[opacity,transform]",
-          isCanvasReady && isRevealed ? "translate-y-0 opacity-100" : "translate-y-4 opacity-0",
-        )}
-      >
-        <VoidhashGradientCanvas
-          inverted={placement === "top"}
-          onReady={() => {
-            setIsCanvasReady(true);
-            onReady(placement);
-          }}
-          seed={placement === "top" ? settings.topSeed : settings.bottomSeed}
-          settings={settings}
-        />
-      </div>
-    </div>
-  );
-}
-
-export type VoidhashGradientBackgroundProps = {
-  className?: string;
-  controlsQueryParam?: string;
-  controlsStorageKey?: string;
-  controlsTitle?: string;
-  settings?: Partial<VoidhashGradientSettings>;
-  settingsStorageKey?: string;
-};
-
-/** Renders the reusable blurred Three.js gradient background used across Voidhash surfaces. */
-export function VoidhashGradientBackground({
-  className,
-  controlsQueryParam = "gradientControls",
-  controlsStorageKey = VOIDHASH_GRADIENT_CONTROLS_STORAGE_KEY,
-  controlsTitle = "Gradient FX",
-  settings: settingsProp,
-  settingsStorageKey = VOIDHASH_GRADIENT_STORAGE_KEY,
-}: VoidhashGradientBackgroundProps) {
-  const baseSettings = useMemo(
-    () => mergeVoidhashGradientSettings(settingsProp ?? DEFAULT_VOIDHASH_GRADIENT_SETTINGS),
-    [settingsProp],
-  );
-  const [isMounted, setIsMounted] = useState(false);
-  const [canDropEntryVeil, setCanDropEntryVeil] = useState(false);
-  const [hasRevealed, setHasRevealed] = useState(false);
-  const [readyPlacements, setReadyPlacements] = useState<ReadyPlacements>({ bottom: false, top: false });
-  const [settings, setSettings] = useState<VoidhashGradientSettings>(baseSettings);
-  const [showControls, setShowControls] = useState(false);
-
-  useEffect(() => {
-    setIsMounted(true);
-
-    const params = new URLSearchParams(window.location.search);
-    const controlsEnabled = params.has(controlsQueryParam) || localStorage.getItem(controlsStorageKey) === "1";
-    const savedSettings = localStorage.getItem(settingsStorageKey);
-
-    if (savedSettings) {
-      try {
-        setSettings(mergeVoidhashGradientSettings(JSON.parse(savedSettings), baseSettings));
-      } catch {
-        localStorage.removeItem(settingsStorageKey);
-      }
-    }
-
-    if (controlsEnabled) {
-      setShowControls(true);
-      localStorage.setItem(controlsStorageKey, "1");
-    }
-  }, [baseSettings, controlsQueryParam, controlsStorageKey, settingsStorageKey]);
-
-  useEffect(() => {
-    if (!isMounted) {
-      return;
-    }
-
-    const veilTimer = window.setTimeout(() => setCanDropEntryVeil(true), 1800);
-
-    return () => window.clearTimeout(veilTimer);
-  }, [isMounted]);
-
-  useEffect(() => {
-    if (isMounted && showControls) {
-      localStorage.setItem(settingsStorageKey, JSON.stringify(settings));
-    }
-  }, [isMounted, settings, settingsStorageKey, showControls]);
-
-  const handleLayerReady = useCallback((placement: VoidhashGradientPlacement) => {
-    setReadyPlacements((current) => {
-      if (current[placement]) {
-        return current;
-      }
-
-      return { ...current, [placement]: true };
-    });
-  }, []);
-
-  const isShaderReady = readyPlacements.bottom && (!settings.topEnabled || readyPlacements.top);
-
-  useEffect(() => {
-    if (!hasRevealed && isMounted && (isShaderReady || canDropEntryVeil)) {
-      setHasRevealed(true);
-    }
-  }, [canDropEntryVeil, hasRevealed, isMounted, isShaderReady]);
-
-  const rootClassName = cn("relative isolate h-full w-full overflow-hidden bg-black", className);
-
-  if (!isMounted) {
-    return (
-      <div className={rootClassName}>
-        <VoidhashGradientEntryVeil isVisible={!hasRevealed} />
-      </div>
-    );
-  }
-
-  return (
-    <div className={rootClassName}>
-      <Suspense fallback={null}>
-        <VoidhashGradientLayer
-          isRevealed={hasRevealed}
-          onReady={handleLayerReady}
-          placement="bottom"
-          settings={settings}
-        />
-        {settings.topEnabled ? (
-          <VoidhashGradientLayer
-            isRevealed={hasRevealed}
-            onReady={handleLayerReady}
-            placement="top"
-            settings={settings}
-          />
-        ) : null}
-      </Suspense>
-      <VoidhashGradientEntryVeil isVisible={!hasRevealed} />
-
-      {showControls ? (
-        <VoidhashGradientControls
-          onChange={setSettings}
-          onHide={() => {
-            setShowControls(false);
-            localStorage.removeItem(controlsStorageKey);
-          }}
-          onReset={() => {
-            setSettings(baseSettings);
-            localStorage.removeItem(settingsStorageKey);
-          }}
-          settings={settings}
-          title={controlsTitle}
-        />
-      ) : null}
-    </div>
-  );
-}
diff --git a/apps/www/src/components/voidhash-gradient-canvas.tsx b/apps/www/src/components/voidhash-gradient-canvas.tsx
deleted file mode 100644
index 3c437287c..000000000
--- a/apps/www/src/components/voidhash-gradient-canvas.tsx
+++ /dev/null
@@ -1,328 +0,0 @@
-"use client";
-
-import { Canvas, useFrame } from "@react-three/fiber";
-import { useEffect, useMemo, useRef } from "react";
-import * as THREE from "three";
-
-import type { VoidhashGradientSettings } from "./voidhash-gradient-settings";
-
-const vertexShader = `
-uniform float uTime;
-uniform float uAmplitude;
-uniform float uFrequency;
-uniform float uMidFrequency;
-uniform float uHighFrequency;
-uniform float uLift;
-uniform float uSeed;
-
-varying vec2 vUv;
-varying vec3 vNormal;
-varying vec3 vViewPosition;
-varying float vWave;
-
-vec4 mod289(vec4 x) {
-  return x - floor(x * (1.0 / 289.0)) * 289.0;
-}
-
-vec3 mod289(vec3 x) {
-  return x - floor(x * (1.0 / 289.0)) * 289.0;
-}
-
-vec4 permute(vec4 x) {
-  return mod289(((x * 34.0) + 10.0) * x);
-}
-
-vec4 taylorInvSqrt(vec4 r) {
-  return 1.79284291400159 - 0.85373472095314 * r;
-}
-
-float snoise(vec3 v) {
-  const vec2 c = vec2(1.0 / 6.0, 1.0 / 3.0);
-  const vec4 d = vec4(0.0, 0.5, 1.0, 2.0);
-
-  vec3 i = floor(v + dot(v, c.yyy));
-  vec3 x0 = v - i + dot(i, c.xxx);
-
-  vec3 g = step(x0.yzx, x0.xyz);
-  vec3 l = 1.0 - g;
-  vec3 i1 = min(g.xyz, l.zxy);
-  vec3 i2 = max(g.xyz, l.zxy);
-
-  vec3 x1 = x0 - i1 + c.xxx;
-  vec3 x2 = x0 - i2 + c.yyy;
-  vec3 x3 = x0 - d.yyy;
-
-  i = mod289(i);
-  vec4 p = permute(permute(permute(
-    i.z + vec4(0.0, i1.z, i2.z, 1.0))
-    + i.y + vec4(0.0, i1.y, i2.y, 1.0))
-    + i.x + vec4(0.0, i1.x, i2.x, 1.0));
-
-  float n_ = 0.142857142857;
-  vec3 ns = n_ * d.wyz - d.xzx;
-
-  vec4 j = p - 49.0 * floor(p * ns.z * ns.z);
-
-  vec4 x_ = floor(j * ns.z);
-  vec4 y_ = floor(j - 7.0 * x_);
-
-  vec4 x = x_ * ns.x + ns.yyyy;
-  vec4 y = y_ * ns.x + ns.yyyy;
-  vec4 h = 1.0 - abs(x) - abs(y);
-
-  vec4 b0 = vec4(x.xy, y.xy);
-  vec4 b1 = vec4(x.zw, y.zw);
-
-  vec4 s0 = floor(b0) * 2.0 + 1.0;
-  vec4 s1 = floor(b1) * 2.0 + 1.0;
-  vec4 sh = -step(h, vec4(0.0));
-
-  vec4 a0 = b0.xzyw + s0.xzyw * sh.xxyy;
-  vec4 a1 = b1.xzyw + s1.xzyw * sh.zzww;
-
-  vec3 p0 = vec3(a0.xy, h.x);
-  vec3 p1 = vec3(a0.zw, h.y);
-  vec3 p2 = vec3(a1.xy, h.z);
-  vec3 p3 = vec3(a1.zw, h.w);
-
-  vec4 norm = taylorInvSqrt(vec4(
-    dot(p0, p0),
-    dot(p1, p1),
-    dot(p2, p2),
-    dot(p3, p3)
-  ));
-  p0 *= norm.x;
-  p1 *= norm.y;
-  p2 *= norm.z;
-  p3 *= norm.w;
-
-  vec4 m = max(0.6 - vec4(
-    dot(x0, x0),
-    dot(x1, x1),
-    dot(x2, x2),
-    dot(x3, x3)
-  ), 0.0);
-  m = m * m;
-
-  return 42.0 * dot(m * m, vec4(
-    dot(p0, x0),
-    dot(p1, x1),
-    dot(p2, x2),
-    dot(p3, x3)
-  ));
-}
-
-float surfaceHeight(vec2 p, float time) {
-  vec2 seedOffset = vec2(uSeed * 1.37, uSeed * -0.73);
-  vec2 q = vec2(p.x * uFrequency, p.y * uFrequency * 2.55) + seedOffset;
-  float seedTime = time + uSeed * 0.11;
-  float low = snoise(vec3(q, seedTime));
-  float mid = snoise(vec3(q * uMidFrequency + vec2(7.4, -3.2) + seedOffset * 0.43, seedTime * 1.65));
-  float high = snoise(vec3(q * uHighFrequency + vec2(-2.0, 5.7) - seedOffset * 0.26, seedTime * 2.4));
-
-  return (low * 0.62 + mid * 0.28 + high * 0.1) * uAmplitude;
-}
-
-void main() {
-  vUv = uv;
-
-  float lift = smoothstep(0.02, 0.92, uv.y);
-  float height = surfaceHeight(position.xy, uTime) * (0.72 + lift * 0.62);
-  float epsilon = 0.08;
-  float heightX = surfaceHeight(position.xy + vec2(epsilon, 0.0), uTime);
-  float heightY = surfaceHeight(position.xy + vec2(0.0, epsilon), uTime);
-
-  vec3 displaced = position;
-  displaced.y += lift * uLift;
-  displaced.z += height;
-
-  vec3 displacedNormal = normalize(vec3(
-    (height - heightX) / epsilon,
-    (height - heightY) / epsilon,
-    1.0
-  ));
-
-  vec4 mvPosition = modelViewMatrix * vec4(displaced, 1.0);
-
-  vNormal = normalize(normalMatrix * displacedNormal);
-  vViewPosition = -mvPosition.xyz;
-  vWave = height;
-
-  gl_Position = projectionMatrix * mvPosition;
-}
-`;
-
-const fragmentShader = `
-uniform vec3 uBaseColor;
-uniform vec3 uFresnelColor;
-uniform float uFresnelPower;
-uniform float uFresnelStrength;
-uniform float uHorizonStrength;
-uniform float uLateralStrength;
-uniform float uIntensity;
-uniform float uBaseGlow;
-uniform float uOpacity;
-
-varying vec2 vUv;
-varying vec3 vNormal;
-varying vec3 vViewPosition;
-varying float vWave;
-
-void main() {
-  vec3 normal = normalize(vNormal);
-  vec3 viewDirection = normalize(vViewPosition);
-  float fresnel = pow(1.0 - max(dot(normal, viewDirection), 0.0), uFresnelPower);
-  float horizon = smoothstep(0.18, 0.94, vUv.y);
-  float lateralFresnel = smoothstep(0.18, 1.0, vUv.x);
-  float blue = clamp(
-    fresnel * uFresnelStrength
-      + horizon * uHorizonStrength
-      + lateralFresnel * uLateralStrength
-      + vWave * 0.08,
-    0.0,
-    1.0
-  );
-  float alpha = smoothstep(0.0, 0.1, vUv.y) * (1.0 - smoothstep(0.8, 1.0, vUv.y));
-  float intensity = clamp(uIntensity + fresnel * 0.28 + horizon * 0.12, 0.0, 1.0);
-  float purpleBalance = clamp(uBaseGlow, 0.0, 1.5);
-  vec3 color = mix(uBaseColor, uFresnelColor, blue) * intensity;
-  color = mix(color, uBaseColor * intensity, min(purpleBalance, 1.0));
-  color = min(color, max(uBaseColor, uFresnelColor));
-
-  gl_FragColor = vec4(color, alpha * uOpacity);
-}
-`;
-
-function setUniformColor(color: THREE.Color, hex: string) {
-  const value = Number.parseInt(hex.slice(1), 16);
-
-  color.r = ((value >> 16) & 255) / 255;
-  color.g = ((value >> 8) & 255) / 255;
-  color.b = (value & 255) / 255;
-}
-
-function AnimatedPlane({
-  inverted,
-  onReady,
-  seed,
-  settings,
-}: {
-  inverted: boolean;
-  onReady?: () => void;
-  seed: number;
-  settings: VoidhashGradientSettings;
-}) {
-  const materialRef = useRef<THREE.ShaderMaterial>(null);
-  const didReportReadyRef = useRef(false);
-  const isMountedRef = useRef(true);
-  const uniforms = useMemo(() => {
-    const baseColor = new THREE.Color();
-    const fresnelColor = new THREE.Color();
-
-    setUniformColor(baseColor, settings.baseColor);
-    setUniformColor(fresnelColor, settings.fresnelColor);
-
-    return {
-      uBaseColor: { value: baseColor },
-      uFresnelColor: { value: fresnelColor },
-      uAmplitude: { value: settings.amplitude },
-      uBaseGlow: { value: settings.baseGlow },
-      uFresnelPower: { value: settings.fresnelPower },
-      uFresnelStrength: { value: settings.fresnelStrength },
-      uFrequency: { value: settings.frequency },
-      uHighFrequency: { value: settings.highFrequency },
-      uHorizonStrength: { value: settings.horizonStrength },
-      uIntensity: { value: settings.intensity },
-      uLateralStrength: { value: settings.lateralStrength },
-      uLift: { value: settings.lift },
-      uMidFrequency: { value: settings.midFrequency },
-      uOpacity: { value: settings.opacity },
-      uSeed: { value: seed },
-      uTime: { value: 0 },
-    };
-  }, [seed, settings]);
-
-  useEffect(() => {
-    return () => {
-      isMountedRef.current = false;
-    };
-  }, []);
-
-  useEffect(() => {
-    uniforms.uAmplitude.value = settings.amplitude;
-    setUniformColor(uniforms.uBaseColor.value, settings.baseColor);
-    uniforms.uBaseGlow.value = settings.baseGlow;
-    setUniformColor(uniforms.uFresnelColor.value, settings.fresnelColor);
-    uniforms.uFresnelPower.value = settings.fresnelPower;
-    uniforms.uFresnelStrength.value = settings.fresnelStrength;
-    uniforms.uFrequency.value = settings.frequency;
-    uniforms.uHighFrequency.value = settings.highFrequency;
-    uniforms.uHorizonStrength.value = settings.horizonStrength;
-    uniforms.uIntensity.value = settings.intensity;
-    uniforms.uLateralStrength.value = settings.lateralStrength;
-    uniforms.uLift.value = settings.lift;
-    uniforms.uMidFrequency.value = settings.midFrequency;
-    uniforms.uOpacity.value = settings.opacity;
-    uniforms.uSeed.value = seed;
-  }, [seed, settings, uniforms]);
-
-  useFrame(({ clock }) => {
-    if (materialRef.current) {
-      materialRef.current.uniforms.uTime.value = clock.elapsedTime * settings.speed;
-    }
-
-    if (!didReportReadyRef.current) {
-      didReportReadyRef.current = true;
-      requestAnimationFrame(() => {
-        if (isMountedRef.current) {
-          onReady?.();
-        }
-      });
-    }
-  });
-
-  return (
-    <group scale={[1, inverted ? -1 : 1, 1]}>
-      <mesh position={[0, settings.planeY, 0]} rotation={[settings.rotationX, 0, 0]} scale={[settings.scaleX, settings.scaleY, 1]}>
-        <planeGeometry args={[14, 6.4, 180, 90]} />
-        <shaderMaterial
-          ref={materialRef}
-          blending={THREE.NormalBlending}
-          depthWrite={false}
-          fragmentShader={fragmentShader}
-          side={THREE.DoubleSide}
-          transparent
-          uniforms={uniforms}
-          vertexShader={vertexShader}
-        />
-      </mesh>
-    </group>
-  );
-}
-
-/** Renders the WebGL plane used by reusable Voidhash gradient backgrounds. */
-export function VoidhashGradientCanvas({
-  inverted = false,
-  onReady,
-  seed,
-  settings,
-}: {
-  inverted?: boolean;
-  onReady?: () => void;
-  seed: number;
-  settings: VoidhashGradientSettings;
-}) {
-  return (
-    <Canvas
-      camera={{ fov: 34, position: [0, 0, 6] }}
-      dpr={[1, 1.5]}
-      gl={{ alpha: true, antialias: true, powerPreference: "high-performance" }}
-      onCreated={({ gl }) => {
-        gl.outputColorSpace = THREE.SRGBColorSpace;
-        gl.setClearColor(0x000000, 0);
-      }}
-    >
-      <AnimatedPlane inverted={inverted} onReady={onReady} seed={seed} settings={settings} />
-    </Canvas>
-  );
-}
diff --git a/apps/www/src/components/voidhash-gradient-controls.tsx b/apps/www/src/components/voidhash-gradient-controls.tsx
deleted file mode 100644
index 2f49f5f00..000000000
--- a/apps/www/src/components/voidhash-gradient-controls.tsx
+++ /dev/null
@@ -1,175 +0,0 @@
-"use client";
-
-import { useState, type Dispatch, type SetStateAction } from "react";
-
-import type { VoidhashGradientSettings } from "./voidhash-gradient-settings";
-
-type NumericSettingKey = {
-  [Key in keyof VoidhashGradientSettings]: VoidhashGradientSettings[Key] extends number ? Key : never;
-}[keyof VoidhashGradientSettings];
-
-type BooleanSettingKey = {
-  [Key in keyof VoidhashGradientSettings]: VoidhashGradientSettings[Key] extends boolean ? Key : never;
-}[keyof VoidhashGradientSettings];
-
-type ColorSettingKey = {
-  [Key in keyof VoidhashGradientSettings]: VoidhashGradientSettings[Key] extends string ? Key : never;
-}[keyof VoidhashGradientSettings];
-
-const booleanControls: Array<{ key: BooleanSettingKey; label: string }> = [
-  { key: "topEnabled", label: "Top effect" },
-];
-
-const numericControls: Array<{
-  key: NumericSettingKey;
-  label: string;
-  min: number;
-  max: number;
-  step: number;
-}> = [
-  { key: "blur", label: "Blur", min: 0, max: 90, step: 1 },
-  { key: "effectHeight", label: "Height", min: 70, max: 180, step: 1 },
-  { key: "bottomOffset", label: "Bottom", min: -60, max: 20, step: 1 },
-  { key: "topOffset", label: "Top", min: -20, max: 60, step: 1 },
-  { key: "bottomSeed", label: "Bottom seed", min: 0, max: 80, step: 0.1 },
-  { key: "topSeed", label: "Top seed", min: 0, max: 80, step: 0.1 },
-  { key: "fadeStart", label: "Fade start", min: 0, max: 80, step: 1 },
-  { key: "fadeEnd", label: "Fade full", min: 10, max: 100, step: 1 },
-  { key: "planeY", label: "Plane Y", min: -2.4, max: 0.2, step: 0.01 },
-  { key: "rotationX", label: "Tilt", min: -1.4, max: -0.25, step: 0.01 },
-  { key: "scaleX", label: "Width", min: 0.8, max: 2.2, step: 0.01 },
-  { key: "scaleY", label: "Depth", min: 0.5, max: 1.8, step: 0.01 },
-  { key: "amplitude", label: "Amplitude", min: 0, max: 1.8, step: 0.01 },
-  { key: "frequency", label: "Frequency", min: 0.05, max: 0.5, step: 0.01 },
-  { key: "midFrequency", label: "Mid noise", min: 0.8, max: 4, step: 0.01 },
-  { key: "highFrequency", label: "Fine noise", min: 1.5, max: 7, step: 0.01 },
-  { key: "speed", label: "Speed", min: 0, max: 0.2, step: 0.001 },
-  { key: "lift", label: "Lift", min: 0, max: 1, step: 0.01 },
-  { key: "fresnelPower", label: "Fresnel pow", min: 0.5, max: 4, step: 0.01 },
-  { key: "fresnelStrength", label: "Fresnel", min: 0, max: 3, step: 0.01 },
-  { key: "horizonStrength", label: "Horizon", min: 0, max: 2, step: 0.01 },
-  { key: "lateralStrength", label: "Blue bias", min: 0, max: 1.5, step: 0.01 },
-  { key: "intensity", label: "Intensity", min: 0.2, max: 2, step: 0.01 },
-  { key: "baseGlow", label: "Purple mix", min: 0, max: 1.5, step: 0.01 },
-  { key: "opacity", label: "Opacity", min: 0, max: 1, step: 0.01 },
-];
-
-const colorControls: Array<{ key: ColorSettingKey; label: string }> = [
-  { key: "baseColor", label: "Base" },
-  { key: "fresnelColor", label: "Fresnel" },
-];
-
-function formatValue(value: number) {
-  if (Math.abs(value) >= 10) {
-    return value.toFixed(0);
-  }
-
-  return value.toFixed(2);
-}
-
-/** Renders the debug tuner for Voidhash gradient background settings. */
-export function VoidhashGradientControls({
-  onChange,
-  onHide,
-  onReset,
-  settings,
-  title = "Gradient FX",
-}: {
-  onChange: Dispatch<SetStateAction<VoidhashGradientSettings>>;
-  onHide: () => void;
-  onReset: () => void;
-  settings: VoidhashGradientSettings;
-  title?: string;
-}) {
-  const [copied, setCopied] = useState(false);
-
-  return (
-    <div className="fixed right-4 bottom-4 z-50 flex max-h-[calc(100vh-2rem)] w-[320px] flex-col overflow-hidden rounded-lg border border-border bg-background/95 text-foreground shadow-2xl backdrop-blur-xl">
-      <div className="flex items-center justify-between border-border border-b px-3 py-2">
-        <div className="font-medium text-sm">{title}</div>
-        <button className="text-muted-foreground text-xs hover:text-foreground" onClick={onHide} type="button">
-          Hide
-        </button>
-      </div>
-
-      <div className="flex-1 space-y-3 overflow-auto p-3">
-        {booleanControls.map((control) => (
-          <label className="grid grid-cols-[88px_1fr_44px] items-center gap-2 text-xs" key={control.key}>
-            <span className="text-muted-foreground">{control.label}</span>
-            <input
-              aria-label={control.label}
-              checked={settings[control.key]}
-              className="h-4 w-4 accent-primary"
-              onChange={(event) => {
-                onChange((current) => ({
-                  ...current,
-                  [control.key]: event.target.checked,
-                }));
-              }}
-              type="checkbox"
-            />
-            <span className="text-right font-mono text-muted-foreground">{settings[control.key] ? "on" : "off"}</span>
-          </label>
-        ))}
-
-        {colorControls.map((control) => (
-          <label className="grid grid-cols-[88px_1fr_76px] items-center gap-2 text-xs" key={control.key}>
-            <span className="text-muted-foreground">{control.label}</span>
-            <input
-              aria-label={control.label}
-              className="h-8 w-full cursor-pointer rounded border border-border bg-transparent"
-              onChange={(event) => {
-                onChange((current) => ({
-                  ...current,
-                  [control.key]: event.target.value,
-                }));
-              }}
-              type="color"
-              value={settings[control.key]}
-            />
-            <span className="font-mono text-muted-foreground">{settings[control.key]}</span>
-          </label>
-        ))}
-
-        {numericControls.map((control) => (
-          <label className="grid grid-cols-[88px_1fr_44px] items-center gap-2 text-xs" key={control.key}>
-            <span className="text-muted-foreground">{control.label}</span>
-            <input
-              aria-label={control.label}
-              className="accent-primary"
-              max={control.max}
-              min={control.min}
-              onChange={(event) => {
-                onChange((current) => ({
-                  ...current,
-                  [control.key]: Number(event.target.value),
-                }));
-              }}
-              step={control.step}
-              type="range"
-              value={settings[control.key]}
-            />
-            <span className="text-right font-mono text-muted-foreground">{formatValue(settings[control.key])}</span>
-          </label>
-        ))}
-      </div>
-
-      <div className="flex gap-2 border-border border-t p-3">
-        <button
-          className="flex-1 rounded-md border border-border px-3 py-2 text-xs hover:bg-card"
-          onClick={async () => {
-            await navigator.clipboard.writeText(JSON.stringify(settings, null, 2));
-            setCopied(true);
-            window.setTimeout(() => setCopied(false), 1200);
-          }}
-          type="button"
-        >
-          {copied ? "Copied" : "Copy JSON"}
-        </button>
-        <button className="rounded-md border border-border px-3 py-2 text-xs hover:bg-card" onClick={onReset} type="button">
-          Reset
-        </button>
-      </div>
-    </div>
-  );
-}
diff --git a/apps/www/src/components/voidhash-gradient-settings.ts b/apps/www/src/components/voidhash-gradient-settings.ts
deleted file mode 100644
index bf826f336..000000000
--- a/apps/www/src/components/voidhash-gradient-settings.ts
+++ /dev/null
@@ -1,102 +0,0 @@
-export type VoidhashGradientSettings = {
-  blur: number;
-  effectHeight: number;
-  bottomOffset: number;
-  topEnabled: boolean;
-  topOffset: number;
-  bottomSeed: number;
-  topSeed: number;
-  fadeStart: number;
-  fadeEnd: number;
-  planeY: number;
-  rotationX: number;
-  scaleX: number;
-  scaleY: number;
-  amplitude: number;
-  frequency: number;
-  midFrequency: number;
-  highFrequency: number;
-  speed: number;
-  lift: number;
-  fresnelPower: number;
-  fresnelStrength: number;
-  horizonStrength: number;
-  lateralStrength: number;
-  intensity: number;
-  baseGlow: number;
-  opacity: number;
-  baseColor: string;
-  fresnelColor: string;
-};
-
-export const VOIDHASH_GRADIENT_STORAGE_KEY = "voidhash:gradient-background-settings";
-export const VOIDHASH_GRADIENT_CONTROLS_STORAGE_KEY = "voidhash:gradient-background-controls";
-
-export const DEFAULT_VOIDHASH_GRADIENT_SETTINGS: VoidhashGradientSettings = {
-  blur: 7,
-  effectHeight: 98,
-  bottomOffset: 0,
-  topEnabled: false,
-  topOffset: 0,
-  bottomSeed: 0,
-  topSeed: 28.7,
-  fadeStart: 22,
-  fadeEnd: 58,
-  planeY: -2.4,
-  rotationX: -0.86,
-  scaleX: 1.42,
-  scaleY: 0.96,
-  amplitude: 1.42,
-  frequency: 0.19,
-  midFrequency: 0.8,
-  highFrequency: 1.5,
-  speed: 0.072,
-  lift: 0.58,
-  fresnelPower: 0.96,
-  fresnelStrength: 1.7,
-  horizonStrength: 0,
-  lateralStrength: 0.52,
-  intensity: 1.03,
-  baseGlow: 0,
-  opacity: 1,
-  baseColor: "#7f14ff",
-  fresnelColor: "#0673ff",
-};
-
-const HEX_COLOR_PATTERN = /^#[0-9a-f]{6}$/i;
-
-/** Merges persisted or caller-provided values with the supported gradient settings. */
-export function mergeVoidhashGradientSettings(
-  value: unknown,
-  defaults: VoidhashGradientSettings = DEFAULT_VOIDHASH_GRADIENT_SETTINGS,
-): VoidhashGradientSettings {
-  if (!value || typeof value !== "object") {
-    return defaults;
-  }
-
-  const settings: VoidhashGradientSettings = { ...defaults };
-  const entries = Object.entries(value as Partial<Record<keyof VoidhashGradientSettings, unknown>>);
-
-  for (const [key, entryValue] of entries) {
-    if (!(key in settings)) {
-      continue;
-    }
-
-    const settingKey = key as keyof VoidhashGradientSettings;
-    const defaultValue = settings[settingKey];
-
-    if (typeof defaultValue === "number" && typeof entryValue === "number" && Number.isFinite(entryValue)) {
-      settings[settingKey] = entryValue as never;
-    }
-
-    if (typeof defaultValue === "boolean" && typeof entryValue === "boolean") {
-      settings[settingKey] = entryValue as never;
-    }
-
-    if (typeof defaultValue === "string" && typeof entryValue === "string" && HEX_COLOR_PATTERN.test(entryValue)) {
-      settings[settingKey] = entryValue.toLowerCase() as never;
-    }
-  }
-
-  return settings;
-}
diff --git a/apps/www/src/features/auth/adapter/auth-screens.ts b/apps/www/src/features/auth/adapter/auth-screens.ts
new file mode 100644
index 000000000..4ac7caa3d
--- /dev/null
+++ b/apps/www/src/features/auth/adapter/auth-screens.ts
@@ -0,0 +1,25 @@
+/**
+ * Shape of the auth-screen slot.
+ *
+ * Lives apart from `ui-adapter.tsx` because that module is replaced wholesale
+ * by a build alias: a private adapter must be able to import the contract
+ * without importing (and so re-entering) the module it is replacing.
+ *
+ * A `null` screen means the route redirects to `/auth/login` instead of
+ * rendering — which is what self-host wants for every self-service flow, since
+ * it has exactly one user.
+ */
+import type { ComponentType } from "react";
+
+/** Props every auth screen receives from its route. */
+export interface AuthScreenProps {
+  readonly next?: string | undefined;
+}
+
+export interface AuthScreens {
+  readonly login: ComponentType<AuthScreenProps>;
+  readonly signUp: ComponentType<AuthScreenProps> | null;
+  readonly verifyEmail: ComponentType<AuthScreenProps> | null;
+  readonly forgotPassword: ComponentType<AuthScreenProps> | null;
+  readonly resetPassword: ComponentType<AuthScreenProps> | null;
+}
diff --git a/apps/www/src/features/auth/adapter/session-adapter.ts b/apps/www/src/features/auth/adapter/session-adapter.ts
new file mode 100644
index 000000000..3d4701bdf
--- /dev/null
+++ b/apps/www/src/features/auth/adapter/session-adapter.ts
@@ -0,0 +1,84 @@
+/**
+ * Server-side identity-provider slot.
+ *
+ * This module is the seam between the open-source dashboard and whichever
+ * identity provider a deployment runs. The open-source default implements the
+ * standalone (single root user) provider; a private composition replaces this
+ * module wholesale through a build alias — the same mechanism the other
+ * dashboard slots use — and supplies its own provider without forking any
+ * route.
+ *
+ * Every export is a `createServerFn` or plain data, so the bodies and the
+ * server-only modules they reach stay out of the client bundle.
+ */
+import { createServerFn } from "@tanstack/react-start";
+import { getRequest, setResponseHeader } from "@tanstack/react-start/server";
+
+import {
+  clearedStandaloneSessionCookie,
+  readStandaloneSession,
+} from "../lib/standalone-session";
+
+/**
+ * The identity fields the dashboard needs before its own `CurrentUser` RPC
+ * resolves.
+ */
+export interface SessionUser {
+  readonly createdAt: string | null;
+  readonly email: string;
+  readonly emailVerified: boolean;
+  readonly externalId: string | null;
+  readonly firstName: string | null;
+  readonly id: string;
+  readonly lastName: string | null;
+  readonly profilePictureUrl: string | null;
+  readonly updatedAt: string | null;
+}
+
+/** The authenticated user for the current request, or `null`. */
+export const getSessionUser = createServerFn({ method: "GET" }).handler(
+  async (): Promise<SessionUser | null> => {
+    const session = await readStandaloneSession(getRequest());
+    if (!session) return null;
+    return {
+      createdAt: null,
+      email: session.user.email,
+      emailVerified: true,
+      externalId: null,
+      firstName: session.user.name,
+      id: session.user.id,
+      lastName: null,
+      profilePictureUrl: null,
+      updatedAt: null,
+    };
+  },
+);
+
+/**
+ * Ends the session. A server function rather than a `fetch` of the sign-out
+ * route, so it works during SSR — the logout route's loader runs on the server
+ * for a direct navigation, where a relative URL cannot be fetched.
+ */
+export const clearSession = createServerFn({ method: "POST" }).handler(async () => {
+  setResponseHeader("Set-Cookie", clearedStandaloneSessionCookie());
+  return { ok: true };
+});
+
+/**
+ * Ends the session for sign-out.
+ *
+ * Returns the path to land on, or `null` when the provider already performed
+ * its own redirect (a hosted sign-out endpoint does this). The standalone
+ * provider has no remote session, so clearing the cookie is the whole sign-out
+ * and the redirect is the route's to perform.
+ */
+export const performSignOut = async (returnTo: string): Promise<string | null> => {
+  await clearSession();
+  return returnTo;
+};
+
+/**
+ * Request middleware the provider needs on every request. The standalone
+ * provider verifies a self-contained token per request and needs none.
+ */
+export const authRequestMiddleware = [] as const;
diff --git a/apps/www/src/features/auth/adapter/ui-adapter.tsx b/apps/www/src/features/auth/adapter/ui-adapter.tsx
new file mode 100644
index 000000000..a551fd9b7
--- /dev/null
+++ b/apps/www/src/features/auth/adapter/ui-adapter.tsx
@@ -0,0 +1,59 @@
+/**
+ * Browser-side identity-provider slot.
+ *
+ * Companion to `session-adapter.ts`: the screens and the browser credential
+ * that differ per identity provider. A private composition replaces this module
+ * through a build alias to supply a richer set of screens (OAuth, passwords,
+ * email verification); the open-source default offers the single standalone
+ * sign-in screen and reports the rest as unavailable.
+ *
+ * A `null` screen means the route redirects to `/auth/login` instead of
+ * rendering — which is what self-host wants for every self-service flow, since
+ * it has exactly one user.
+ */
+import { StandaloneLoginScreen } from "../components/standalone-login-screen";
+import type { AuthScreenProps, AuthScreens } from "./auth-screens";
+
+export type { AuthScreenProps, AuthScreens };
+
+export const authScreens: AuthScreens = {
+  forgotPassword: null,
+  login: StandaloneLoginScreen,
+  resetPassword: null,
+  signUp: null,
+  verifyEmail: null,
+};
+
+/**
+ * Wraps the application root. The standalone provider keeps no client-side auth
+ * context, so the default is a passthrough.
+ */
+export function AuthProvider({ children }: { children: React.ReactNode }) {
+  return <>{children}</>;
+}
+
+/**
+ * Memoized for the lifetime of the document: the session only changes across a
+ * full navigation (sign-in and sign-out each perform one).
+ */
+let accessToken: Promise<string | undefined> | undefined;
+
+/**
+ * Supplies the browser RPC client's bearer credential. The session cookie is
+ * `HttpOnly`, so the token is read back from the session endpoint rather than
+ * from `document.cookie`.
+ */
+export function useBrowserAccessTokenProvider(): () => Promise<string | undefined> {
+  return () => {
+    accessToken ??= fetch("/api/auth/session", { credentials: "include" })
+      .then((response) => (response.ok ? response.json() : null))
+      .then((body: { accessToken?: string | null } | null) => body?.accessToken ?? undefined)
+      .catch(() => undefined);
+    return accessToken;
+  };
+}
+
+/** Drops the memoized credential when the bridge unmounts. */
+export function resetBrowserAccessToken(): void {
+  accessToken = undefined;
+}
diff --git a/apps/www/src/features/auth/components/auth-lenticular-background.tsx b/apps/www/src/features/auth/components/auth-lenticular-background.tsx
index 6ace73fe9..c92abc7eb 100644
--- a/apps/www/src/features/auth/components/auth-lenticular-background.tsx
+++ b/apps/www/src/features/auth/components/auth-lenticular-background.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { HeroShader } from "@/features/www/hero/hero-shader";
+import { HeroShader } from "@/components/hero-shader";
 import { cn } from "@/lib/utils";
 
 /** Renders the landing lenticular composition with the animated Perlin surface as its source. */
diff --git a/apps/www/src/features/auth/components/auth-screen-layout.tsx b/apps/www/src/features/auth/components/auth-screen-layout.tsx
new file mode 100644
index 000000000..e71134dbb
--- /dev/null
+++ b/apps/www/src/features/auth/components/auth-screen-layout.tsx
@@ -0,0 +1,24 @@
+import { Link } from "@tanstack/react-router";
+import { Logo } from "@voidhash/ui";
+import type { ReactNode } from "react";
+
+import { AuthLenticularBackground } from "./auth-lenticular-background";
+
+/** Shared page chrome for the auth screens: background, brand mark, centered column. */
+export function AuthScreenLayout({ children }: { children: ReactNode }) {
+  return (
+    <div className="relative grid min-h-svh overflow-hidden bg-background lg:grid-cols-12">
+      <AuthLenticularBackground className="absolute inset-0" />
+      <div className="relative z-10 col-span-8 flex flex-col gap-4 p-6 md:p-10 bg-linear-to-r from-background to-transparent">
+        <div className="flex justify-center gap-2 md:justify-start">
+          <Link className="flex gap-2 font-medium" to="/">
+            <Logo />
+          </Link>
+        </div>
+        <div className="flex flex-1 items-center justify-center">
+          <div className="w-full max-w-sm">{children}</div>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/www/src/features/auth/components/standalone-login-screen.tsx b/apps/www/src/features/auth/components/standalone-login-screen.tsx
new file mode 100644
index 000000000..afbc1f948
--- /dev/null
+++ b/apps/www/src/features/auth/components/standalone-login-screen.tsx
@@ -0,0 +1,14 @@
+import { AuthScreenLayout } from "./auth-screen-layout";
+import { StandaloneSignInForm } from "./standalone-sign-in-form";
+
+/** The one sign-in screen the standalone provider offers. */
+export function StandaloneLoginScreen({ next }: { next?: string | undefined }) {
+  return (
+    <AuthScreenLayout>
+      <div className="flex flex-col items-start gap-2 text-left">
+        <h1 className="text-3xl">Welcome back!</h1>
+      </div>
+      <StandaloneSignInForm next={next} />
+    </AuthScreenLayout>
+  );
+}
diff --git a/apps/www/src/features/auth/components/standalone-sign-in-form.tsx b/apps/www/src/features/auth/components/standalone-sign-in-form.tsx
new file mode 100644
index 000000000..cbaca3ecf
--- /dev/null
+++ b/apps/www/src/features/auth/components/standalone-sign-in-form.tsx
@@ -0,0 +1,93 @@
+import { useMutation } from "@tanstack/react-query";
+import { Alert, AlertDescription, AlertTitle, Button, Input, Label } from "@voidhash/ui";
+import { AlertCircle, Loader2 } from "lucide-react";
+import { type FormEvent, useState } from "react";
+
+import { signInWithRootCredentials } from "@/features/auth/lib/auth-api";
+
+/**
+ * Sign-in for the standalone identity provider: the single root account, whose
+ * username and password come from the deployment's environment. There is no
+ * sign-up, no password reset, and no second user.
+ */
+export function StandaloneSignInForm({ next }: { next?: string | undefined }) {
+  const [error, setError] = useState<string>();
+  const signInMutation = useMutation({
+    mutationFn: signInWithRootCredentials,
+    onError: (mutationError) => {
+      setError(mutationError.message);
+    },
+    onMutate: () => {
+      setError(undefined);
+    },
+    onSuccess: (payload) => {
+      // A full navigation so the new cookie is picked up by the server render
+      // and the access-token bridge re-seeds from the session endpoint.
+      window.location.href = payload.redirectTo ?? "/studio";
+    },
+  });
+
+  const handleSubmit = (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    const formData = new FormData(event.currentTarget);
+    signInMutation.mutate({
+      password: String(formData.get("password") ?? ""),
+      returnPathname: next,
+      username: String(formData.get("username") ?? ""),
+    });
+  };
+
+  return (
+    <form className="mt-10 flex flex-col gap-6" onSubmit={handleSubmit}>
+      {error && (
+        <Alert variant="destructive">
+          <AlertCircle className="h-4 w-4" />
+          <AlertTitle>Sign-in failed</AlertTitle>
+          <AlertDescription>{error}</AlertDescription>
+        </Alert>
+      )}
+
+      <div className="grid gap-6">
+        <div className="grid gap-2">
+          <Label htmlFor="username">Username</Label>
+          <Input
+            autoComplete="username"
+            autoFocus
+            id="username"
+            name="username"
+            placeholder="root"
+            required
+            size={"lg"}
+            type="text"
+          />
+        </div>
+        <div className="grid gap-2">
+          <Label htmlFor="password">Password</Label>
+          <Input
+            autoComplete="current-password"
+            id="password"
+            name="password"
+            required
+            size={"lg"}
+            type="password"
+          />
+        </div>
+        <Button
+          className="w-full cursor-pointer"
+          disabled={signInMutation.isPending}
+          size={"lg"}
+          type="submit"
+        >
+          {signInMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
+          Continue
+        </Button>
+      </div>
+
+      <p className="text-muted-foreground text-sm">
+        Voidhash self-host signs in with the root credentials from your
+        environment (<code>VOIDHASH_ROOT_USERNAME</code> and{" "}
+        <code>VOIDHASH_ROOT_PASSWORD</code>).
+      </p>
+    </form>
+  );
+}
diff --git a/apps/www/src/features/auth/globals.css b/apps/www/src/features/auth/globals.css
index 629e41a6d..b8795c885 100644
--- a/apps/www/src/features/auth/globals.css
+++ b/apps/www/src/features/auth/globals.css
@@ -1,4 +1,3 @@
-/** biome-ignore-all lint/nursery/noUnknownAtRule: tailwind */
 @import "tailwindcss";
 
 @import "tw-animate-css";
diff --git a/apps/www/src/features/auth/lib/auth-api.ts b/apps/www/src/features/auth/lib/auth-api.ts
index bba5ad99c..7c81476ee 100644
--- a/apps/www/src/features/auth/lib/auth-api.ts
+++ b/apps/www/src/features/auth/lib/auth-api.ts
@@ -1,71 +1,11 @@
-type AuthApiErrorPayload = {
-  error?: string;
-};
-
-type AuthRedirectResponse = {
-  redirectTo?: string;
-};
-
 /**
- * Fields returned by sign-up / sign-in when the account exists but its email is
- * not yet verified. The client uses these to drive the verify-email step.
+ * Browser client for the dashboard's own auth endpoints.
+ *
+ * Provider-specific flows (OAuth, passwords, email verification) live with the
+ * screens that use them, behind the auth adapter slot.
  */
-type EmailVerificationChallenge = {
-  email?: string;
-  emailVerificationRequired?: boolean;
-  pendingAuthenticationToken?: string;
-  userId?: string;
-};
-
-type SignUpResponse = AuthRedirectResponse & EmailVerificationChallenge;
-
-type SignInResponse = AuthRedirectResponse & EmailVerificationChallenge;
-
-type VerifyEmailResponse = AuthRedirectResponse & {
-  verified?: boolean;
-};
-
-type ResendVerificationResponse = {
-  ok?: boolean;
-};
-
-type ForgotPasswordResponse = {
-  message?: string;
-};
-
-type SignInPasswordInput = {
-  email: string;
-  password: string;
-  returnPathname?: string;
-};
-
-type SignUpPasswordInput = {
-  email: string;
-  firstName: string;
-  lastName: string;
-  password: string;
-  returnPathname?: string;
-};
-
-type ForgotPasswordInput = {
-  email: string;
-};
-
-type ResetPasswordInput = {
-  password: string;
-  token: string;
-};
-
-type VerifyEmailInput = {
-  code: string;
-  email?: string;
-  pendingAuthenticationToken?: string;
-  returnPathname?: string;
-};
-
-type ResendVerificationInput = {
-  email?: string;
-  userId?: string;
+type AuthApiErrorPayload = {
+  error?: string;
 };
 
 const postAuthJson = async <TResponse>(
@@ -87,40 +27,21 @@ const postAuthJson = async <TResponse>(
   return payload;
 };
 
-export const signInWithPassword = (input: SignInPasswordInput) =>
-  postAuthJson<SignInResponse>("/api/auth/password/sign-in", input, "We could not sign you in.");
-
-export const verifyEmailCode = (input: VerifyEmailInput) =>
-  postAuthJson<VerifyEmailResponse>(
-    "/api/auth/email/verify",
-    input,
-    "We could not verify your email.",
-  );
-
-export const resendVerificationCode = (input: ResendVerificationInput) =>
-  postAuthJson<ResendVerificationResponse>(
-    "/api/auth/email/resend",
-    input,
-    "We could not send a new code.",
-  );
-
-export const signUpWithPassword = (input: SignUpPasswordInput) =>
-  postAuthJson<SignUpResponse>(
-    "/api/auth/password/sign-up",
-    input,
-    "We could not create your account.",
-  );
+export type RootSignInInput = {
+  username: string;
+  password: string;
+  returnPathname?: string;
+};
 
-export const requestPasswordReset = (input: ForgotPasswordInput) =>
-  postAuthJson<ForgotPasswordResponse>(
-    "/api/auth/password/forgot-password",
-    input,
-    "We could not send a reset link.",
-  );
+export type RootSignInResponse = {
+  accessToken: string;
+  redirectTo: string;
+};
 
-export const resetPassword = (input: ResetPasswordInput) =>
-  postAuthJson<AuthRedirectResponse>(
-    "/api/auth/password/reset-password",
+/** Standalone sign-in with the deployment's configured root credentials. */
+export const signInWithRootCredentials = (input: RootSignInInput) =>
+  postAuthJson<RootSignInResponse>(
+    "/api/auth/sign-in",
     input,
-    "We could not reset your password.",
+    "We could not sign you in.",
   );
diff --git a/apps/www/src/features/auth/lib/http.ts b/apps/www/src/features/auth/lib/http.ts
new file mode 100644
index 000000000..5fae94af2
--- /dev/null
+++ b/apps/www/src/features/auth/lib/http.ts
@@ -0,0 +1,64 @@
+/**
+ * Provider-neutral HTTP helpers shared by every auth route handler.
+ *
+ * Extracted so the standalone routes and any private identity-provider adapter
+ * can build responses the same way without depending on each other.
+ */
+import { toSafeReturnPathname } from "./validation";
+
+export type JsonBody = Record<string, unknown>;
+
+const appendHeaders = (target: Headers, source?: Record<string, string | string[]>) => {
+  if (!source) {
+    return;
+  }
+
+  for (const [key, value] of Object.entries(source)) {
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        target.append(key, item);
+      }
+      continue;
+    }
+
+    target.append(key, value);
+  }
+};
+
+/** JSON response with optional extra headers (`Set-Cookie` may repeat). */
+export const jsonResponse = (
+  body: JsonBody,
+  init: ResponseInit = {},
+  extraHeaders?: Record<string, string | string[]>,
+) => {
+  const headers = new Headers(init.headers);
+  headers.set("Content-Type", "application/json");
+  appendHeaders(headers, extraHeaders);
+  return new Response(JSON.stringify(body), { ...init, headers });
+};
+
+/** Uniform `{ error }` body for a failed authentication attempt. */
+export const authErrorResponse = (message: string, status = 400) =>
+  jsonResponse({ error: message }, { status });
+
+/** Parses a JSON request body, treating malformed input as empty. */
+export const getJsonBody = async <T extends object>(request: Request): Promise<Partial<T>> => {
+  try {
+    return (await request.json()) as Partial<T>;
+  } catch {
+    return {} as Partial<T>;
+  }
+};
+
+/** Same-origin `returnPathname` from the query string, or the fallback. */
+export const getSafeReturnPathnameFromRequest = (request: Request, fallback = "/studio") => {
+  const url = new URL(request.url);
+  return toSafeReturnPathname(url.searchParams.get("returnPathname"), url.origin) ?? fallback;
+};
+
+/** Same-origin `returnPathname` from an arbitrary value, or the fallback. */
+export const getSafeReturnPathname = (
+  request: Request,
+  value: string | null | undefined,
+  fallback = "/studio",
+) => toSafeReturnPathname(value, new URL(request.url).origin) ?? fallback;
diff --git a/apps/www/src/features/auth/lib/session.ts b/apps/www/src/features/auth/lib/session.ts
new file mode 100644
index 000000000..e164e7ede
--- /dev/null
+++ b/apps/www/src/features/auth/lib/session.ts
@@ -0,0 +1,15 @@
+/**
+ * Provider-neutral session access for the dashboard.
+ *
+ * Route guards and loaders import from here rather than from any provider SDK,
+ * so the same code path serves whichever identity provider a deployment runs.
+ * The implementation lives behind the adapter slot in
+ * `features/auth/adapter/session-adapter.ts`.
+ */
+export {
+  authRequestMiddleware,
+  clearSession,
+  getSessionUser,
+  performSignOut,
+  type SessionUser,
+} from "@/features/auth/adapter/session-adapter";
diff --git a/apps/www/src/features/auth/lib/workos.ts b/apps/www/src/features/auth/lib/sign-out.ts
similarity index 100%
rename from apps/www/src/features/auth/lib/workos.ts
rename to apps/www/src/features/auth/lib/sign-out.ts
diff --git a/apps/www/src/features/auth/lib/standalone-session.ts b/apps/www/src/features/auth/lib/standalone-session.ts
new file mode 100644
index 000000000..c797852fb
--- /dev/null
+++ b/apps/www/src/features/auth/lib/standalone-session.ts
@@ -0,0 +1,105 @@
+/**
+ * Server-side helpers for the standalone root session.
+ *
+ * Deliberately not named `*.server.ts`: that pattern is import-protected from
+ * any client-reachable module, and these helpers are needed by the server-fn
+ * handlers the dashboard imports. Every export is only ever called from a
+ * server route handler or a `createServerFn` handler, both of which the
+ * framework strips from the client bundle.
+ *
+ * The signed token minted here is the same one the backend verifies, so the
+ * dashboard and the API agree on the identity with no shared state beyond the
+ * signing key.
+ */
+import { resolveStandaloneAuthConfig } from "@voidhash/core/services/auth/StandaloneAuthConfig";
+import {
+  STANDALONE_AUTH_COOKIE_NAME,
+  STANDALONE_AUTH_DEFAULT_TTL_SECONDS,
+  readCookieValue,
+  secretsMatch,
+  signStandaloneAuthToken,
+  verifyStandaloneAuthToken,
+  type StandaloneAuthTokenClaims,
+} from "@voidhash/core/utils/crypto/standalone-auth-token";
+import { Effect } from "effect";
+
+export interface StandaloneSessionUser {
+  readonly email: string;
+  readonly id: string;
+  readonly name: string;
+}
+
+const toUser = (claims: StandaloneAuthTokenClaims): StandaloneSessionUser => ({
+  email: claims.email,
+  id: claims.sub,
+  name: claims.name ?? claims.email,
+});
+
+/**
+ * Verifies the submitted root credentials.
+ *
+ * Both fields are compared in constant time, and the username is checked even
+ * when it is wrong, so a failed attempt takes the same work regardless of which
+ * field was incorrect.
+ */
+export const verifyRootCredentials = async (input: {
+  readonly username: string;
+  readonly password: string;
+}): Promise<boolean> => {
+  const config = resolveStandaloneAuthConfig();
+  const [usernameMatches, passwordMatches] = await Promise.all([
+    Effect.runPromise(secretsMatch(input.username.trim(), config.rootUsername)),
+    Effect.runPromise(secretsMatch(input.password, config.rootPassword)),
+  ]);
+  return usernameMatches && passwordMatches;
+};
+
+/** Mints a session token for the configured root identity. */
+export const mintStandaloneSessionToken = (): Promise<string> => {
+  const config = resolveStandaloneAuthConfig();
+  return Effect.runPromise(
+    signStandaloneAuthToken({
+      email: config.rootEmail,
+      name: config.rootUsername,
+      secret: config.secret,
+    }),
+  );
+};
+
+/** Reads and verifies the session from a request, or `null` when absent. */
+export const readStandaloneSession = async (
+  request: Request,
+): Promise<{ token: string; user: StandaloneSessionUser } | null> => {
+  const token = readCookieValue(request.headers.get("cookie"), STANDALONE_AUTH_COOKIE_NAME);
+  if (!token) return null;
+
+  const claims = await Effect.runPromise(
+    verifyStandaloneAuthToken(token, resolveStandaloneAuthConfig().secret).pipe(
+      Effect.map((value): StandaloneAuthTokenClaims | null => value),
+      Effect.catch(() => Effect.succeed(null)),
+    ),
+  );
+
+  return claims === null ? null : { token, user: toUser(claims) };
+};
+
+/**
+ * Serializes the session cookie. `Secure` tracks the request scheme so the
+ * cookie is still accepted over plain-HTTP loopback during evaluation, while a
+ * real HTTPS deployment always gets it.
+ */
+export const standaloneSessionCookie = (token: string, request: Request): string => {
+  const secure = new URL(request.url).protocol === "https:";
+  return [
+    `${STANDALONE_AUTH_COOKIE_NAME}=${encodeURIComponent(token)}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${STANDALONE_AUTH_DEFAULT_TTL_SECONDS}`,
+    ...(secure ? ["Secure"] : []),
+  ].join("; ");
+};
+
+/** Serializes the cookie that clears the session. */
+export const clearedStandaloneSessionCookie = (): string =>
+  `${STANDALONE_AUTH_COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
diff --git a/apps/www/src/features/auth/lib/workos-user-management.server.test.ts b/apps/www/src/features/auth/lib/workos-user-management.server.test.ts
deleted file mode 100644
index 7bf198296..000000000
--- a/apps/www/src/features/auth/lib/workos-user-management.server.test.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import {
-  authenticateWithOrganizationSelectionChallenge,
-  getOrganizationSelectionChallenge,
-} from "./workos-user-management.server";
-
-describe("getOrganizationSelectionChallenge", () => {
-  it("extracts the WorkOS organization-selection challenge", () => {
-    expect(
-      getOrganizationSelectionChallenge({
-        code: "organization_selection_required",
-        pendingAuthenticationToken: "pat_123",
-        rawData: {
-          organizations: [
-            { id: "org_1", name: "Acme" },
-            { id: "org_2", name: "Beta" },
-          ],
-        },
-      }),
-    ).toEqual({
-      organizations: [
-        { id: "org_1", name: "Acme" },
-        { id: "org_2", name: "Beta" },
-      ],
-      pendingAuthenticationToken: "pat_123",
-    });
-  });
-
-  it("reads the pending token from rawData and ignores malformed organizations", () => {
-    expect(
-      getOrganizationSelectionChallenge({
-        rawData: {
-          code: "organization_selection_required",
-          organizations: [{ id: "org_1" }, { name: "Missing id" }, null],
-          pending_authentication_token: "pat_456",
-        },
-      }),
-    ).toEqual({
-      organizations: [{ id: "org_1", name: "org_1" }],
-      pendingAuthenticationToken: "pat_456",
-    });
-  });
-
-  it("returns null for non-organization-selection errors", () => {
-    expect(
-      getOrganizationSelectionChallenge({
-        code: "email_verification_required",
-        pendingAuthenticationToken: "pat_123",
-      }),
-    ).toBeNull();
-  });
-});
-
-describe("authenticateWithOrganizationSelectionChallenge", () => {
-  it("authenticates against the first organization returned by WorkOS", async () => {
-    const authenticateWithOrganizationSelection = async (payload: unknown) => {
-      expect(payload).toEqual({
-        clientId: "client_123",
-        organizationId: "org_1",
-        pendingAuthenticationToken: "pat_123",
-        session: {
-          cookiePassword: "cookie_secret",
-          sealSession: true,
-        },
-      });
-
-      return { sealedSession: "sealed_session" };
-    };
-
-    const result = await authenticateWithOrganizationSelectionChallenge(
-      {
-        userManagement: {
-          authenticateWithOrganizationSelection,
-        },
-      } as never,
-      {
-        code: "organization_selection_required",
-        pendingAuthenticationToken: "pat_123",
-        rawData: {
-          organizations: [
-            { id: "org_1", name: "Acme" },
-            { id: "org_2", name: "Beta" },
-          ],
-        },
-      },
-      { clientId: "client_123", cookiePassword: "cookie_secret" },
-    );
-
-    expect(result).toEqual({ sealedSession: "sealed_session" });
-  });
-});
diff --git a/apps/www/src/features/auth/lib/workos-user-management.server.ts b/apps/www/src/features/auth/lib/workos-user-management.server.ts
deleted file mode 100644
index 48d86d272..000000000
--- a/apps/www/src/features/auth/lib/workos-user-management.server.ts
+++ /dev/null
@@ -1,355 +0,0 @@
-import { getAuthkit } from "@workos/authkit-tanstack-react-start";
-import { WorkOS, type AuthenticationResponse } from "@workos-inc/node";
-
-import { toSafeReturnPathname } from "./validation";
-
-type JsonBody = Record<string, unknown>;
-
-export type WorkosAuthConfig = {
-  apiKey: string;
-  clientId: string;
-  cookiePassword: string;
-};
-
-export type WorkosOrganizationSelectionChallenge = {
-  organizations: ReadonlyArray<{
-    id: string;
-    name: string;
-  }>;
-  pendingAuthenticationToken: string;
-};
-
-const providerBySlug = {
-  github: "GitHubOAuth",
-  google: "GoogleOAuth",
-  microsoft: "MicrosoftOAuth",
-} as const;
-
-export type OAuthProviderSlug = keyof typeof providerBySlug;
-
-const getRequiredEnv = (name: string) => {
-  const value = process.env[name]?.trim();
-  if (!value) {
-    throw new Error(`Missing required environment variable: ${name}`);
-  }
-  return value;
-};
-
-export const getWorkosAuthConfig = (): WorkosAuthConfig => ({
-  apiKey: getRequiredEnv("WORKOS_API_KEY"),
-  clientId: getRequiredEnv("WORKOS_CLIENT_ID"),
-  cookiePassword: getRequiredEnv("WORKOS_COOKIE_PASSWORD"),
-});
-
-export const createWorkosClient = (config = getWorkosAuthConfig()) => {
-  const { apiKey, clientId } = config;
-  return new WorkOS(apiKey, { clientId });
-};
-
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === "object" && value !== null;
-
-const getRawData = (error: unknown) => {
-  if (!isRecord(error) || !isRecord(error.rawData)) {
-    return undefined;
-  }
-
-  return error.rawData;
-};
-
-const getErrorCode = (error: unknown) => {
-  if (!isRecord(error)) {
-    return undefined;
-  }
-
-  const rawData = getRawData(error);
-  return error.code ?? rawData?.code ?? rawData?.error;
-};
-
-const getPendingAuthenticationToken = (error: unknown) => {
-  if (!isRecord(error)) {
-    return undefined;
-  }
-
-  const rawData = getRawData(error);
-  if (typeof error.pendingAuthenticationToken === "string") {
-    return error.pendingAuthenticationToken;
-  }
-
-  return typeof rawData?.pending_authentication_token === "string"
-    ? rawData.pending_authentication_token
-    : undefined;
-};
-
-const getOrganizations = (error: unknown) => {
-  const rawData = getRawData(error);
-  if (!Array.isArray(rawData?.organizations)) {
-    return [];
-  }
-
-  return rawData.organizations.flatMap((organization) => {
-    if (!isRecord(organization) || typeof organization.id !== "string") {
-      return [];
-    }
-
-    return [
-      {
-        id: organization.id,
-        name: typeof organization.name === "string" ? organization.name : organization.id,
-      },
-    ];
-  });
-};
-
-/**
- * Extracts WorkOS's organization-selection challenge from an authentication
- * error. Multi-organization users receive this challenge before WorkOS can mint
- * a session-bound access token.
- */
-export const getOrganizationSelectionChallenge = (
-  error: unknown,
-): WorkosOrganizationSelectionChallenge | null => {
-  if (getErrorCode(error) !== "organization_selection_required") {
-    return null;
-  }
-
-  const pendingAuthenticationToken = getPendingAuthenticationToken(error);
-  const organizations = getOrganizations(error);
-
-  if (!pendingAuthenticationToken || organizations.length === 0) {
-    return null;
-  }
-
-  return { organizations, pendingAuthenticationToken };
-};
-
-/**
- * Completes a WorkOS organization-selection challenge using the first
- * organization WorkOS returned. The app loads all local memberships after the
- * session is saved, so this selection only provides the org context WorkOS
- * needs to issue the AuthKit session.
- */
-export const authenticateWithOrganizationSelectionChallenge = async (
-  workos: WorkOS,
-  error: unknown,
-  options: Pick<WorkosAuthConfig, "clientId" | "cookiePassword">,
-): Promise<AuthenticationResponse | null> => {
-  const challenge = getOrganizationSelectionChallenge(error);
-  const organizationId = challenge?.organizations[0]?.id;
-
-  if (!challenge || !organizationId) {
-    return null;
-  }
-
-  return workos.userManagement.authenticateWithOrganizationSelection({
-    clientId: options.clientId,
-    organizationId,
-    pendingAuthenticationToken: challenge.pendingAuthenticationToken,
-    session: {
-      cookiePassword: options.cookiePassword,
-      sealSession: true,
-    },
-  });
-};
-
-const appendHeaders = (target: Headers, source?: Record<string, string | string[]>) => {
-  if (!source) {
-    return;
-  }
-
-  for (const [key, value] of Object.entries(source)) {
-    if (Array.isArray(value)) {
-      for (const item of value) {
-        target.append(key, item);
-      }
-      continue;
-    }
-
-    target.append(key, value);
-  }
-};
-
-export const jsonResponse = (
-  body: JsonBody,
-  init: ResponseInit = {},
-  extraHeaders?: Record<string, string | string[]>,
-) => {
-  const headers = new Headers(init.headers);
-  headers.set("Content-Type", "application/json");
-  appendHeaders(headers, extraHeaders);
-  return new Response(JSON.stringify(body), { ...init, headers });
-};
-
-export const authErrorResponse = (message: string, status = 400) =>
-  jsonResponse({ error: message }, { status });
-
-/**
- * Detects whether a WorkOS authentication error means "the user exists but
- * their email is not yet verified". WorkOS surfaces this two ways depending on
- * the environment's email-verification configuration:
- *
- *   - the structured `email_verification_required` auth-error code (carries a
- *     `pendingAuthenticationToken` for the inline-code step-up), or
- *   - a `GenericServerException` whose message is
- *     "Email ownership must be verified before authentication." (email-link mode).
- *
- * Both mean the same thing for sign-up: the account was created and the user
- * must verify their email before they can authenticate.
- */
-export const isEmailVerificationRequiredError = (error: unknown): boolean => {
-  if (typeof error !== "object" || error === null) {
-    return false;
-  }
-  const candidate = error as {
-    code?: unknown;
-    rawData?: { code?: unknown } | null;
-    message?: unknown;
-  };
-  if (
-    candidate.code === "email_verification_required" ||
-    candidate.rawData?.code === "email_verification_required"
-  ) {
-    return true;
-  }
-  return (
-    typeof candidate.message === "string" &&
-    /email ownership must be verified|email[_\s-]?verification|verify your email/i.test(
-      candidate.message,
-    )
-  );
-};
-
-/**
- * The pieces of an "email verification required" error that the client needs to
- * complete the inline 6-digit-code step-up.
- *
- *   - `pendingAuthenticationToken` lets us call `authenticateWithEmailVerification`,
- *     which both verifies the code and mints a session (the user lands logged in).
- *   - `userId` / `email` let us (re)send a verification code via
- *     `sendVerificationEmail` and look the account up later.
- */
-export type EmailVerificationChallenge = {
-  email?: string;
-  pendingAuthenticationToken?: string;
-  userId?: string;
-};
-
-/**
- * Extracts the email-verification challenge from a WorkOS authentication error.
- * Returns `null` when the error is not an email-verification-required error.
- *
- * The structured `email_verification_required` error (code mode) carries the
- * `pending_authentication_token` and the `user` object; link-mode
- * (`GenericServerException`) carries neither, so the corresponding fields are
- * left undefined and the caller falls back to an email lookup.
- */
-export const getEmailVerificationChallenge = (
-  error: unknown,
-): EmailVerificationChallenge | null => {
-  if (!isEmailVerificationRequiredError(error)) {
-    return null;
-  }
-  const candidate = error as {
-    pendingAuthenticationToken?: unknown;
-    rawData?: {
-      pending_authentication_token?: unknown;
-      user?: { id?: unknown; email?: unknown } | null;
-    } | null;
-  };
-  const token =
-    typeof candidate.pendingAuthenticationToken === "string"
-      ? candidate.pendingAuthenticationToken
-      : typeof candidate.rawData?.pending_authentication_token === "string"
-        ? candidate.rawData.pending_authentication_token
-        : undefined;
-  const user = candidate.rawData?.user ?? null;
-  return {
-    email: typeof user?.email === "string" ? user.email : undefined,
-    pendingAuthenticationToken: token,
-    userId: typeof user?.id === "string" ? user.id : undefined,
-  };
-};
-
-/**
- * Looks up a WorkOS user id by email. Used to (re)send verification codes when
- * we don't already have the user id from an authentication error.
- */
-export const findUserIdByEmail = async (
-  workos: WorkOS,
-  email: string,
-): Promise<string | undefined> => {
-  if (!email) {
-    return undefined;
-  }
-  const { data } = await workos.userManagement.listUsers({ email });
-  return data[0]?.id;
-};
-
-export const getJsonBody = async <T extends object>(request: Request): Promise<Partial<T>> => {
-  try {
-    return (await request.json()) as Partial<T>;
-  } catch {
-    return {} as Partial<T>;
-  }
-};
-
-export const getSafeReturnPathnameFromRequest = (request: Request, fallback = "/studio") => {
-  const url = new URL(request.url);
-  return toSafeReturnPathname(url.searchParams.get("returnPathname"), url.origin) ?? fallback;
-};
-
-export const getSafeReturnPathname = (
-  request: Request,
-  value: string | null | undefined,
-  fallback = "/studio",
-) => toSafeReturnPathname(value, new URL(request.url).origin) ?? fallback;
-
-export const responseWithSession = async (
-  authResponse: AuthenticationResponse,
-  body: JsonBody,
-  init: ResponseInit = {},
-) => {
-  if (!authResponse.sealedSession) {
-    throw new Error("WorkOS did not return a sealed session");
-  }
-
-  const authkit = await getAuthkit();
-  const sessionResult = await authkit.saveSession(undefined, authResponse.sealedSession);
-  const headers =
-    sessionResult.headers ??
-    (sessionResult.response?.headers.get("Set-Cookie")
-      ? { "Set-Cookie": sessionResult.response.headers.get("Set-Cookie") as string }
-      : undefined);
-
-  return jsonResponse(body, init, headers);
-};
-
-export const redirectWithSession = async (
-  authResponse: AuthenticationResponse,
-  location: string,
-  status = 303,
-) => {
-  if (!authResponse.sealedSession) {
-    throw new Error("WorkOS did not return a sealed session");
-  }
-
-  const authkit = await getAuthkit();
-  const sessionResult = await authkit.saveSession(undefined, authResponse.sealedSession);
-  const headers = new Headers({ Location: location });
-  appendHeaders(headers, sessionResult.headers);
-
-  const setCookie = sessionResult.response?.headers.get("Set-Cookie");
-  if (setCookie) {
-    headers.append("Set-Cookie", setCookie);
-  }
-
-  return new Response(null, { headers, status });
-};
-
-export const getProviderForSlug = (slug: string | undefined) => {
-  if (!slug || !(slug in providerBySlug)) {
-    return undefined;
-  }
-
-  return providerBySlug[slug as OAuthProviderSlug];
-};
diff --git a/apps/www/src/features/auth/middleware/auth.ts b/apps/www/src/features/auth/middleware/auth.ts
index 1874aa84e..f459ad163 100644
--- a/apps/www/src/features/auth/middleware/auth.ts
+++ b/apps/www/src/features/auth/middleware/auth.ts
@@ -1,11 +1,11 @@
 import { redirect } from "@tanstack/react-router";
 import { createMiddleware } from "@tanstack/react-start";
-import { getAuth } from "@workos/authkit-tanstack-react-start";
+import { getSessionUser } from "../lib/session";
 
 export const authMiddleware = createMiddleware().server(async ({ next }) => {
-  const auth = await getAuth();
+  const user = await getSessionUser();
 
-  if (!auth.user) {
+  if (!user) {
     throw redirect({ to: "/auth/login" });
   }
 
diff --git a/apps/www/src/features/design/components/docs/colors/index.tsx b/apps/www/src/features/design/components/docs/colors/index.tsx
deleted file mode 100644
index 0b50c638b..000000000
--- a/apps/www/src/features/design/components/docs/colors/index.tsx
+++ /dev/null
@@ -1,282 +0,0 @@
-"use client";
-
-import { CheckIcon, CopyIcon } from "lucide-react";
-import { useCallback, useState } from "react";
-
-import { cn } from "@/features/design/lib/cn";
-
-import {
-  BRAND_SCALES,
-  isLightColor,
-  resolveToken,
-  scaleSteps,
-  SEMANTIC_GROUPS,
-  type SemanticToken,
-  type ThemeName,
-} from "./tokens";
-
-const THEMES: ThemeName[] = ["light", "dark"];
-
-const useCopyValue = () => {
-  const [copied, setCopied] = useState<string | undefined>(undefined);
-
-  const copy = useCallback((value: string) => {
-    void navigator.clipboard.writeText(value).then(() => {
-      setCopied(value);
-      setTimeout(() => setCopied((current) => (current === value ? undefined : current)), 1200);
-    });
-  }, []);
-
-  return { copied, copy };
-};
-
-interface CopyButtonProps {
-  className?: string;
-  copied: boolean;
-  label: string;
-  onCopy: () => void;
-  value: string;
-}
-
-function CopyButton({ className, copied, label, onCopy, value }: CopyButtonProps) {
-  return (
-    <button
-      className={cn(
-        "group inline-flex items-center gap-1.5 rounded-sm font-mono text-xs transition-colors hover:text-foreground",
-        className,
-      )}
-      onClick={onCopy}
-      title={`Copy ${label}`}
-      type="button"
-    >
-      <span>{value}</span>
-      {copied ? (
-        <CheckIcon className="size-3 text-success" />
-      ) : (
-        <CopyIcon className="size-3 opacity-0 transition-opacity group-hover:opacity-60" />
-      )}
-    </button>
-  );
-}
-
-interface TokenSwatchProps {
-  theme: ThemeName;
-  token: SemanticToken;
-}
-
-function TokenSwatch({ theme, token }: TokenSwatchProps) {
-  const resolved = resolveToken(token.name, theme);
-  if (!resolved) {
-    return null;
-  }
-
-  const on = token.on ? resolveToken(token.on, theme) : undefined;
-  const fallbackText = isLightColor(resolved.value) ? "oklch(0% 0 0)" : "oklch(100% 0 0)";
-
-  return (
-    <div
-      className="flex h-16 flex-1 items-center justify-center"
-      style={{ backgroundColor: resolved.value }}
-    >
-      <span
-        className="font-medium text-sm"
-        style={{ color: on?.value ?? fallbackText, opacity: token.on ? 1 : 0.55 }}
-      >
-        {token.on ? "Aa" : theme === "light" ? "L" : "D"}
-      </span>
-    </div>
-  );
-}
-
-interface TokenValueProps {
-  copiedValue: string | undefined;
-  onCopy: (value: string) => void;
-  theme: ThemeName;
-  token: SemanticToken;
-}
-
-function TokenValue({ copiedValue, onCopy, theme, token }: TokenValueProps) {
-  const resolved = resolveToken(token.name, theme);
-  if (!resolved) {
-    return null;
-  }
-
-  return (
-    <div className="flex flex-wrap items-baseline gap-x-2 gap-y-0.5 text-muted-foreground text-xs">
-      <span className="w-9 shrink-0 uppercase tracking-wide">{theme}</span>
-      <CopyButton
-        copied={copiedValue === resolved.value}
-        label={`${theme} value`}
-        onCopy={() => onCopy(resolved.value)}
-        value={resolved.value}
-      />
-      {resolved.alias ? <span className="opacity-70">via {resolved.alias}</span> : null}
-    </div>
-  );
-}
-
-interface SemanticTokenCardProps {
-  copiedValue: string | undefined;
-  onCopy: (value: string) => void;
-  token: SemanticToken;
-}
-
-function SemanticTokenCard({ copiedValue, onCopy, token }: SemanticTokenCardProps) {
-  const variable = `var(--${token.name})`;
-
-  return (
-    <div className="flex flex-col overflow-hidden rounded-lg border bg-card">
-      <div className="flex">
-        {THEMES.map((theme) => (
-          <TokenSwatch key={theme} theme={theme} token={token} />
-        ))}
-      </div>
-
-      <div className="flex flex-1 flex-col gap-2 border-t p-3">
-        <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
-          <CopyButton
-            className="font-medium text-foreground text-sm"
-            copied={copiedValue === variable}
-            label="variable"
-            onCopy={() => onCopy(variable)}
-            value={`--${token.name}`}
-          />
-          {token.on ? (
-            <span className="text-muted-foreground text-xs">
-              on <span className="font-mono">--{token.on}</span>
-            </span>
-          ) : null}
-        </div>
-
-        <p className="text-muted-foreground text-sm leading-snug">{token.meaning}</p>
-
-        <div className="flex flex-wrap gap-1">
-          {token.utilities.map((utility) => (
-            <code
-              className="rounded-sm bg-muted px-1.5 py-0.5 font-mono text-[11px] text-muted-foreground"
-              key={utility}
-            >
-              {utility}
-            </code>
-          ))}
-        </div>
-
-        <div className="mt-auto flex flex-col gap-0.5 pt-1">
-          {THEMES.map((theme) => (
-            <TokenValue
-              copiedValue={copiedValue}
-              key={theme}
-              onCopy={onCopy}
-              theme={theme}
-              token={token}
-            />
-          ))}
-        </div>
-      </div>
-    </div>
-  );
-}
-
-/**
- * Renders every semantic theme token grouped by intent, with its light and dark
- * value, the alias it resolves through, and the Tailwind utilities that map to
- * it. Values are read from `@voidhash/ui/styles/brand-theme.css`, so this page
- * cannot drift from the theme.
- */
-export function SemanticColorTokens() {
-  const { copied, copy } = useCopyValue();
-
-  return (
-    <div className="not-prose flex flex-col gap-10">
-      {SEMANTIC_GROUPS.map((group) => (
-        <section className="flex flex-col gap-4" key={group.title}>
-          <div className="flex flex-col gap-1">
-            <h3 className="font-semibold text-lg tracking-tight">{group.title}</h3>
-            <p className="max-w-[70ch] text-muted-foreground text-sm">{group.description}</p>
-          </div>
-
-          <div className="grid gap-4 sm:grid-cols-2 xl:grid-cols-3">
-            {group.tokens.map((token) => (
-              <SemanticTokenCard
-                copiedValue={copied}
-                key={token.name}
-                onCopy={copy}
-                token={token}
-              />
-            ))}
-          </div>
-        </section>
-      ))}
-    </div>
-  );
-}
-
-/**
- * Renders the raw brand ramps every semantic token is built from. Scales are
- * theme-independent — only the semantic tokens above remap between light and
- * dark.
- */
-export function BrandColorScales() {
-  const { copied, copy } = useCopyValue();
-
-  return (
-    <div className="not-prose flex flex-col gap-10">
-      {BRAND_SCALES.map((scale) => {
-        const steps = scaleSteps(scale.prefix);
-
-        return (
-          <section className="flex flex-col gap-3" key={scale.prefix}>
-            <div className="flex flex-col gap-1">
-              <h3 className="font-semibold text-lg tracking-tight">{scale.title}</h3>
-              <p className="max-w-[70ch] text-muted-foreground text-sm">{scale.meaning}</p>
-            </div>
-
-            <div className="grid grid-cols-4 gap-2 sm:grid-cols-6 lg:grid-cols-11">
-              {steps.map((step) => {
-                const name = `${scale.prefix}-${step}`;
-                const resolved = resolveToken(name, "light");
-                if (!resolved) {
-                  return null;
-                }
-
-                const variable = `var(--${name})`;
-
-                return (
-                  <button
-                    className="group flex flex-col gap-1.5 text-left"
-                    key={step}
-                    onClick={() => copy(variable)}
-                    title={`Copy ${variable}`}
-                    type="button"
-                  >
-                    <span
-                      className="flex h-14 items-center justify-center rounded-md border border-black/5 transition-transform group-hover:scale-[1.03] dark:border-white/10"
-                      style={{ backgroundColor: resolved.value }}
-                    >
-                      {copied === variable ? (
-                        <CheckIcon
-                          className="size-4"
-                          style={{
-                            color: isLightColor(resolved.value)
-                              ? "oklch(0% 0 0)"
-                              : "oklch(100% 0 0)",
-                          }}
-                        />
-                      ) : null}
-                    </span>
-                    <span className="flex flex-col leading-tight">
-                      <span className="font-medium text-xs">{step}</span>
-                      <span className="break-all font-mono text-[10px] text-muted-foreground">
-                        {resolved.value}
-                      </span>
-                    </span>
-                  </button>
-                );
-              })}
-            </div>
-          </section>
-        );
-      })}
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/colors/tokens.ts b/apps/www/src/features/design/components/docs/colors/tokens.ts
deleted file mode 100644
index 9f9124708..000000000
--- a/apps/www/src/features/design/components/docs/colors/tokens.ts
+++ /dev/null
@@ -1,452 +0,0 @@
-import brandThemeCss from "@voidhash/ui/styles/brand-theme.css?raw";
-
-export type ThemeName = "light" | "dark";
-
-export interface ResolvedToken {
-  /** Final color value with every `var()` indirection followed. */
-  value: string;
-  /** The variable this token points at, when it is defined as an alias. */
-  alias?: string;
-}
-
-export interface SemanticToken {
-  /** Custom property name without the leading dashes, e.g. `primary`. */
-  name: string;
-  /** What the token is for and when to reach for it. */
-  meaning: string;
-  /** Tailwind utilities that map onto this token. */
-  utilities: string[];
-  /** Token used for text/icons placed on top of this one, if there is a pair. */
-  on?: string;
-}
-
-export interface SemanticGroup {
-  title: string;
-  description: string;
-  tokens: SemanticToken[];
-}
-
-export interface BrandScale {
-  /** Custom property prefix, e.g. `blue-ribbon` for `--blue-ribbon-500`. */
-  prefix: string;
-  title: string;
-  meaning: string;
-}
-
-const SELECTOR_LIGHT = ":root";
-const SELECTOR_DARK = ".dark";
-const ALIAS_PATTERN = /^var\((--[\w-]+)\)$/;
-
-/**
- * Reads the custom properties declared in a single flat rule block. The brand
- * theme keeps `:root` and `.dark` free of nested rules, so a brace scan is
- * enough — no CSS parser needed.
- */
-const readDeclarations = (css: string, selector: string): Record<string, string> => {
-  const selectorStart = css.indexOf(`${selector} {`);
-  if (selectorStart === -1) {
-    return {};
-  }
-
-  const blockStart = css.indexOf("{", selectorStart);
-  const blockEnd = css.indexOf("}", blockStart);
-  const declarations: Record<string, string> = {};
-
-  for (const declaration of css.slice(blockStart + 1, blockEnd).split(";")) {
-    const separator = declaration.indexOf(":");
-    if (separator === -1) {
-      continue;
-    }
-
-    const name = declaration.slice(0, separator).trim();
-    if (name.startsWith("--")) {
-      declarations[name] = declaration.slice(separator + 1).trim();
-    }
-  }
-
-  return declarations;
-};
-
-const LIGHT_DECLARATIONS = readDeclarations(brandThemeCss, SELECTOR_LIGHT);
-const DARK_DECLARATIONS = {
-  ...LIGHT_DECLARATIONS,
-  ...readDeclarations(brandThemeCss, SELECTOR_DARK),
-};
-
-const declarationsFor = (theme: ThemeName) =>
-  theme === "dark" ? DARK_DECLARATIONS : LIGHT_DECLARATIONS;
-
-const follow = (declarations: Record<string, string>, value: string, depth = 0): string => {
-  const alias = ALIAS_PATTERN.exec(value);
-  const target = alias ? declarations[alias[1]] : undefined;
-  if (!target || depth > 10) {
-    return value;
-  }
-
-  return follow(declarations, target, depth + 1);
-};
-
-/**
- * Resolves a theme token to its literal color, following alias chains such as
- * `--primary` → `--blue-ribbon-600` → `oklch(…)`. Returns `undefined` when the
- * token is not declared for the given theme.
- */
-export const resolveToken = (name: string, theme: ThemeName): ResolvedToken | undefined => {
-  const declarations = declarationsFor(theme);
-  const raw = declarations[`--${name}`];
-  if (!raw) {
-    return undefined;
-  }
-
-  const alias = ALIAS_PATTERN.exec(raw);
-  return {
-    alias: alias?.[1],
-    value: follow(declarations, raw),
-  };
-};
-
-/** Lists the steps declared for a scale prefix, ordered light to dark. */
-export const scaleSteps = (prefix: string): number[] =>
-  Object.keys(LIGHT_DECLARATIONS)
-    .map((name) => {
-      const match = new RegExp(`^--${prefix}-(\\d+)$`).exec(name);
-      return match ? Number(match[1]) : undefined;
-    })
-    .filter((step): step is number => step !== undefined)
-    .sort((a, b) => a - b);
-
-/**
- * Estimates whether a color is light enough to need dark text on top. Handles
- * the two literal formats used by the theme: `oklch(L% C H)` and hex.
- */
-export const isLightColor = (value: string): boolean => {
-  const oklch = /^oklch\(\s*([\d.]+)%/.exec(value);
-  if (oklch) {
-    return Number(oklch[1]) >= 62;
-  }
-
-  const hex = /^#([\da-f]{6})$/i.exec(value);
-  if (hex) {
-    const int = Number.parseInt(hex[1], 16);
-    const luminance =
-      (0.2126 * ((int >> 16) & 0xff) + 0.7152 * ((int >> 8) & 0xff) + 0.0722 * (int & 0xff)) / 255;
-    return luminance >= 0.55;
-  }
-
-  return true;
-};
-
-export const SEMANTIC_GROUPS: SemanticGroup[] = [
-  {
-    description:
-      "The stack of neutral surfaces, from the page canvas up to floating layers. Pick the one that matches how far the element is lifted off the page, not the color you want.",
-    title: "Surfaces",
-    tokens: [
-      {
-        meaning:
-          "The app canvas. Everything else sits on top of it. Set once on `body` — components should not repaint it.",
-        name: "background",
-        on: "foreground",
-        utilities: ["bg-background"],
-      },
-      {
-        meaning:
-          "A neutral surface raised off the canvas: toolbars, inspector rails, list rows that need separation without a card border.",
-        name: "surface",
-        on: "foreground",
-        utilities: ["bg-surface"],
-      },
-      {
-        meaning:
-          "A recessed surface for wells and tracks — slider rails, progress backgrounds, inset code blocks.",
-        name: "surface-muted",
-        on: "foreground",
-        utilities: ["bg-surface-muted"],
-      },
-      {
-        meaning:
-          "Content containers. Use with `--border` for the outline; in dark mode it reads lighter than the canvas so cards float.",
-        name: "card",
-        on: "card-foreground",
-        utilities: ["bg-card"],
-      },
-      {
-        meaning: "Text and icons inside a card.",
-        name: "card-foreground",
-        utilities: ["text-card-foreground"],
-      },
-      {
-        meaning:
-          "App chrome around the workspace — designer and editor panels. Slightly darker than `--card` in dark mode so tooling recedes behind content.",
-        name: "panel",
-        on: "foreground",
-        utilities: ["bg-panel"],
-      },
-      {
-        meaning:
-          "Layers that float above the page: dropdowns, menus, tooltips, comboboxes, date pickers.",
-        name: "popover",
-        on: "popover-foreground",
-        utilities: ["bg-popover"],
-      },
-      {
-        meaning: "Text and icons inside a popover layer.",
-        name: "popover-foreground",
-        utilities: ["text-popover-foreground"],
-      },
-    ],
-  },
-  {
-    description:
-      "Text and icon colors. Body copy is `--foreground`; anything quieter steps down to `--muted-foreground` rather than lowering opacity.",
-    title: "Content",
-    tokens: [
-      {
-        meaning: "Default body text, headings, and icons on the canvas.",
-        name: "foreground",
-        utilities: ["text-foreground"],
-      },
-      {
-        meaning:
-          "Secondary text: labels, helper copy, placeholders, timestamps, inactive icons. The lowest-emphasis text that still meets contrast.",
-        name: "muted-foreground",
-        utilities: ["text-muted-foreground"],
-      },
-      {
-        meaning:
-          "Quiet neutral fill for badges, skeletons, disabled controls, and hovered table rows.",
-        name: "muted",
-        on: "muted-foreground",
-        utilities: ["bg-muted"],
-      },
-    ],
-  },
-  {
-    description:
-      "Interactive intent. One primary action per view; everything competing with it drops to secondary or ghost styling.",
-    title: "Actions",
-    tokens: [
-      {
-        meaning:
-          "The primary action and brand accent — solid buttons, selected states, links, active nav items.",
-        name: "primary",
-        on: "primary-foreground",
-        utilities: ["bg-primary", "text-primary", "border-primary"],
-      },
-      {
-        meaning: "Text and icons on a primary fill. Stays white in both themes.",
-        name: "primary-foreground",
-        utilities: ["text-primary-foreground"],
-      },
-      {
-        meaning: "Neutral, lower-emphasis actions that sit next to a primary button.",
-        name: "secondary",
-        on: "secondary-foreground",
-        utilities: ["bg-secondary"],
-      },
-      {
-        meaning: "Text and icons on a secondary fill.",
-        name: "secondary-foreground",
-        utilities: ["text-secondary-foreground"],
-      },
-      {
-        meaning:
-          "Hover and highlight state for list-like surfaces: menu items, command results, sidebar rows, ghost buttons.",
-        name: "accent",
-        on: "accent-foreground",
-        utilities: ["bg-accent", "hover:bg-accent"],
-      },
-      {
-        meaning: "Text and icons on an accent highlight.",
-        name: "accent-foreground",
-        utilities: ["text-accent-foreground"],
-      },
-    ],
-  },
-  {
-    description:
-      "Status colors. Reserved for outcomes and risk — never used decoratively, so their appearance always carries meaning.",
-    title: "Feedback",
-    tokens: [
-      {
-        meaning:
-          "Destructive and irreversible actions, error states, invalid fields. Pair with a confirmation for anything unrecoverable.",
-        name: "destructive",
-        on: "destructive-foreground",
-        utilities: ["bg-destructive", "text-destructive", "border-destructive"],
-      },
-      {
-        meaning: "Text and icons on a destructive fill.",
-        name: "destructive-foreground",
-        utilities: ["text-destructive-foreground"],
-      },
-      {
-        meaning: "Successful outcomes and healthy status — completed steps, live deployments.",
-        name: "success",
-        on: "success-foreground",
-        utilities: ["bg-success", "text-success"],
-      },
-      {
-        meaning: "Text and icons on a success fill.",
-        name: "success-foreground",
-        utilities: ["text-success-foreground"],
-      },
-    ],
-  },
-  {
-    description:
-      "Hairlines, control outlines, and focus. These are the only tokens allowed to draw structure — do not fake borders with a background color.",
-    title: "Borders and focus",
-    tokens: [
-      {
-        meaning:
-          "Default hairline between surfaces. Applied globally by the base layer, so most elements inherit it without a border utility.",
-        name: "border",
-        utilities: ["border-border"],
-      },
-      {
-        meaning: "Outline of form controls — inputs, textareas, selects, checkboxes.",
-        name: "input",
-        utilities: ["border-input"],
-      },
-      {
-        meaning:
-          "Keyboard focus ring. The base layer renders it at 50% opacity (`outline-ring/50`), so focus reads clearly without shouting.",
-        name: "ring",
-        utilities: ["ring-ring", "outline-ring/50"],
-      },
-    ],
-  },
-  {
-    description:
-      "The sidebar runs its own surface stack so navigation can go darker than the app without dragging the rest of the UI with it.",
-    title: "Sidebar",
-    tokens: [
-      {
-        meaning: "Sidebar background. Pure black in dark mode, pinning navigation to the far edge.",
-        name: "sidebar",
-        on: "sidebar-foreground",
-        utilities: ["bg-sidebar"],
-      },
-      {
-        meaning: "Sidebar labels and icons.",
-        name: "sidebar-foreground",
-        utilities: ["text-sidebar-foreground"],
-      },
-      {
-        meaning:
-          "Active navigation item. Deliberately neutral rather than brand blue so the sidebar does not compete with in-page primary actions.",
-        name: "sidebar-primary",
-        on: "sidebar-primary-foreground",
-        utilities: ["bg-sidebar-primary"],
-      },
-      {
-        meaning: "Text on an active navigation item.",
-        name: "sidebar-primary-foreground",
-        utilities: ["text-sidebar-primary-foreground"],
-      },
-      {
-        meaning: "Hovered navigation item.",
-        name: "sidebar-accent",
-        on: "sidebar-accent-foreground",
-        utilities: ["bg-sidebar-accent"],
-      },
-      {
-        meaning: "Text on a hovered navigation item.",
-        name: "sidebar-accent-foreground",
-        utilities: ["text-sidebar-accent-foreground"],
-      },
-      {
-        meaning: "Dividers inside the sidebar and the seam against the app canvas.",
-        name: "sidebar-border",
-        utilities: ["border-sidebar-border"],
-      },
-      {
-        meaning: "Focus ring for sidebar controls.",
-        name: "sidebar-ring",
-        utilities: ["ring-sidebar-ring"],
-      },
-    ],
-  },
-  {
-    description:
-      "Categorical series colors, ordered by how they should be assigned. Use them in sequence so the same series index keeps the same color across charts.",
-    title: "Data visualization",
-    tokens: [
-      {
-        meaning: "First series — the metric the chart is about.",
-        name: "chart-1",
-        utilities: ["fill-chart-1", "stroke-chart-1"],
-      },
-      {
-        meaning: "Second series.",
-        name: "chart-2",
-        utilities: ["fill-chart-2", "stroke-chart-2"],
-      },
-      {
-        meaning: "Third series.",
-        name: "chart-3",
-        utilities: ["fill-chart-3", "stroke-chart-3"],
-      },
-      {
-        meaning: "Fourth series.",
-        name: "chart-4",
-        utilities: ["fill-chart-4", "stroke-chart-4"],
-      },
-      {
-        meaning: "Fifth series. Beyond five categories, group the tail into an “Other” bucket.",
-        name: "chart-5",
-        utilities: ["fill-chart-5", "stroke-chart-5"],
-      },
-    ],
-  },
-];
-
-export const BRAND_SCALES: BrandScale[] = [
-  {
-    meaning:
-      "The Voidhash brand hue. Step 600 is `--primary`, step 500 is `--ring`. Lighter steps back tinted surfaces; darker steps are for text on tinted backgrounds.",
-    prefix: "blue-ribbon",
-    title: "Blue Ribbon",
-  },
-  {
-    meaning:
-      "Secondary brand hue. Used for the second chart series and for AI/agent surfaces that need to read as distinct from primary actions.",
-    prefix: "electric-violet",
-    title: "Electric Violet",
-  },
-  {
-    meaning: "Third chart series and accent illustrations. Not used for interactive states.",
-    prefix: "fuchsia-pink",
-    title: "Fuchsia Pink",
-  },
-  {
-    meaning:
-      "Danger. Step 600 is `--destructive` in light mode, step 500 in dark mode where the surface is darker.",
-    prefix: "radical-red",
-    title: "Radical Red",
-  },
-  {
-    meaning:
-      "Reserved for high-urgency, non-destructive states. No semantic token maps to it yet, so reference the scale directly and document the usage.",
-    prefix: "blaze-orange",
-    title: "Blaze Orange",
-  },
-  {
-    meaning:
-      "Warnings and pending states — there is no `--warning` token, so use `amber-500`/`amber-600` when you need caution without danger. Also the fourth chart series.",
-    prefix: "amber",
-    title: "Amber",
-  },
-  {
-    meaning: "Success and healthy status. Step 600 is `--success`; step 500 is the fifth series.",
-    prefix: "pistachio",
-    title: "Pistachio",
-  },
-  {
-    meaning:
-      "The neutral ramp every surface, border, and text token is built from. Light mode maps 50–200 to surfaces and 500–900 to text; dark mode inverts that.",
-    prefix: "zinc",
-    title: "Zinc",
-  },
-];
diff --git a/apps/www/src/features/design/components/docs/component-overview.tsx b/apps/www/src/features/design/components/docs/component-overview.tsx
deleted file mode 100644
index f2488d0cc..000000000
--- a/apps/www/src/features/design/components/docs/component-overview.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-"use client";
-
-import Preview02Example from "./component-overview/index";
-
-/**
- * Renders shadcn's preview-02 composition using the Voidhash UI primitives.
- */
-export function ComponentOverview() {
-  return (
-    <div className="not-prose">
-      <Preview02Example />
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/account-access.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/account-access.tsx
deleted file mode 100644
index 24981f391..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/account-access.tsx
+++ /dev/null
@@ -1,86 +0,0 @@
-"use client";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Field, FieldGroup, FieldLabel } from "@voidhash/ui";
-import { Input } from "@voidhash/ui";
-import { Item, ItemContent, ItemDescription, ItemMedia, ItemTitle } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function AccountAccess() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Account Access</CardTitle>
-        <CardDescription>Update your credentials or re-authenticate.</CardDescription>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="email-address">Email Address</FieldLabel>
-            <Input id="email-address" type="email" defaultValue="artist@studio.inc" />
-          </Field>
-          <Field>
-            <div className="flex items-center justify-between">
-              <FieldLabel htmlFor="current-password">Current Password</FieldLabel>
-              <a
-                href="#"
-                className="text-xs font-medium tracking-wider text-muted-foreground uppercase hover:text-foreground"
-              >
-                Forgot?
-              </a>
-            </div>
-            <Input id="current-password" type="password" defaultValue="password123" />
-          </Field>
-        </FieldGroup>
-      </CardContent>
-      <CardFooter className="flex-col gap-4">
-        <Button className="w-full">
-          <IconPlaceholder
-            lucide="LockKeyholeIcon"
-            tabler="IconLock"
-            hugeicons="SquareLock02Icon"
-            phosphor="LockKeyIcon"
-            remixicon="RiLockLine"
-          />
-          Update Security
-        </Button>
-        <Item asChild variant="muted">
-          <a href="#">
-            <ItemMedia variant="icon">
-              <IconPlaceholder
-                lucide="AlertCircleIcon"
-                tabler="IconAlertCircle"
-                hugeicons="AlertCircleIcon"
-                phosphor="WarningCircleIcon"
-                remixicon="RiErrorWarningLine"
-                className="text-destructive"
-              />
-            </ItemMedia>
-            <ItemContent>
-              <ItemTitle>Danger Zone</ItemTitle>
-              <ItemDescription className="line-clamp-1">
-                Archive account and remove catalog
-              </ItemDescription>
-            </ItemContent>
-            <IconPlaceholder
-              lucide="ArrowRightIcon"
-              tabler="IconArrowRight"
-              hugeicons="ArrowRight01Icon"
-              phosphor="ArrowRightIcon"
-              remixicon="RiArrowRightLine"
-              className="size-4"
-            />
-          </a>
-        </Item>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/card-overview.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/card-overview.tsx
deleted file mode 100644
index 74c81fe07..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/card-overview.tsx
+++ /dev/null
@@ -1,77 +0,0 @@
-"use client";
-
-import { Bar, BarChart, XAxis } from "recharts";
-
-import { Badge } from "@voidhash/ui";
-import { Button } from "@voidhash/ui";
-import { Card, CardContent, CardDescription, CardTitle } from "@voidhash/ui";
-import { ChartContainer, ChartTooltip, ChartTooltipContent, type ChartConfig } from "@voidhash/ui";
-
-const activityData = [
-  { month: "Jan", amount: 40 },
-  { month: "Feb", amount: 55 },
-  { month: "Mar", amount: 35 },
-  { month: "Apr", amount: 60 },
-  { month: "May", amount: 45 },
-  { month: "Jun", amount: 50 },
-  { month: "Jul", amount: 65 },
-  { month: "Aug", amount: 40 },
-  { month: "Sep", amount: 55 },
-  { month: "Oct", amount: 70 },
-  { month: "Nov", amount: 45 },
-  { month: "Dec", amount: 80 },
-];
-
-const chartConfig = {
-  amount: {
-    label: "Activity",
-    color: "var(--chart-2)",
-  },
-} satisfies ChartConfig;
-
-export function CardOverview() {
-  return (
-    <div className="grid grid-cols-2 gap-3">
-      <Card>
-        <CardContent>
-          <CardDescription>Card Balance</CardDescription>
-          <CardTitle className="text-2xl tabular-nums">US$12.94</CardTitle>
-          <CardDescription className="tabular-nums">US$11,337.06 Available</CardDescription>
-        </CardContent>
-      </Card>
-      <Card className="flex flex-col justify-between">
-        <CardContent className="flex flex-1 flex-col justify-between">
-          <div className="flex flex-col gap-1">
-            <CardDescription>Payment Due</CardDescription>
-            <CardTitle className="text-2xl">1 Apr</CardTitle>
-          </div>
-          <Button variant="outline" size="sm" className="mt-3 w-full">
-            Pay Early
-          </Button>
-        </CardContent>
-      </Card>
-      <Card className="col-span-2">
-        <CardContent className="flex flex-col gap-2">
-          <div className="flex items-center justify-between">
-            <CardDescription>Yearly Activity</CardDescription>
-            <Badge variant="secondary">+US$0.25 Daily Cash</Badge>
-          </div>
-          <ChartContainer config={chartConfig} className="h-20 w-full">
-            <BarChart data={activityData} margin={{ top: 4, right: 0, bottom: 0, left: 0 }}>
-              <XAxis
-                dataKey="month"
-                tickLine={false}
-                tickMargin={4}
-                axisLine={false}
-                tickFormatter={(v) => String(v).slice(0, 1)}
-                className="text-[10px]"
-              />
-              <ChartTooltip cursor={false} content={<ChartTooltipContent hideLabel />} />
-              <Bar dataKey="amount" fill="var(--color-amount)" radius={[3, 3, 0, 0]} />
-            </BarChart>
-          </ChartContainer>
-        </CardContent>
-      </Card>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/claimable-balance.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/claimable-balance.tsx
deleted file mode 100644
index 1c7e3f98f..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/claimable-balance.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import { Badge } from "@voidhash/ui";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Item, ItemContent } from "@voidhash/ui";
-import { Separator } from "@voidhash/ui";
-
-export function ClaimableBalance() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardDescription>Claimable Balance</CardDescription>
-        <CardTitle className="text-5xl tabular-nums">$0.00</CardTitle>
-        <Badge variant="outline">
-          <span className="size-2 rounded-full bg-yellow-500" />
-          Pending Setup
-        </Badge>
-      </CardHeader>
-      <CardContent className="flex flex-1 flex-col justify-end">
-        <Item variant="muted" className="flex-col items-stretch">
-          <ItemContent className="gap-3">
-            <div className="flex items-center justify-between">
-              <span className="text-sm text-muted-foreground">Net Royalties</span>
-              <span className="text-sm font-medium tabular-nums">$0.00</span>
-            </div>
-            <div className="flex items-center justify-between">
-              <span className="text-sm text-muted-foreground">Processing Fee</span>
-              <span className="text-sm font-medium tabular-nums">-$0.00</span>
-            </div>
-            <Separator />
-            <div className="flex items-center justify-between">
-              <span className="text-sm text-muted-foreground">Total Ready to Claim</span>
-              <span className="text-sm font-semibold tabular-nums">$0.00 USD</span>
-            </div>
-          </ItemContent>
-        </Item>
-      </CardContent>
-      <CardFooter>
-        <CardDescription>
-          Once your bank is connected, balances over $10.00 are automatically eligible for monthly
-          distribution on the 15th of each month.
-        </CardDescription>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/contribution-history.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/contribution-history.tsx
deleted file mode 100644
index 120fb2ecf..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/contribution-history.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-"use client";
-
-import { Bar, BarChart, XAxis } from "recharts";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { ChartContainer, ChartTooltip, ChartTooltipContent, type ChartConfig } from "@voidhash/ui";
-import { Item, ItemContent, ItemDescription } from "@voidhash/ui";
-import { useDesignSystemSearchParams } from "../preview-config";
-
-const chartData = [
-  { month: "Dec", amount: 800 },
-  { month: "Jan", amount: 1100 },
-  { month: "Feb", amount: 900 },
-  { month: "Mar", amount: 1300 },
-  { month: "Apr", amount: 750 },
-  { month: "May", amount: 1400 },
-];
-
-const chartConfig = {
-  amount: {
-    label: "Contribution",
-    color: "var(--chart-2)",
-  },
-} satisfies ChartConfig;
-
-export function ContributionHistory() {
-  const [params] = useDesignSystemSearchParams();
-  const isRounded = !["lyra", "sera"].includes(params.style);
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Contribution History</CardTitle>
-        <CardDescription>Last 6 months of activity</CardDescription>
-      </CardHeader>
-      <CardContent>
-        <ChartContainer config={chartConfig} className="h-[200px] w-full">
-          <BarChart
-            accessibilityLayer
-            data={chartData}
-            margin={{ left: 0, right: 0, top: 8, bottom: 0 }}
-          >
-            <XAxis dataKey="month" tickLine={false} tickMargin={8} axisLine={false} />
-            <ChartTooltip
-              cursor={false}
-              content={<ChartTooltipContent hideLabel className="min-w-40" />}
-            />
-            <Bar
-              dataKey="amount"
-              fill="var(--color-amount)"
-              radius={isRounded ? [6, 6, 0, 0] : 0}
-              maxBarSize={40}
-            />
-          </BarChart>
-        </ChartContainer>
-      </CardContent>
-      <CardContent>
-        <div className="grid w-full grid-cols-1 gap-3 md:grid-cols-2">
-          <Item variant="muted" className="flex-col items-stretch">
-            <ItemContent className="gap-1">
-              <ItemDescription className="text-xs font-medium tracking-wider text-muted-foreground uppercase">
-                Upcoming
-              </ItemDescription>
-              <span className="cn-font-heading text-lg font-semibold">May 25, 2024</span>
-              <span className="text-sm text-muted-foreground">$1,000 scheduled</span>
-            </ItemContent>
-          </Item>
-          <Item variant="muted" className="flex-col items-stretch">
-            <ItemContent className="gap-1">
-              <ItemDescription className="text-xs font-medium tracking-wider text-muted-foreground uppercase">
-                Auto-Save Plan
-              </ItemDescription>
-              <span className="cn-font-heading text-lg font-semibold">Accelerated</span>
-              <span className="text-sm text-muted-foreground">Recurring weekly</span>
-            </ItemContent>
-          </Item>
-        </div>
-      </CardContent>
-      <CardFooter>
-        <Button className="w-full">View Full Report</Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/cover-art.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/cover-art.tsx
deleted file mode 100644
index 383abf71e..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/cover-art.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { Card, CardContent, CardDescription, CardFooter } from "@voidhash/ui";
-import { Item } from "@voidhash/ui";
-import { Label } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function CoverArt() {
-  return (
-    <Card>
-      <CardContent className="flex flex-col gap-3">
-        <Label
-          htmlFor="cover-art"
-          className="text-center text-xs font-normal tracking-wider text-muted-foreground uppercase"
-        >
-          Cover Art
-        </Label>
-        <Item className="aspect-square" variant="outline">
-          <label
-            htmlFor="cover-art"
-            className="flex size-full cursor-pointer items-center justify-center"
-          >
-            <IconPlaceholder
-              lucide="ImageIcon"
-              tabler="IconPhoto"
-              hugeicons="Image01Icon"
-              phosphor="ImageIcon"
-              remixicon="RiImageLine"
-              className="size-10 text-muted-foreground/50"
-            />
-          </label>
-        </Item>
-        <input id="cover-art" type="file" accept="image/jpeg,image/png" className="sr-only" />
-      </CardContent>
-      <CardFooter className="flex-col gap-2">
-        <Button variant="outline" className="w-full" asChild>
-          <label htmlFor="cover-art" className="cursor-pointer">
-            Upload Artwork
-          </label>
-        </Button>
-        <CardDescription className="text-center text-xs">
-          Minimum 3000 × 3000px
-          <br />
-          JPEG or PNG only
-        </CardDescription>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/dividend-income.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/dividend-income.tsx
deleted file mode 100644
index d1c67686c..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/dividend-income.tsx
+++ /dev/null
@@ -1,123 +0,0 @@
-"use client";
-
-import { Bar, BarChart } from "recharts";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { ChartContainer, ChartTooltip, ChartTooltipContent, type ChartConfig } from "@voidhash/ui";
-import { Item, ItemContent, ItemDescription, ItemGroup, ItemTitle } from "@voidhash/ui";
-import { useDesignSystemSearchParams } from "../preview-config";
-import { IconPlaceholder } from "../icon-placeholder";
-
-const HOLDINGS = [
-  {
-    name: "Vanguard VIG",
-    shares: "450 Shares",
-    amount: "$1,842.10",
-    data: [
-      { q: "Q1", value: 380 },
-      { q: "Q2", value: 420 },
-      { q: "Q3", value: 390 },
-      { q: "Q4", value: 652 },
-    ],
-  },
-  {
-    name: "S&P 500 VOO",
-    shares: "112 Shares",
-    amount: "$928.40",
-    data: [
-      { q: "Q1", value: 180 },
-      { q: "Q2", value: 210 },
-      { q: "Q3", value: 320 },
-      { q: "Q4", value: 218 },
-    ],
-  },
-  {
-    name: "Apple AAPL",
-    shares: "85 Shares",
-    amount: "$340.00",
-    data: [
-      { q: "Q1", value: 60 },
-      { q: "Q2", value: 70 },
-      { q: "Q3", value: 120 },
-      { q: "Q4", value: 90 },
-    ],
-  },
-  {
-    name: "Realty Income",
-    shares: "320 Shares",
-    amount: "$1,139.50",
-    data: [
-      { q: "Q1", value: 240 },
-      { q: "Q2", value: 260 },
-      { q: "Q3", value: 280 },
-      { q: "Q4", value: 360 },
-    ],
-  },
-];
-
-const miniChartConfig = {
-  value: {
-    label: "Dividend",
-    color: "var(--chart-2)",
-  },
-} satisfies ChartConfig;
-
-export function DividendIncome() {
-  const [params] = useDesignSystemSearchParams();
-  const isRounded = !["lyra", "sera"].includes(params.style);
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Q2 Dividend Income</CardTitle>
-        <CardDescription>
-          Quarterly dividend payouts across your portfolio holdings.
-        </CardDescription>
-        <CardAction>
-          <Button variant="ghost" size="icon-sm" className="bg-muted">
-            <IconPlaceholder
-              lucide="XIcon"
-              tabler="IconX"
-              hugeicons="Cancel01Icon"
-              phosphor="XIcon"
-              remixicon="RiCloseLine"
-            />
-          </Button>
-        </CardAction>
-      </CardHeader>
-      <CardContent>
-        <ItemGroup>
-          {HOLDINGS.map((holding) => (
-            <Item key={holding.name} variant="muted">
-              <ItemContent>
-                <ItemTitle>{holding.name}</ItemTitle>
-                <ItemDescription>{holding.shares}</ItemDescription>
-              </ItemContent>
-              <ChartContainer config={miniChartConfig} className="hidden h-8 w-24 md:block">
-                <BarChart data={holding.data} margin={{ top: 0, right: 0, bottom: 0, left: 0 }}>
-                  <ChartTooltip cursor={false} content={<ChartTooltipContent hideLabel />} />
-                  <Bar
-                    dataKey="value"
-                    fill="var(--color-value)"
-                    radius={isRounded ? [3, 3, 0, 0] : 0}
-                  />
-                </BarChart>
-              </ChartContainer>
-              <span className="hidden text-sm font-semibold tabular-nums md:block">
-                {holding.amount}
-              </span>
-            </Item>
-          ))}
-        </ItemGroup>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/empty-connect-bank.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/empty-connect-bank.tsx
deleted file mode 100644
index 9f37a47ed..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/empty-connect-bank.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { Card, CardContent } from "@voidhash/ui";
-import {
-  Empty,
-  EmptyContent,
-  EmptyDescription,
-  EmptyHeader,
-  EmptyMedia,
-  EmptyTitle,
-} from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function EmptyConnectBank() {
-  return (
-    <Card>
-      <CardContent>
-        <Empty className="p-4">
-          <EmptyMedia variant="icon">
-            <IconPlaceholder
-              lucide="CreditCardIcon"
-              tabler="IconCreditCard"
-              hugeicons="CreditCardIcon"
-              phosphor="CreditCardIcon"
-              remixicon="RiBankCardLine"
-            />
-          </EmptyMedia>
-          <EmptyHeader>
-            <EmptyTitle>Connect Bank</EmptyTitle>
-            <EmptyDescription>
-              Link your payout method to receive monthly royalty distributions automatically.
-            </EmptyDescription>
-          </EmptyHeader>
-          <EmptyContent>
-            <Button>Set Up Payouts</Button>
-          </EmptyContent>
-        </Empty>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/empty-distribute-track.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/empty-distribute-track.tsx
deleted file mode 100644
index 7f79c0ed0..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/empty-distribute-track.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { Card, CardContent } from "@voidhash/ui";
-import {
-  Empty,
-  EmptyContent,
-  EmptyDescription,
-  EmptyHeader,
-  EmptyMedia,
-  EmptyTitle,
-} from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function EmptyDistributeTrack() {
-  return (
-    <Card>
-      <CardContent>
-        <Empty className="p-4">
-          <EmptyMedia variant="icon">
-            <IconPlaceholder
-              lucide="PlusIcon"
-              tabler="IconPlus"
-              hugeicons="Add01Icon"
-              phosphor="PlusIcon"
-              remixicon="RiAddLine"
-            />
-          </EmptyMedia>
-          <EmptyHeader>
-            <EmptyTitle>Distribute Track</EmptyTitle>
-            <EmptyDescription>
-              Upload your first master to start reaching listeners on Spotify, Apple Music, and
-              more.
-            </EmptyDescription>
-          </EmptyHeader>
-          <EmptyContent>
-            <Button>Create Release</Button>
-          </EmptyContent>
-        </Empty>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/empty-explore-catalog.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/empty-explore-catalog.tsx
deleted file mode 100644
index 7411baae8..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/empty-explore-catalog.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { Card, CardContent } from "@voidhash/ui";
-import {
-  Empty,
-  EmptyContent,
-  EmptyDescription,
-  EmptyHeader,
-  EmptyMedia,
-  EmptyTitle,
-} from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function EmptyExploreCatalog() {
-  return (
-    <Card>
-      <CardContent>
-        <Empty className="p-4">
-          <EmptyMedia variant="icon">
-            <IconPlaceholder
-              lucide="AudioLinesIcon"
-              tabler="IconPlayerRecordFilled"
-              hugeicons="AudioWave01Icon"
-              phosphor="RecordIcon"
-              remixicon="RiRecordCircleLine"
-            />
-          </EmptyMedia>
-          <EmptyHeader>
-            <EmptyTitle>Explore Catalog</EmptyTitle>
-            <EmptyDescription>
-              Check your ISRC codes, metadata, and visual assets before going live.
-            </EmptyDescription>
-          </EmptyHeader>
-          <EmptyContent>
-            <Button>View Catalog</Button>
-          </EmptyContent>
-        </Empty>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/faq.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/faq.tsx
deleted file mode 100644
index b895b6033..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/faq.tsx
+++ /dev/null
@@ -1,103 +0,0 @@
-"use client";
-
-import { Accordion, AccordionContent, AccordionItem, AccordionTrigger } from "@voidhash/ui";
-import { Button } from "@voidhash/ui";
-import { Card, CardContent, CardFooter } from "@voidhash/ui";
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@voidhash/ui";
-
-const GENERAL_QUESTIONS = [
-  {
-    q: "How secure is my financial data with Ledger?",
-    a: "We use bank-level AES-256 encryption, SOC 2 Type II certified infrastructure, and never store your credentials. All connections use read-only access tokens. We are a SEC registered investment advisor.",
-  },
-  {
-    q: "How do I connect my bank or investment accounts?",
-    a: "Go to Settings > Linked Accounts and search for your institution. We support over 12,000 banks and brokerages via Plaid and MX.",
-  },
-  {
-    q: "Can I export my data for tax purposes?",
-    a: "Yes. Navigate to Reports > Tax Export to download a CSV or PDF summary of your transactions, dividends, and capital gains for any tax year.",
-  },
-];
-
-const SYNC_QUESTIONS = [
-  {
-    q: "How often does data refresh?",
-    a: "Connected institutions sync every six hours, and you can pull a manual refresh from the account detail view at any time.",
-  },
-  {
-    q: "Why is a transaction missing?",
-    a: "Pending transactions appear once the institution posts them. If a posted transaction is still missing after 48 hours, reconnect the account from Settings.",
-  },
-  {
-    q: "Can I import a statement manually?",
-    a: "Yes. Upload a CSV or OFX file from the account detail view and map the columns once — the mapping is remembered for later imports.",
-  },
-];
-
-const GOALS_QUESTIONS = [
-  {
-    q: "How do I set up a custom financial goal?",
-    a: "Click New Goal from the Savings Targets card. Choose a category, set a target amount and date, and we'll calculate the monthly contribution needed.",
-  },
-  {
-    q: "Can I track multiple goals at once?",
-    a: "Yes. Pro accounts can track unlimited goals. Basic accounts support up to 3 active goals.",
-  },
-  {
-    q: "How are monthly contributions calculated?",
-    a: "We divide the remaining amount by the number of months until your target date, adjusted for your current savings rate and any auto-transfer schedules.",
-  },
-];
-
-function QuestionList({ questions }: { questions: { q: string; a: string }[] }) {
-  return (
-    <Accordion type="single" collapsible defaultValue="item-0">
-      {questions.map((item, index) => (
-        <AccordionItem key={index} value={`item-${index}`}>
-          <AccordionTrigger>{item.q}</AccordionTrigger>
-          <AccordionContent>{item.a}</AccordionContent>
-        </AccordionItem>
-      ))}
-    </Accordion>
-  );
-}
-
-export function Faq() {
-  return (
-    <Card>
-      <CardContent>
-        <Tabs defaultValue="general">
-          <TabsList className="w-full">
-            <TabsTrigger value="general" className="flex-1">
-              General
-            </TabsTrigger>
-            <TabsTrigger value="sync" className="flex-1">
-              Sync
-            </TabsTrigger>
-            <TabsTrigger value="goals" className="flex-1">
-              Goals
-            </TabsTrigger>
-          </TabsList>
-          <TabsContent value="general">
-            <QuestionList questions={GENERAL_QUESTIONS} />
-          </TabsContent>
-          <TabsContent value="sync">
-            <QuestionList questions={SYNC_QUESTIONS} />
-          </TabsContent>
-          <TabsContent value="goals">
-            <QuestionList questions={GOALS_QUESTIONS} />
-          </TabsContent>
-        </Tabs>
-      </CardContent>
-      <CardFooter>
-        <Button variant="outline" className="w-full">
-          Contact Support
-        </Button>
-        <Button variant="link" className="w-full">
-          Learn More
-        </Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/front-door.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/front-door.tsx
deleted file mode 100644
index 240d3a142..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/front-door.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import { Badge } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function FrontDoor() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Front Door</CardTitle>
-        <CardDescription>Smart Lock Pro</CardDescription>
-        <CardAction>
-          <div className="flex items-center gap-1.5 text-sm text-muted-foreground">
-            Locked
-            <IconPlaceholder
-              lucide="LockIcon"
-              tabler="IconLock"
-              hugeicons="SquareLock02Icon"
-              phosphor="LockKeyIcon"
-              remixicon="RiLockLine"
-              className="size-4"
-            />
-          </div>
-        </CardAction>
-      </CardHeader>
-      <CardContent>
-        <div className="relative flex aspect-video items-center justify-center overflow-hidden rounded-lg bg-muted bg-[repeating-linear-gradient(45deg,transparent,transparent_10px,var(--border)_10px,var(--border)_11px)]">
-          <Badge variant="destructive" className="absolute top-2 right-2">
-            Live
-          </Badge>
-        </div>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/index-investing.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/index-investing.tsx
deleted file mode 100644
index d5d5b2cc3..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/index-investing.tsx
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@voidhash/ui";
-
-export function IndexInvesting() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Dollar-Cost Averaging</CardTitle>
-        <CardDescription>A strategy for building wealth over time.</CardDescription>
-      </CardHeader>
-      <CardContent>
-        <CardDescription className="mt-3 text-sm leading-relaxed style-sera:mt-0">
-          <a href="#" className="underline underline-offset-4 hover:text-primary">
-            Over time
-          </a>
-          , this smooths out the average cost of your investments. When prices drop, your fixed
-          amount buys more shares. When prices rise, you buy fewer. The result is a lower average
-          cost per share compared to lump-sum investing during volatile periods.
-        </CardDescription>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/kitchen-island.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/kitchen-island.tsx
deleted file mode 100644
index db97fc696..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/kitchen-island.tsx
+++ /dev/null
@@ -1,161 +0,0 @@
-"use client";
-
-import * as React from "react";
-
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Item, ItemActions, ItemContent, ItemGroup, ItemMedia, ItemTitle } from "@voidhash/ui";
-import { Slider } from "@voidhash/ui";
-import { Switch } from "@voidhash/ui";
-import { ToggleGroup, ToggleGroupItem } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-const SCENES = {
-  cooking: { brightness: [90], colorTemp: [70], volume: [30], fade: [0] },
-  dining: { brightness: [50], colorTemp: [40], volume: [20], fade: [60] },
-  nightlight: { brightness: [15], colorTemp: [20], volume: [0], fade: [80] },
-  focus: { brightness: [100], colorTemp: [85], volume: [0], fade: [0] },
-} as const;
-
-export function KitchenIsland() {
-  const [enabled, setEnabled] = React.useState(true);
-  const [scene, setScene] = React.useState("cooking");
-  const [brightness, setBrightness] = React.useState([90]);
-  const [colorTemp, setColorTemp] = React.useState([70]);
-  const [volume, setVolume] = React.useState([30]);
-  const [fade, setFade] = React.useState([0]);
-
-  const handleSceneChange = (value: string) => {
-    if (!value) return;
-    setScene(value);
-    const preset = SCENES[value as keyof typeof SCENES];
-    setBrightness([...preset.brightness]);
-    setColorTemp([...preset.colorTemp]);
-    setVolume([...preset.volume]);
-    setFade([...preset.fade]);
-  };
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Kitchen Island</CardTitle>
-        <CardDescription>Hue Color Ambient</CardDescription>
-        <CardAction>
-          <Switch checked={enabled} onCheckedChange={setEnabled} />
-        </CardAction>
-      </CardHeader>
-      <CardContent className="flex flex-col gap-4">
-        <div className="flex flex-col gap-2">
-          <span className="sr-only">Scenes</span>
-          <ToggleGroup
-            type="single"
-            value={scene}
-            onValueChange={handleSceneChange}
-            spacing={1}
-            className="flex-wrap"
-          >
-            <ToggleGroupItem value="cooking" disabled={!enabled}>
-              Cooking
-            </ToggleGroupItem>
-            <ToggleGroupItem value="dining" disabled={!enabled}>
-              Dining
-            </ToggleGroupItem>
-            <ToggleGroupItem value="nightlight" disabled={!enabled}>
-              Nightlight
-            </ToggleGroupItem>
-            <ToggleGroupItem value="focus" disabled={!enabled}>
-              Focus
-            </ToggleGroupItem>
-          </ToggleGroup>
-        </div>
-        <ItemGroup>
-          <Item size="sm" variant="outline">
-            <ItemMedia variant="icon">
-              <IconPlaceholder
-                lucide="SunIcon"
-                tabler="IconSun"
-                hugeicons="Sun03Icon"
-                phosphor="SunIcon"
-                remixicon="RiSunLine"
-              />
-            </ItemMedia>
-            <ItemContent className="flex-row items-center gap-3">
-              <ItemTitle className="shrink-0">Brightness</ItemTitle>
-            </ItemContent>
-            <ItemActions className="flex-1">
-              <Slider
-                value={brightness}
-                onValueChange={setBrightness}
-                max={100}
-                disabled={!enabled}
-                className="w-full"
-              />
-            </ItemActions>
-          </Item>
-          <Item size="sm" variant="outline">
-            <ItemMedia variant="icon">
-              <IconPlaceholder
-                lucide="ThermometerIcon"
-                tabler="IconThermometer"
-                hugeicons="ThermometerWarmIcon"
-                phosphor="ThermometerIcon"
-                remixicon="RiThermometerLine"
-              />
-            </ItemMedia>
-            <ItemContent className="flex-row items-center gap-3">
-              <ItemTitle className="shrink-0">Color Temp</ItemTitle>
-            </ItemContent>
-            <ItemActions className="flex-1">
-              <Slider
-                value={colorTemp}
-                onValueChange={setColorTemp}
-                max={100}
-                disabled={!enabled}
-              />
-            </ItemActions>
-          </Item>
-          <Item size="sm" variant="outline">
-            <ItemMedia variant="icon">
-              <IconPlaceholder
-                lucide="Volume2Icon"
-                tabler="IconVolume"
-                hugeicons="VolumeHighIcon"
-                phosphor="SpeakerHighIcon"
-                remixicon="RiVolumeUpLine"
-              />
-            </ItemMedia>
-            <ItemContent className="flex-row items-center gap-3">
-              <ItemTitle className="shrink-0">Volume</ItemTitle>
-            </ItemContent>
-            <ItemActions className="flex-1">
-              <Slider value={volume} onValueChange={setVolume} max={100} disabled={!enabled} />
-            </ItemActions>
-          </Item>
-          <Item size="sm" variant="outline">
-            <ItemMedia variant="icon">
-              <IconPlaceholder
-                lucide="TimerIcon"
-                tabler="IconClock"
-                hugeicons="Clock03Icon"
-                phosphor="TimerIcon"
-                remixicon="RiTimerLine"
-              />
-            </ItemMedia>
-            <ItemContent className="flex-row items-center gap-3">
-              <ItemTitle className="shrink-0">Fade</ItemTitle>
-            </ItemContent>
-            <ItemActions className="flex-1">
-              <Slider value={fade} onValueChange={setFade} max={100} disabled={!enabled} />
-            </ItemActions>
-          </Item>
-        </ItemGroup>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/loading-card.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/loading-card.tsx
deleted file mode 100644
index 38dc57158..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/loading-card.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-import { Card, CardContent, CardHeader } from "@voidhash/ui";
-import { Skeleton } from "@voidhash/ui";
-
-export function LoadingCard() {
-  return (
-    <Card>
-      <CardHeader>
-        <Skeleton className="h-5 w-32" />
-        <Skeleton className="h-4 w-48" />
-      </CardHeader>
-      <CardContent className="flex flex-col gap-4">
-        <Skeleton className="h-32 w-full rounded-lg" />
-        <div className="flex flex-col gap-2">
-          <Skeleton className="h-4 w-full" />
-          <Skeleton className="h-4 w-3/4" />
-          <Skeleton className="h-4 w-1/2" />
-        </div>
-        <div className="flex gap-2">
-          <Skeleton className="h-9 flex-1 rounded-md" />
-          <Skeleton className="h-9 flex-1 rounded-md" />
-        </div>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/new-milestone.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/new-milestone.tsx
deleted file mode 100644
index 0bc6c3d2f..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/new-milestone.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-"use client";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Field, FieldGroup, FieldLabel } from "@voidhash/ui";
-import { Input } from "@voidhash/ui";
-
-export function NewMilestone() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Set a new milestone</CardTitle>
-        <CardDescription>
-          Define your financial target and we&apos;ll help you pace your savings.
-        </CardDescription>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="goal-name">Goal Name</FieldLabel>
-            <Input id="goal-name" placeholder="e.g. New Car, Home Downpayment" />
-          </Field>
-          <div className="grid grid-cols-2 gap-3">
-            <Field>
-              <FieldLabel htmlFor="target-amount">Target Amount</FieldLabel>
-              <Input id="target-amount" defaultValue="$15,000" />
-            </Field>
-            <Field>
-              <FieldLabel htmlFor="target-date">Target Date</FieldLabel>
-              <Input id="target-date" defaultValue="Dec 2025" />
-            </Field>
-          </div>
-        </FieldGroup>
-      </CardContent>
-      <CardFooter className="flex-col gap-2">
-        <Button className="w-full">Create Goal</Button>
-        <Button variant="outline" className="w-full">
-          Cancel
-        </Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/notification-settings.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/notification-settings.tsx
deleted file mode 100644
index 3074bebb6..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/notification-settings.tsx
+++ /dev/null
@@ -1,98 +0,0 @@
-"use client";
-
-import * as React from "react";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Checkbox } from "@voidhash/ui";
-import { Field, FieldContent, FieldDescription, FieldGroup, FieldLabel } from "@voidhash/ui";
-
-const NOTIFICATIONS = [
-  {
-    id: "transactions",
-    label: "Transaction alerts",
-    description: "Deposits, withdrawals, and transfers.",
-    defaultChecked: true,
-  },
-  {
-    id: "security",
-    label: "Security alerts",
-    description: "Login attempts and account changes.",
-    defaultChecked: true,
-  },
-  {
-    id: "goals",
-    label: "Goal milestones",
-    description: "Updates at 25%, 50%, 75%, and 100%.",
-    defaultChecked: false,
-  },
-  {
-    id: "market",
-    label: "Market updates",
-    description: "Daily portfolio summary and price alerts.",
-    defaultChecked: false,
-  },
-];
-
-export function NotificationSettings() {
-  const [checked, setChecked] = React.useState<Record<string, boolean>>(
-    Object.fromEntries(NOTIFICATIONS.map((n) => [n.id, n.defaultChecked])),
-  );
-
-  const allChecked = NOTIFICATIONS.every((n) => checked[n.id]);
-  const someChecked = NOTIFICATIONS.some((n) => checked[n.id]) && !allChecked;
-
-  const handleSelectAll = (value: boolean) => {
-    setChecked(Object.fromEntries(NOTIFICATIONS.map((n) => [n.id, value])));
-  };
-
-  const handleToggle = (id: string, value: boolean) => {
-    setChecked((prev) => ({ ...prev, [id]: value }));
-  };
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Notifications</CardTitle>
-        <CardDescription>Choose what you want to be notified about.</CardDescription>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field orientation="horizontal">
-            <Checkbox
-              id="notify-all"
-              checked={someChecked ? "indeterminate" : allChecked}
-              onCheckedChange={(v) => handleSelectAll(!!v)}
-            />
-            <FieldContent>
-              <FieldLabel htmlFor="notify-all">Select all</FieldLabel>
-            </FieldContent>
-          </Field>
-          {NOTIFICATIONS.map((n) => (
-            <Field key={n.id} orientation="horizontal">
-              <Checkbox
-                id={`notify-${n.id}`}
-                checked={checked[n.id]}
-                onCheckedChange={(v) => handleToggle(n.id, !!v)}
-              />
-              <FieldContent>
-                <FieldLabel htmlFor={`notify-${n.id}`}>{n.label}</FieldLabel>
-                <FieldDescription>{n.description}</FieldDescription>
-              </FieldContent>
-            </Field>
-          ))}
-        </FieldGroup>
-      </CardContent>
-      <CardFooter>
-        <Button className="w-full">Save Preferences</Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/payments.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/payments.tsx
deleted file mode 100644
index 0e7be017d..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/payments.tsx
+++ /dev/null
@@ -1,169 +0,0 @@
-"use client";
-
-import {
-  Breadcrumb,
-  BreadcrumbItem,
-  BreadcrumbLink,
-  BreadcrumbList,
-  BreadcrumbPage,
-  BreadcrumbSeparator,
-} from "@voidhash/ui";
-import { Button } from "@voidhash/ui";
-import { Card, CardContent, CardHeader } from "@voidhash/ui";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuGroup,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from "@voidhash/ui";
-import { Item, ItemContent, ItemDescription, ItemGroup, ItemMedia, ItemTitle } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function Payments() {
-  return (
-    <Card>
-      <CardHeader className="flex flex-col gap-3">
-        <Breadcrumb>
-          <BreadcrumbList>
-            <BreadcrumbItem>
-              <BreadcrumbLink href="#">Home</BreadcrumbLink>
-            </BreadcrumbItem>
-            <BreadcrumbSeparator />
-            <BreadcrumbItem>
-              <DropdownMenu>
-                <DropdownMenuTrigger asChild>
-                  <Button size="icon-sm" variant="ghost">
-                    <IconPlaceholder
-                      lucide="MoreHorizontalIcon"
-                      tabler="IconDots"
-                      hugeicons="MoreHorizontalCircle01Icon"
-                      phosphor="DotsThreeIcon"
-                      remixicon="RiMoreLine"
-                    />
-                    <span className="sr-only">Account options</span>
-                  </Button>
-                </DropdownMenuTrigger>
-                <DropdownMenuContent align="start">
-                  <DropdownMenuGroup>
-                    <DropdownMenuItem>Profile</DropdownMenuItem>
-                    <DropdownMenuItem>Statements</DropdownMenuItem>
-                    <DropdownMenuItem>Documents</DropdownMenuItem>
-                  </DropdownMenuGroup>
-                </DropdownMenuContent>
-              </DropdownMenu>
-            </BreadcrumbItem>
-            <BreadcrumbSeparator />
-            <BreadcrumbItem>
-              <BreadcrumbPage>Payments</BreadcrumbPage>
-            </BreadcrumbItem>
-          </BreadcrumbList>
-        </Breadcrumb>
-      </CardHeader>
-      <CardContent>
-        <ItemGroup>
-          <Item asChild variant="muted">
-            <a href="#">
-              <ItemMedia variant="icon">
-                <IconPlaceholder
-                  lucide="GaugeIcon"
-                  tabler="IconGauge"
-                  hugeicons="Settings01Icon"
-                  phosphor="GaugeIcon"
-                  remixicon="RiDashboardLine"
-                />
-              </ItemMedia>
-              <ItemContent>
-                <ItemTitle>Change transfer limit</ItemTitle>
-                <ItemDescription>Adjust how much you can send from your balance.</ItemDescription>
-              </ItemContent>
-              <IconPlaceholder
-                lucide="ChevronRightIcon"
-                tabler="IconChevronRight"
-                hugeicons="ArrowRight01Icon"
-                phosphor="CaretRightIcon"
-                remixicon="RiArrowRightSLine"
-                className="size-4 shrink-0 text-muted-foreground"
-              />
-            </a>
-          </Item>
-          <Item asChild variant="muted">
-            <a href="#">
-              <ItemMedia variant="icon">
-                <IconPlaceholder
-                  lucide="CalendarIcon"
-                  tabler="IconCalendar"
-                  hugeicons="Calendar03Icon"
-                  phosphor="CalendarIcon"
-                  remixicon="RiCalendarLine"
-                />
-              </ItemMedia>
-              <ItemContent>
-                <ItemTitle>Scheduled transfers</ItemTitle>
-                <ItemDescription>Set up a transfer to send at a later date.</ItemDescription>
-              </ItemContent>
-              <IconPlaceholder
-                lucide="ChevronRightIcon"
-                tabler="IconChevronRight"
-                hugeicons="ArrowRight01Icon"
-                phosphor="CaretRightIcon"
-                remixicon="RiArrowRightSLine"
-                className="size-4 shrink-0 text-muted-foreground"
-              />
-            </a>
-          </Item>
-          <Item asChild variant="muted">
-            <a href="#">
-              <ItemMedia variant="icon">
-                <IconPlaceholder
-                  lucide="RepeatIcon"
-                  tabler="IconRepeat"
-                  hugeicons="RepeatIcon"
-                  phosphor="RepeatIcon"
-                  remixicon="RiRepeatLine"
-                />
-              </ItemMedia>
-              <ItemContent>
-                <ItemTitle>Direct Debits</ItemTitle>
-                <ItemDescription>Set up and manage regular payments.</ItemDescription>
-              </ItemContent>
-              <IconPlaceholder
-                lucide="ChevronRightIcon"
-                tabler="IconChevronRight"
-                hugeicons="ArrowRight01Icon"
-                phosphor="CaretRightIcon"
-                remixicon="RiArrowRightSLine"
-                className="size-4 shrink-0 text-muted-foreground"
-              />
-            </a>
-          </Item>
-          <Item asChild variant="muted">
-            <a href="#">
-              <ItemMedia variant="icon">
-                <IconPlaceholder
-                  lucide="RefreshCwIcon"
-                  tabler="IconRefresh"
-                  hugeicons="RepeatIcon"
-                  phosphor="ArrowsClockwiseIcon"
-                  remixicon="RiRefreshLine"
-                />
-              </ItemMedia>
-              <ItemContent>
-                <ItemTitle>Recurring card payments</ItemTitle>
-                <ItemDescription>Manage your repeated card transactions.</ItemDescription>
-              </ItemContent>
-              <IconPlaceholder
-                lucide="ChevronRightIcon"
-                tabler="IconChevronRight"
-                hugeicons="ArrowRight01Icon"
-                phosphor="CaretRightIcon"
-                remixicon="RiArrowRightSLine"
-                className="size-4 shrink-0 text-muted-foreground"
-              />
-            </a>
-          </Item>
-        </ItemGroup>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/payout-threshold.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/payout-threshold.tsx
deleted file mode 100644
index a8a402735..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/payout-threshold.tsx
+++ /dev/null
@@ -1,101 +0,0 @@
-"use client";
-
-import * as React from "react";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Field, FieldDescription, FieldGroup, FieldLabel } from "@voidhash/ui";
-import {
-  Select,
-  SelectContent,
-  SelectGroup,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@voidhash/ui";
-import { Slider } from "@voidhash/ui";
-import { Textarea } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function PayoutThreshold() {
-  const [amount, setAmount] = React.useState([2500]);
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Payout Threshold</CardTitle>
-        <CardDescription>
-          Set the minimum balance required before a payout is triggered.
-        </CardDescription>
-        <CardAction>
-          <Button variant="ghost" size="icon-sm" className="bg-muted">
-            <IconPlaceholder
-              lucide="XIcon"
-              tabler="IconX"
-              hugeicons="Cancel01Icon"
-              phosphor="XIcon"
-              remixicon="RiCloseLine"
-            />
-          </Button>
-        </CardAction>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="preferred-currency">Preferred Currency</FieldLabel>
-            <Select defaultValue="usd">
-              <SelectTrigger id="preferred-currency" className="w-full">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectGroup>
-                  <SelectItem value="usd">USD — United States Dollar</SelectItem>
-                  <SelectItem value="eur">EUR — Euro</SelectItem>
-                  <SelectItem value="gbp">GBP — British Pound</SelectItem>
-                  <SelectItem value="jpy">JPY — Japanese Yen</SelectItem>
-                </SelectGroup>
-              </SelectContent>
-            </Select>
-          </Field>
-          <Field>
-            <div className="flex items-baseline justify-between">
-              <FieldLabel htmlFor="min-payout">Minimum Payout Amount</FieldLabel>
-              <span className="text-2xl font-semibold tabular-nums">${amount[0].toFixed(2)}</span>
-            </div>
-            <Slider
-              id="min-payout"
-              value={amount}
-              onValueChange={setAmount}
-              min={50}
-              max={10000}
-              step={50}
-            />
-            <div className="flex items-center justify-between">
-              <FieldDescription>$50 (MIN)</FieldDescription>
-              <FieldDescription>$10,000 (MAX)</FieldDescription>
-            </div>
-          </Field>
-          <Field>
-            <FieldLabel htmlFor="payout-notes">Notes</FieldLabel>
-            <Textarea
-              id="payout-notes"
-              placeholder="Add any notes for this payout configuration..."
-              className="min-h-[100px]"
-            />
-          </Field>
-        </FieldGroup>
-      </CardContent>
-      <CardFooter>
-        <Button className="w-full">Save Threshold</Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/power-usage.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/power-usage.tsx
deleted file mode 100644
index d5cdc2426..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/power-usage.tsx
+++ /dev/null
@@ -1,81 +0,0 @@
-"use client";
-
-import { Bar, BarChart, XAxis } from "recharts";
-
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { ChartContainer, ChartTooltip, ChartTooltipContent, type ChartConfig } from "@voidhash/ui";
-import { Progress } from "@voidhash/ui";
-import { Separator } from "@voidhash/ui";
-import { useDesignSystemSearchParams } from "../preview-config";
-
-const chartData = [
-  { hour: "6a", usage: 1.2 },
-  { hour: "8a", usage: 2.8 },
-  { hour: "10a", usage: 3.1 },
-  { hour: "12p", usage: 2.4 },
-  { hour: "2p", usage: 3.4 },
-  { hour: "4p", usage: 2.9 },
-  { hour: "6p", usage: 3.8 },
-  { hour: "8p", usage: 3.2 },
-];
-
-const chartConfig = {
-  usage: {
-    label: "Usage (kW)",
-    color: "var(--chart-2)",
-  },
-} satisfies ChartConfig;
-
-export function PowerUsage() {
-  const [params] = useDesignSystemSearchParams();
-  const isRounded = !["lyra", "sera"].includes(params.style);
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Power Usage</CardTitle>
-        <CardDescription>Whole Home</CardDescription>
-      </CardHeader>
-      <CardContent className="flex flex-col gap-4">
-        <ChartContainer config={chartConfig} className="h-[140px] w-full">
-          <BarChart data={chartData} margin={{ left: 0, right: 0, top: 4, bottom: 0 }}>
-            <XAxis
-              dataKey="hour"
-              tickLine={false}
-              tickMargin={6}
-              axisLine={false}
-              className="text-xs"
-            />
-            <ChartTooltip cursor={false} content={<ChartTooltipContent hideLabel />} />
-            <Bar dataKey="usage" fill="var(--color-usage)" radius={isRounded ? [4, 4, 0, 0] : 0} />
-          </BarChart>
-        </ChartContainer>
-        <Separator />
-        <div className="grid grid-cols-2 gap-4">
-          <div className="flex flex-col gap-0.5">
-            <span className="text-sm text-muted-foreground">Currently Using</span>
-            <span className="text-lg font-semibold tabular-nums">3.4 kW</span>
-          </div>
-          <div className="flex flex-col gap-0.5">
-            <span className="text-sm text-muted-foreground">Solar Gen</span>
-            <span className="text-lg font-semibold text-chart-1 tabular-nums">+1.2 kW</span>
-          </div>
-        </div>
-      </CardContent>
-      <CardFooter className="flex-col items-start gap-1">
-        <span className="text-sm text-muted-foreground">Battery Level</span>
-        <div className="flex w-full items-center gap-2">
-          <Progress value={85} className="flex-1" />
-          <span className="text-sm font-medium tabular-nums">85%</span>
-        </div>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/preferences.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/preferences.tsx
deleted file mode 100644
index b7f37da80..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/preferences.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import {
-  Field,
-  FieldContent,
-  FieldDescription,
-  FieldGroup,
-  FieldLabel,
-  FieldSeparator,
-} from "@voidhash/ui";
-import {
-  Select,
-  SelectContent,
-  SelectGroup,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@voidhash/ui";
-import { Switch } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function Preferences() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Preferences</CardTitle>
-        <CardDescription>Manage your account settings and notifications.</CardDescription>
-        <CardAction>
-          <Button variant="ghost" size="icon-sm" className="bg-muted">
-            <IconPlaceholder
-              lucide="XIcon"
-              tabler="IconX"
-              hugeicons="Cancel01Icon"
-              phosphor="XIcon"
-              remixicon="RiCloseLine"
-            />
-          </Button>
-        </CardAction>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="default-currency">Default Currency</FieldLabel>
-            <Select defaultValue="usd">
-              <SelectTrigger id="default-currency" className="w-full">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectGroup>
-                  <SelectItem value="usd">USD — United States Dollar</SelectItem>
-                  <SelectItem value="eur">EUR — Euro</SelectItem>
-                  <SelectItem value="gbp">GBP — British Pound</SelectItem>
-                  <SelectItem value="jpy">JPY — Japanese Yen</SelectItem>
-                </SelectGroup>
-              </SelectContent>
-            </Select>
-          </Field>
-          <FieldSeparator className="-my-4 style-sera:hidden" />
-          <Field orientation="horizontal">
-            <FieldContent>
-              <FieldLabel htmlFor="public-statistics">Public Statistics</FieldLabel>
-              <FieldDescription>
-                Allow others to see your total stream count and listening activity
-              </FieldDescription>
-            </FieldContent>
-            <Switch id="public-statistics" defaultChecked />
-          </Field>
-          <FieldSeparator className="-my-4 style-sera:hidden" />
-          <Field orientation="horizontal">
-            <FieldContent>
-              <FieldLabel htmlFor="email-notifications">Email Notifications</FieldLabel>
-              <FieldDescription>Monthly royalty reports and distribution updates</FieldDescription>
-            </FieldContent>
-            <Switch id="email-notifications" defaultChecked />
-          </Field>
-        </FieldGroup>
-      </CardContent>
-      <CardFooter>
-        <Button variant="outline">Reset</Button>
-        <Button className="ml-auto">Save Preferences</Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/project-actions.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/project-actions.tsx
deleted file mode 100644
index 2134d675a..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/project-actions.tsx
+++ /dev/null
@@ -1,96 +0,0 @@
-import {
-  Button,
-  Card,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-  ToggleGroup,
-  ToggleGroupItem,
-} from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function ProjectActions() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Project Actions</CardTitle>
-        <CardDescription>Manage and publish your current project.</CardDescription>
-      </CardHeader>
-      <CardContent className="overflow-x-auto">
-        <div className="flex min-w-max items-center gap-2">
-          <Button variant="ghost" size="icon-sm" aria-label="More actions">
-            <IconPlaceholder
-              lucide="MoreHorizontalIcon"
-              tabler="IconDots"
-              hugeicons="MoreHorizontalCircle01Icon"
-              phosphor="DotsThreeIcon"
-              remixicon="RiMoreLine"
-            />
-          </Button>
-          <Button variant="outline" size="icon-sm" aria-label="Filter project">
-            <IconPlaceholder
-              lucide="ListFilterIcon"
-              tabler="IconFilter"
-              hugeicons="FilterHorizontalIcon"
-              phosphor="FunnelIcon"
-              remixicon="RiFilter3Line"
-            />
-          </Button>
-          <Button variant="outline" size="sm">
-            <IconPlaceholder
-              lucide="PlusIcon"
-              tabler="IconPlus"
-              hugeicons="Add01Icon"
-              phosphor="PlusIcon"
-              remixicon="RiAddLine"
-              data-icon="inline-start"
-            />
-            Add
-          </Button>
-
-          <Button variant="ghost" size="sm">
-            Cancel
-          </Button>
-          <Button variant="outline" size="sm">
-            Preview
-          </Button>
-          <Button variant="outline" size="sm">
-            Copy
-          </Button>
-          <Button size="sm">Publish</Button>
-
-          <ToggleGroup type="single" defaultValue="grid">
-            <ToggleGroupItem value="list" aria-label="List view">
-              <IconPlaceholder
-                lucide="ListIcon"
-                tabler="IconList"
-                hugeicons="LeftToRightListBulletIcon"
-                phosphor="ListBulletsIcon"
-                remixicon="RiListUnordered"
-              />
-            </ToggleGroupItem>
-            <ToggleGroupItem value="grid" aria-label="Grid view">
-              <IconPlaceholder
-                lucide="LayoutGridIcon"
-                tabler="IconLayoutGrid"
-                hugeicons="GridViewIcon"
-                phosphor="GridFourIcon"
-                remixicon="RiGridFill"
-              />
-            </ToggleGroupItem>
-            <ToggleGroupItem value="columns" aria-label="Columns view">
-              <IconPlaceholder
-                lucide="Columns3Icon"
-                tabler="IconColumns3"
-                hugeicons="Layout3ColumnIcon"
-                phosphor="ColumnsIcon"
-                remixicon="RiLayoutColumnLine"
-              />
-            </ToggleGroupItem>
-          </ToggleGroup>
-        </div>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/qr-connect.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/qr-connect.tsx
deleted file mode 100644
index da6d2b02b..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/qr-connect.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-"use client";
-
-import QRCode from "react-qr-code";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-
-export function QrConnect() {
-  return (
-    <Card>
-      <CardContent className="flex justify-center pt-6">
-        <div className="rounded-xl border bg-white p-4">
-          <QRCode value="https://ledger.app/connect/jd-4829" size={160} level="M" />
-        </div>
-      </CardContent>
-      <CardHeader className="text-center">
-        <CardTitle>Scan to connect your mobile device</CardTitle>
-        <CardDescription>
-          Open the Ledger mobile app and scan this code to link your device.
-        </CardDescription>
-      </CardHeader>
-      <CardFooter>
-        <Button variant="outline" className="w-full">
-          Got it
-        </Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/receiving-method.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/receiving-method.tsx
deleted file mode 100644
index 4c6849ccb..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/receiving-method.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-"use client";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import {
-  Field,
-  FieldContent,
-  FieldDescription,
-  FieldGroup,
-  FieldLabel,
-  FieldLegend,
-  FieldSet,
-  FieldTitle,
-} from "@voidhash/ui";
-import { Input } from "@voidhash/ui";
-import { RadioGroup, RadioGroupItem } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function ReceivingMethod() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardDescription>Payout Preferences</CardDescription>
-        <CardTitle>Receiving Method</CardTitle>
-        <CardAction>
-          <Button variant="ghost" size="icon-sm" className="bg-muted">
-            <IconPlaceholder
-              lucide="XIcon"
-              tabler="IconX"
-              hugeicons="Cancel01Icon"
-              phosphor="XIcon"
-              remixicon="RiCloseLine"
-            />
-          </Button>
-        </CardAction>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="account-holder">Account Holder Name</FieldLabel>
-            <Input id="account-holder" defaultValue="Synthetic Horizons Music LLC" />
-          </Field>
-          <FieldSet>
-            <FieldLegend variant="label">Receiving Method</FieldLegend>
-            <RadioGroup
-              defaultValue="bank"
-              className="grid grid-cols-1 items-start gap-3 md:grid-cols-2 style-sera:grid-cols-1"
-            >
-              <FieldLabel htmlFor="method-bank">
-                <Field orientation="horizontal" className="pb-2.5">
-                  <RadioGroupItem value="bank" id="method-bank" />
-                  <FieldContent>
-                    <FieldTitle>Bank Transfer</FieldTitle>
-                    <FieldDescription>SWIFT / IBAN</FieldDescription>
-                  </FieldContent>
-                </Field>
-              </FieldLabel>
-              <FieldLabel htmlFor="method-paypal">
-                <Field orientation="horizontal" className="pb-2.5">
-                  <RadioGroupItem value="paypal" id="method-paypal" />
-                  <FieldContent>
-                    <FieldTitle>PayPal</FieldTitle>
-                    <FieldDescription className="line-clamp-1">Instant Payout</FieldDescription>
-                  </FieldContent>
-                </Field>
-              </FieldLabel>
-            </RadioGroup>
-          </FieldSet>
-          <Field>
-            <FieldLabel htmlFor="iban">IBAN / Account Number</FieldLabel>
-            <Input id="iban" placeholder="DE89 3704 0044 ...." />
-          </Field>
-        </FieldGroup>
-      </CardContent>
-      <CardFooter>
-        <Button className="w-full" disabled>
-          Save Payout Settings
-        </Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/recent-transactions.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/recent-transactions.tsx
deleted file mode 100644
index ce77ee3cb..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/recent-transactions.tsx
+++ /dev/null
@@ -1,276 +0,0 @@
-"use client";
-
-import * as React from "react";
-
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger,
-} from "@voidhash/ui";
-import { Table, TableBody, TableCell, TableRow } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function RecentTransactions() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Recent Transactions</CardTitle>
-        <CardDescription>Your latest account activity.</CardDescription>
-        <CardAction>
-          <Button variant="outline" size="sm">
-            View All
-          </Button>
-        </CardAction>
-      </CardHeader>
-      <CardContent>
-        <Table>
-          <TableBody>
-            <TableRow>
-              <TableCell className="w-10">
-                <div className="flex size-10 items-center justify-center rounded-lg bg-muted">
-                  <IconPlaceholder
-                    className="size-4 shrink-0"
-                    lucide="CoffeeIcon"
-                    tabler="IconCoffee"
-                    hugeicons="CoffeeIcon"
-                    phosphor="CoffeeIcon"
-                    remixicon="RiCupLine"
-                  />
-                </div>
-              </TableCell>
-              <TableCell>
-                <div className="flex flex-col">
-                  <span className="font-medium">Blue Bottle Coffee</span>
-                  <span className="text-sm text-muted-foreground">Food & Drink</span>
-                </div>
-              </TableCell>
-              <TableCell className="text-sm text-muted-foreground">Today, 10:24 AM</TableCell>
-              <TableCell className="text-right">
-                <span className="text-sm font-semibold tabular-nums">-$6.50</span>
-              </TableCell>
-              <TableCell className="w-8">
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <Button variant="ghost" size="icon-sm">
-                      <IconPlaceholder
-                        lucide="MoreHorizontalIcon"
-                        tabler="IconDotsVertical"
-                        hugeicons="MoreVerticalCircle01Icon"
-                        phosphor="DotsThreeIcon"
-                        remixicon="RiMore2Line"
-                      />
-                    </Button>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="end">
-                    <DropdownMenuItem>View details</DropdownMenuItem>
-                    <DropdownMenuItem>Add note</DropdownMenuItem>
-                    <DropdownMenuItem>Categorize</DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem>Dispute</DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </TableCell>
-            </TableRow>
-            <TableRow>
-              <TableCell className="w-10">
-                <div className="flex size-10 items-center justify-center rounded-lg bg-muted">
-                  <IconPlaceholder
-                    className="size-4 shrink-0"
-                    lucide="ShoppingCartIcon"
-                    tabler="IconShoppingCart"
-                    hugeicons="ShoppingCart01Icon"
-                    phosphor="ShoppingCartIcon"
-                    remixicon="RiShoppingCartLine"
-                  />
-                </div>
-              </TableCell>
-              <TableCell>
-                <div className="flex flex-col">
-                  <span className="font-medium">Whole Foods Market</span>
-                  <span className="text-sm text-muted-foreground">Groceries</span>
-                </div>
-              </TableCell>
-              <TableCell className="text-sm text-muted-foreground">Yesterday</TableCell>
-              <TableCell className="text-right">
-                <span className="text-sm font-semibold tabular-nums">-$142.30</span>
-              </TableCell>
-              <TableCell className="w-8">
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <Button variant="ghost" size="icon-sm">
-                      <IconPlaceholder
-                        lucide="MoreHorizontalIcon"
-                        tabler="IconDotsVertical"
-                        hugeicons="MoreVerticalCircle01Icon"
-                        phosphor="DotsThreeIcon"
-                        remixicon="RiMore2Line"
-                      />
-                    </Button>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="end">
-                    <DropdownMenuItem>View details</DropdownMenuItem>
-                    <DropdownMenuItem>Add note</DropdownMenuItem>
-                    <DropdownMenuItem>Categorize</DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem>Dispute</DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </TableCell>
-            </TableRow>
-            <TableRow>
-              <TableCell className="w-10">
-                <div className="flex size-10 items-center justify-center rounded-lg bg-muted">
-                  <IconPlaceholder
-                    className="size-4 shrink-0"
-                    lucide="WalletIcon"
-                    tabler="IconWallet"
-                    hugeicons="Wallet01Icon"
-                    phosphor="WalletIcon"
-                    remixicon="RiWalletLine"
-                  />
-                </div>
-              </TableCell>
-              <TableCell>
-                <div className="flex flex-col">
-                  <span className="font-medium">Stripe Payout</span>
-                  <span className="text-sm text-muted-foreground">Income</span>
-                </div>
-              </TableCell>
-              <TableCell className="text-sm text-muted-foreground">Oct 12</TableCell>
-              <TableCell className="text-right">
-                <span className="text-sm font-semibold text-emerald-500 tabular-nums">
-                  +$4,200.00
-                </span>
-              </TableCell>
-              <TableCell className="w-8">
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <Button variant="ghost" size="icon-sm">
-                      <IconPlaceholder
-                        lucide="MoreHorizontalIcon"
-                        tabler="IconDotsVertical"
-                        hugeicons="MoreVerticalCircle01Icon"
-                        phosphor="DotsThreeIcon"
-                        remixicon="RiMore2Line"
-                      />
-                    </Button>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="end">
-                    <DropdownMenuItem>View details</DropdownMenuItem>
-                    <DropdownMenuItem>Add note</DropdownMenuItem>
-                    <DropdownMenuItem>Categorize</DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem>Dispute</DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </TableCell>
-            </TableRow>
-            <TableRow>
-              <TableCell className="w-10">
-                <div className="flex size-10 items-center justify-center rounded-lg bg-muted">
-                  <IconPlaceholder
-                    className="size-4 shrink-0"
-                    lucide="CarIcon"
-                    tabler="IconCar"
-                    hugeicons="Car01Icon"
-                    phosphor="CarIcon"
-                    remixicon="RiCarLine"
-                  />
-                </div>
-              </TableCell>
-              <TableCell>
-                <div className="flex flex-col">
-                  <span className="font-medium">Uber Technologies</span>
-                  <span className="text-sm text-muted-foreground">Transport</span>
-                </div>
-              </TableCell>
-              <TableCell className="text-sm text-muted-foreground">Oct 11</TableCell>
-              <TableCell className="text-right">
-                <span className="text-sm font-semibold tabular-nums">-$24.10</span>
-              </TableCell>
-              <TableCell className="w-8">
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <Button variant="ghost" size="icon-sm">
-                      <IconPlaceholder
-                        lucide="MoreHorizontalIcon"
-                        tabler="IconDotsVertical"
-                        hugeicons="MoreVerticalCircle01Icon"
-                        phosphor="DotsThreeIcon"
-                        remixicon="RiMore2Line"
-                      />
-                    </Button>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="end">
-                    <DropdownMenuItem>View details</DropdownMenuItem>
-                    <DropdownMenuItem>Add note</DropdownMenuItem>
-                    <DropdownMenuItem>Categorize</DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem>Dispute</DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </TableCell>
-            </TableRow>
-            <TableRow>
-              <TableCell className="w-10">
-                <div className="flex size-10 items-center justify-center rounded-lg bg-muted">
-                  <IconPlaceholder
-                    className="size-4 shrink-0"
-                    lucide="TvIcon"
-                    tabler="IconDeviceTv"
-                    hugeicons="Tv01Icon"
-                    phosphor="TelevisionIcon"
-                    remixicon="RiTvLine"
-                  />
-                </div>
-              </TableCell>
-              <TableCell>
-                <div className="flex flex-col">
-                  <span className="font-medium">Netflix Subscription</span>
-                  <span className="text-sm text-muted-foreground">Entertainment</span>
-                </div>
-              </TableCell>
-              <TableCell className="text-sm text-muted-foreground">Oct 10</TableCell>
-              <TableCell className="text-right">
-                <span className="text-sm font-semibold tabular-nums">-$19.99</span>
-              </TableCell>
-              <TableCell className="w-8">
-                <DropdownMenu>
-                  <DropdownMenuTrigger asChild>
-                    <Button variant="ghost" size="icon-sm">
-                      <IconPlaceholder
-                        lucide="MoreHorizontalIcon"
-                        tabler="IconDotsVertical"
-                        hugeicons="MoreVerticalCircle01Icon"
-                        phosphor="DotsThreeIcon"
-                        remixicon="RiMore2Line"
-                      />
-                    </Button>
-                  </DropdownMenuTrigger>
-                  <DropdownMenuContent align="end">
-                    <DropdownMenuItem>View details</DropdownMenuItem>
-                    <DropdownMenuItem>Add note</DropdownMenuItem>
-                    <DropdownMenuItem>Categorize</DropdownMenuItem>
-                    <DropdownMenuSeparator />
-                    <DropdownMenuItem>Dispute</DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              </TableCell>
-            </TableRow>
-          </TableBody>
-        </Table>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/release-catalog.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/release-catalog.tsx
deleted file mode 100644
index 6be85e158..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/release-catalog.tsx
+++ /dev/null
@@ -1,99 +0,0 @@
-"use client";
-
-import { Badge } from "@voidhash/ui";
-import { Card, CardContent, CardHeader } from "@voidhash/ui";
-import { InputGroup, InputGroupAddon, InputGroupInput } from "@voidhash/ui";
-import { Item, ItemContent, ItemDescription, ItemGroup, ItemMedia, ItemTitle } from "@voidhash/ui";
-import { ToggleGroup, ToggleGroupItem } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-const HOLDINGS = [
-  {
-    ticker: "VOO",
-    name: "Vanguard S&P 500 ETF",
-    type: "ETF",
-    added: "Jan 2021",
-    shares: "112",
-    value: "$48,230.40",
-  },
-  {
-    ticker: "VIG",
-    name: "Vanguard Dividend Appreciation",
-    type: "ETF",
-    added: "Mar 2022",
-    shares: "450",
-    value: "$26,033.79",
-  },
-  {
-    ticker: "AAPL",
-    name: "Apple Inc.",
-    type: "Stock",
-    added: "Nov 2020",
-    shares: "85",
-    value: "$18,488.90",
-  },
-  {
-    ticker: "O",
-    name: "Realty Income Corp",
-    type: "REIT",
-    added: "Jun 2023",
-    shares: "320",
-    value: "$15,136.59",
-  },
-];
-
-export function ReleaseCatalog() {
-  return (
-    <Card>
-      <CardHeader>
-        <div className="flex items-center justify-between gap-3">
-          <InputGroup className="max-w-sm">
-            <InputGroupAddon>
-              <IconPlaceholder
-                lucide="SearchIcon"
-                tabler="IconSearch"
-                hugeicons="Search01Icon"
-                phosphor="MagnifyingGlassIcon"
-                remixicon="RiSearchLine"
-              />
-            </InputGroupAddon>
-            <InputGroupInput placeholder="Search holdings or tickers..." />
-          </InputGroup>
-          <ToggleGroup type="single" defaultValue="etfs" spacing={1}>
-            <ToggleGroupItem value="stocks">Stocks</ToggleGroupItem>
-            <ToggleGroupItem value="etfs">ETFs</ToggleGroupItem>
-            <ToggleGroupItem value="reits">REITs</ToggleGroupItem>
-          </ToggleGroup>
-        </div>
-      </CardHeader>
-      <CardContent>
-        <ItemGroup>
-          {HOLDINGS.map((holding) => (
-            <Item key={holding.ticker} variant="muted">
-              <ItemMedia>
-                <div className="flex size-12 items-center justify-center rounded-lg border text-sm font-semibold">
-                  {holding.ticker}
-                </div>
-              </ItemMedia>
-              <ItemContent>
-                <ItemTitle>{holding.name}</ItemTitle>
-                <ItemDescription className="text-xs tracking-wider uppercase">
-                  {holding.shares} Shares · {holding.added}
-                </ItemDescription>
-              </ItemContent>
-              <div className="flex shrink-0 items-center gap-6">
-                <Badge variant="outline">{holding.type}</Badge>
-                <div className="flex flex-col items-end gap-0.5">
-                  <span className="text-xs tracking-wider text-muted-foreground uppercase">
-                    Value
-                  </span>
-                  <span className="font-medium tabular-nums">{holding.value}</span>
-                </div>
-              </div>
-            </Item>
-          ))}
-        </ItemGroup>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/roller-shades.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/roller-shades.tsx
deleted file mode 100644
index 9bd1136f2..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/roller-shades.tsx
+++ /dev/null
@@ -1,69 +0,0 @@
-"use client";
-
-import * as React from "react";
-
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Slider } from "@voidhash/ui";
-import { ToggleGroup, ToggleGroupItem } from "@voidhash/ui";
-
-export function RollerShades() {
-  const [position, setPosition] = React.useState([50]);
-
-  const preset = position[0] <= 10 ? "open" : position[0] >= 90 ? "closed" : "half";
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Living Room</CardTitle>
-        <CardDescription>Roller Shades</CardDescription>
-      </CardHeader>
-      <CardContent className="flex flex-col gap-4">
-        <div className="flex h-32 flex-col overflow-hidden rounded-lg border bg-muted">
-          <div
-            className="bg-muted-foreground transition-all duration-300"
-            style={{ height: `${position[0]}%` }}
-          />
-        </div>
-        <div className="flex items-center gap-3">
-          <span className="text-xs font-medium tracking-wider text-muted-foreground uppercase">
-            Open
-          </span>
-          <Slider value={position} onValueChange={setPosition} max={100} className="flex-1" />
-          <span className="text-xs font-medium tracking-wider text-muted-foreground uppercase">
-            Close
-          </span>
-        </div>
-      </CardContent>
-      <CardFooter>
-        <ToggleGroup
-          type="single"
-          value={preset}
-          onValueChange={(value) => {
-            if (value === "open") setPosition([0]);
-            if (value === "half") setPosition([50]);
-            if (value === "closed") setPosition([100]);
-          }}
-          spacing={1}
-          className="w-full"
-        >
-          <ToggleGroupItem value="open" className="flex-1">
-            Open
-          </ToggleGroupItem>
-          <ToggleGroupItem value="half" className="flex-1">
-            Half
-          </ToggleGroupItem>
-          <ToggleGroupItem value="closed" className="flex-1">
-            Closed
-          </ToggleGroupItem>
-        </ToggleGroup>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/savings-progress.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/savings-progress.tsx
deleted file mode 100644
index aad759d97..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/savings-progress.tsx
+++ /dev/null
@@ -1,93 +0,0 @@
-"use client";
-
-import { Label, Pie, PieChart } from "recharts";
-
-import { Card, CardContent, CardFooter } from "@voidhash/ui";
-import { ChartContainer, ChartTooltip, ChartTooltipContent, type ChartConfig } from "@voidhash/ui";
-import { Separator } from "@voidhash/ui";
-
-const chartData = [
-  { name: "saved", value: 24000, fill: "var(--color-saved)" },
-  { name: "remaining", value: 6000, fill: "var(--color-remaining)" },
-];
-
-const chartConfig = {
-  saved: {
-    label: "Saved",
-    color: "var(--chart-2)",
-  },
-  remaining: {
-    label: "Remaining",
-    color: "var(--chart-1)",
-  },
-} satisfies ChartConfig;
-
-export function SavingsProgress() {
-  return (
-    <Card>
-      <CardContent>
-        <ChartContainer config={chartConfig} className="mx-auto aspect-square max-h-[220px]">
-          <PieChart>
-            <ChartTooltip cursor={false} content={<ChartTooltipContent hideLabel />} />
-            <Pie
-              data={chartData}
-              dataKey="value"
-              nameKey="name"
-              innerRadius={70}
-              outerRadius={95}
-              strokeWidth={0}
-              startAngle={90}
-              endAngle={-270}
-            >
-              <Label
-                content={({ viewBox }) => {
-                  if (viewBox && "cx" in viewBox && "cy" in viewBox) {
-                    return (
-                      <text
-                        x={viewBox.cx}
-                        y={viewBox.cy}
-                        textAnchor="middle"
-                        dominantBaseline="middle"
-                      >
-                        <tspan
-                          x={viewBox.cx}
-                          y={(viewBox.cy || 0) - 12}
-                          className="fill-foreground text-2xl font-bold"
-                        >
-                          $24,000
-                        </tspan>
-                        <tspan
-                          x={viewBox.cx}
-                          y={(viewBox.cy || 0) + 12}
-                          className="fill-muted-foreground text-xs"
-                        >
-                          80% of $30,000
-                        </tspan>
-                      </text>
-                    );
-                  }
-                }}
-              />
-            </Pie>
-          </PieChart>
-        </ChartContainer>
-      </CardContent>
-      <CardFooter className="flex-col gap-0">
-        <div className="flex w-full items-center justify-between py-3">
-          <span className="text-sm text-muted-foreground">Projected Finish</span>
-          <span className="text-sm font-semibold">October 2024</span>
-        </div>
-        <Separator />
-        <div className="flex w-full items-center justify-between py-3">
-          <span className="text-sm text-muted-foreground">Monthly Average</span>
-          <span className="text-sm font-semibold tabular-nums">$1,250</span>
-        </div>
-        <Separator />
-        <div className="flex w-full items-center justify-between py-3">
-          <span className="text-sm text-muted-foreground">Top Contributor</span>
-          <span className="text-sm font-semibold">Auto-Transfer</span>
-        </div>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/savings-targets.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/savings-targets.tsx
deleted file mode 100644
index 5d1ceb7c7..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/savings-targets.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Field, FieldDescription, FieldGroup, FieldLabel } from "@voidhash/ui";
-import { InputGroup, InputGroupAddon, InputGroupInput, InputGroupText } from "@voidhash/ui";
-import { Item, ItemContent, ItemDescription, ItemFooter, ItemGroup } from "@voidhash/ui";
-import { NativeSelect, NativeSelectOption } from "@voidhash/ui";
-import { Progress } from "@voidhash/ui";
-
-export function SavingsTargets() {
-  return (
-    <div className="grid grid-cols-2 gap-(--gap)">
-      <Card>
-        <CardHeader>
-          <CardTitle>Savings Targets</CardTitle>
-          <CardDescription>Active milestones for 2024</CardDescription>
-          <CardAction>
-            <Button variant="outline" size="sm">
-              New Goal
-            </Button>
-          </CardAction>
-        </CardHeader>
-        <CardContent>
-          <ItemGroup className="gap-3">
-            <Item variant="muted" className="flex-col items-stretch">
-              <ItemContent className="gap-3">
-                <ItemDescription className="cn-font-heading text-xs font-medium tracking-wider text-muted-foreground uppercase">
-                  Retirement
-                </ItemDescription>
-                <span className="text-3xl font-semibold tabular-nums">$420,000</span>
-                <Progress value={65} />
-              </ItemContent>
-              <ItemFooter>
-                <span className="text-sm text-muted-foreground">65% achieved</span>
-                <span className="text-sm font-medium tabular-nums">$273,000</span>
-              </ItemFooter>
-            </Item>
-            <Item variant="muted" className="flex-col items-stretch">
-              <ItemContent className="gap-3">
-                <ItemDescription className="cn-font-heading text-xs font-medium tracking-wider text-muted-foreground uppercase">
-                  Real Estate
-                </ItemDescription>
-                <span className="text-3xl font-semibold tabular-nums">$85,000</span>
-                <Progress value={32} />
-              </ItemContent>
-              <ItemFooter>
-                <span className="text-sm text-muted-foreground">32% achieved</span>
-                <span className="text-sm font-medium tabular-nums">$27,200</span>
-              </ItemFooter>
-            </Item>
-          </ItemGroup>
-        </CardContent>
-        <CardFooter>
-          <CardDescription className="text-center">
-            You have not met your targets for this year.
-          </CardDescription>
-        </CardFooter>
-      </Card>
-      <Card>
-        <CardHeader>
-          <CardTitle>Buy Investment</CardTitle>
-          <CardAction>
-            <Button variant="outline" size="sm">
-              View Orders
-            </Button>
-          </CardAction>
-        </CardHeader>
-        <CardContent className="flex flex-1 flex-col gap-3">
-          <FieldGroup className="flex-1">
-            <Field>
-              <FieldLabel htmlFor="invest-amount">Amount to Invest</FieldLabel>
-              <InputGroup>
-                <InputGroupAddon>
-                  <InputGroupText>$</InputGroupText>
-                </InputGroupAddon>
-                <InputGroupInput id="invest-amount" defaultValue="1,000.00" />
-              </InputGroup>
-            </Field>
-            <Field>
-              <FieldLabel htmlFor="invest-type">Order Type</FieldLabel>
-              <NativeSelect id="invest-type" defaultValue="market">
-                <NativeSelectOption value="market">Market Order</NativeSelectOption>
-                <NativeSelectOption value="limit">Limit Order</NativeSelectOption>
-                <NativeSelectOption value="stop">Stop Order</NativeSelectOption>
-              </NativeSelect>
-              <FieldDescription>Market orders execute at the current price.</FieldDescription>
-            </Field>
-            <div className="flex flex-col gap-2">
-              <div className="flex items-center justify-between">
-                <span className="text-sm text-muted-foreground">Estimated Shares</span>
-                <span className="text-sm font-semibold tabular-nums">1.95</span>
-              </div>
-              <div className="flex items-center justify-between">
-                <span className="text-sm text-muted-foreground">Buying Power</span>
-                <span className="text-sm font-semibold tabular-nums">$12,450.00</span>
-              </div>
-            </div>
-          </FieldGroup>
-        </CardContent>
-        <CardFooter className="flex-col gap-3">
-          <Button className="w-full">Review Order</Button>
-          <CardDescription className="text-center">
-            Trades are typically executed within minutes during market hours.
-          </CardDescription>
-        </CardFooter>
-      </Card>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/sidebar-nav.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/sidebar-nav.tsx
deleted file mode 100644
index ab3e6b1b9..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/sidebar-nav.tsx
+++ /dev/null
@@ -1,285 +0,0 @@
-"use client";
-
-import { Card } from "@voidhash/ui";
-import {
-  Sidebar,
-  SidebarContent,
-  SidebarGroup,
-  SidebarGroupContent,
-  SidebarGroupLabel,
-  SidebarMenu,
-  SidebarMenuButton,
-  SidebarMenuItem,
-  SidebarProvider,
-  SidebarSeparator,
-} from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function SidebarNav() {
-  return (
-    <div className="grid grid-cols-2 items-start gap-6">
-      <Card className="overflow-hidden py-0">
-        <SidebarProvider className="min-h-0">
-          <Sidebar collapsible="none" className="w-full bg-transparent">
-            <SidebarContent className="gap-0">
-              <SidebarGroup className="pb-1">
-                <SidebarGroupLabel>Overview</SidebarGroupLabel>
-                <SidebarGroupContent>
-                  <SidebarMenu>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton isActive>
-                        <IconPlaceholder
-                          lucide="LayoutDashboardIcon"
-                          tabler="IconLayoutDashboard"
-                          hugeicons="DashboardSquare01Icon"
-                          phosphor="SquaresFourIcon"
-                          remixicon="RiDashboardLine"
-                        />
-                        Dashboard
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="ArrowLeftRightIcon"
-                          tabler="IconArrowsLeftRight"
-                          hugeicons="ArrowDataTransferHorizontalIcon"
-                          phosphor="ArrowsLeftRightIcon"
-                          remixicon="RiArrowLeftRightLine"
-                        />
-                        Transactions
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="TrendingUpIcon"
-                          tabler="IconTrendingUp"
-                          hugeicons="AnalyticsUpIcon"
-                          phosphor="TrendUpIcon"
-                          remixicon="RiLineChartLine"
-                        />
-                        Investments
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="Building2Icon"
-                          tabler="IconBuildingBank"
-                          hugeicons="BankIcon"
-                          phosphor="BankIcon"
-                          remixicon="RiBankLine"
-                        />
-                        Accounts
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="PieChartIcon"
-                          tabler="IconChartPie"
-                          hugeicons="PieChartIcon"
-                          phosphor="ChartPieIcon"
-                          remixicon="RiPieChartLine"
-                        />
-                        Spending
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                  </SidebarMenu>
-                </SidebarGroupContent>
-              </SidebarGroup>
-              <SidebarSeparator className="w-auto!" />
-              <SidebarGroup className="pt-1">
-                <SidebarGroupLabel>Planning</SidebarGroupLabel>
-                <SidebarGroupContent>
-                  <SidebarMenu>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="TargetIcon"
-                          tabler="IconTarget"
-                          hugeicons="Target02Icon"
-                          phosphor="TargetIcon"
-                          remixicon="RiFocus3Line"
-                        />
-                        Goals
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="WalletIcon"
-                          tabler="IconWallet"
-                          hugeicons="Wallet01Icon"
-                          phosphor="WalletIcon"
-                          remixicon="RiWalletLine"
-                        />
-                        Budget
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="FileBarChartIcon"
-                          tabler="IconReportAnalytics"
-                          hugeicons="ChartBarLineIcon"
-                          phosphor="ChartBarIcon"
-                          remixicon="RiBarChartLine"
-                        />
-                        Reports
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="FileTextIcon"
-                          tabler="IconFileText"
-                          hugeicons="File02Icon"
-                          phosphor="FileTextIcon"
-                          remixicon="RiFileTextLine"
-                        />
-                        Documents
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                  </SidebarMenu>
-                </SidebarGroupContent>
-              </SidebarGroup>
-            </SidebarContent>
-          </Sidebar>
-        </SidebarProvider>
-      </Card>
-      <Card className="overflow-hidden py-0">
-        <SidebarProvider className="min-h-0">
-          <Sidebar collapsible="none" className="w-full bg-transparent">
-            <SidebarContent className="gap-0">
-              <SidebarGroup className="pb-1">
-                <SidebarGroupLabel>Account</SidebarGroupLabel>
-                <SidebarGroupContent>
-                  <SidebarMenu>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="UserIcon"
-                          tabler="IconUser"
-                          hugeicons="UserIcon"
-                          phosphor="UserIcon"
-                          remixicon="RiUserLine"
-                        />
-                        Profile
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton isActive>
-                        <IconPlaceholder
-                          lucide="UsersIcon"
-                          tabler="IconUsers"
-                          hugeicons="UserMultipleIcon"
-                          phosphor="UsersIcon"
-                          remixicon="RiTeamLine"
-                        />
-                        Members
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="BellIcon"
-                          tabler="IconBell"
-                          hugeicons="Notification03Icon"
-                          phosphor="BellIcon"
-                          remixicon="RiBellLine"
-                        />
-                        Notifications
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="ShieldIcon"
-                          tabler="IconShield"
-                          hugeicons="ShieldIcon"
-                          phosphor="ShieldIcon"
-                          remixicon="RiShieldLine"
-                        />
-                        Security
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="PaintbrushIcon"
-                          tabler="IconPalette"
-                          hugeicons="PaintBoardIcon"
-                          phosphor="PaletteIcon"
-                          remixicon="RiPaletteLine"
-                        />
-                        Appearance
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                  </SidebarMenu>
-                </SidebarGroupContent>
-              </SidebarGroup>
-              <SidebarSeparator className="w-auto!" />
-              <SidebarGroup className="pt-1">
-                <SidebarGroupLabel>Support</SidebarGroupLabel>
-                <SidebarGroupContent>
-                  <SidebarMenu>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="CircleHelpIcon"
-                          tabler="IconHelp"
-                          hugeicons="HelpCircleIcon"
-                          phosphor="QuestionIcon"
-                          remixicon="RiQuestionLine"
-                        />
-                        Help Center
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="MessageSquareIcon"
-                          tabler="IconMessage"
-                          hugeicons="Message01Icon"
-                          phosphor="ChatIcon"
-                          remixicon="RiChat1Line"
-                        />
-                        Contact Us
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="BookOpenIcon"
-                          tabler="IconBook"
-                          hugeicons="BookOpen02Icon"
-                          phosphor="BookOpenIcon"
-                          remixicon="RiBookOpenLine"
-                        />
-                        Documentation
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                    <SidebarMenuItem>
-                      <SidebarMenuButton>
-                        <IconPlaceholder
-                          lucide="ActivityIcon"
-                          tabler="IconActivity"
-                          hugeicons="ActivityIcon"
-                          phosphor="ActivityIcon"
-                          remixicon="RiPulseLine"
-                        />
-                        Status
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                  </SidebarMenu>
-                </SidebarGroupContent>
-              </SidebarGroup>
-            </SidebarContent>
-          </Sidebar>
-        </SidebarProvider>
-      </Card>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/social-links.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/social-links.tsx
deleted file mode 100644
index 178cab282..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/social-links.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { Card, CardContent, CardFooter, CardHeader, CardTitle } from "@voidhash/ui";
-import { Field, FieldGroup, FieldLabel } from "@voidhash/ui";
-import { InputGroup, InputGroupAddon, InputGroupInput } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function SocialLinks() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Social Links</CardTitle>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="spotify-url">Spotify Artist URL</FieldLabel>
-            <InputGroup>
-              <InputGroupAddon>
-                <IconPlaceholder
-                  lucide="CirclePlusIcon"
-                  tabler="IconCirclePlus"
-                  hugeicons="PlusSignCircleIcon"
-                  phosphor="PlusCircleIcon"
-                  remixicon="RiAddCircleLine"
-                />
-              </InputGroupAddon>
-              <InputGroupInput id="spotify-url" defaultValue="spotify.com/artist/3j...2k" />
-            </InputGroup>
-          </Field>
-          <Field>
-            <FieldLabel htmlFor="instagram-handle">Instagram Handle</FieldLabel>
-            <InputGroup>
-              <InputGroupAddon>
-                <IconPlaceholder
-                  lucide="CameraIcon"
-                  tabler="IconCamera"
-                  hugeicons="Camera01Icon"
-                  phosphor="CameraIcon"
-                  remixicon="RiCameraLine"
-                />
-              </InputGroupAddon>
-              <InputGroupInput id="instagram-handle" defaultValue="@julianduryea_music" />
-            </InputGroup>
-          </Field>
-          <Field>
-            <FieldLabel htmlFor="soundcloud-url">SoundCloud URL</FieldLabel>
-            <InputGroup>
-              <InputGroupAddon>
-                <IconPlaceholder
-                  lucide="CloudIcon"
-                  tabler="IconCloud"
-                  hugeicons="CloudUploadIcon"
-                  phosphor="CloudIcon"
-                  remixicon="RiCloudLine"
-                />
-              </InputGroupAddon>
-              <InputGroupInput id="soundcloud-url" placeholder="soundcloud.com/username" />
-            </InputGroup>
-          </Field>
-          <Field>
-            <FieldLabel htmlFor="website-url">Website</FieldLabel>
-            <InputGroup>
-              <InputGroupAddon>
-                <IconPlaceholder
-                  lucide="GlobeIcon"
-                  tabler="IconWorld"
-                  hugeicons="Globe02Icon"
-                  phosphor="GlobeIcon"
-                  remixicon="RiGlobalLine"
-                />
-              </InputGroupAddon>
-              <InputGroupInput id="website-url" placeholder="https://yoursite.com" />
-            </InputGroup>
-          </Field>
-        </FieldGroup>
-      </CardContent>
-      <CardFooter className="justify-end gap-2 style-sera:justify-center">
-        <Button variant="outline" className="style-sera:flex-1">
-          Discard
-        </Button>
-        <Button className="style-sera:flex-1">Save Changes</Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/stock-performance.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/stock-performance.tsx
deleted file mode 100644
index d02f5cd48..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/stock-performance.tsx
+++ /dev/null
@@ -1,119 +0,0 @@
-"use client";
-
-import * as React from "react";
-import { Area, AreaChart, CartesianGrid } from "recharts";
-
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@voidhash/ui";
-import { ChartContainer, ChartTooltip, ChartTooltipContent, type ChartConfig } from "@voidhash/ui";
-import {
-  Combobox,
-  ComboboxContent,
-  ComboboxEmpty,
-  ComboboxInput,
-  ComboboxItem,
-  ComboboxList,
-} from "@voidhash/ui";
-import { Field, FieldGroup, FieldLabel } from "@voidhash/ui";
-import { Separator } from "@voidhash/ui";
-
-const TICKERS = ["VOO", "VIG", "AAPL", "MSFT", "GOOGL", "AMZN", "TSLA"];
-
-const CHART_DATA: Record<string, { month: string; price: number }[]> = {
-  VOO: [
-    { month: "Jan", price: 412 },
-    { month: "Feb", price: 438 },
-    { month: "Mar", price: 395 },
-    { month: "Apr", price: 450 },
-    { month: "May", price: 420 },
-    { month: "Jun", price: 462 },
-  ],
-  AAPL: [
-    { month: "Jan", price: 185 },
-    { month: "Feb", price: 210 },
-    { month: "Mar", price: 172 },
-    { month: "Apr", price: 198 },
-    { month: "May", price: 178 },
-    { month: "Jun", price: 215 },
-  ],
-};
-
-const DEFAULT_DATA = [
-  { month: "Jan", price: 100 },
-  { month: "Feb", price: 118 },
-  { month: "Mar", price: 95 },
-  { month: "Apr", price: 125 },
-  { month: "May", price: 108 },
-  { month: "Jun", price: 130 },
-];
-
-const chartConfig = {
-  price: {
-    label: "Price",
-    color: "var(--chart-1)",
-  },
-} satisfies ChartConfig;
-
-export function StockPerformance() {
-  const [ticker, setTicker] = React.useState("VOO");
-
-  const data = CHART_DATA[ticker] ?? DEFAULT_DATA;
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Stock Performance</CardTitle>
-        <CardDescription>6-month price history.</CardDescription>
-      </CardHeader>
-      <CardContent className="flex flex-col gap-4">
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="ticker-select">Ticker</FieldLabel>
-            <Combobox
-              items={TICKERS}
-              value={ticker}
-              onValueChange={(value) => {
-                if (value !== null) setTicker(value);
-              }}
-            >
-              <ComboboxInput id="ticker-select" placeholder="Search ticker..." />
-              <ComboboxContent>
-                <ComboboxEmpty>No tickers found.</ComboboxEmpty>
-                <ComboboxList>
-                  {(item) => (
-                    <ComboboxItem key={item} value={item}>
-                      {item}
-                    </ComboboxItem>
-                  )}
-                </ComboboxList>
-              </ComboboxContent>
-            </Combobox>
-          </Field>
-        </FieldGroup>
-        <Separator className="style-sera:hidden" />
-        <ChartContainer config={chartConfig} className="h-[200px] w-full">
-          <AreaChart
-            accessibilityLayer
-            data={data}
-            margin={{ left: 0, right: 0, top: 8, bottom: 0 }}
-          >
-            <defs>
-              <linearGradient id="fillPrice" x1="0" y1="0" x2="0" y2="1">
-                <stop offset="0%" stopColor="var(--color-price)" stopOpacity={0.3} />
-                <stop offset="100%" stopColor="var(--color-price)" stopOpacity={0.05} />
-              </linearGradient>
-            </defs>
-            <CartesianGrid vertical={false} strokeDasharray="3 3" />
-            <ChartTooltip cursor={false} content={<ChartTooltipContent hideLabel />} />
-            <Area
-              type="monotone"
-              dataKey="price"
-              stroke="var(--color-price)"
-              strokeWidth={2}
-              fill="url(#fillPrice)"
-            />
-          </AreaChart>
-        </ChartContainer>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/syncing-state.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/syncing-state.tsx
deleted file mode 100644
index e2de49252..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/syncing-state.tsx
+++ /dev/null
@@ -1,34 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { Card, CardContent } from "@voidhash/ui";
-import {
-  Empty,
-  EmptyContent,
-  EmptyDescription,
-  EmptyHeader,
-  EmptyMedia,
-  EmptyTitle,
-} from "@voidhash/ui";
-import { Spinner } from "@voidhash/ui/spinner";
-
-export function SyncingState() {
-  return (
-    <Card>
-      <CardContent className="p-0">
-        <Empty className="p-4">
-          <EmptyHeader>
-            <EmptyMedia variant="icon">
-              <Spinner />
-            </EmptyMedia>
-            <EmptyTitle>Syncing your accounts</EmptyTitle>
-            <EmptyDescription>
-              We&apos;re pulling in your latest transactions. This usually takes a few seconds.
-            </EmptyDescription>
-          </EmptyHeader>
-          <EmptyContent>
-            <Button variant="outline">Cancel</Button>
-          </EmptyContent>
-        </Empty>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/transfer-funds.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/transfer-funds.tsx
deleted file mode 100644
index 17ea2f0b5..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/transfer-funds.tsx
+++ /dev/null
@@ -1,107 +0,0 @@
-import { Button } from "@voidhash/ui";
-import {
-  Card,
-  CardAction,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-import { Field, FieldGroup, FieldLabel } from "@voidhash/ui";
-import { InputGroup, InputGroupAddon, InputGroupInput, InputGroupText } from "@voidhash/ui";
-import { Item, ItemContent } from "@voidhash/ui";
-import {
-  Select,
-  SelectContent,
-  SelectGroup,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@voidhash/ui";
-import { Separator } from "@voidhash/ui";
-import { IconPlaceholder } from "../icon-placeholder";
-
-export function TransferFunds() {
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Transfer Funds</CardTitle>
-        <CardDescription>Move money between your connected accounts.</CardDescription>
-        <CardAction>
-          <Button variant="ghost" size="icon-sm" className="bg-muted">
-            <IconPlaceholder
-              lucide="XIcon"
-              tabler="IconX"
-              hugeicons="Cancel01Icon"
-              phosphor="XIcon"
-              remixicon="RiCloseLine"
-            />
-          </Button>
-        </CardAction>
-      </CardHeader>
-      <CardContent>
-        <FieldGroup>
-          <Field>
-            <FieldLabel htmlFor="transfer-amount">Amount to Transfer</FieldLabel>
-            <InputGroup>
-              <InputGroupAddon>
-                <InputGroupText>$</InputGroupText>
-              </InputGroupAddon>
-              <InputGroupInput id="transfer-amount" defaultValue="1,200.00" />
-            </InputGroup>
-          </Field>
-          <Field>
-            <FieldLabel htmlFor="from-account">From Account</FieldLabel>
-            <Select defaultValue="checking">
-              <SelectTrigger id="from-account" className="w-full">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectGroup>
-                  <SelectItem value="checking">Main Checking (··8402) — $12,450.00</SelectItem>
-                  <SelectItem value="business">Business (··7731) — $8,920.00</SelectItem>
-                </SelectGroup>
-              </SelectContent>
-            </Select>
-          </Field>
-          <Field>
-            <FieldLabel htmlFor="to-account">To Account</FieldLabel>
-            <Select defaultValue="savings">
-              <SelectTrigger id="to-account" className="w-full">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectGroup>
-                  <SelectItem value="savings">High Yield Savings (··1192) — $42,100.00</SelectItem>
-                  <SelectItem value="investment">Investment (··3349) — $18,200.00</SelectItem>
-                </SelectGroup>
-              </SelectContent>
-            </Select>
-          </Field>
-          <Item variant="muted" className="flex-col items-stretch">
-            <ItemContent className="gap-3">
-              <div className="flex items-center justify-between">
-                <span className="text-sm text-muted-foreground">Estimated arrival</span>
-                <span className="text-sm font-medium">Today, Apr 14</span>
-              </div>
-              <Separator />
-              <div className="flex items-center justify-between">
-                <span className="text-sm text-muted-foreground">Transaction fee</span>
-                <span className="text-sm font-medium tabular-nums">$0.00</span>
-              </div>
-              <Separator />
-              <div className="flex items-center justify-between">
-                <span className="text-sm font-medium">Total amount</span>
-                <span className="text-sm font-semibold tabular-nums">$1,200.00</span>
-              </div>
-            </ItemContent>
-          </Item>
-        </FieldGroup>
-      </CardContent>
-      <CardFooter>
-        <Button className="w-full">Confirm Transfer</Button>
-      </CardFooter>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/cards/upcoming-payments.tsx b/apps/www/src/features/design/components/docs/component-overview/cards/upcoming-payments.tsx
deleted file mode 100644
index a5d323fb0..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/cards/upcoming-payments.tsx
+++ /dev/null
@@ -1,54 +0,0 @@
-"use client";
-
-import * as React from "react";
-
-import { Badge } from "@voidhash/ui";
-import { Calendar } from "@voidhash/ui";
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@voidhash/ui";
-import { Item, ItemContent, ItemDescription, ItemGroup, ItemTitle } from "@voidhash/ui";
-
-export function UpcomingPayments() {
-  const [date, setDate] = React.useState<Date | undefined>(new Date());
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Upcoming Payments</CardTitle>
-        <CardDescription>Select a date to view scheduled payments.</CardDescription>
-      </CardHeader>
-      <CardContent className="flex flex-col gap-4">
-        <Item variant="outline" className="justify-center">
-          <Calendar
-            mode="single"
-            selected={date}
-            onSelect={setDate}
-            className="w-full [--cell-size:--spacing(8)] md:[--cell-size:--spacing(10)] style-sera:md:[--cell-size:--spacing(9)]"
-          />
-        </Item>
-        <ItemGroup className="w-full">
-          <Item variant="muted">
-            <ItemContent>
-              <ItemTitle>Netflix Subscription</ItemTitle>
-              <ItemDescription>Apr 15, 2024</ItemDescription>
-            </ItemContent>
-            <Badge variant="secondary">$19.99</Badge>
-          </Item>
-          <Item variant="muted">
-            <ItemContent>
-              <ItemTitle>Rent Payment</ItemTitle>
-              <ItemDescription>Apr 1, 2024</ItemDescription>
-            </ItemContent>
-            <Badge variant="secondary">$2,400.00</Badge>
-          </Item>
-          <Item variant="muted">
-            <ItemContent>
-              <ItemTitle>Auto Insurance</ItemTitle>
-              <ItemDescription>Apr 22, 2024</ItemDescription>
-            </ItemContent>
-            <Badge variant="secondary">$186.00</Badge>
-          </Item>
-        </ItemGroup>
-      </CardContent>
-    </Card>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/icon-placeholder.tsx b/apps/www/src/features/design/components/docs/component-overview/icon-placeholder.tsx
deleted file mode 100644
index 6112a5d76..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/icon-placeholder.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-"use client";
-
-import type { ComponentProps, ComponentType } from "react";
-import * as LucideIcons from "lucide-react";
-import { SquareIcon } from "lucide-react";
-
-type IconPlaceholderProps = ComponentProps<"svg"> & {
-  lucide: string;
-  tabler?: string;
-  hugeicons?: string;
-  phosphor?: string;
-  remixicon?: string;
-};
-
-/**
- * Resolves the Lucide icon selected by the Voidhash design system.
- */
-export function IconPlaceholder({
-  lucide,
-  tabler: _tabler,
-  hugeicons: _hugeicons,
-  phosphor: _phosphor,
-  remixicon: _remixicon,
-  ...props
-}: IconPlaceholderProps) {
-  const Icon = LucideIcons[lucide as keyof typeof LucideIcons] as
-    | ComponentType<ComponentProps<"svg">>
-    | undefined;
-
-  return Icon ? <Icon {...props} /> : <SquareIcon {...props} />;
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/index.tsx b/apps/www/src/features/design/components/docs/component-overview/index.tsx
deleted file mode 100644
index 0297eb504..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/index.tsx
+++ /dev/null
@@ -1,100 +0,0 @@
-import { AccountAccess } from "./cards/account-access";
-import { CardOverview } from "./cards/card-overview";
-import { ClaimableBalance } from "./cards/claimable-balance";
-import { ContributionHistory } from "./cards/contribution-history";
-import { CoverArt } from "./cards/cover-art";
-import { DividendIncome } from "./cards/dividend-income";
-import { EmptyConnectBank } from "./cards/empty-connect-bank";
-import { EmptyDistributeTrack } from "./cards/empty-distribute-track";
-import { EmptyExploreCatalog } from "./cards/empty-explore-catalog";
-import { Faq } from "./cards/faq";
-import { FrontDoor } from "./cards/front-door";
-import { IndexInvesting } from "./cards/index-investing";
-import { KitchenIsland } from "./cards/kitchen-island";
-import { LoadingCard } from "./cards/loading-card";
-import { NewMilestone } from "./cards/new-milestone";
-import { NotificationSettings } from "./cards/notification-settings";
-import { Payments } from "./cards/payments";
-import { PayoutThreshold } from "./cards/payout-threshold";
-import { PowerUsage } from "./cards/power-usage";
-import { Preferences } from "./cards/preferences";
-import { ProjectActions } from "./cards/project-actions";
-import { QrConnect } from "./cards/qr-connect";
-import { ReceivingMethod } from "./cards/receiving-method";
-import { RecentTransactions } from "./cards/recent-transactions";
-import { ReleaseCatalog } from "./cards/release-catalog";
-import { RollerShades } from "./cards/roller-shades";
-import { SavingsProgress } from "./cards/savings-progress";
-import { SavingsTargets } from "./cards/savings-targets";
-import { SidebarNav } from "./cards/sidebar-nav";
-import { SocialLinks } from "./cards/social-links";
-import { StockPerformance } from "./cards/stock-performance";
-import { SyncingState } from "./cards/syncing-state";
-import { TransferFunds } from "./cards/transfer-funds";
-import { UpcomingPayments } from "./cards/upcoming-payments";
-
-export default function Preview02Example() {
-  return (
-    <div className="overflow-x-auto overflow-y-hidden bg-muted contain-[paint] [--gap:--spacing(4)] 3xl:[--gap:--spacing(12)] md:[--gap:--spacing(10)] dark:bg-background style-lyra:md:[--gap:--spacing(6)] style-mira:md:[--gap:--spacing(6)]">
-      <div className="flex w-full min-w-max justify-center">
-        <div
-          className="grid w-[2400px] grid-cols-7 items-start gap-(--gap) bg-muted p-(--gap) md:w-[3000px] dark:bg-background style-lyra:md:w-[2600px] style-mira:md:w-[2600px] *:[div]:gap-(--gap)"
-          data-slot="capture-target"
-        >
-          <div className="flex flex-col p-1 [contain-intrinsic-size:380px_1200px] [content-visibility:auto]">
-            <ContributionHistory />
-            <EmptyDistributeTrack />
-            <QrConnect />
-            <DividendIncome />
-            <IndexInvesting />
-            <SyncingState />
-          </div>
-          <div className="flex flex-col p-1 [contain-intrinsic-size:380px_1200px] [content-visibility:auto]">
-            <PayoutThreshold />
-            <ClaimableBalance />
-            <Preferences />
-            <SavingsProgress />
-            <KitchenIsland />
-          </div>
-          <div className="col-span-2 flex flex-col p-1 [contain-intrinsic-size:760px_1200px] [content-visibility:auto]">
-            <SavingsTargets />
-            <ProjectActions />
-            <RecentTransactions />
-            <div className="grid grid-cols-2 items-start gap-(--gap)">
-              <div className="flex flex-col gap-(--gap)">
-                <SidebarNav />
-                <Faq />
-              </div>
-              <div className="flex flex-col gap-(--gap)">
-                <Payments />
-                <FrontDoor />
-              </div>
-            </div>
-            <ReleaseCatalog />
-          </div>
-          <div className="flex flex-col p-1 [contain-intrinsic-size:380px_1200px] [content-visibility:auto]">
-            <AccountAccess />
-            <CardOverview />
-            <TransferFunds />
-            <CoverArt />
-            <LoadingCard />
-          </div>
-          <div className="flex flex-col p-1 [contain-intrinsic-size:380px_1200px] [content-visibility:auto]">
-            <ReceivingMethod />
-            <PowerUsage />
-            <EmptyConnectBank />
-            <UpcomingPayments />
-            <RollerShades />
-          </div>
-          <div className="flex flex-col p-1 [contain-intrinsic-size:380px_1200px] [content-visibility:auto]">
-            <StockPerformance />
-            <EmptyExploreCatalog />
-            <NewMilestone />
-            <SocialLinks />
-            <NotificationSettings />
-          </div>
-        </div>
-      </div>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/docs/component-overview/preview-config.ts b/apps/www/src/features/design/components/docs/component-overview/preview-config.ts
deleted file mode 100644
index 576ec62ae..000000000
--- a/apps/www/src/features/design/components/docs/component-overview/preview-config.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-const previewConfig = {
-  style: "nova",
-} as const;
-
-/**
- * Provides the upstream preview's default style selection.
- */
-export function useDesignSystemSearchParams() {
-  return [previewConfig] as const;
-}
diff --git a/apps/www/src/features/design/components/docs/component-registry.tsx b/apps/www/src/features/design/components/docs/component-registry.tsx
deleted file mode 100644
index 678242302..000000000
--- a/apps/www/src/features/design/components/docs/component-registry.tsx
+++ /dev/null
@@ -1,34 +0,0 @@
-"use client";
-
-// Re-export all UI components from @voidhash/ui for use in MDX
-export * from "@voidhash/ui";
-export { BrandColorScales, SemanticColorTokens } from "./colors";
-export { ComponentOverview } from "./component-overview";
-
-// Export common icons used in examples
-export {
-  AlertCircleIcon,
-  ArrowLeftIcon,
-  ArrowRightIcon,
-  BoldIcon,
-  CalendarIcon,
-  CheckIcon,
-  ChevronDownIcon,
-  ChevronLeftIcon,
-  ChevronRightIcon,
-  ChevronUpIcon,
-  CopyIcon,
-  ItalicIcon,
-  LoaderIcon,
-  MailIcon,
-  MenuIcon,
-  MoonIcon,
-  PlusIcon,
-  SearchIcon,
-  SettingsIcon,
-  SunIcon,
-  TrashIcon,
-  UnderlineIcon,
-  UserIcon,
-  XIcon,
-} from "lucide-react";
diff --git a/apps/www/src/features/design/components/docs/preview.tsx b/apps/www/src/features/design/components/docs/preview.tsx
deleted file mode 100644
index 06a4dc86d..000000000
--- a/apps/www/src/features/design/components/docs/preview.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-"use client";
-
-import { cn } from "@/features/design/lib/cn";
-import type { ReactNode } from "react";
-
-interface PreviewProps {
-  children: ReactNode;
-  className?: string;
-  centered?: boolean;
-}
-
-export function Preview({ children, className, centered = true }: PreviewProps) {
-  return (
-    <div
-      className={cn(
-        "not-prose rounded-lg border bg-background p-6",
-        centered && "flex items-center justify-center",
-        className,
-      )}
-    >
-      {children}
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/layout/docs.tsx b/apps/www/src/features/design/components/layout/docs.tsx
deleted file mode 100644
index 29761cc5e..000000000
--- a/apps/www/src/features/design/components/layout/docs.tsx
+++ /dev/null
@@ -1,227 +0,0 @@
-"use client";
-
-import {
-  Collapsible,
-  CollapsibleContent,
-  CollapsibleTrigger,
-  Sidebar,
-  SidebarContent,
-  SidebarGroup,
-  SidebarGroupContent,
-  SidebarGroupLabel,
-  SidebarInset,
-  SidebarMenu,
-  SidebarMenuButton,
-  SidebarMenuItem,
-  SidebarProvider,
-} from "@voidhash/ui";
-import { Link as FrameworkLink, usePathname } from "fumadocs-core/framework";
-import type * as PageTree from "fumadocs-core/page-tree";
-import { TreeContextProvider, useTreeContext } from "fumadocs-ui/contexts/tree";
-import { ChevronRight } from "lucide-react";
-import { CirclePlay } from "lucide-static";
-import {
-  type ComponentProps,
-  type ComponentType,
-  type ReactElement,
-  type ReactNode,
-  useMemo,
-} from "react";
-
-import { NavBar } from "../nav-bar";
-import { DocsThemeToggle } from "../theme-toggle";
-
-export interface DocsLayoutProps {
-  tree: PageTree.Root;
-  children: ReactNode;
-}
-
-export function DocsLayout({ tree, children }: DocsLayoutProps) {
-  return (
-    <SidebarProvider
-      className="flex flex-col [--header-height:calc(theme(spacing.14))]"
-      defaultOpen={true}
-    >
-      <TreeContextProvider tree={tree}>
-        <NavBar />
-
-        <div className="flex flex-1">
-          <DocsSidebar />
-
-          <SidebarInset className="top-[var(--header-height)] flex-1 transition-all duration-75">
-            <div className="flex w-full">{children}</div>
-          </SidebarInset>
-        </div>
-      </TreeContextProvider>
-    </SidebarProvider>
-  );
-}
-
-function DocsSidebar() {
-  const { root } = useTreeContext();
-  const pathname = usePathname();
-
-  const groups = useMemo(() => {
-    function transformNode(node: PageTree.Node): {
-      icon?: ReactElement;
-      title: string;
-      url: string;
-      isActive?: () => boolean;
-      items?: {
-        title: string;
-        url: string;
-        isActive?: () => boolean;
-      }[];
-    } | null {
-      if (node.type === "page") {
-        return {
-          icon: node.icon as ReactElement,
-          isActive: () => pathname === node.url,
-          title: typeof node.name === "string" ? node.name : String(node.name),
-          url: node.url,
-        };
-      }
-
-      if (node.type === "folder") {
-        const items = node.children
-          .map(transformNode)
-          .filter((item): item is NonNullable<typeof item> => item !== null);
-
-        if (node.index) {
-          return {
-            icon: node.icon as ReactElement,
-            isActive: () => pathname === node.index?.url || items.some((item) => item.isActive?.()),
-            items: items.length > 0 ? items : undefined,
-            title: typeof node.name === "string" ? node.name : String(node.name),
-            url: node.index.url,
-          };
-        }
-
-        if (items.length > 0) {
-          return {
-            icon: node.icon as ReactElement,
-            isActive: () => items.some((item) => item.isActive?.()),
-            items,
-            title: typeof node.name === "string" ? node.name : String(node.name),
-            url: "#",
-          };
-        }
-      }
-
-      return null;
-    }
-
-    const itemsWithDefaultGroup: PageTree.Node[] = [
-      {
-        $id: "get-started",
-        children: root.children.filter((item) => item.type === "page"),
-        icon: CirclePlay as unknown as ReactElement,
-        index: {
-          $id: "index.mdx",
-          $ref: "index.mdx",
-          name: "Index",
-          type: "page",
-          url: "/design",
-        },
-        name: "Get Started",
-        type: "folder",
-      },
-      ...root.children.filter((item) => item.type === "folder"),
-    ];
-
-    return itemsWithDefaultGroup
-      .map(transformNode)
-      .filter((item): item is NonNullable<typeof item> => item !== null);
-  }, [root, pathname]);
-
-  return (
-    <Sidebar className="!top-[var(--header-height)] !h-[calc(100svh-var(--header-height))] fixed min-w-64 border-r bg-background transition-all duration-75">
-      <SidebarContent className="gap-0">
-        <NavMain groups={groups} link={SidebarLink} />
-        <DocsThemeToggle className="mt-2 ml-5 block md:hidden" />
-      </SidebarContent>
-    </Sidebar>
-  );
-}
-
-function SidebarLink(props: ComponentProps<typeof FrameworkLink>) {
-  const href = props.href ?? "#";
-  return <FrameworkLink {...props} href={href} />;
-}
-
-export function NavMain({
-  link: Link,
-  groups,
-}: {
-  link: ComponentType<ComponentProps<"a">> | "a";
-  defaultOpenNested?: boolean;
-  groups: {
-    title: string;
-    icon?: ReactElement;
-    items?: {
-      title: string;
-      url: string;
-      icon?: ReactElement;
-      isActive?: () => boolean;
-      items?: {
-        title: string;
-        url: string;
-        isActive?: () => boolean;
-      }[];
-    }[];
-  }[];
-  tooltips?: "enabled" | "disabled";
-}) {
-  return (
-    <>
-      {groups.map((group) => (
-        <Collapsible
-          className="group/collapsible"
-          defaultOpen
-          key={group.title}
-          title={group.title}
-        >
-          <SidebarGroup className="p-0">
-            <SidebarGroupLabel
-              asChild
-              className="group/label -mt-px rounded-none border-border border-y px-6 py-5 text-sidebar-foreground text-sm hover:bg-sidebar-accent hover:text-sidebar-accent-foreground"
-            >
-              <CollapsibleTrigger className="cursor-pointer">
-                <div
-                  className="*:-ml-0.5 *:mr-2 *:size-4 *:text-muted-foreground"
-                  // biome-ignore lint/security/noDangerouslySetInnerHtml: It is safe - static icon markup
-                  dangerouslySetInnerHTML={{
-                    __html: group.icon as unknown as string,
-                  }}
-                />
-                {group.title}
-                <ChevronRight className="ml-auto size-4 transition-transform group-data-[state=open]/collapsible:rotate-90" />
-              </CollapsibleTrigger>
-            </SidebarGroupLabel>
-            <CollapsibleContent className="pt-1">
-              <SidebarGroupContent className="p-2 pb-[9px]">
-                <SidebarMenu>
-                  {group.items?.map((item) => (
-                    <SidebarMenuItem
-                      className="px-1 font-normal text-muted-foreground"
-                      key={item.title}
-                    >
-                      <SidebarMenuButton asChild isActive={item.isActive?.()}>
-                        <Link
-                          className="px-3 font-normal data-[active=true]:bg-muted data-[active=true]:font-normal data-[active=true]:text-foreground"
-                          href={item.url}
-                        >
-                          {item.title}
-                        </Link>
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                  ))}
-                </SidebarMenu>
-              </SidebarGroupContent>
-            </CollapsibleContent>
-          </SidebarGroup>
-        </Collapsible>
-      ))}
-    </>
-  );
-}
diff --git a/apps/www/src/features/design/components/layout/page.tsx b/apps/www/src/features/design/components/layout/page.tsx
deleted file mode 100644
index 68c401e4b..000000000
--- a/apps/www/src/features/design/components/layout/page.tsx
+++ /dev/null
@@ -1,126 +0,0 @@
-"use client";
-import type * as PageTree from "fumadocs-core/page-tree";
-
-import { Card, CardContent, CardDescription, CardTitle } from "@voidhash/ui";
-import { Link, usePathname } from "fumadocs-core/framework";
-import { useTreeContext } from "fumadocs-ui/contexts/tree";
-import { ChevronLeftIcon, ChevronRightIcon } from "lucide-react";
-import { type ComponentProps, type ReactNode, useMemo } from "react";
-
-import { cn } from "../../lib/cn";
-
-export interface DocsPageProps {
-  children: ReactNode;
-  full?: boolean;
-}
-
-export function DocsPage({ full = false, ...props }: DocsPageProps) {
-  return (
-    <main className="flex w-full min-w-0 flex-col">
-      <article
-        className={cn(
-          "flex w-full flex-1 flex-col gap-6 px-4 py-8 md:mx-auto md:px-6",
-          full ? "max-w-none" : "max-w-[860px]",
-        )}
-      >
-        {props.children}
-        <Footer />
-      </article>
-    </main>
-  );
-}
-
-export function DocsBody(props: ComponentProps<"div">) {
-  return (
-    <div {...props} className={cn("prose ", props.className)}>
-      {props.children}
-    </div>
-  );
-}
-
-export function DocsDescription(props: ComponentProps<"p">) {
-  // don't render if no description provided
-  if (props.children === undefined) {
-    return null;
-  }
-
-  return (
-    <p {...props} className={cn("mt-1 text-muted-foreground", props.className)}>
-      {props.children}
-    </p>
-  );
-}
-
-export function DocsTitle(props: ComponentProps<"h1">) {
-  return (
-    <h1 {...props} className={cn("mt-8 font-semibold text-3xl tracking-right", props.className)}>
-      {props.children}
-    </h1>
-  );
-}
-
-function Footer() {
-  const { root } = useTreeContext();
-  const pathname = usePathname();
-  const flatten = useMemo(() => {
-    const result: PageTree.Item[] = [];
-
-    function scan(items: PageTree.Node[]) {
-      for (const item of items) {
-        if (item.type === "page") {
-          result.push(item);
-        } else if (item.type === "folder") {
-          if (item.index) {
-            result.push(item.index);
-          }
-          scan(item.children);
-        }
-      }
-    }
-
-    scan(root.children);
-    return result;
-  }, [root]);
-
-  const { previous, next } = useMemo(() => {
-    const idx = flatten.findIndex((item) => item.url === pathname);
-
-    if (idx === -1) {
-      return {};
-    }
-    return {
-      next: flatten[idx + 1],
-      previous: flatten[idx - 1],
-    };
-  }, [flatten, pathname]);
-
-  return (
-    <div className="flex flex-row items-center justify-between gap-8">
-      {previous ? (
-        <Link className="flex-1" href={previous.url}>
-          <Card className="rounded-none hover:bg-card">
-            <CardContent>
-              <CardDescription className="mt-1 flex items-center">
-                <ChevronLeftIcon className="-ml-1 mr-1 size-4" /> <span>Previous Page</span>
-              </CardDescription>
-              <CardTitle className="mt-2 font-normal text-md">{previous.name}</CardTitle>
-            </CardContent>
-          </Card>
-        </Link>
-      ) : null}
-      {next ? (
-        <Link className="flex-1" href={next.url}>
-          <Card className="rounded-none hover:bg-card">
-            <CardContent className="flex w-full flex-col items-end">
-              <CardDescription className="mt-1 flex items-center">
-                <span>Next Page</span>
-                <ChevronRightIcon className="-mr-1 ml-1 size-4" />{" "}
-              </CardDescription>
-              <CardTitle className="mt-2 font-normal text-md">{next.name}</CardTitle>
-            </CardContent>
-          </Card>
-        </Link>
-      ) : null}
-    </div>
-  );
-}
diff --git a/apps/www/src/features/design/components/nav-bar.tsx b/apps/www/src/features/design/components/nav-bar.tsx
deleted file mode 100644
index 8160e1b29..000000000
--- a/apps/www/src/features/design/components/nav-bar.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-"use client";
-
-import { Button, CommandShortcut, Logo, cn, useSidebar } from "@voidhash/ui";
-import { useSearchContext } from "fumadocs-ui/contexts/search";
-import { MenuIcon, SearchIcon } from "lucide-react";
-import type { ComponentProps } from "react";
-
-import { DocsThemeToggle } from "./theme-toggle";
-
-function SearchToggle(props: ComponentProps<"button">) {
-  const { enabled, setOpenSearch } = useSearchContext();
-  if (!enabled) {
-    return;
-  }
-
-  return (
-    <button
-      {...props}
-      className={cn(
-        "flex min-w-[200px] items-center gap-2 bg-transparent text-sm md:bg-muted",
-        props.className,
-      )}
-      onClick={() => setOpenSearch(true)}
-    >
-      <SearchIcon className="size-4 cursor-pointer text-muted-foreground " />
-      <span className="mr-4 hidden flex-1 text-left text-muted-foreground md:block">Search...</span>
-      <CommandShortcut className="hidden md:block">⌘K</CommandShortcut>
-    </button>
-  );
-}
-
-export function NavBar() {
-  return (
-    <div className="fixed z-10 flex h-[var(--header-height)] w-full flex-row items-center justify-between border-border border-b bg-background transition-all duration-75">
-      <div className="flex flex-1 items-center justify-between px-4 py-2">
-        <div className="mr-7 flex items-center">
-          <a className="flex items-center gap-3" href="/">
-            <Logo className="ml-2 h-4" color="mono" variant="symbol" />
-            <span className="rounded-md border-border bg-muted p-1 px-2 font-semibold text-foreground text-xs uppercase">
-              Design System
-            </span>
-          </a>
-        </div>
-        <div className="flex items-center gap-2 md:flex-1">
-          <div className="md:flex-1">
-            <SearchToggle className="ml-8 cursor-pointer rounded-lg bg-muted p-2 px-3 hover:bg-accent" />
-          </div>
-          <DocsThemeToggle />
-          <SidebarToggle />
-        </div>
-      </div>
-    </div>
-  );
-}
-
-function SidebarToggle() {
-  const { openMobile, setOpenMobile } = useSidebar();
-  const handleToggle = () => {
-    setOpenMobile(!openMobile);
-  };
-  return (
-    <Button className={cn("md:hidden")} onClick={handleToggle} variant="ghost">
-      <MenuIcon className="size-4" />
-    </Button>
-  );
-}
diff --git a/apps/www/src/features/design/components/theme-toggle.tsx b/apps/www/src/features/design/components/theme-toggle.tsx
deleted file mode 100644
index 87c810b14..000000000
--- a/apps/www/src/features/design/components/theme-toggle.tsx
+++ /dev/null
@@ -1,15 +0,0 @@
-"use client";
-import { ThemeToggle, cn } from "@voidhash/ui";
-import { useTheme } from "next-themes";
-
-export function DocsThemeToggle({ className }: { className?: string }) {
-  const { theme, setTheme } = useTheme();
-
-  return (
-    <ThemeToggle
-      className={cn("hidden md:block", className)}
-      setTheme={setTheme}
-      theme={theme ?? "system"}
-    />
-  );
-}
diff --git a/apps/www/src/features/design/content/docs/components/accordion.mdx b/apps/www/src/features/design/content/docs/components/accordion.mdx
deleted file mode 100644
index 9f384c78f..000000000
--- a/apps/www/src/features/design/content/docs/components/accordion.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-title: Accordion
-description: A vertically stacked set of interactive headings that reveal content.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Accordion type="single" collapsible className="w-full">
-    <AccordionItem value="item-1">
-      <AccordionTrigger>Is it accessible?</AccordionTrigger>
-      <AccordionContent>Yes. It adheres to the WAI-ARIA design pattern.</AccordionContent>
-    </AccordionItem>
-    <AccordionItem value="item-2">
-      <AccordionTrigger>Is it styled?</AccordionTrigger>
-      <AccordionContent>
-        Yes. It comes with default styles that match your design system.
-      </AccordionContent>
-    </AccordionItem>
-    <AccordionItem value="item-3">
-      <AccordionTrigger>Is it animated?</AccordionTrigger>
-      <AccordionContent>
-        Yes. It's animated by default with smooth expand/collapse transitions.
-      </AccordionContent>
-    </AccordionItem>
-  </Accordion>
-</Preview>
-
-```tsx
-import {
-  Accordion,
-  AccordionContent,
-  AccordionItem,
-  AccordionTrigger,
-} from "@voidhash/ui";
-
-<Accordion type="single" collapsible>
-  <AccordionItem value="item-1">
-    <AccordionTrigger>Is it accessible?</AccordionTrigger>
-    <AccordionContent>Yes. It adheres to the WAI-ARIA design pattern.</AccordionContent>
-  </AccordionItem>
-</Accordion>;
-```
-
-## Components
-
-### Accordion
-
-The root container that manages the accordion state.
-
-### AccordionItem
-
-A single collapsible item within the accordion.
-
-### AccordionTrigger
-
-The button that toggles the accordion item's content.
-
-### AccordionContent
-
-The content revealed when the accordion item is expanded.
-
-## Examples
-
-### Multiple Items Open
-
-<Preview centered={false}>
-  <Accordion type="multiple" className="w-full">
-    <AccordionItem value="item-1">
-      <AccordionTrigger>First Item</AccordionTrigger>
-      <AccordionContent>Content for the first item.</AccordionContent>
-    </AccordionItem>
-    <AccordionItem value="item-2">
-      <AccordionTrigger>Second Item</AccordionTrigger>
-      <AccordionContent>Content for the second item.</AccordionContent>
-    </AccordionItem>
-  </Accordion>
-</Preview>
-
-```tsx
-<Accordion type="multiple">
-  <AccordionItem value="item-1">
-    <AccordionTrigger>First Item</AccordionTrigger>
-    <AccordionContent>Content for the first item.</AccordionContent>
-  </AccordionItem>
-  <AccordionItem value="item-2">
-    <AccordionTrigger>Second Item</AccordionTrigger>
-    <AccordionContent>Content for the second item.</AccordionContent>
-  </AccordionItem>
-</Accordion>
-```
-
-## Props
-
-### Accordion Props
-
-<TypeTable
-  type={{
-    type: {
-      description: "Whether single or multiple items can be opened",
-      type: "'single' | 'multiple'",
-      default: "Required",
-    },
-    collapsible: {
-      description: "Allow closing all items (only for type='single')",
-      type: "boolean",
-      default: "false",
-    },
-    defaultValue: {
-      description: "Default expanded item(s)",
-      type: "string | string[]",
-      default: "undefined",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/alert-dialog.mdx b/apps/www/src/features/design/content/docs/components/alert-dialog.mdx
deleted file mode 100644
index 045d41615..000000000
--- a/apps/www/src/features/design/content/docs/components/alert-dialog.mdx
+++ /dev/null
@@ -1,119 +0,0 @@
----
-title: Alert Dialog
-description: A modal dialog that interrupts the user with important content and expects a response.
----
-
-## Usage
-
-<Preview>
-  <AlertDialog>
-    <AlertDialogTrigger asChild>
-      <Button variant="outline">Delete Account</Button>
-    </AlertDialogTrigger>
-    <AlertDialogContent>
-      <AlertDialogHeader>
-        <AlertDialogTitle>Are you absolutely sure?</AlertDialogTitle>
-        <AlertDialogDescription>
-          This action cannot be undone. This will permanently delete your account and remove your
-          data from our servers.
-        </AlertDialogDescription>
-      </AlertDialogHeader>
-      <AlertDialogFooter>
-        <AlertDialogCancel>Cancel</AlertDialogCancel>
-        <AlertDialogAction>Continue</AlertDialogAction>
-      </AlertDialogFooter>
-    </AlertDialogContent>
-  </AlertDialog>
-</Preview>
-
-```tsx
-import {
-  AlertDialog,
-  AlertDialogAction,
-  AlertDialogCancel,
-  AlertDialogContent,
-  AlertDialogDescription,
-  AlertDialogFooter,
-  AlertDialogHeader,
-  AlertDialogTitle,
-  AlertDialogTrigger,
-} from "@voidhash/ui";
-
-<AlertDialog>
-  <AlertDialogTrigger asChild>
-    <Button variant="outline">Delete Account</Button>
-  </AlertDialogTrigger>
-  <AlertDialogContent>
-    <AlertDialogHeader>
-      <AlertDialogTitle>Are you absolutely sure?</AlertDialogTitle>
-      <AlertDialogDescription>This action cannot be undone.</AlertDialogDescription>
-    </AlertDialogHeader>
-    <AlertDialogFooter>
-      <AlertDialogCancel>Cancel</AlertDialogCancel>
-      <AlertDialogAction>Continue</AlertDialogAction>
-    </AlertDialogFooter>
-  </AlertDialogContent>
-</AlertDialog>;
-```
-
-## Components
-
-### AlertDialog
-
-The root component that manages dialog state.
-
-### AlertDialogTrigger
-
-The element that opens the dialog.
-
-### AlertDialogContent
-
-The modal content container with overlay.
-
-### AlertDialogHeader
-
-Container for title and description.
-
-### AlertDialogTitle
-
-The title of the alert dialog.
-
-### AlertDialogDescription
-
-A description of the alert dialog's purpose.
-
-### AlertDialogFooter
-
-Container for action buttons.
-
-### AlertDialogAction
-
-The primary action button (styled as default button).
-
-### AlertDialogCancel
-
-The cancel button (styled as outline button).
-
-## Props
-
-### AlertDialog Props
-
-<TypeTable
-  type={{
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-    defaultOpen: {
-      description: "Initial open state for uncontrolled usage",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/alert.mdx b/apps/www/src/features/design/content/docs/components/alert.mdx
deleted file mode 100644
index f3bb020d9..000000000
--- a/apps/www/src/features/design/content/docs/components/alert.mdx
+++ /dev/null
@@ -1,85 +0,0 @@
----
-title: Alert
-description: Displays a callout for user attention with different severity levels.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Alert>
-    <AlertCircleIcon />
-    <AlertTitle>Heads up!</AlertTitle>
-    <AlertDescription>You can add components to your app using the CLI.</AlertDescription>
-  </Alert>
-</Preview>
-
-```tsx
-import { Alert, AlertDescription, AlertTitle } from "@voidhash/ui";
-import { AlertCircleIcon } from "lucide-react";
-
-<Alert>
-  <AlertCircleIcon />
-  <AlertTitle>Heads up!</AlertTitle>
-  <AlertDescription>You can add components to your app using the CLI.</AlertDescription>
-</Alert>;
-```
-
-## Variants
-
-<div className="grid gap-4">
-  <Preview centered={false}>
-    <Alert variant="default">
-      <AlertCircleIcon />
-      <AlertTitle>Default</AlertTitle>
-      <AlertDescription>This is a default alert.</AlertDescription>
-    </Alert>
-  </Preview>
-  <Preview centered={false}>
-    <Alert variant="success">
-      <CheckIcon />
-      <AlertTitle>Success</AlertTitle>
-      <AlertDescription>Your changes have been saved.</AlertDescription>
-    </Alert>
-  </Preview>
-  <Preview centered={false}>
-    <Alert variant="destructive">
-      <XIcon />
-      <AlertTitle>Error</AlertTitle>
-      <AlertDescription>Something went wrong.</AlertDescription>
-    </Alert>
-  </Preview>
-</div>
-
-```tsx
-<Alert variant="default">...</Alert>
-<Alert variant="success">...</Alert>
-<Alert variant="destructive">...</Alert>
-```
-
-## Components
-
-### Alert
-
-The main container component with variant styling.
-
-### AlertTitle
-
-The title of the alert message.
-
-### AlertDescription
-
-The description or body text of the alert.
-
-## Props
-
-### Alert Props
-
-<TypeTable
-  type={{
-    variant: {
-      description: "The visual style of the alert",
-      type: "'default' | 'success' | 'destructive'",
-      default: "'default'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/avatar.mdx b/apps/www/src/features/design/content/docs/components/avatar.mdx
deleted file mode 100644
index 353d2d3eb..000000000
--- a/apps/www/src/features/design/content/docs/components/avatar.mdx
+++ /dev/null
@@ -1,110 +0,0 @@
----
-title: Avatar
-description: An image element with a fallback for representing the user.
----
-
-## Usage
-
-<Preview>
-  <Avatar>
-    <AvatarImage src="https://github.com/shadcn.png" alt="@shadcn" />
-    <AvatarFallback>CN</AvatarFallback>
-  </Avatar>
-</Preview>
-
-```tsx
-import { Avatar, AvatarFallback, AvatarImage } from "@voidhash/ui";
-
-<Avatar>
-  <AvatarImage src="https://github.com/shadcn.png" alt="@shadcn" />
-  <AvatarFallback>CN</AvatarFallback>
-</Avatar>;
-```
-
-## Components
-
-### Avatar
-
-The root container that wraps the image and fallback.
-
-### AvatarImage
-
-The image element that displays the user's avatar.
-
-### AvatarFallback
-
-A fallback element shown when the image fails to load.
-
-## Examples
-
-### With Fallback
-
-<Preview>
-  <Avatar>
-    <AvatarImage src="/broken-image.jpg" alt="User" />
-    <AvatarFallback>JD</AvatarFallback>
-  </Avatar>
-</Preview>
-
-```tsx
-<Avatar>
-  <AvatarImage src="/broken-image.jpg" alt="User" />
-  <AvatarFallback>JD</AvatarFallback>
-</Avatar>
-```
-
-### Different Sizes
-
-<Preview>
-  <div className="flex items-center gap-4">
-    <Avatar className="size-6">
-      <AvatarImage src="https://github.com/shadcn.png" />
-      <AvatarFallback>S</AvatarFallback>
-    </Avatar>
-    <Avatar className="size-8">
-      <AvatarImage src="https://github.com/shadcn.png" />
-      <AvatarFallback>M</AvatarFallback>
-    </Avatar>
-    <Avatar className="size-12">
-      <AvatarImage src="https://github.com/shadcn.png" />
-      <AvatarFallback>L</AvatarFallback>
-    </Avatar>
-  </div>
-</Preview>
-
-```tsx
-<Avatar className="size-6">...</Avatar>
-<Avatar className="size-8">...</Avatar>
-<Avatar className="size-12">...</Avatar>
-```
-
-## Props
-
-### Avatar Props
-
-<TypeTable
-  type={{
-    className: {
-      description: "Additional CSS classes for sizing",
-      type: "string",
-      default: "size-8",
-    },
-  }}
-/>
-
-### AvatarImage Props
-
-<TypeTable
-  type={{
-    src: {
-      description: "The image source URL",
-      type: "string",
-      default: "Required",
-    },
-    alt: {
-      description: "Alternative text for the image",
-      type: "string",
-      default: "undefined",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/badge.mdx b/apps/www/src/features/design/content/docs/components/badge.mdx
deleted file mode 100644
index dfae9b3cf..000000000
--- a/apps/www/src/features/design/content/docs/components/badge.mdx
+++ /dev/null
@@ -1,89 +0,0 @@
----
-title: Badge
-description: Displays a small label or indicator for status, categories, or counts.
----
-
-## Usage
-
-<Preview>
-  <Badge>Badge</Badge>
-</Preview>
-
-```tsx
-import { Badge } from "@voidhash/ui";
-
-<Badge>Badge</Badge>;
-```
-
-## Variants
-
-<div className="flex flex-wrap gap-4">
-  <Preview className="p-4">
-    <Badge variant="default">Default</Badge>
-  </Preview>
-  <Preview className="p-4">
-    <Badge variant="secondary">Secondary</Badge>
-  </Preview>
-  <Preview className="p-4">
-    <Badge variant="destructive">Destructive</Badge>
-  </Preview>
-  <Preview className="p-4">
-    <Badge variant="outline">Outline</Badge>
-  </Preview>
-</div>
-
-```tsx
-<Badge variant="default">Default</Badge>
-<Badge variant="secondary">Secondary</Badge>
-<Badge variant="destructive">Destructive</Badge>
-<Badge variant="outline">Outline</Badge>
-```
-
-## Examples
-
-### With Icon
-
-<Preview>
-  <Badge>
-    <CheckIcon /> Verified
-  </Badge>
-</Preview>
-
-```tsx
-<Badge>
-  <CheckIcon /> Verified
-</Badge>
-```
-
-### As Link
-
-Use the `asChild` prop to render the badge as a link:
-
-<Preview>
-  <Badge asChild>
-    <a href="#">Clickable Badge</a>
-  </Badge>
-</Preview>
-
-```tsx
-<Badge asChild>
-  <a href="/category">Category</a>
-</Badge>
-```
-
-## Props
-
-<TypeTable
-  type={{
-    variant: {
-      description: "The visual style of the badge",
-      type: "'default' | 'secondary' | 'destructive' | 'outline'",
-      default: "'default'",
-    },
-    asChild: {
-      description: "Render as a child element using Radix Slot",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/breadcrumb.mdx b/apps/www/src/features/design/content/docs/components/breadcrumb.mdx
deleted file mode 100644
index 497641d38..000000000
--- a/apps/www/src/features/design/content/docs/components/breadcrumb.mdx
+++ /dev/null
@@ -1,132 +0,0 @@
----
-title: Breadcrumb
-description: Displays the path to the current resource using a hierarchy of links.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Breadcrumb>
-    <BreadcrumbList>
-      <BreadcrumbItem>
-        <BreadcrumbLink href="/">Home</BreadcrumbLink>
-      </BreadcrumbItem>
-      <BreadcrumbSeparator />
-      <BreadcrumbItem>
-        <BreadcrumbLink href="/components">Components</BreadcrumbLink>
-      </BreadcrumbItem>
-      <BreadcrumbSeparator />
-      <BreadcrumbItem>
-        <BreadcrumbPage>Breadcrumb</BreadcrumbPage>
-      </BreadcrumbItem>
-    </BreadcrumbList>
-  </Breadcrumb>
-</Preview>
-
-```tsx
-import {
-  Breadcrumb,
-  BreadcrumbItem,
-  BreadcrumbLink,
-  BreadcrumbList,
-  BreadcrumbPage,
-  BreadcrumbSeparator,
-} from "@voidhash/ui";
-
-<Breadcrumb>
-  <BreadcrumbList>
-    <BreadcrumbItem>
-      <BreadcrumbLink href="/">Home</BreadcrumbLink>
-    </BreadcrumbItem>
-    <BreadcrumbSeparator />
-    <BreadcrumbItem>
-      <BreadcrumbLink href="/components">Components</BreadcrumbLink>
-    </BreadcrumbItem>
-    <BreadcrumbSeparator />
-    <BreadcrumbItem>
-      <BreadcrumbPage>Breadcrumb</BreadcrumbPage>
-    </BreadcrumbItem>
-  </BreadcrumbList>
-</Breadcrumb>;
-```
-
-## Components
-
-### Breadcrumb
-
-The root navigation element.
-
-### BreadcrumbList
-
-The ordered list container for breadcrumb items.
-
-### BreadcrumbItem
-
-A single item in the breadcrumb trail.
-
-### BreadcrumbLink
-
-A clickable link within a breadcrumb item.
-
-### BreadcrumbPage
-
-The current page indicator (non-clickable).
-
-### BreadcrumbSeparator
-
-The separator between breadcrumb items (default: chevron).
-
-### BreadcrumbEllipsis
-
-An ellipsis indicator for collapsed breadcrumb items.
-
-## Examples
-
-### With Ellipsis
-
-<Preview centered={false}>
-  <Breadcrumb>
-    <BreadcrumbList>
-      <BreadcrumbItem>
-        <BreadcrumbLink href="/">Home</BreadcrumbLink>
-      </BreadcrumbItem>
-      <BreadcrumbSeparator />
-      <BreadcrumbItem>
-        <BreadcrumbEllipsis />
-      </BreadcrumbItem>
-      <BreadcrumbSeparator />
-      <BreadcrumbItem>
-        <BreadcrumbLink href="/docs">Documentation</BreadcrumbLink>
-      </BreadcrumbItem>
-      <BreadcrumbSeparator />
-      <BreadcrumbItem>
-        <BreadcrumbPage>Current</BreadcrumbPage>
-      </BreadcrumbItem>
-    </BreadcrumbList>
-  </Breadcrumb>
-</Preview>
-
-```tsx
-<BreadcrumbItem>
-  <BreadcrumbEllipsis />
-</BreadcrumbItem>
-```
-
-## Props
-
-### BreadcrumbLink Props
-
-<TypeTable
-  type={{
-    href: {
-      description: "The URL to navigate to",
-      type: "string",
-      default: "undefined",
-    },
-    asChild: {
-      description: "Render as child element",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/button.mdx b/apps/www/src/features/design/content/docs/components/button.mdx
deleted file mode 100644
index cf71e6dfc..000000000
--- a/apps/www/src/features/design/content/docs/components/button.mdx
+++ /dev/null
@@ -1,184 +0,0 @@
----
-title: Button
-description: A versatile button component with multiple variants and sizes.
----
-
-## Usage
-
-<Preview>
-  <Button>Click me</Button>
-</Preview>
-
-```tsx
-import { Button } from "@voidhash/ui";
-
-<Button>Click me</Button>;
-```
-
-## Variants
-
-The Button component supports the following visual variants:
-
-<div className="grid grid-cols-2 md:grid-cols-4 gap-4">
-  <Preview className="p-4">
-    <Button variant="default">Default</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button variant="destructive">Destructive</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button variant="success">Success</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button variant="outline">Outline</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button variant="ghost">Ghost</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button variant="link">Link</Button>
-  </Preview>
-</div>
-
-```tsx
-<Button variant="default">Default</Button>
-<Button variant="destructive">Destructive</Button>
-<Button variant="success">Success</Button>
-<Button variant="outline">Outline</Button>
-<Button variant="ghost">Ghost</Button>
-<Button variant="link">Link</Button>
-```
-
-## Sizes
-
-<div className="flex flex-wrap items-center gap-4">
-  <Preview className="p-4">
-    <Button size="sm">Small</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button size="default">Default</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button size="lg">Large</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button size="icon">
-      <PlusIcon />
-    </Button>
-  </Preview>
-</div>
-
-```tsx
-<Button size="sm">Small</Button>
-<Button size="default">Default</Button>
-<Button size="lg">Large</Button>
-<Button size="icon"><PlusIcon /></Button>
-```
-
-## Examples
-
-### With Icon
-
-<Preview>
-  <Button>
-    <MailIcon /> Login with Email
-  </Button>
-</Preview>
-
-```tsx
-<Button>
-  <MailIcon /> Login with Email
-</Button>
-```
-
-### Disabled State
-
-<Preview>
-  <Button disabled>Disabled</Button>
-</Preview>
-
-```tsx
-<Button disabled>Disabled</Button>
-```
-
-### Loading State
-
-Use the `loading` prop to show a spinner and disable the button:
-
-<Preview>
-  <Button loading>Loading</Button>
-</Preview>
-
-```tsx
-<Button loading>Loading</Button>
-```
-
-<div className="flex flex-wrap items-center gap-4">
-  <Preview className="p-4">
-    <Button loading>Saving...</Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button variant="ghost" loading>
-      Processing
-    </Button>
-  </Preview>
-  <Preview className="p-4">
-    <Button variant="outline" loading>
-      Loading
-    </Button>
-  </Preview>
-</div>
-
-```tsx
-<Button loading>Saving...</Button>
-<Button variant="ghost" loading>Processing</Button>
-<Button variant="outline" loading>Loading</Button>
-```
-
-### As Link
-
-Use the `asChild` prop to render the button as a child element, like a link:
-
-<Preview>
-  <Button asChild>
-    <a href="#">Link Button</a>
-  </Button>
-</Preview>
-
-```tsx
-<Button asChild>
-  <a href="/dashboard">Go to Dashboard</a>
-</Button>
-```
-
-## Props
-
-<TypeTable
-  type={{
-    variant: {
-      description: "The visual style of the button",
-      type: "'default' | 'destructive' | 'success' | 'outline' | 'ghost' | 'link'",
-      default: "'default'",
-    },
-    size: {
-      description: "The size of the button",
-      type: "'default' | 'sm' | 'lg' | 'icon'",
-      default: "'default'",
-    },
-    asChild: {
-      description: "Render as a child element using Radix Slot",
-      type: "boolean",
-      default: "false",
-    },
-    disabled: {
-      description: "Whether the button is disabled",
-      type: "boolean",
-      default: "false",
-    },
-    loading: {
-      description: "Whether the button is in a loading state (shows spinner and disables button)",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/calendar.mdx b/apps/www/src/features/design/content/docs/components/calendar.mdx
deleted file mode 100644
index 264279b4a..000000000
--- a/apps/www/src/features/design/content/docs/components/calendar.mdx
+++ /dev/null
@@ -1,93 +0,0 @@
----
-title: Calendar
-description: A date picker component for selecting dates.
----
-
-## Usage
-
-<Preview>
-  <Calendar mode="single" className="rounded-md border" />
-</Preview>
-
-```tsx
-import { Calendar } from "@voidhash/ui";
-
-<Calendar mode="single" />;
-```
-
-## Examples
-
-### Single Date Selection
-
-<Preview>
-  <Calendar mode="single" className="rounded-md border" />
-</Preview>
-
-```tsx
-const [date, setDate] = useState<Date | undefined>(new Date());
-
-<Calendar mode="single" selected={date} onSelect={setDate} />;
-```
-
-### Range Selection
-
-<Preview>
-  <Calendar mode="range" numberOfMonths={2} className="rounded-md border" />
-</Preview>
-
-```tsx
-<Calendar mode="range" numberOfMonths={2} selected={dateRange} onSelect={setDateRange} />
-```
-
-### Multiple Months
-
-<Preview>
-  <Calendar mode="single" numberOfMonths={2} className="rounded-md border" />
-</Preview>
-
-```tsx
-<Calendar mode="single" numberOfMonths={2} />
-```
-
-### Disabled Dates
-
-```tsx
-<Calendar mode="single" disabled={(date) => date < new Date()} />
-```
-
-## Props
-
-<TypeTable
-  type={{
-    mode: {
-      description: "Selection mode",
-      type: "'single' | 'range' | 'multiple'",
-      default: "'single'",
-    },
-    selected: {
-      description: "Selected date(s)",
-      type: "Date | DateRange | Date[]",
-      default: "undefined",
-    },
-    onSelect: {
-      description: "Callback when selection changes",
-      type: "(date: Date | DateRange | Date[]) => void",
-      default: "undefined",
-    },
-    numberOfMonths: {
-      description: "Number of months to display",
-      type: "number",
-      default: "1",
-    },
-    disabled: {
-      description: "Disable specific dates",
-      type: "Matcher | Matcher[]",
-      default: "undefined",
-    },
-    defaultMonth: {
-      description: "Initial month to display",
-      type: "Date",
-      default: "new Date()",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/card.mdx b/apps/www/src/features/design/content/docs/components/card.mdx
deleted file mode 100644
index 5b6d9720d..000000000
--- a/apps/www/src/features/design/content/docs/components/card.mdx
+++ /dev/null
@@ -1,153 +0,0 @@
----
-title: Card
-description: A container component for grouping related content and actions.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Card className="w-full max-w-md">
-    <CardHeader>
-      <CardTitle>Card Title</CardTitle>
-      <CardDescription>Card description with additional context.</CardDescription>
-    </CardHeader>
-    <CardContent>
-      <p>Card content goes here. This can contain any content you need.</p>
-    </CardContent>
-    <CardFooter>
-      <Button>Action</Button>
-    </CardFooter>
-  </Card>
-</Preview>
-
-```tsx
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardFooter,
-  CardHeader,
-  CardTitle,
-} from "@voidhash/ui";
-
-<Card>
-  <CardHeader>
-    <CardTitle>Card Title</CardTitle>
-    <CardDescription>Card description.</CardDescription>
-  </CardHeader>
-  <CardContent>
-    <p>Card content goes here.</p>
-  </CardContent>
-  <CardFooter>
-    <Button>Action</Button>
-  </CardFooter>
-</Card>;
-```
-
-## Components
-
-### Card
-
-The main container with optional variant styling.
-
-### CardHeader
-
-Container for title, description, and optional action.
-
-### CardTitle
-
-The card's heading text.
-
-### CardDescription
-
-Secondary text describing the card's purpose.
-
-### CardAction
-
-An action element positioned in the header.
-
-### CardContent
-
-The main content area of the card.
-
-### CardFooter
-
-Container for action buttons at the bottom.
-
-## Variants
-
-<div className="grid gap-4">
-  <Preview centered={false}>
-    <Card variant="default" className="w-full max-w-md">
-      <CardHeader>
-        <CardTitle>Default Card</CardTitle>
-        <CardDescription>Standard card styling.</CardDescription>
-      </CardHeader>
-      <CardContent>Default variant content.</CardContent>
-    </Card>
-  </Preview>
-  <Preview centered={false}>
-    <Card variant="destructive" className="w-full max-w-md">
-      <CardHeader>
-        <CardTitle>Destructive Card</CardTitle>
-        <CardDescription>Card with destructive border.</CardDescription>
-      </CardHeader>
-      <CardContent>Destructive variant content.</CardContent>
-    </Card>
-  </Preview>
-</div>
-
-```tsx
-<Card variant="default">...</Card>
-<Card variant="destructive">...</Card>
-```
-
-## Examples
-
-### With Action Button
-
-<Preview centered={false}>
-  <Card className="w-full max-w-md">
-    <CardHeader>
-      <CardTitle>Settings</CardTitle>
-      <CardDescription>Manage your account settings.</CardDescription>
-      <CardAction>
-        <Button variant="outline" size="sm">
-          Edit
-        </Button>
-      </CardAction>
-    </CardHeader>
-    <CardContent>
-      <p>Your current settings are displayed here.</p>
-    </CardContent>
-  </Card>
-</Preview>
-
-```tsx
-<Card>
-  <CardHeader>
-    <CardTitle>Settings</CardTitle>
-    <CardDescription>Manage your account settings.</CardDescription>
-    <CardAction>
-      <Button variant="outline" size="sm">
-        Edit
-      </Button>
-    </CardAction>
-  </CardHeader>
-  <CardContent>...</CardContent>
-</Card>
-```
-
-## Props
-
-### Card Props
-
-<TypeTable
-  type={{
-    variant: {
-      description: "The visual style of the card",
-      type: "'default' | 'destructive'",
-      default: "'default'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/carousel.mdx b/apps/www/src/features/design/content/docs/components/carousel.mdx
deleted file mode 100644
index efa44ca04..000000000
--- a/apps/www/src/features/design/content/docs/components/carousel.mdx
+++ /dev/null
@@ -1,126 +0,0 @@
----
-title: Carousel
-description: A slideshow component for cycling through elements.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Carousel className="w-full max-w-sm">
-    <CarouselContent>
-      {Array.from({ length: 5 }).map((_, index) => (
-        <CarouselItem key={index}>
-          <Card>
-            <CardContent className="flex aspect-square items-center justify-center p-6">
-              <span className="text-4xl font-semibold">{index + 1}</span>
-            </CardContent>
-          </Card>
-        </CarouselItem>
-      ))}
-    </CarouselContent>
-    <CarouselPrevious />
-    <CarouselNext />
-  </Carousel>
-</Preview>
-
-```tsx
-import {
-  Carousel,
-  CarouselContent,
-  CarouselItem,
-  CarouselNext,
-  CarouselPrevious,
-} from "@voidhash/ui";
-
-<Carousel>
-  <CarouselContent>
-    <CarouselItem>Slide 1</CarouselItem>
-    <CarouselItem>Slide 2</CarouselItem>
-    <CarouselItem>Slide 3</CarouselItem>
-  </CarouselContent>
-  <CarouselPrevious />
-  <CarouselNext />
-</Carousel>;
-```
-
-## Components
-
-### Carousel
-
-The root container with carousel state.
-
-### CarouselContent
-
-The scrollable container for items.
-
-### CarouselItem
-
-A single slide in the carousel.
-
-### CarouselPrevious
-
-Button to go to the previous slide.
-
-### CarouselNext
-
-Button to go to the next slide.
-
-## Examples
-
-### Multiple Items Per View
-
-<Preview centered={false}>
-  <Carousel className="w-full max-w-md">
-    <CarouselContent className="-ml-4">
-      {Array.from({ length: 5 }).map((_, index) => (
-        <CarouselItem key={index} className="basis-1/3 pl-4">
-          <Card>
-            <CardContent className="flex aspect-square items-center justify-center p-6">
-              <span className="text-2xl font-semibold">{index + 1}</span>
-            </CardContent>
-          </Card>
-        </CarouselItem>
-      ))}
-    </CarouselContent>
-    <CarouselPrevious />
-    <CarouselNext />
-  </Carousel>
-</Preview>
-
-```tsx
-<CarouselItem className="basis-1/3">...</CarouselItem>
-```
-
-### Vertical Orientation
-
-```tsx
-<Carousel orientation="vertical">
-  <CarouselContent className="h-[200px]">
-    <CarouselItem>...</CarouselItem>
-  </CarouselContent>
-</Carousel>
-```
-
-## Props
-
-### Carousel Props
-
-<TypeTable
-  type={{
-    orientation: {
-      description: "Scroll orientation",
-      type: "'horizontal' | 'vertical'",
-      default: "'horizontal'",
-    },
-    opts: {
-      description: "Embla Carousel options",
-      type: "EmblaOptionsType",
-      default: "{}",
-    },
-    setApi: {
-      description: "Callback to receive carousel API",
-      type: "(api: EmblaCarouselType) => void",
-      default: "undefined",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/chart.mdx b/apps/www/src/features/design/content/docs/components/chart.mdx
deleted file mode 100644
index 0b30dcc3f..000000000
--- a/apps/www/src/features/design/content/docs/components/chart.mdx
+++ /dev/null
@@ -1,138 +0,0 @@
----
-title: Chart
-description: A wrapper around Recharts for consistent chart styling.
----
-
-## Usage
-
-The Chart components provide a styled wrapper around Recharts library.
-
-```tsx
-import {
-  ChartContainer,
-  ChartTooltip,
-  ChartTooltipContent,
-  ChartLegend,
-  ChartLegendContent,
-} from "@voidhash/ui";
-import { Bar, BarChart, XAxis, YAxis } from "recharts";
-
-const chartConfig = {
-  desktop: {
-    label: "Desktop",
-    color: "hsl(var(--chart-1))",
-  },
-  mobile: {
-    label: "Mobile",
-    color: "hsl(var(--chart-2))",
-  },
-};
-
-const data = [
-  { month: "January", desktop: 186, mobile: 80 },
-  { month: "February", desktop: 305, mobile: 200 },
-  { month: "March", desktop: 237, mobile: 120 },
-];
-
-<ChartContainer config={chartConfig} className="h-[300px]">
-  <BarChart data={data}>
-    <XAxis dataKey="month" />
-    <YAxis />
-    <ChartTooltip content={<ChartTooltipContent />} />
-    <ChartLegend content={<ChartLegendContent />} />
-    <Bar dataKey="desktop" fill="var(--color-desktop)" />
-    <Bar dataKey="mobile" fill="var(--color-mobile)" />
-  </BarChart>
-</ChartContainer>;
-```
-
-## Components
-
-### ChartContainer
-
-The main wrapper that provides chart configuration and styling.
-
-### ChartTooltip
-
-A styled tooltip for displaying data on hover.
-
-### ChartTooltipContent
-
-The content rendered inside the tooltip.
-
-### ChartLegend
-
-A legend component for the chart.
-
-### ChartLegendContent
-
-The content rendered inside the legend.
-
-## Configuration
-
-Define a chart config object to map data keys to labels and colors:
-
-```tsx
-const chartConfig = {
-  revenue: {
-    label: "Revenue",
-    color: "hsl(var(--chart-1))",
-  },
-  expenses: {
-    label: "Expenses",
-    color: "hsl(var(--chart-2))",
-  },
-};
-```
-
-## Available Chart Types
-
-You can use any Recharts chart type:
-
-- AreaChart
-- BarChart
-- LineChart
-- PieChart
-- RadarChart
-- RadialBarChart
-
-## Props
-
-### ChartContainer Props
-
-<TypeTable
-  type={{
-    config: {
-      description: "Chart configuration object",
-      type: "ChartConfig",
-      default: "Required",
-    },
-    className: {
-      description: "CSS classes for sizing",
-      type: "string",
-      default: "undefined",
-    },
-  }}
-/>
-
-### ChartTooltipContent Props
-
-<TypeTable
-  type={{
-    hideLabel: {
-      description: "Hide the label in tooltip",
-      type: "boolean",
-      default: "false",
-    },
-    hideIndicator: {
-      description: "Hide the color indicator",
-      type: "boolean",
-      default: "false",
-    },
-    indicator: {
-      description: "Indicator style",
-      type: "'line' | 'dot' | 'dashed'",
-      default: "'dot'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/checkbox.mdx b/apps/www/src/features/design/content/docs/components/checkbox.mdx
deleted file mode 100644
index 909059860..000000000
--- a/apps/www/src/features/design/content/docs/components/checkbox.mdx
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: Checkbox
-description: A control that allows the user to toggle between checked and not checked.
----
-
-## Usage
-
-<Preview>
-  <div className="flex items-center gap-2">
-    <Checkbox id="terms" />
-    <Label htmlFor="terms">Accept terms and conditions</Label>
-  </div>
-</Preview>
-
-```tsx
-import { Checkbox } from "@voidhash/ui";
-import { Label } from "@voidhash/ui";
-
-<div className="flex items-center gap-2">
-  <Checkbox id="terms" />
-  <Label htmlFor="terms">Accept terms and conditions</Label>
-</div>;
-```
-
-## Examples
-
-### Checked by Default
-
-<Preview>
-  <div className="flex items-center gap-2">
-    <Checkbox id="default-checked" defaultChecked />
-    <Label htmlFor="default-checked">Checked by default</Label>
-  </div>
-</Preview>
-
-```tsx
-<Checkbox defaultChecked />
-```
-
-### Disabled
-
-<Preview>
-  <div className="flex flex-col gap-4">
-    <div className="flex items-center gap-2">
-      <Checkbox id="disabled" disabled />
-      <Label htmlFor="disabled">Disabled unchecked</Label>
-    </div>
-    <div className="flex items-center gap-2">
-      <Checkbox id="disabled-checked" disabled defaultChecked />
-      <Label htmlFor="disabled-checked">Disabled checked</Label>
-    </div>
-  </div>
-</Preview>
-
-```tsx
-<Checkbox disabled />
-<Checkbox disabled defaultChecked />
-```
-
-### With Form
-
-<Preview centered={false}>
-  <div className="grid gap-4">
-    <div className="flex items-center gap-2">
-      <Checkbox id="newsletter" />
-      <Label htmlFor="newsletter">Subscribe to newsletter</Label>
-    </div>
-    <div className="flex items-center gap-2">
-      <Checkbox id="marketing" />
-      <Label htmlFor="marketing">Receive marketing emails</Label>
-    </div>
-  </div>
-</Preview>
-
-## Props
-
-<TypeTable
-  type={{
-    checked: {
-      description: "Controlled checked state",
-      type: "boolean | 'indeterminate'",
-      default: "undefined",
-    },
-    defaultChecked: {
-      description: "Initial checked state",
-      type: "boolean",
-      default: "false",
-    },
-    onCheckedChange: {
-      description: "Callback when checked state changes",
-      type: "(checked: boolean | 'indeterminate') => void",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the checkbox is disabled",
-      type: "boolean",
-      default: "false",
-    },
-    required: {
-      description: "Whether the checkbox is required",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/collapsible.mdx b/apps/www/src/features/design/content/docs/components/collapsible.mdx
deleted file mode 100644
index fb3bbca1e..000000000
--- a/apps/www/src/features/design/content/docs/components/collapsible.mdx
+++ /dev/null
@@ -1,101 +0,0 @@
----
-title: Collapsible
-description: An interactive component that expands and collapses content.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Collapsible className="w-full max-w-md space-y-2">
-    <div className="flex items-center justify-between space-x-4 px-4">
-      <h4 className="text-sm font-semibold">@peduarte starred 3 repositories</h4>
-      <CollapsibleTrigger asChild>
-        <Button variant="ghost" size="sm">
-          <ChevronDownIcon className="h-4 w-4" />
-          <span className="sr-only">Toggle</span>
-        </Button>
-      </CollapsibleTrigger>
-    </div>
-    <div className="rounded-md border px-4 py-2 font-mono text-sm shadow-sm">
-      @radix-ui/primitives
-    </div>
-    <CollapsibleContent className="space-y-2">
-      <div className="rounded-md border px-4 py-2 font-mono text-sm shadow-sm">
-        @radix-ui/colors
-      </div>
-      <div className="rounded-md border px-4 py-2 font-mono text-sm shadow-sm">@stitches/react</div>
-    </CollapsibleContent>
-  </Collapsible>
-</Preview>
-
-```tsx
-import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@voidhash/ui";
-
-<Collapsible>
-  <div className="flex items-center justify-between">
-    <span>Toggle content</span>
-    <CollapsibleTrigger asChild>
-      <Button variant="ghost" size="sm">
-        <ChevronDownIcon />
-      </Button>
-    </CollapsibleTrigger>
-  </div>
-  <CollapsibleContent>Hidden content here</CollapsibleContent>
-</Collapsible>;
-```
-
-## Components
-
-### Collapsible
-
-The root component managing collapse state.
-
-### CollapsibleTrigger
-
-The element that toggles the collapsed state.
-
-### CollapsibleContent
-
-The content that is shown/hidden.
-
-## Examples
-
-### Controlled
-
-```tsx
-const [isOpen, setIsOpen] = useState(false);
-
-<Collapsible open={isOpen} onOpenChange={setIsOpen}>
-  <CollapsibleTrigger>Toggle</CollapsibleTrigger>
-  <CollapsibleContent>Content</CollapsibleContent>
-</Collapsible>;
-```
-
-## Props
-
-### Collapsible Props
-
-<TypeTable
-  type={{
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    defaultOpen: {
-      description: "Initial open state",
-      type: "boolean",
-      default: "false",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the collapsible is disabled",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/command.mdx b/apps/www/src/features/design/content/docs/components/command.mdx
deleted file mode 100644
index 87cfa6e99..000000000
--- a/apps/www/src/features/design/content/docs/components/command.mdx
+++ /dev/null
@@ -1,159 +0,0 @@
----
-title: Command
-description: A command palette component for searching and selecting commands.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Command className="rounded-lg border shadow-md w-full max-w-md">
-    <CommandInput placeholder="Type a command or search..." />
-    <CommandList>
-      <CommandEmpty>No results found.</CommandEmpty>
-      <CommandGroup heading="Suggestions">
-        <CommandItem>
-          <CalendarIcon className="mr-2 h-4 w-4" /> Calendar
-        </CommandItem>
-        <CommandItem>
-          <SearchIcon className="mr-2 h-4 w-4" /> Search
-        </CommandItem>
-        <CommandItem>
-          <SettingsIcon className="mr-2 h-4 w-4" /> Settings
-        </CommandItem>
-      </CommandGroup>
-      <CommandSeparator />
-      <CommandGroup heading="Actions">
-        <CommandItem>
-          <UserIcon className="mr-2 h-4 w-4" /> Profile
-        </CommandItem>
-        <CommandItem>
-          <MailIcon className="mr-2 h-4 w-4" /> Mail
-        </CommandItem>
-      </CommandGroup>
-    </CommandList>
-  </Command>
-</Preview>
-
-```tsx
-import {
-  Command,
-  CommandEmpty,
-  CommandGroup,
-  CommandInput,
-  CommandItem,
-  CommandList,
-  CommandSeparator,
-} from "@voidhash/ui";
-
-<Command>
-  <CommandInput placeholder="Search..." />
-  <CommandList>
-    <CommandEmpty>No results found.</CommandEmpty>
-    <CommandGroup heading="Suggestions">
-      <CommandItem>Calendar</CommandItem>
-      <CommandItem>Search</CommandItem>
-    </CommandGroup>
-  </CommandList>
-</Command>;
-```
-
-## Components
-
-### Command
-
-The root command palette container.
-
-### CommandInput
-
-The search input field.
-
-### CommandList
-
-The scrollable list of results.
-
-### CommandEmpty
-
-Message shown when no results match.
-
-### CommandGroup
-
-A group of related items with a heading.
-
-### CommandItem
-
-An individual selectable item.
-
-### CommandSeparator
-
-A visual divider between groups.
-
-### CommandShortcut
-
-Displays keyboard shortcut text.
-
-### CommandDialog
-
-A dialog-wrapped command palette.
-
-## Examples
-
-### Command Dialog
-
-<Preview>
-  <Button variant="outline" className="text-muted-foreground">
-    <SearchIcon className="mr-2 h-4 w-4" />
-    <span>Search...</span>
-    <CommandShortcut className="ml-4">⌘K</CommandShortcut>
-  </Button>
-</Preview>
-
-```tsx
-import { CommandDialog } from "@voidhash/ui";
-
-const [open, setOpen] = useState(false);
-
-<CommandDialog open={open} onOpenChange={setOpen}>
-  <CommandInput placeholder="Search..." />
-  <CommandList>
-    <CommandEmpty>No results found.</CommandEmpty>
-    <CommandGroup heading="Actions">
-      <CommandItem>New File</CommandItem>
-      <CommandItem>New Folder</CommandItem>
-    </CommandGroup>
-  </CommandList>
-</CommandDialog>;
-```
-
-### With Keyboard Shortcut
-
-```tsx
-useEffect(() => {
-  const down = (e: KeyboardEvent) => {
-    if (e.key === "k" && (e.metaKey || e.ctrlKey)) {
-      e.preventDefault();
-      setOpen((open) => !open);
-    }
-  };
-  document.addEventListener("keydown", down);
-  return () => document.removeEventListener("keydown", down);
-}, []);
-```
-
-## Props
-
-### CommandItem Props
-
-<TypeTable
-  type={{
-    onSelect: {
-      description: "Callback when item is selected",
-      type: "(value: string) => void",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the item is disabled",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/context-menu.mdx b/apps/www/src/features/design/content/docs/components/context-menu.mdx
deleted file mode 100644
index 8307b555e..000000000
--- a/apps/www/src/features/design/content/docs/components/context-menu.mdx
+++ /dev/null
@@ -1,127 +0,0 @@
----
-title: Context Menu
-description: A menu that appears on right-click or long-press.
----
-
-## Usage
-
-<Preview centered={false}>
-  <ContextMenu>
-    <ContextMenuTrigger className="flex h-[150px] w-[300px] items-center justify-center rounded-md border border-dashed text-sm">
-      Right click here
-    </ContextMenuTrigger>
-    <ContextMenuContent className="w-64">
-      <ContextMenuItem>
-        Back
-        <ContextMenuShortcut>⌘[</ContextMenuShortcut>
-      </ContextMenuItem>
-      <ContextMenuItem disabled>
-        Forward
-        <ContextMenuShortcut>⌘]</ContextMenuShortcut>
-      </ContextMenuItem>
-      <ContextMenuItem>
-        Reload
-        <ContextMenuShortcut>⌘R</ContextMenuShortcut>
-      </ContextMenuItem>
-      <ContextMenuSeparator />
-      <ContextMenuCheckboxItem checked>
-        Show Bookmarks Bar
-        <ContextMenuShortcut>⌘⇧B</ContextMenuShortcut>
-      </ContextMenuCheckboxItem>
-      <ContextMenuCheckboxItem>Show Full URLs</ContextMenuCheckboxItem>
-      <ContextMenuSeparator />
-      <ContextMenuRadioGroup value="pedro">
-        <ContextMenuLabel inset>People</ContextMenuLabel>
-        <ContextMenuSeparator />
-        <ContextMenuRadioItem value="pedro">Pedro Duarte</ContextMenuRadioItem>
-        <ContextMenuRadioItem value="colm">Colm Tuite</ContextMenuRadioItem>
-      </ContextMenuRadioGroup>
-    </ContextMenuContent>
-  </ContextMenu>
-</Preview>
-
-```tsx
-import {
-  ContextMenu,
-  ContextMenuCheckboxItem,
-  ContextMenuContent,
-  ContextMenuItem,
-  ContextMenuLabel,
-  ContextMenuRadioGroup,
-  ContextMenuRadioItem,
-  ContextMenuSeparator,
-  ContextMenuShortcut,
-  ContextMenuTrigger,
-} from "@voidhash/ui";
-
-<ContextMenu>
-  <ContextMenuTrigger>Right click here</ContextMenuTrigger>
-  <ContextMenuContent>
-    <ContextMenuItem>Back</ContextMenuItem>
-    <ContextMenuItem>Forward</ContextMenuItem>
-    <ContextMenuSeparator />
-    <ContextMenuCheckboxItem checked>Show Toolbar</ContextMenuCheckboxItem>
-  </ContextMenuContent>
-</ContextMenu>;
-```
-
-## Components
-
-### ContextMenu
-
-The root component.
-
-### ContextMenuTrigger
-
-The element that triggers the menu on right-click.
-
-### ContextMenuContent
-
-The popup menu content.
-
-### ContextMenuItem
-
-A clickable menu item.
-
-### ContextMenuCheckboxItem
-
-A menu item with a checkbox.
-
-### ContextMenuRadioGroup / ContextMenuRadioItem
-
-Radio button items for single selection.
-
-### ContextMenuLabel
-
-A non-interactive label.
-
-### ContextMenuSeparator
-
-A visual divider.
-
-### ContextMenuShortcut
-
-Displays keyboard shortcut text.
-
-### ContextMenuSub / ContextMenuSubTrigger / ContextMenuSubContent
-
-Submenu components.
-
-## Props
-
-### ContextMenuItem Props
-
-<TypeTable
-  type={{
-    inset: {
-      description: "Add left padding for alignment",
-      type: "boolean",
-      default: "false",
-    },
-    disabled: {
-      description: "Disable the item",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/dialog.mdx b/apps/www/src/features/design/content/docs/components/dialog.mdx
deleted file mode 100644
index 87d66544b..000000000
--- a/apps/www/src/features/design/content/docs/components/dialog.mdx
+++ /dev/null
@@ -1,156 +0,0 @@
----
-title: Dialog
-description: A modal window that appears on top of the main content.
----
-
-## Usage
-
-<Preview>
-  <Dialog>
-    <DialogTrigger asChild>
-      <Button variant="outline">Open Dialog</Button>
-    </DialogTrigger>
-    <DialogContent>
-      <DialogHeader>
-        <DialogTitle>Edit Profile</DialogTitle>
-        <DialogDescription>
-          Make changes to your profile here. Click save when you're done.
-        </DialogDescription>
-      </DialogHeader>
-      <div className="grid gap-4 py-4">
-        <div className="grid gap-2">
-          <Label htmlFor="name">Name</Label>
-          <Input id="name" defaultValue="John Doe" />
-        </div>
-        <div className="grid gap-2">
-          <Label htmlFor="email">Email</Label>
-          <Input id="email" defaultValue="john@example.com" />
-        </div>
-      </div>
-      <DialogFooter>
-        <Button type="submit">Save changes</Button>
-      </DialogFooter>
-    </DialogContent>
-  </Dialog>
-</Preview>
-
-```tsx
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogTitle,
-  DialogTrigger,
-} from "@voidhash/ui";
-
-<Dialog>
-  <DialogTrigger asChild>
-    <Button variant="outline">Open Dialog</Button>
-  </DialogTrigger>
-  <DialogContent>
-    <DialogHeader>
-      <DialogTitle>Edit Profile</DialogTitle>
-      <DialogDescription>Make changes to your profile here.</DialogDescription>
-    </DialogHeader>
-    <div className="py-4">{/* Dialog content */}</div>
-    <DialogFooter>
-      <Button type="submit">Save changes</Button>
-    </DialogFooter>
-  </DialogContent>
-</Dialog>;
-```
-
-## Components
-
-### Dialog
-
-The root component that manages dialog state.
-
-### DialogTrigger
-
-The element that opens the dialog when clicked.
-
-### DialogContent
-
-The modal content container with close button and overlay.
-
-### DialogHeader
-
-Container for title and description.
-
-### DialogTitle
-
-The dialog's heading text.
-
-### DialogDescription
-
-A description of the dialog's purpose.
-
-### DialogFooter
-
-Container for action buttons at the bottom.
-
-### DialogClose
-
-An element that closes the dialog when clicked.
-
-## Examples
-
-### Simple Confirmation
-
-<Preview>
-  <Dialog>
-    <DialogTrigger asChild>
-      <Button>Confirm Action</Button>
-    </DialogTrigger>
-    <DialogContent>
-      <DialogHeader>
-        <DialogTitle>Confirm</DialogTitle>
-        <DialogDescription>Are you sure you want to continue?</DialogDescription>
-      </DialogHeader>
-      <DialogFooter>
-        <DialogClose asChild>
-          <Button variant="outline">Cancel</Button>
-        </DialogClose>
-        <Button>Continue</Button>
-      </DialogFooter>
-    </DialogContent>
-  </Dialog>
-</Preview>
-
-```tsx
-<DialogClose asChild>
-  <Button variant="outline">Cancel</Button>
-</DialogClose>
-```
-
-## Props
-
-### Dialog Props
-
-<TypeTable
-  type={{
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-    defaultOpen: {
-      description: "Initial open state",
-      type: "boolean",
-      default: "false",
-    },
-    modal: {
-      description: "Whether to render as modal",
-      type: "boolean",
-      default: "true",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/drawer.mdx b/apps/www/src/features/design/content/docs/components/drawer.mdx
deleted file mode 100644
index 8e7603a80..000000000
--- a/apps/www/src/features/design/content/docs/components/drawer.mdx
+++ /dev/null
@@ -1,169 +0,0 @@
----
-title: Drawer
-description: A touch-friendly panel that slides from any edge with gesture support.
----
-
-## Usage
-
-<Preview>
-  <Drawer>
-    <DrawerTrigger asChild>
-      <Button variant="outline">Open Drawer</Button>
-    </DrawerTrigger>
-    <DrawerContent>
-      <DrawerHeader>
-        <DrawerTitle>Drawer Title</DrawerTitle>
-        <DrawerDescription>This is a drawer with touch gestures support.</DrawerDescription>
-      </DrawerHeader>
-      <div className="p-4">
-        <p>Drawer content goes here.</p>
-      </div>
-      <DrawerFooter>
-        <Button>Submit</Button>
-        <DrawerClose asChild>
-          <Button variant="outline">Cancel</Button>
-        </DrawerClose>
-      </DrawerFooter>
-    </DrawerContent>
-  </Drawer>
-</Preview>
-
-```tsx
-import {
-  Drawer,
-  DrawerClose,
-  DrawerContent,
-  DrawerDescription,
-  DrawerFooter,
-  DrawerHeader,
-  DrawerTitle,
-  DrawerTrigger,
-} from "@voidhash/ui";
-
-<Drawer>
-  <DrawerTrigger asChild>
-    <Button variant="outline">Open Drawer</Button>
-  </DrawerTrigger>
-  <DrawerContent>
-    <DrawerHeader>
-      <DrawerTitle>Drawer Title</DrawerTitle>
-      <DrawerDescription>Description here.</DrawerDescription>
-    </DrawerHeader>
-    <div className="p-4">Content</div>
-    <DrawerFooter>
-      <Button>Submit</Button>
-      <DrawerClose asChild>
-        <Button variant="outline">Cancel</Button>
-      </DrawerClose>
-    </DrawerFooter>
-  </DrawerContent>
-</Drawer>;
-```
-
-## Components
-
-### Drawer
-
-The root component managing drawer state.
-
-### DrawerTrigger
-
-The element that opens the drawer.
-
-### DrawerContent
-
-The sliding panel with a handle indicator.
-
-### DrawerHeader
-
-Container for title and description.
-
-### DrawerTitle
-
-The drawer's heading.
-
-### DrawerDescription
-
-A description of the drawer's purpose.
-
-### DrawerFooter
-
-Container for action buttons.
-
-### DrawerClose
-
-An element that closes the drawer.
-
-## Examples
-
-### Different Directions
-
-<Preview>
-  <div className="flex gap-2">
-    <Drawer direction="bottom">
-      <DrawerTrigger asChild>
-        <Button variant="outline">Bottom</Button>
-      </DrawerTrigger>
-      <DrawerContent>
-        <DrawerHeader>
-          <DrawerTitle>Bottom Drawer</DrawerTitle>
-        </DrawerHeader>
-      </DrawerContent>
-    </Drawer>
-    <Drawer direction="left">
-      <DrawerTrigger asChild>
-        <Button variant="outline">Left</Button>
-      </DrawerTrigger>
-      <DrawerContent>
-        <DrawerHeader>
-          <DrawerTitle>Left Drawer</DrawerTitle>
-        </DrawerHeader>
-      </DrawerContent>
-    </Drawer>
-    <Drawer direction="right">
-      <DrawerTrigger asChild>
-        <Button variant="outline">Right</Button>
-      </DrawerTrigger>
-      <DrawerContent>
-        <DrawerHeader>
-          <DrawerTitle>Right Drawer</DrawerTitle>
-        </DrawerHeader>
-      </DrawerContent>
-    </Drawer>
-  </div>
-</Preview>
-
-```tsx
-<Drawer direction="bottom">...</Drawer>
-<Drawer direction="left">...</Drawer>
-<Drawer direction="right">...</Drawer>
-```
-
-## Props
-
-### Drawer Props
-
-<TypeTable
-  type={{
-    direction: {
-      description: "The edge to slide from",
-      type: "'top' | 'right' | 'bottom' | 'left'",
-      default: "'bottom'",
-    },
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-    shouldScaleBackground: {
-      description: "Whether to scale the background",
-      type: "boolean",
-      default: "true",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/dropdown-menu.mdx b/apps/www/src/features/design/content/docs/components/dropdown-menu.mdx
deleted file mode 100644
index cd33c5250..000000000
--- a/apps/www/src/features/design/content/docs/components/dropdown-menu.mdx
+++ /dev/null
@@ -1,195 +0,0 @@
----
-title: Dropdown Menu
-description: A menu with a set of actions triggered by a button.
----
-
-## Usage
-
-<Preview>
-  <DropdownMenu>
-    <DropdownMenuTrigger asChild>
-      <Button variant="outline">Open Menu</Button>
-    </DropdownMenuTrigger>
-    <DropdownMenuContent>
-      <DropdownMenuLabel>My Account</DropdownMenuLabel>
-      <DropdownMenuSeparator />
-      <DropdownMenuItem>
-        <UserIcon /> Profile
-      </DropdownMenuItem>
-      <DropdownMenuItem>
-        <SettingsIcon /> Settings
-      </DropdownMenuItem>
-      <DropdownMenuSeparator />
-      <DropdownMenuItem variant="destructive">
-        <TrashIcon /> Delete
-      </DropdownMenuItem>
-    </DropdownMenuContent>
-  </DropdownMenu>
-</Preview>
-
-```tsx
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuLabel,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger,
-} from "@voidhash/ui";
-
-<DropdownMenu>
-  <DropdownMenuTrigger asChild>
-    <Button variant="outline">Open Menu</Button>
-  </DropdownMenuTrigger>
-  <DropdownMenuContent>
-    <DropdownMenuLabel>My Account</DropdownMenuLabel>
-    <DropdownMenuSeparator />
-    <DropdownMenuItem>Profile</DropdownMenuItem>
-    <DropdownMenuItem>Settings</DropdownMenuItem>
-  </DropdownMenuContent>
-</DropdownMenu>;
-```
-
-## Components
-
-### DropdownMenu
-
-The root component managing menu state.
-
-### DropdownMenuTrigger
-
-The element that opens the menu.
-
-### DropdownMenuContent
-
-The popup content container.
-
-### DropdownMenuItem
-
-A clickable menu item.
-
-### DropdownMenuLabel
-
-A non-interactive label.
-
-### DropdownMenuSeparator
-
-A visual divider between items.
-
-### DropdownMenuCheckboxItem
-
-A menu item with a checkbox.
-
-### DropdownMenuRadioGroup / DropdownMenuRadioItem
-
-Radio button items for single selection.
-
-### DropdownMenuShortcut
-
-Displays keyboard shortcut text.
-
-### DropdownMenuSub / DropdownMenuSubTrigger / DropdownMenuSubContent
-
-Nested submenu components.
-
-## Examples
-
-### With Checkbox Items
-
-<Preview>
-  <DropdownMenu>
-    <DropdownMenuTrigger asChild>
-      <Button variant="outline">View Options</Button>
-    </DropdownMenuTrigger>
-    <DropdownMenuContent>
-      <DropdownMenuLabel>Appearance</DropdownMenuLabel>
-      <DropdownMenuSeparator />
-      <DropdownMenuCheckboxItem checked>Show Toolbar</DropdownMenuCheckboxItem>
-      <DropdownMenuCheckboxItem>Show Sidebar</DropdownMenuCheckboxItem>
-      <DropdownMenuCheckboxItem>Show Status Bar</DropdownMenuCheckboxItem>
-    </DropdownMenuContent>
-  </DropdownMenu>
-</Preview>
-
-```tsx
-<DropdownMenuCheckboxItem checked>Show Toolbar</DropdownMenuCheckboxItem>
-```
-
-### With Keyboard Shortcuts
-
-<Preview>
-  <DropdownMenu>
-    <DropdownMenuTrigger asChild>
-      <Button variant="outline">Edit</Button>
-    </DropdownMenuTrigger>
-    <DropdownMenuContent className="w-56">
-      <DropdownMenuItem>
-        Cut
-        <DropdownMenuShortcut>⌘X</DropdownMenuShortcut>
-      </DropdownMenuItem>
-      <DropdownMenuItem>
-        Copy
-        <DropdownMenuShortcut>⌘C</DropdownMenuShortcut>
-      </DropdownMenuItem>
-      <DropdownMenuItem>
-        Paste
-        <DropdownMenuShortcut>⌘V</DropdownMenuShortcut>
-      </DropdownMenuItem>
-    </DropdownMenuContent>
-  </DropdownMenu>
-</Preview>
-
-```tsx
-<DropdownMenuItem>
-  Cut
-  <DropdownMenuShortcut>⌘X</DropdownMenuShortcut>
-</DropdownMenuItem>
-```
-
-### Destructive Item
-
-<Preview>
-  <DropdownMenu>
-    <DropdownMenuTrigger asChild>
-      <Button variant="outline">Actions</Button>
-    </DropdownMenuTrigger>
-    <DropdownMenuContent>
-      <DropdownMenuItem>Edit</DropdownMenuItem>
-      <DropdownMenuItem>Duplicate</DropdownMenuItem>
-      <DropdownMenuSeparator />
-      <DropdownMenuItem variant="destructive">
-        <TrashIcon /> Delete
-      </DropdownMenuItem>
-    </DropdownMenuContent>
-  </DropdownMenu>
-</Preview>
-
-```tsx
-<DropdownMenuItem variant="destructive">
-  <TrashIcon /> Delete
-</DropdownMenuItem>
-```
-
-## Props
-
-### DropdownMenuItem Props
-
-<TypeTable
-  type={{
-    variant: {
-      description: "Visual variant",
-      type: "'default' | 'destructive'",
-      default: "'default'",
-    },
-    inset: {
-      description: "Add left padding for alignment",
-      type: "boolean",
-      default: "false",
-    },
-    disabled: {
-      description: "Disable the item",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/dropzone.mdx b/apps/www/src/features/design/content/docs/components/dropzone.mdx
deleted file mode 100644
index 1ae1f3641..000000000
--- a/apps/www/src/features/design/content/docs/components/dropzone.mdx
+++ /dev/null
@@ -1,102 +0,0 @@
----
-title: Dropzone
-description: A file upload zone with drag and drop support.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Dropzone className="w-full max-w-md" />
-</Preview>
-
-```tsx
-import { Dropzone } from "@voidhash/ui";
-
-<Dropzone
-  onDrop={(files) => console.log(files)}
-  accept={{ "image/*": [".png", ".jpg", ".jpeg"] }}
-/>;
-```
-
-## Examples
-
-### With Custom Content
-
-```tsx
-<Dropzone>
-  <div className="flex flex-col items-center gap-2">
-    <UploadIcon className="h-8 w-8 text-muted-foreground" />
-    <p className="text-sm text-muted-foreground">Drag and drop files here, or click to browse</p>
-  </div>
-</Dropzone>
-```
-
-### Accept Specific File Types
-
-```tsx
-<Dropzone
-  accept={{
-    "image/*": [".png", ".jpg", ".jpeg", ".gif"],
-    "application/pdf": [".pdf"],
-  }}
-/>
-```
-
-### With Max File Size
-
-```tsx
-<Dropzone
-  maxSize={5 * 1024 * 1024} // 5MB
-  onDropRejected={(files) => {
-    toast.error("File too large");
-  }}
-/>
-```
-
-### Multiple Files
-
-```tsx
-<Dropzone
-  multiple
-  onDrop={(files) => {
-    console.log("Dropped files:", files);
-  }}
-/>
-```
-
-## Props
-
-<TypeTable
-  type={{
-    onDrop: {
-      description: "Callback when files are dropped",
-      type: "(files: File[]) => void",
-      default: "undefined",
-    },
-    onDropRejected: {
-      description: "Callback when files are rejected",
-      type: "(files: FileRejection[]) => void",
-      default: "undefined",
-    },
-    accept: {
-      description: "Accepted file types",
-      type: "Accept",
-      default: "undefined",
-    },
-    maxSize: {
-      description: "Maximum file size in bytes",
-      type: "number",
-      default: "undefined",
-    },
-    multiple: {
-      description: "Allow multiple files",
-      type: "boolean",
-      default: "false",
-    },
-    disabled: {
-      description: "Disable the dropzone",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/form.mdx b/apps/www/src/features/design/content/docs/components/form.mdx
deleted file mode 100644
index 89986f6b4..000000000
--- a/apps/www/src/features/design/content/docs/components/form.mdx
+++ /dev/null
@@ -1,186 +0,0 @@
----
-title: Form
-description: Form components with validation using react-hook-form and zod.
----
-
-## Usage
-
-The Form components integrate with react-hook-form for validation and error handling.
-
-```tsx
-import { zodResolver } from "@hookform/resolvers/zod";
-import { useForm } from "react-hook-form";
-import * as z from "zod";
-import {
-  Form,
-  FormControl,
-  FormDescription,
-  FormField,
-  FormItem,
-  FormLabel,
-  FormMessage,
-} from "@voidhash/ui";
-
-const formSchema = z.object({
-  username: z.string().min(2, {
-    message: "Username must be at least 2 characters.",
-  }),
-});
-
-function ProfileForm() {
-  const form = useForm<z.infer<typeof formSchema>>({
-    resolver: zodResolver(formSchema),
-    defaultValues: {
-      username: "",
-    },
-  });
-
-  function onSubmit(values: z.infer<typeof formSchema>) {
-    console.log(values);
-  }
-
-  return (
-    <Form {...form}>
-      <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-8">
-        <FormField
-          control={form.control}
-          name="username"
-          render={({ field }) => (
-            <FormItem>
-              <FormLabel>Username</FormLabel>
-              <FormControl>
-                <Input placeholder="username" {...field} />
-              </FormControl>
-              <FormDescription>This is your public display name.</FormDescription>
-              <FormMessage />
-            </FormItem>
-          )}
-        />
-        <Button type="submit">Submit</Button>
-      </form>
-    </Form>
-  );
-}
-```
-
-## Components
-
-### Form
-
-The root form provider that wraps react-hook-form.
-
-### FormField
-
-Connects a form field to react-hook-form's control.
-
-### FormItem
-
-Container for a single form field.
-
-### FormLabel
-
-The label for a form field.
-
-### FormControl
-
-Wrapper for the form input element.
-
-### FormDescription
-
-Helper text for the form field.
-
-### FormMessage
-
-Displays validation error messages.
-
-## Examples
-
-### With Multiple Fields
-
-```tsx
-<Form {...form}>
-  <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
-    <FormField
-      control={form.control}
-      name="email"
-      render={({ field }) => (
-        <FormItem>
-          <FormLabel>Email</FormLabel>
-          <FormControl>
-            <Input type="email" {...field} />
-          </FormControl>
-          <FormMessage />
-        </FormItem>
-      )}
-    />
-    <FormField
-      control={form.control}
-      name="password"
-      render={({ field }) => (
-        <FormItem>
-          <FormLabel>Password</FormLabel>
-          <FormControl>
-            <Input type="password" {...field} />
-          </FormControl>
-          <FormMessage />
-        </FormItem>
-      )}
-    />
-    <Button type="submit">Submit</Button>
-  </form>
-</Form>
-```
-
-### With Select
-
-```tsx
-<FormField
-  control={form.control}
-  name="role"
-  render={({ field }) => (
-    <FormItem>
-      <FormLabel>Role</FormLabel>
-      <Select onValueChange={field.onChange} defaultValue={field.value}>
-        <FormControl>
-          <SelectTrigger>
-            <SelectValue placeholder="Select a role" />
-          </SelectTrigger>
-        </FormControl>
-        <SelectContent>
-          <SelectItem value="admin">Admin</SelectItem>
-          <SelectItem value="user">User</SelectItem>
-        </SelectContent>
-      </Select>
-      <FormMessage />
-    </FormItem>
-  )}
-/>
-```
-
-### With Checkbox
-
-```tsx
-<FormField
-  control={form.control}
-  name="terms"
-  render={({ field }) => (
-    <FormItem className="flex items-start space-x-3 space-y-0">
-      <FormControl>
-        <Checkbox checked={field.value} onCheckedChange={field.onChange} />
-      </FormControl>
-      <div className="space-y-1 leading-none">
-        <FormLabel>Accept terms and conditions</FormLabel>
-        <FormDescription>You agree to our Terms of Service.</FormDescription>
-      </div>
-    </FormItem>
-  )}
-/>
-```
-
-## Dependencies
-
-The Form component requires:
-
-```bash
-npm install react-hook-form @hookform/resolvers zod
-```
diff --git a/apps/www/src/features/design/content/docs/components/hover-card.mdx b/apps/www/src/features/design/content/docs/components/hover-card.mdx
deleted file mode 100644
index 66405abc1..000000000
--- a/apps/www/src/features/design/content/docs/components/hover-card.mdx
+++ /dev/null
@@ -1,137 +0,0 @@
----
-title: Hover Card
-description: A card that appears when hovering over an element.
----
-
-## Usage
-
-<Preview>
-  <HoverCard>
-    <HoverCardTrigger asChild>
-      <Button variant="link">@nextjs</Button>
-    </HoverCardTrigger>
-    <HoverCardContent>
-      <div className="flex justify-between space-x-4">
-        <Avatar>
-          <AvatarImage src="https://github.com/vercel.png" />
-          <AvatarFallback>VC</AvatarFallback>
-        </Avatar>
-        <div className="space-y-1">
-          <h4 className="text-sm font-semibold">@nextjs</h4>
-          <p className="text-sm">The React Framework – created and maintained by @vercel.</p>
-          <div className="flex items-center pt-2">
-            <CalendarIcon className="mr-2 h-4 w-4 opacity-70" />
-            <span className="text-xs text-muted-foreground">Joined December 2021</span>
-          </div>
-        </div>
-      </div>
-    </HoverCardContent>
-  </HoverCard>
-</Preview>
-
-```tsx
-import { HoverCard, HoverCardContent, HoverCardTrigger } from "@voidhash/ui";
-
-<HoverCard>
-  <HoverCardTrigger asChild>
-    <Button variant="link">@nextjs</Button>
-  </HoverCardTrigger>
-  <HoverCardContent>
-    <div className="space-y-1">
-      <h4 className="text-sm font-semibold">@nextjs</h4>
-      <p className="text-sm">The React Framework.</p>
-    </div>
-  </HoverCardContent>
-</HoverCard>;
-```
-
-## Components
-
-### HoverCard
-
-The root component managing hover state.
-
-### HoverCardTrigger
-
-The element that triggers the card on hover.
-
-### HoverCardContent
-
-The popup card content.
-
-## Examples
-
-### Simple Hover Card
-
-<Preview>
-  <HoverCard>
-    <HoverCardTrigger asChild>
-      <span className="text-primary underline cursor-pointer">Hover me</span>
-    </HoverCardTrigger>
-    <HoverCardContent>
-      <p className="text-sm">This is additional information.</p>
-    </HoverCardContent>
-  </HoverCard>
-</Preview>
-
-```tsx
-<HoverCard>
-  <HoverCardTrigger asChild>
-    <span className="underline cursor-pointer">Hover me</span>
-  </HoverCardTrigger>
-  <HoverCardContent>
-    <p>Additional information.</p>
-  </HoverCardContent>
-</HoverCard>
-```
-
-## Props
-
-### HoverCard Props
-
-<TypeTable
-  type={{
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-    openDelay: {
-      description: "Delay before opening in ms",
-      type: "number",
-      default: "700",
-    },
-    closeDelay: {
-      description: "Delay before closing in ms",
-      type: "number",
-      default: "300",
-    },
-  }}
-/>
-
-### HoverCardContent Props
-
-<TypeTable
-  type={{
-    side: {
-      description: "Side to display the card",
-      type: "'top' | 'right' | 'bottom' | 'left'",
-      default: "'bottom'",
-    },
-    align: {
-      description: "Alignment along the side",
-      type: "'start' | 'center' | 'end'",
-      default: "'center'",
-    },
-    sideOffset: {
-      description: "Distance from trigger in pixels",
-      type: "number",
-      default: "4",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/input-otp.mdx b/apps/www/src/features/design/content/docs/components/input-otp.mdx
deleted file mode 100644
index 4cddb0fa0..000000000
--- a/apps/www/src/features/design/content/docs/components/input-otp.mdx
+++ /dev/null
@@ -1,136 +0,0 @@
----
-title: Input OTP
-description: A one-time password input component for verification codes.
----
-
-## Usage
-
-<Preview>
-  <InputOTP maxLength={6}>
-    <InputOTPGroup>
-      <InputOTPSlot index={0} />
-      <InputOTPSlot index={1} />
-      <InputOTPSlot index={2} />
-    </InputOTPGroup>
-    <InputOTPSeparator />
-    <InputOTPGroup>
-      <InputOTPSlot index={3} />
-      <InputOTPSlot index={4} />
-      <InputOTPSlot index={5} />
-    </InputOTPGroup>
-  </InputOTP>
-</Preview>
-
-```tsx
-import { InputOTP, InputOTPGroup, InputOTPSeparator, InputOTPSlot } from "@voidhash/ui";
-
-<InputOTP maxLength={6}>
-  <InputOTPGroup>
-    <InputOTPSlot index={0} />
-    <InputOTPSlot index={1} />
-    <InputOTPSlot index={2} />
-  </InputOTPGroup>
-  <InputOTPSeparator />
-  <InputOTPGroup>
-    <InputOTPSlot index={3} />
-    <InputOTPSlot index={4} />
-    <InputOTPSlot index={5} />
-  </InputOTPGroup>
-</InputOTP>;
-```
-
-## Components
-
-### InputOTP
-
-The root component managing OTP input state.
-
-### InputOTPGroup
-
-A group of OTP slots.
-
-### InputOTPSlot
-
-A single input slot for one character.
-
-### InputOTPSeparator
-
-A visual separator between groups.
-
-## Examples
-
-### 4-Digit Code
-
-<Preview>
-  <InputOTP maxLength={4}>
-    <InputOTPGroup>
-      <InputOTPSlot index={0} />
-      <InputOTPSlot index={1} />
-      <InputOTPSlot index={2} />
-      <InputOTPSlot index={3} />
-    </InputOTPGroup>
-  </InputOTP>
-</Preview>
-
-```tsx
-<InputOTP maxLength={4}>
-  <InputOTPGroup>
-    <InputOTPSlot index={0} />
-    <InputOTPSlot index={1} />
-    <InputOTPSlot index={2} />
-    <InputOTPSlot index={3} />
-  </InputOTPGroup>
-</InputOTP>
-```
-
-### Controlled
-
-```tsx
-const [value, setValue] = useState("");
-
-<InputOTP maxLength={6} value={value} onChange={setValue}>
-  ...
-</InputOTP>;
-```
-
-### Pattern Validation
-
-```tsx
-<InputOTP maxLength={6} pattern={REGEXP_ONLY_DIGITS}>
-  ...
-</InputOTP>
-```
-
-## Props
-
-### InputOTP Props
-
-<TypeTable
-  type={{
-    maxLength: {
-      description: "Maximum number of characters",
-      type: "number",
-      default: "Required",
-    },
-    value: {
-      description: "Controlled value",
-      type: "string",
-      default: "undefined",
-    },
-    onChange: {
-      description: "Callback when value changes",
-      type: "(value: string) => void",
-      default: "undefined",
-    },
-    pattern: {
-      description: "Regex pattern for validation",
-      type: "string | RegExp",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Disable the input",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/input.mdx b/apps/www/src/features/design/content/docs/components/input.mdx
deleted file mode 100644
index 5e4072f5a..000000000
--- a/apps/www/src/features/design/content/docs/components/input.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-title: Input
-description: A basic text input field for user data entry.
----
-
-## Usage
-
-<Preview>
-  <Input placeholder="Enter text..." />
-</Preview>
-
-```tsx
-import { Input } from "@voidhash/ui";
-
-<Input placeholder="Enter text..." />;
-```
-
-## Examples
-
-### With Label
-
-<Preview centered={false}>
-  <div className="grid gap-2 w-full max-w-sm">
-    <Label htmlFor="email">Email</Label>
-    <Input id="email" type="email" placeholder="email@example.com" />
-  </div>
-</Preview>
-
-```tsx
-<div className="grid gap-2">
-  <Label htmlFor="email">Email</Label>
-  <Input id="email" type="email" placeholder="email@example.com" />
-</div>
-```
-
-### Input Types
-
-<Preview centered={false}>
-  <div className="grid gap-4 w-full max-w-sm">
-    <Input type="text" placeholder="Text input" />
-    <Input type="email" placeholder="Email input" />
-    <Input type="password" placeholder="Password input" />
-    <Input type="number" placeholder="Number input" />
-    <Input type="search" placeholder="Search input" />
-  </div>
-</Preview>
-
-```tsx
-<Input type="text" placeholder="Text input" />
-<Input type="email" placeholder="Email input" />
-<Input type="password" placeholder="Password input" />
-<Input type="number" placeholder="Number input" />
-<Input type="search" placeholder="Search input" />
-```
-
-### Disabled
-
-<Preview>
-  <Input disabled placeholder="Disabled input" />
-</Preview>
-
-```tsx
-<Input disabled placeholder="Disabled input" />
-```
-
-### With Error State
-
-<Preview>
-  <Input aria-invalid placeholder="Invalid input" />
-</Preview>
-
-```tsx
-<Input aria-invalid placeholder="Invalid input" />
-```
-
-### File Input
-
-<Preview>
-  <Input type="file" />
-</Preview>
-
-```tsx
-<Input type="file" />
-```
-
-## Props
-
-The Input component accepts all standard HTML input attributes.
-
-<TypeTable
-  type={{
-    type: {
-      description: "The input type",
-      type: "string",
-      default: "'text'",
-    },
-    placeholder: {
-      description: "Placeholder text",
-      type: "string",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the input is disabled",
-      type: "boolean",
-      default: "false",
-    },
-    "aria-invalid": {
-      description: "Indicates an error state",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/label.mdx b/apps/www/src/features/design/content/docs/components/label.mdx
deleted file mode 100644
index eb2344556..000000000
--- a/apps/www/src/features/design/content/docs/components/label.mdx
+++ /dev/null
@@ -1,81 +0,0 @@
----
-title: Label
-description: Renders an accessible label associated with form controls.
----
-
-## Usage
-
-<Preview>
-  <div className="grid gap-2">
-    <Label htmlFor="name">Name</Label>
-    <Input id="name" placeholder="Enter your name" />
-  </div>
-</Preview>
-
-```tsx
-import { Label } from "@voidhash/ui";
-import { Input } from "@voidhash/ui";
-
-<div className="grid gap-2">
-  <Label htmlFor="name">Name</Label>
-  <Input id="name" placeholder="Enter your name" />
-</div>;
-```
-
-## Examples
-
-### With Checkbox
-
-<Preview>
-  <div className="flex items-center gap-2">
-    <Checkbox id="agree" />
-    <Label htmlFor="agree">I agree to the terms</Label>
-  </div>
-</Preview>
-
-```tsx
-<div className="flex items-center gap-2">
-  <Checkbox id="agree" />
-  <Label htmlFor="agree">I agree to the terms</Label>
-</div>
-```
-
-### With Required Indicator
-
-<Preview>
-  <div className="grid gap-2">
-    <Label htmlFor="required-field">
-      Email <span className="text-destructive">*</span>
-    </Label>
-    <Input id="required-field" type="email" required />
-  </div>
-</Preview>
-
-```tsx
-<Label htmlFor="email">
-  Email <span className="text-destructive">*</span>
-</Label>
-```
-
-### Disabled State
-
-The label automatically adjusts its style when associated with a disabled input.
-
-<Preview>
-  <div className="grid gap-2">
-    <Label htmlFor="disabled-input">Disabled Field</Label>
-    <Input id="disabled-input" disabled placeholder="Disabled" />
-  </div>
-</Preview>
-
-## Props
-
-<TypeTable
-  type={{
-    htmlFor: {
-      description: "The ID of the form element this label is for",
-      type: "string",
-      default: "undefined",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/menubar.mdx b/apps/www/src/features/design/content/docs/components/menubar.mdx
deleted file mode 100644
index a8d6bd2ef..000000000
--- a/apps/www/src/features/design/content/docs/components/menubar.mdx
+++ /dev/null
@@ -1,136 +0,0 @@
----
-title: Menubar
-description: A horizontal menu bar with dropdown menus.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Menubar>
-    <MenubarMenu>
-      <MenubarTrigger>File</MenubarTrigger>
-      <MenubarContent>
-        <MenubarItem>
-          New Tab <MenubarShortcut>⌘T</MenubarShortcut>
-        </MenubarItem>
-        <MenubarItem>
-          New Window <MenubarShortcut>⌘N</MenubarShortcut>
-        </MenubarItem>
-        <MenubarSeparator />
-        <MenubarItem>Share</MenubarItem>
-        <MenubarSeparator />
-        <MenubarItem>Print</MenubarItem>
-      </MenubarContent>
-    </MenubarMenu>
-    <MenubarMenu>
-      <MenubarTrigger>Edit</MenubarTrigger>
-      <MenubarContent>
-        <MenubarItem>
-          Undo <MenubarShortcut>⌘Z</MenubarShortcut>
-        </MenubarItem>
-        <MenubarItem>
-          Redo <MenubarShortcut>⇧⌘Z</MenubarShortcut>
-        </MenubarItem>
-        <MenubarSeparator />
-        <MenubarItem>Cut</MenubarItem>
-        <MenubarItem>Copy</MenubarItem>
-        <MenubarItem>Paste</MenubarItem>
-      </MenubarContent>
-    </MenubarMenu>
-    <MenubarMenu>
-      <MenubarTrigger>View</MenubarTrigger>
-      <MenubarContent>
-        <MenubarCheckboxItem>Show Toolbar</MenubarCheckboxItem>
-        <MenubarCheckboxItem checked>Show Statusbar</MenubarCheckboxItem>
-      </MenubarContent>
-    </MenubarMenu>
-  </Menubar>
-</Preview>
-
-```tsx
-import {
-  Menubar,
-  MenubarCheckboxItem,
-  MenubarContent,
-  MenubarItem,
-  MenubarMenu,
-  MenubarSeparator,
-  MenubarShortcut,
-  MenubarTrigger,
-} from "@voidhash/ui";
-
-<Menubar>
-  <MenubarMenu>
-    <MenubarTrigger>File</MenubarTrigger>
-    <MenubarContent>
-      <MenubarItem>New Tab</MenubarItem>
-      <MenubarItem>New Window</MenubarItem>
-    </MenubarContent>
-  </MenubarMenu>
-</Menubar>;
-```
-
-## Components
-
-### Menubar
-
-The root horizontal menu container.
-
-### MenubarMenu
-
-A single menu in the menubar.
-
-### MenubarTrigger
-
-The trigger button for a menu.
-
-### MenubarContent
-
-The dropdown content of a menu.
-
-### MenubarItem
-
-A clickable menu item.
-
-### MenubarCheckboxItem
-
-A menu item with a checkbox.
-
-### MenubarRadioGroup / MenubarRadioItem
-
-Radio button items.
-
-### MenubarLabel
-
-A non-interactive label.
-
-### MenubarSeparator
-
-A visual divider.
-
-### MenubarShortcut
-
-Displays keyboard shortcut text.
-
-### MenubarSub / MenubarSubTrigger / MenubarSubContent
-
-Submenu components.
-
-## Props
-
-### MenubarItem Props
-
-<TypeTable
-  type={{
-    inset: {
-      description: "Add left padding for alignment",
-      type: "boolean",
-      default: "false",
-    },
-    disabled: {
-      description: "Disable the item",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/meta.yaml b/apps/www/src/features/design/content/docs/components/meta.yaml
deleted file mode 100644
index 6edb3f8b6..000000000
--- a/apps/www/src/features/design/content/docs/components/meta.yaml
+++ /dev/null
@@ -1,53 +0,0 @@
-icon: Component
-title: Components
-pages:
-  - overview
-  - accordion
-  - alert
-  - alert-dialog
-  - avatar
-  - badge
-  - breadcrumb
-  - button
-  - calendar
-  - card
-  - carousel
-  - chart
-  - checkbox
-  - collapsible
-  - command
-  - context-menu
-  - dialog
-  - drawer
-  - dropdown-menu
-  - dropzone
-  - form
-  - hover-card
-  - input
-  - input-otp
-  - label
-  - menubar
-  - navigation-menu
-  - page-bar
-  - pagination
-  - phone
-  - popover
-  - progress
-  - radio-group
-  - resizable
-  - scroll-area
-  - select
-  - separator
-  - sheet
-  - sidebar
-  - skeleton
-  - slider
-  - sonner
-  - switch
-  - table
-  - tabs
-  - textarea
-  - toggle
-  - toggle-group
-  - tooltip
-  - underline-tabs
diff --git a/apps/www/src/features/design/content/docs/components/navigation-menu.mdx b/apps/www/src/features/design/content/docs/components/navigation-menu.mdx
deleted file mode 100644
index 51a914de6..000000000
--- a/apps/www/src/features/design/content/docs/components/navigation-menu.mdx
+++ /dev/null
@@ -1,156 +0,0 @@
----
-title: Navigation Menu
-description: A collection of links for navigating websites with dropdown menus.
----
-
-## Usage
-
-<Preview centered={false}>
-  <NavigationMenu>
-    <NavigationMenuList>
-      <NavigationMenuItem>
-        <NavigationMenuTrigger>Getting Started</NavigationMenuTrigger>
-        <NavigationMenuContent>
-          <ul className="grid gap-3 p-4 md:w-[400px] lg:w-[500px] lg:grid-cols-[.75fr_1fr]">
-            <li className="row-span-3">
-              <NavigationMenuLink asChild>
-                <a
-                  className="flex h-full w-full select-none flex-col justify-end rounded-md bg-gradient-to-b from-muted/50 to-muted p-6"
-                  href="/"
-                >
-                  <div className="mb-2 mt-4 text-lg font-medium">Voidhash</div>
-                  <p className="text-sm leading-tight text-muted-foreground">
-                    Build your next project faster.
-                  </p>
-                </a>
-              </NavigationMenuLink>
-            </li>
-            <li>
-              <NavigationMenuLink asChild>
-                <a href="/docs">Introduction</a>
-              </NavigationMenuLink>
-            </li>
-            <li>
-              <NavigationMenuLink asChild>
-                <a href="/docs/installation">Installation</a>
-              </NavigationMenuLink>
-            </li>
-          </ul>
-        </NavigationMenuContent>
-      </NavigationMenuItem>
-      <NavigationMenuItem>
-        <NavigationMenuTrigger>Components</NavigationMenuTrigger>
-        <NavigationMenuContent>
-          <ul className="grid w-[400px] gap-3 p-4 md:w-[500px] md:grid-cols-2">
-            <li>
-              <NavigationMenuLink asChild>
-                <a href="/docs/components/button">Button</a>
-              </NavigationMenuLink>
-            </li>
-            <li>
-              <NavigationMenuLink asChild>
-                <a href="/docs/components/card">Card</a>
-              </NavigationMenuLink>
-            </li>
-          </ul>
-        </NavigationMenuContent>
-      </NavigationMenuItem>
-      <NavigationMenuItem>
-        <NavigationMenuLink href="/docs">Documentation</NavigationMenuLink>
-      </NavigationMenuItem>
-    </NavigationMenuList>
-  </NavigationMenu>
-</Preview>
-
-```tsx
-import {
-  NavigationMenu,
-  NavigationMenuContent,
-  NavigationMenuItem,
-  NavigationMenuLink,
-  NavigationMenuList,
-  NavigationMenuTrigger,
-} from "@voidhash/ui";
-
-<NavigationMenu>
-  <NavigationMenuList>
-    <NavigationMenuItem>
-      <NavigationMenuTrigger>Item One</NavigationMenuTrigger>
-      <NavigationMenuContent>
-        <ul className="grid gap-3 p-4 w-[400px]">
-          <li>
-            <NavigationMenuLink href="/link1">Link 1</NavigationMenuLink>
-          </li>
-          <li>
-            <NavigationMenuLink href="/link2">Link 2</NavigationMenuLink>
-          </li>
-        </ul>
-      </NavigationMenuContent>
-    </NavigationMenuItem>
-  </NavigationMenuList>
-</NavigationMenu>;
-```
-
-## Components
-
-### NavigationMenu
-
-The root navigation container.
-
-### NavigationMenuList
-
-The list of navigation items.
-
-### NavigationMenuItem
-
-A single navigation item.
-
-### NavigationMenuTrigger
-
-A button that opens a dropdown.
-
-### NavigationMenuContent
-
-The dropdown content area.
-
-### NavigationMenuLink
-
-A navigation link.
-
-### NavigationMenuIndicator
-
-Visual indicator for the active item.
-
-### NavigationMenuPositioner
-
-The portaled popup that dropdown content animates through. `NavigationMenu` renders one
-automatically; render it yourself only when you need custom positioning.
-
-## Props
-
-### NavigationMenu Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "Controlled active item",
-      type: "string",
-      default: "undefined",
-    },
-    defaultValue: {
-      description: "Initial active item",
-      type: "string",
-      default: "undefined",
-    },
-    onValueChange: {
-      description: "Callback when active item changes",
-      type: "(value: string) => void",
-      default: "undefined",
-    },
-    orientation: {
-      description: "Menu orientation",
-      type: "'horizontal' | 'vertical'",
-      default: "'horizontal'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/overview.mdx b/apps/www/src/features/design/content/docs/components/overview.mdx
deleted file mode 100644
index 21322b7ae..000000000
--- a/apps/www/src/features/design/content/docs/components/overview.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: Component Overview
-description: Real product examples composed from the Voidhash design system.
-full: true
----
-
-<ComponentOverview />
diff --git a/apps/www/src/features/design/content/docs/components/page-bar.mdx b/apps/www/src/features/design/content/docs/components/page-bar.mdx
deleted file mode 100644
index c90ca367e..000000000
--- a/apps/www/src/features/design/content/docs/components/page-bar.mdx
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Page Bar
-description: A full-width secondary bar below the page header with tabs and actions on either side.
----
-
-## Usage
-
-`PageBar` shares the horizontal spacing and bottom border of `PageHeader`, so its underline runs edge to edge. Both sides accept tabs and buttons: the left side via `children`, the right side via `rightActions`.
-
-<Preview centered={false} className="overflow-hidden p-0">
-  <PageTabs defaultValue="all">
-    <PageHeader rightActions={<Button size="sm"><PlusIcon data-icon="inline-start" />New paywall</Button>}>
-      <PageHeaderTitle>Paywalls</PageHeaderTitle>
-    </PageHeader>
-    <PageBar rightActions={<Button size="sm" variant="ghost">Filter</Button>}>
-      <PageBarTabs>
-        <PageBarTab value="all">All</PageBarTab>
-        <PageBarTab value="active">Active</PageBarTab>
-        <PageBarTab value="inactive">Inactive</PageBarTab>
-        <PageBarTab value="archived">Archived</PageBarTab>
-      </PageBarTabs>
-    </PageBar>
-    <div className="p-4 text-muted-foreground text-sm">Page content</div>
-  </PageTabs>
-</Preview>
-
-```tsx
-import { PageBar, PageBarTab, PageBarTabs, PageTabs } from "@voidhash/ui";
-
-<PageTabs defaultValue="all">
-  <PageBar rightActions={<Button size="sm">Action</Button>}>
-    <PageBarTabs>
-      <PageBarTab value="all">All</PageBarTab>
-      <PageBarTab value="archived">Archived</PageBarTab>
-    </PageBarTabs>
-  </PageBar>
-  {/* tab content rendered anywhere below the bar */}
-</PageTabs>;
-```
-
-## Components
-
-### PageTabs
-
-Unstyled tabs root. Wrap it around the `PageBar` and the tab content so `PageBarTab` triggers can control content rendered anywhere below the bar. Omit it when the bar holds no tabs.
-
-### PageBar
-
-The bar itself. `children` render on the left, `rightActions` on the right; both sides vertically center buttons while tabs stretch to the full bar height.
-
-### PageBarTabs
-
-Tab strip for use inside a `PageBar`. The active underline sits on the bar's bottom border.
-
-### PageBarTab
-
-A single tab trigger inside `PageBarTabs`.
diff --git a/apps/www/src/features/design/content/docs/components/pagination.mdx b/apps/www/src/features/design/content/docs/components/pagination.mdx
deleted file mode 100644
index 458dc1758..000000000
--- a/apps/www/src/features/design/content/docs/components/pagination.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: Pagination
-description: Navigation component for paginated content.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Pagination>
-    <PaginationContent>
-      <PaginationItem>
-        <PaginationPrevious href="#" />
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationLink href="#">1</PaginationLink>
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationLink href="#" isActive>
-          2
-        </PaginationLink>
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationLink href="#">3</PaginationLink>
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationEllipsis />
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationNext href="#" />
-      </PaginationItem>
-    </PaginationContent>
-  </Pagination>
-</Preview>
-
-```tsx
-import {
-  Pagination,
-  PaginationContent,
-  PaginationEllipsis,
-  PaginationItem,
-  PaginationLink,
-  PaginationNext,
-  PaginationPrevious,
-} from "@voidhash/ui";
-
-<Pagination>
-  <PaginationContent>
-    <PaginationItem>
-      <PaginationPrevious href="#" />
-    </PaginationItem>
-    <PaginationItem>
-      <PaginationLink href="#">1</PaginationLink>
-    </PaginationItem>
-    <PaginationItem>
-      <PaginationLink href="#" isActive>
-        2
-      </PaginationLink>
-    </PaginationItem>
-    <PaginationItem>
-      <PaginationNext href="#" />
-    </PaginationItem>
-  </PaginationContent>
-</Pagination>;
-```
-
-## Components
-
-### Pagination
-
-The root navigation container.
-
-### PaginationContent
-
-The list container for pagination items.
-
-### PaginationItem
-
-A single item in the pagination.
-
-### PaginationLink
-
-A page number link.
-
-### PaginationPrevious
-
-The previous page button.
-
-### PaginationNext
-
-The next page button.
-
-### PaginationEllipsis
-
-An ellipsis indicator for skipped pages.
-
-## Examples
-
-### Simple Pagination
-
-<Preview centered={false}>
-  <Pagination>
-    <PaginationContent>
-      <PaginationItem>
-        <PaginationPrevious href="#" />
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationLink href="#" isActive>
-          1
-        </PaginationLink>
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationLink href="#">2</PaginationLink>
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationLink href="#">3</PaginationLink>
-      </PaginationItem>
-      <PaginationItem>
-        <PaginationNext href="#" />
-      </PaginationItem>
-    </PaginationContent>
-  </Pagination>
-</Preview>
-
-## Props
-
-### PaginationLink Props
-
-<TypeTable
-  type={{
-    href: {
-      description: "The URL for the page",
-      type: "string",
-      default: "undefined",
-    },
-    isActive: {
-      description: "Whether this is the current page",
-      type: "boolean",
-      default: "false",
-    },
-    size: {
-      description: "Size of the link button",
-      type: "'default' | 'sm' | 'lg' | 'icon'",
-      default: "'icon'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/phone.mdx b/apps/www/src/features/design/content/docs/components/phone.mdx
deleted file mode 100644
index cf796e051..000000000
--- a/apps/www/src/features/design/content/docs/components/phone.mdx
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Phone
-description: A phone mockup that frames arbitrary screen content and scales to any width.
----
-
-## Usage
-
-`Phone` renders a black device body with a 9:19.5 screen, dynamic island, home indicator and side buttons. Every dimension is expressed in container-query units against the device's own width, so the same component reads correctly from a dashboard thumbnail up to a full-size preview. Children are clipped to the rounded screen — give them `size-full` to fill it.
-
-<Preview>
-  <Phone className="w-[220px]" screenClassName="bg-linear-150 from-blue-ribbon-700 to-electric-violet-800" />
-</Preview>
-
-```tsx
-import { Phone } from "@voidhash/ui";
-
-<Phone className="w-[220px]">
-  <img alt="" className="size-full object-cover object-top" src={thumbnailUrl} />
-</Phone>;
-```
-
-## Sizing from height
-
-By default the device fills the available width. Pass `fitHeight` to derive the width from the available height instead — pair it with `h-full` or `max-h-*` on `className`.
-
-<Preview className="h-[320px]">
-  <Phone className="h-full" fitHeight screenClassName="bg-zinc-800" />
-</Preview>
-
-```tsx
-<Phone className="h-full max-h-[832px]" fitHeight>
-  <iframe className="size-full" srcDoc={html} title="Preview" />
-</Phone>
-```
-
-## Browser toolbar
-
-Passing `url` floats a Safari-style toolbar over the bottom of the screen, together with a scrim that keeps it legible against light content.
-
-<Preview>
-  <Phone className="w-[220px]" screenClassName="bg-zinc-700" url="voidha.sh" />
-</Preview>
-
-```tsx
-<Phone url="voidha.sh">{content}</Phone>
-```
-
-## Props
-
-| Prop              | Type        | Default | Description                                                             |
-| ----------------- | ----------- | ------- | ----------------------------------------------------------------------- |
-| `children`        | `ReactNode` | —       | Screen content, clipped to the rounded display.                          |
-| `fitHeight`       | `boolean`   | `false` | Derive the device size from the available height instead of the width.   |
-| `screenClassName` | `string`    | —       | Extra classes for the screen surface, e.g. its background colour.        |
-| `url`             | `string`    | —       | Renders the floating browser toolbar showing this URL.                   |
-
-`PHONE_ASPECT_RATIO` is exported alongside the component for layouts that need to reserve the device's footprint themselves.
diff --git a/apps/www/src/features/design/content/docs/components/popover.mdx b/apps/www/src/features/design/content/docs/components/popover.mdx
deleted file mode 100644
index 94a9e7385..000000000
--- a/apps/www/src/features/design/content/docs/components/popover.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: Popover
-description: Displays rich content in a portal, triggered by a button.
----
-
-## Usage
-
-<Preview>
-  <Popover>
-    <PopoverTrigger asChild>
-      <Button variant="outline">Open Popover</Button>
-    </PopoverTrigger>
-    <PopoverContent>
-      <div className="grid gap-4">
-        <div className="space-y-2">
-          <h4 className="font-medium leading-none">Dimensions</h4>
-          <p className="text-sm text-muted-foreground">Set the dimensions for the layer.</p>
-        </div>
-        <div className="grid gap-2">
-          <div className="grid grid-cols-3 items-center gap-4">
-            <Label htmlFor="width">Width</Label>
-            <Input id="width" defaultValue="100%" className="col-span-2 h-8" />
-          </div>
-          <div className="grid grid-cols-3 items-center gap-4">
-            <Label htmlFor="height">Height</Label>
-            <Input id="height" defaultValue="25px" className="col-span-2 h-8" />
-          </div>
-        </div>
-      </div>
-    </PopoverContent>
-  </Popover>
-</Preview>
-
-```tsx
-import { Popover, PopoverContent, PopoverTrigger } from "@voidhash/ui";
-
-<Popover>
-  <PopoverTrigger asChild>
-    <Button variant="outline">Open Popover</Button>
-  </PopoverTrigger>
-  <PopoverContent>Popover content here.</PopoverContent>
-</Popover>;
-```
-
-## Components
-
-### Popover
-
-The root component that manages popover state.
-
-### PopoverTrigger
-
-The element that opens the popover when clicked.
-
-### PopoverContent
-
-The content displayed in the popover.
-
-### PopoverAnchor
-
-An optional anchor element to position the popover.
-
-## Examples
-
-### Different Alignments
-
-<Preview>
-  <div className="flex gap-4">
-    <Popover>
-      <PopoverTrigger asChild>
-        <Button variant="outline">Start</Button>
-      </PopoverTrigger>
-      <PopoverContent align="start" className="w-48">
-        <p>Aligned to start</p>
-      </PopoverContent>
-    </Popover>
-    <Popover>
-      <PopoverTrigger asChild>
-        <Button variant="outline">Center</Button>
-      </PopoverTrigger>
-      <PopoverContent align="center" className="w-48">
-        <p>Aligned to center</p>
-      </PopoverContent>
-    </Popover>
-    <Popover>
-      <PopoverTrigger asChild>
-        <Button variant="outline">End</Button>
-      </PopoverTrigger>
-      <PopoverContent align="end" className="w-48">
-        <p>Aligned to end</p>
-      </PopoverContent>
-    </Popover>
-  </div>
-</Preview>
-
-```tsx
-<PopoverContent align="start">...</PopoverContent>
-<PopoverContent align="center">...</PopoverContent>
-<PopoverContent align="end">...</PopoverContent>
-```
-
-## Props
-
-### Popover Props
-
-<TypeTable
-  type={{
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-    defaultOpen: {
-      description: "Initial open state",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
-
-### PopoverContent Props
-
-<TypeTable
-  type={{
-    side: {
-      description: "Side of the trigger to display",
-      type: "'top' | 'right' | 'bottom' | 'left'",
-      default: "'bottom'",
-    },
-    align: {
-      description: "Alignment along the side",
-      type: "'start' | 'center' | 'end'",
-      default: "'center'",
-    },
-    sideOffset: {
-      description: "Distance from trigger in pixels",
-      type: "number",
-      default: "4",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/progress.mdx b/apps/www/src/features/design/content/docs/components/progress.mdx
deleted file mode 100644
index 81bc6240f..000000000
--- a/apps/www/src/features/design/content/docs/components/progress.mdx
+++ /dev/null
@@ -1,92 +0,0 @@
----
-title: Progress
-description: Displays an indicator showing the completion progress of a task.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Progress value={33} className="w-full max-w-md" />
-</Preview>
-
-```tsx
-import { Progress } from "@voidhash/ui";
-
-<Progress value={33} />;
-```
-
-## Examples
-
-### Different Values
-
-<Preview centered={false}>
-  <div className="grid gap-4 w-full max-w-md">
-    <div className="space-y-1">
-      <p className="text-sm">0%</p>
-      <Progress value={0} />
-    </div>
-    <div className="space-y-1">
-      <p className="text-sm">25%</p>
-      <Progress value={25} />
-    </div>
-    <div className="space-y-1">
-      <p className="text-sm">50%</p>
-      <Progress value={50} />
-    </div>
-    <div className="space-y-1">
-      <p className="text-sm">75%</p>
-      <Progress value={75} />
-    </div>
-    <div className="space-y-1">
-      <p className="text-sm">100%</p>
-      <Progress value={100} />
-    </div>
-  </div>
-</Preview>
-
-```tsx
-<Progress value={0} />
-<Progress value={25} />
-<Progress value={50} />
-<Progress value={75} />
-<Progress value={100} />
-```
-
-### With Label
-
-<Preview centered={false}>
-  <div className="w-full max-w-md space-y-2">
-    <div className="flex justify-between text-sm">
-      <span>Uploading...</span>
-      <span>66%</span>
-    </div>
-    <Progress value={66} />
-  </div>
-</Preview>
-
-```tsx
-<div className="space-y-2">
-  <div className="flex justify-between text-sm">
-    <span>Uploading...</span>
-    <span>66%</span>
-  </div>
-  <Progress value={66} />
-</div>
-```
-
-## Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "Current progress value (0-100)",
-      type: "number",
-      default: "0",
-    },
-    max: {
-      description: "Maximum value",
-      type: "number",
-      default: "100",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/radio-group.mdx b/apps/www/src/features/design/content/docs/components/radio-group.mdx
deleted file mode 100644
index 5e908a336..000000000
--- a/apps/www/src/features/design/content/docs/components/radio-group.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: Radio Group
-description: A set of checkable buttons where only one can be checked at a time.
----
-
-## Usage
-
-<Preview centered={false}>
-  <RadioGroup defaultValue="option-one">
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="option-one" id="option-one" />
-      <Label htmlFor="option-one">Option One</Label>
-    </div>
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="option-two" id="option-two" />
-      <Label htmlFor="option-two">Option Two</Label>
-    </div>
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="option-three" id="option-three" />
-      <Label htmlFor="option-three">Option Three</Label>
-    </div>
-  </RadioGroup>
-</Preview>
-
-```tsx
-import { RadioGroup, RadioGroupItem } from "@voidhash/ui";
-import { Label } from "@voidhash/ui";
-
-<RadioGroup defaultValue="option-one">
-  <div className="flex items-center space-x-2">
-    <RadioGroupItem value="option-one" id="option-one" />
-    <Label htmlFor="option-one">Option One</Label>
-  </div>
-  <div className="flex items-center space-x-2">
-    <RadioGroupItem value="option-two" id="option-two" />
-    <Label htmlFor="option-two">Option Two</Label>
-  </div>
-</RadioGroup>;
-```
-
-## Components
-
-### RadioGroup
-
-The root container that manages the radio group state.
-
-### RadioGroupItem
-
-An individual radio button within the group.
-
-## Examples
-
-### Horizontal Layout
-
-<Preview>
-  <RadioGroup defaultValue="sm" className="flex gap-4" orientation="horizontal">
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="sm" id="sm" />
-      <Label htmlFor="sm">Small</Label>
-    </div>
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="md" id="md" />
-      <Label htmlFor="md">Medium</Label>
-    </div>
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="lg" id="lg" />
-      <Label htmlFor="lg">Large</Label>
-    </div>
-  </RadioGroup>
-</Preview>
-
-```tsx
-<RadioGroup className="flex gap-4" orientation="horizontal">
-  ...
-</RadioGroup>
-```
-
-### Disabled
-
-<Preview centered={false}>
-  <RadioGroup defaultValue="option-one" disabled>
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="option-one" id="disabled-one" />
-      <Label htmlFor="disabled-one">Disabled One</Label>
-    </div>
-    <div className="flex items-center space-x-2">
-      <RadioGroupItem value="option-two" id="disabled-two" />
-      <Label htmlFor="disabled-two">Disabled Two</Label>
-    </div>
-  </RadioGroup>
-</Preview>
-
-```tsx
-<RadioGroup disabled>...</RadioGroup>
-```
-
-## Props
-
-### RadioGroup Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "Controlled selected value",
-      type: "string",
-      default: "undefined",
-    },
-    defaultValue: {
-      description: "Initial selected value",
-      type: "string",
-      default: "undefined",
-    },
-    onValueChange: {
-      description: "Callback when selection changes",
-      type: "(value: string) => void",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Disable all items in the group",
-      type: "boolean",
-      default: "false",
-    },
-    orientation: {
-      description: "Layout orientation",
-      type: "'horizontal' | 'vertical'",
-      default: "'vertical'",
-    },
-  }}
-/>
-
-### RadioGroupItem Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "The unique value for this item",
-      type: "string",
-      default: "Required",
-    },
-    disabled: {
-      description: "Disable this specific item",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/resizable.mdx b/apps/www/src/features/design/content/docs/components/resizable.mdx
deleted file mode 100644
index 43e43ca94..000000000
--- a/apps/www/src/features/design/content/docs/components/resizable.mdx
+++ /dev/null
@@ -1,144 +0,0 @@
----
-title: Resizable
-description: A component for creating resizable panel layouts.
----
-
-## Usage
-
-<Preview centered={false}>
-  <ResizablePanelGroup direction="horizontal" className="min-h-[200px] max-w-md rounded-lg border">
-    <ResizablePanel defaultSize={50}>
-      <div className="flex h-full items-center justify-center p-6">
-        <span className="font-semibold">Panel One</span>
-      </div>
-    </ResizablePanel>
-    <ResizableHandle />
-    <ResizablePanel defaultSize={50}>
-      <div className="flex h-full items-center justify-center p-6">
-        <span className="font-semibold">Panel Two</span>
-      </div>
-    </ResizablePanel>
-  </ResizablePanelGroup>
-</Preview>
-
-```tsx
-import { ResizableHandle, ResizablePanel, ResizablePanelGroup } from "@voidhash/ui";
-
-<ResizablePanelGroup direction="horizontal">
-  <ResizablePanel defaultSize={50}>Left Panel</ResizablePanel>
-  <ResizableHandle />
-  <ResizablePanel defaultSize={50}>Right Panel</ResizablePanel>
-</ResizablePanelGroup>;
-```
-
-## Components
-
-### ResizablePanelGroup
-
-The root container for resizable panels.
-
-### ResizablePanel
-
-An individual resizable panel.
-
-### ResizableHandle
-
-The draggable handle between panels.
-
-## Examples
-
-### Vertical Layout
-
-<Preview centered={false}>
-  <ResizablePanelGroup direction="vertical" className="min-h-[300px] max-w-md rounded-lg border">
-    <ResizablePanel defaultSize={25}>
-      <div className="flex h-full items-center justify-center p-6">
-        <span className="font-semibold">Header</span>
-      </div>
-    </ResizablePanel>
-    <ResizableHandle />
-    <ResizablePanel defaultSize={75}>
-      <div className="flex h-full items-center justify-center p-6">
-        <span className="font-semibold">Content</span>
-      </div>
-    </ResizablePanel>
-  </ResizablePanelGroup>
-</Preview>
-
-```tsx
-<ResizablePanelGroup direction="vertical">
-  <ResizablePanel defaultSize={25}>Header</ResizablePanel>
-  <ResizableHandle />
-  <ResizablePanel defaultSize={75}>Content</ResizablePanel>
-</ResizablePanelGroup>
-```
-
-### Three Panels
-
-<Preview centered={false}>
-  <ResizablePanelGroup direction="horizontal" className="min-h-[200px] max-w-lg rounded-lg border">
-    <ResizablePanel defaultSize={25}>
-      <div className="flex h-full items-center justify-center p-4">
-        <span className="font-semibold">Sidebar</span>
-      </div>
-    </ResizablePanel>
-    <ResizableHandle />
-    <ResizablePanel defaultSize={50}>
-      <div className="flex h-full items-center justify-center p-4">
-        <span className="font-semibold">Main</span>
-      </div>
-    </ResizablePanel>
-    <ResizableHandle />
-    <ResizablePanel defaultSize={25}>
-      <div className="flex h-full items-center justify-center p-4">
-        <span className="font-semibold">Panel</span>
-      </div>
-    </ResizablePanel>
-  </ResizablePanelGroup>
-</Preview>
-
-## Props
-
-### ResizablePanelGroup Props
-
-<TypeTable
-  type={{
-    direction: {
-      description: "Layout direction",
-      type: "'horizontal' | 'vertical'",
-      default: "Required",
-    },
-    onLayout: {
-      description: "Callback when layout changes",
-      type: "(sizes: number[]) => void",
-      default: "undefined",
-    },
-  }}
-/>
-
-### ResizablePanel Props
-
-<TypeTable
-  type={{
-    defaultSize: {
-      description: "Initial size as percentage",
-      type: "number",
-      default: "undefined",
-    },
-    minSize: {
-      description: "Minimum size as percentage",
-      type: "number",
-      default: "10",
-    },
-    maxSize: {
-      description: "Maximum size as percentage",
-      type: "number",
-      default: "undefined",
-    },
-    collapsible: {
-      description: "Allow panel to collapse",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/scroll-area.mdx b/apps/www/src/features/design/content/docs/components/scroll-area.mdx
deleted file mode 100644
index 56827d09b..000000000
--- a/apps/www/src/features/design/content/docs/components/scroll-area.mdx
+++ /dev/null
@@ -1,109 +0,0 @@
----
-title: Scroll Area
-description: A custom scrollbar component with consistent styling across browsers.
----
-
-## Usage
-
-<Preview centered={false}>
-  <ScrollArea className="h-72 w-48 rounded-md border">
-    <div className="p-4">
-      <h4 className="mb-4 text-sm font-medium leading-none">Tags</h4>
-      {Array.from({ length: 50 }).map((_, i) => (
-        <div key={i} className="text-sm py-1">
-          Tag {i + 1}
-        </div>
-      ))}
-    </div>
-  </ScrollArea>
-</Preview>
-
-```tsx
-import { ScrollArea } from "@voidhash/ui";
-
-<ScrollArea className="h-72 w-48 rounded-md border">
-  <div className="p-4">{/* Long content here */}</div>
-</ScrollArea>;
-```
-
-## Components
-
-### ScrollArea
-
-The main scrollable container with custom scrollbars.
-
-### ScrollBar
-
-The scrollbar track and thumb, customizable for horizontal or vertical.
-
-## Examples
-
-### Horizontal Scroll
-
-<Preview centered={false}>
-  <ScrollArea className="w-96 whitespace-nowrap rounded-md border">
-    <div className="flex w-max space-x-4 p-4">
-      {Array.from({ length: 20 }).map((_, i) => (
-        <div key={i} className="w-32 h-24 rounded-md bg-muted flex items-center justify-center">
-          Item {i + 1}
-        </div>
-      ))}
-    </div>
-    <ScrollBar orientation="horizontal" />
-  </ScrollArea>
-</Preview>
-
-```tsx
-<ScrollArea className="w-96 whitespace-nowrap rounded-md border">
-  <div className="flex w-max space-x-4 p-4">{/* Horizontal content */}</div>
-  <ScrollBar orientation="horizontal" />
-</ScrollArea>
-```
-
-### Card List
-
-<Preview centered={false}>
-  <ScrollArea className="h-80 w-full max-w-md rounded-md border">
-    <div className="p-4 space-y-4">
-      {Array.from({ length: 10 }).map((_, i) => (
-        <Card key={i}>
-          <CardHeader>
-            <CardTitle>Card {i + 1}</CardTitle>
-            <CardDescription>Card description</CardDescription>
-          </CardHeader>
-        </Card>
-      ))}
-    </div>
-  </ScrollArea>
-</Preview>
-
-## Props
-
-### ScrollArea Props
-
-<TypeTable
-  type={{
-    className: {
-      description: "CSS classes for the container",
-      type: "string",
-      default: "undefined",
-    },
-    type: {
-      description: "Scrollbar visibility behavior",
-      type: "'auto' | 'always' | 'scroll' | 'hover'",
-      default: "'hover'",
-    },
-  }}
-/>
-
-### ScrollBar Props
-
-<TypeTable
-  type={{
-    orientation: {
-      description: "Scrollbar orientation",
-      type: "'vertical' | 'horizontal'",
-      default: "'vertical'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/select.mdx b/apps/www/src/features/design/content/docs/components/select.mdx
deleted file mode 100644
index a80da32d8..000000000
--- a/apps/www/src/features/design/content/docs/components/select.mdx
+++ /dev/null
@@ -1,185 +0,0 @@
----
-title: Select
-description: A dropdown component for selecting from a list of options.
----
-
-## Usage
-
-<Preview>
-  <Select>
-    <SelectTrigger className="w-[180px]">
-      <SelectValue placeholder="Select a fruit" />
-    </SelectTrigger>
-    <SelectContent>
-      <SelectItem value="apple">Apple</SelectItem>
-      <SelectItem value="banana">Banana</SelectItem>
-      <SelectItem value="orange">Orange</SelectItem>
-      <SelectItem value="grape">Grape</SelectItem>
-    </SelectContent>
-  </Select>
-</Preview>
-
-```tsx
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@voidhash/ui";
-
-<Select>
-  <SelectTrigger className="w-[180px]">
-    <SelectValue placeholder="Select a fruit" />
-  </SelectTrigger>
-  <SelectContent>
-    <SelectItem value="apple">Apple</SelectItem>
-    <SelectItem value="banana">Banana</SelectItem>
-    <SelectItem value="orange">Orange</SelectItem>
-  </SelectContent>
-</Select>;
-```
-
-## Components
-
-### Select
-
-The root component managing select state.
-
-### SelectTrigger
-
-The button that toggles the dropdown.
-
-### SelectValue
-
-Displays the selected value or placeholder.
-
-### SelectContent
-
-The dropdown content container.
-
-### SelectItem
-
-An individual selectable option.
-
-### SelectGroup
-
-Groups related options together.
-
-### SelectLabel
-
-A label for a group of options.
-
-### SelectSeparator
-
-A visual separator between options.
-
-## Examples
-
-### With Groups
-
-<Preview>
-  <Select>
-    <SelectTrigger className="w-[200px]">
-      <SelectValue placeholder="Select a timezone" />
-    </SelectTrigger>
-    <SelectContent>
-      <SelectGroup>
-        <SelectLabel>North America</SelectLabel>
-        <SelectItem value="est">Eastern Time (ET)</SelectItem>
-        <SelectItem value="cst">Central Time (CT)</SelectItem>
-        <SelectItem value="pst">Pacific Time (PT)</SelectItem>
-      </SelectGroup>
-      <SelectSeparator />
-      <SelectGroup>
-        <SelectLabel>Europe</SelectLabel>
-        <SelectItem value="gmt">Greenwich Mean Time (GMT)</SelectItem>
-        <SelectItem value="cet">Central European Time (CET)</SelectItem>
-      </SelectGroup>
-    </SelectContent>
-  </Select>
-</Preview>
-
-```tsx
-<SelectGroup>
-  <SelectLabel>North America</SelectLabel>
-  <SelectItem value="est">Eastern Time</SelectItem>
-  <SelectItem value="cst">Central Time</SelectItem>
-</SelectGroup>
-<SelectSeparator />
-```
-
-### Small Size
-
-<Preview>
-  <Select>
-    <SelectTrigger size="sm" className="w-[150px]">
-      <SelectValue placeholder="Size" />
-    </SelectTrigger>
-    <SelectContent>
-      <SelectItem value="sm">Small</SelectItem>
-      <SelectItem value="md">Medium</SelectItem>
-      <SelectItem value="lg">Large</SelectItem>
-    </SelectContent>
-  </Select>
-</Preview>
-
-```tsx
-<SelectTrigger size="sm">
-  <SelectValue placeholder="Size" />
-</SelectTrigger>
-```
-
-### Disabled
-
-<Preview>
-  <Select disabled>
-    <SelectTrigger className="w-[180px]">
-      <SelectValue placeholder="Disabled" />
-    </SelectTrigger>
-    <SelectContent>
-      <SelectItem value="option">Option</SelectItem>
-    </SelectContent>
-  </Select>
-</Preview>
-
-## Props
-
-### Select Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "Controlled value",
-      type: "string",
-      default: "undefined",
-    },
-    onValueChange: {
-      description: "Callback when value changes",
-      type: "(value: string) => void",
-      default: "undefined",
-    },
-    defaultValue: {
-      description: "Initial value",
-      type: "string",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the select is disabled",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
-
-### SelectTrigger Props
-
-<TypeTable
-  type={{
-    size: {
-      description: "Size of the trigger",
-      type: "'default' | 'sm'",
-      default: "'default'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/separator.mdx b/apps/www/src/features/design/content/docs/components/separator.mdx
deleted file mode 100644
index ffe2ddb9e..000000000
--- a/apps/www/src/features/design/content/docs/components/separator.mdx
+++ /dev/null
@@ -1,84 +0,0 @@
----
-title: Separator
-description: Visually separates content into distinct groups.
----
-
-## Usage
-
-<Preview centered={false}>
-  <div className="w-full max-w-md">
-    <div className="space-y-1">
-      <h4 className="font-medium text-sm leading-none">Radix Primitives</h4>
-      <p className="text-sm text-muted-foreground">An open-source UI component library.</p>
-    </div>
-    <Separator className="my-4" />
-    <div className="flex h-5 items-center space-x-4 text-sm">
-      <div>Blog</div>
-      <Separator orientation="vertical" />
-      <div>Docs</div>
-      <Separator orientation="vertical" />
-      <div>Source</div>
-    </div>
-  </div>
-</Preview>
-
-```tsx
-import { Separator } from "@voidhash/ui";
-
-<div>
-  <div>Content above</div>
-  <Separator className="my-4" />
-  <div>Content below</div>
-</div>;
-```
-
-## Examples
-
-### Horizontal
-
-<Preview centered={false}>
-  <div className="w-full max-w-md space-y-4">
-    <p>First section</p>
-    <Separator />
-    <p>Second section</p>
-    <Separator />
-    <p>Third section</p>
-  </div>
-</Preview>
-
-```tsx
-<Separator />
-```
-
-### Vertical
-
-<Preview>
-  <div className="flex h-5 items-center space-x-4 text-sm">
-    <div>Home</div>
-    <Separator orientation="vertical" />
-    <div>About</div>
-    <Separator orientation="vertical" />
-    <div>Contact</div>
-  </div>
-</Preview>
-
-```tsx
-<Separator orientation="vertical" />
-```
-
-## Props
-
-<TypeTable
-  type={{
-    orientation: {
-      description: "The orientation of the separator",
-      type: "'horizontal' | 'vertical'",
-      default: "'horizontal'",
-    },
-    decorative: {
-      description: "Whether the separator is purely decorative",
-      type: "boolean",
-      default: "true",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/sheet.mdx b/apps/www/src/features/design/content/docs/components/sheet.mdx
deleted file mode 100644
index 1f1e6fe0e..000000000
--- a/apps/www/src/features/design/content/docs/components/sheet.mdx
+++ /dev/null
@@ -1,177 +0,0 @@
----
-title: Sheet
-description: A panel that slides out from the edge of the screen.
----
-
-## Usage
-
-<Preview>
-  <Sheet>
-    <SheetTrigger asChild>
-      <Button variant="outline">Open Sheet</Button>
-    </SheetTrigger>
-    <SheetContent>
-      <SheetHeader>
-        <SheetTitle>Sheet Title</SheetTitle>
-        <SheetDescription>
-          This is a sheet description. Make changes to your settings here.
-        </SheetDescription>
-      </SheetHeader>
-      <div className="p-4">
-        <p>Sheet content goes here.</p>
-      </div>
-      <SheetFooter>
-        <Button>Save changes</Button>
-      </SheetFooter>
-    </SheetContent>
-  </Sheet>
-</Preview>
-
-```tsx
-import {
-  Sheet,
-  SheetContent,
-  SheetDescription,
-  SheetFooter,
-  SheetHeader,
-  SheetTitle,
-  SheetTrigger,
-} from "@voidhash/ui";
-
-<Sheet>
-  <SheetTrigger asChild>
-    <Button variant="outline">Open Sheet</Button>
-  </SheetTrigger>
-  <SheetContent>
-    <SheetHeader>
-      <SheetTitle>Sheet Title</SheetTitle>
-      <SheetDescription>Sheet description.</SheetDescription>
-    </SheetHeader>
-    <div className="p-4">Content here</div>
-    <SheetFooter>
-      <Button>Save</Button>
-    </SheetFooter>
-  </SheetContent>
-</Sheet>;
-```
-
-## Components
-
-### Sheet
-
-The root component managing sheet state.
-
-### SheetTrigger
-
-The element that opens the sheet.
-
-### SheetContent
-
-The sliding panel content.
-
-### SheetHeader
-
-Container for title and description.
-
-### SheetTitle
-
-The sheet's heading.
-
-### SheetDescription
-
-A description of the sheet's purpose.
-
-### SheetFooter
-
-Container for action buttons.
-
-### SheetClose
-
-An element that closes the sheet.
-
-## Examples
-
-### Different Sides
-
-<Preview>
-  <div className="flex gap-2">
-    <Sheet>
-      <SheetTrigger asChild>
-        <Button variant="outline">Left</Button>
-      </SheetTrigger>
-      <SheetContent side="left">
-        <SheetHeader>
-          <SheetTitle>Left Side</SheetTitle>
-        </SheetHeader>
-      </SheetContent>
-    </Sheet>
-    <Sheet>
-      <SheetTrigger asChild>
-        <Button variant="outline">Right</Button>
-      </SheetTrigger>
-      <SheetContent side="right">
-        <SheetHeader>
-          <SheetTitle>Right Side</SheetTitle>
-        </SheetHeader>
-      </SheetContent>
-    </Sheet>
-    <Sheet>
-      <SheetTrigger asChild>
-        <Button variant="outline">Top</Button>
-      </SheetTrigger>
-      <SheetContent side="top">
-        <SheetHeader>
-          <SheetTitle>Top Side</SheetTitle>
-        </SheetHeader>
-      </SheetContent>
-    </Sheet>
-    <Sheet>
-      <SheetTrigger asChild>
-        <Button variant="outline">Bottom</Button>
-      </SheetTrigger>
-      <SheetContent side="bottom">
-        <SheetHeader>
-          <SheetTitle>Bottom Side</SheetTitle>
-        </SheetHeader>
-      </SheetContent>
-    </Sheet>
-  </div>
-</Preview>
-
-```tsx
-<SheetContent side="left">...</SheetContent>
-<SheetContent side="right">...</SheetContent>
-<SheetContent side="top">...</SheetContent>
-<SheetContent side="bottom">...</SheetContent>
-```
-
-## Props
-
-### SheetContent Props
-
-<TypeTable
-  type={{
-    side: {
-      description: "The edge of the screen to slide from",
-      type: "'top' | 'right' | 'bottom' | 'left'",
-      default: "'right'",
-    },
-  }}
-/>
-
-### Sheet Props
-
-<TypeTable
-  type={{
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/sidebar.mdx b/apps/www/src/features/design/content/docs/components/sidebar.mdx
deleted file mode 100644
index 1fbcde07b..000000000
--- a/apps/www/src/features/design/content/docs/components/sidebar.mdx
+++ /dev/null
@@ -1,179 +0,0 @@
----
-title: Sidebar
-description: A collapsible sidebar component for application navigation.
----
-
-## Usage
-
-The Sidebar component provides a complete sidebar navigation system with collapsible behavior.
-
-```tsx
-import {
-  Sidebar,
-  SidebarContent,
-  SidebarGroup,
-  SidebarGroupContent,
-  SidebarGroupLabel,
-  SidebarHeader,
-  SidebarMenu,
-  SidebarMenuButton,
-  SidebarMenuItem,
-  SidebarProvider,
-} from "@voidhash/ui";
-
-<SidebarProvider>
-  <Sidebar>
-    <SidebarHeader>
-      <h2>App Name</h2>
-    </SidebarHeader>
-    <SidebarContent>
-      <SidebarGroup>
-        <SidebarGroupLabel>Navigation</SidebarGroupLabel>
-        <SidebarGroupContent>
-          <SidebarMenu>
-            <SidebarMenuItem>
-              <SidebarMenuButton asChild>
-                <a href="/dashboard">
-                  <HomeIcon /> Dashboard
-                </a>
-              </SidebarMenuButton>
-            </SidebarMenuItem>
-            <SidebarMenuItem>
-              <SidebarMenuButton asChild>
-                <a href="/settings">
-                  <SettingsIcon /> Settings
-                </a>
-              </SidebarMenuButton>
-            </SidebarMenuItem>
-          </SidebarMenu>
-        </SidebarGroupContent>
-      </SidebarGroup>
-    </SidebarContent>
-  </Sidebar>
-  <main>Content</main>
-</SidebarProvider>;
-```
-
-## Components
-
-### SidebarProvider
-
-Provides context for sidebar state management.
-
-### Sidebar
-
-The main sidebar container.
-
-### SidebarHeader
-
-The header section of the sidebar.
-
-### SidebarContent
-
-The main content area with scroll support.
-
-### SidebarFooter
-
-The footer section of the sidebar.
-
-### SidebarGroup
-
-A group of related menu items.
-
-### SidebarGroupLabel
-
-A label for a group of items.
-
-### SidebarGroupContent
-
-The content of a group.
-
-### SidebarMenu
-
-A navigation menu container.
-
-### SidebarMenuItem
-
-A single menu item.
-
-### SidebarMenuButton
-
-A clickable button within a menu item.
-
-### SidebarTrigger
-
-A button to toggle sidebar visibility.
-
-### SidebarRail
-
-The collapsed rail for the sidebar.
-
-## Examples
-
-### With useSidebar Hook
-
-```tsx
-import { useSidebar } from "@voidhash/ui";
-
-function SidebarToggle() {
-  const { open, setOpen, toggleSidebar } = useSidebar();
-
-  return <Button onClick={toggleSidebar}>{open ? "Close" : "Open"} Sidebar</Button>;
-}
-```
-
-### Controlled State
-
-```tsx
-const [open, setOpen] = useState(true);
-
-<SidebarProvider open={open} onOpenChange={setOpen}>
-  <Sidebar>...</Sidebar>
-</SidebarProvider>;
-```
-
-## Props
-
-### SidebarProvider Props
-
-<TypeTable
-  type={{
-    open: {
-      description: "Controlled open state",
-      type: "boolean",
-      default: "undefined",
-    },
-    onOpenChange: {
-      description: "Callback when open state changes",
-      type: "(open: boolean) => void",
-      default: "undefined",
-    },
-    defaultOpen: {
-      description: "Initial open state",
-      type: "boolean",
-      default: "true",
-    },
-  }}
-/>
-
-### Sidebar Props
-
-<TypeTable
-  type={{
-    side: {
-      description: "Which side to display",
-      type: "'left' | 'right'",
-      default: "'left'",
-    },
-    variant: {
-      description: "Sidebar variant",
-      type: "'sidebar' | 'floating' | 'inset'",
-      default: "'sidebar'",
-    },
-    collapsible: {
-      description: "Collapse behavior",
-      type: "'offcanvas' | 'icon' | 'none'",
-      default: "'offcanvas'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/skeleton.mdx b/apps/www/src/features/design/content/docs/components/skeleton.mdx
deleted file mode 100644
index 225bce0e8..000000000
--- a/apps/www/src/features/design/content/docs/components/skeleton.mdx
+++ /dev/null
@@ -1,91 +0,0 @@
----
-title: Skeleton
-description: A placeholder loading state for content that is still loading.
----
-
-## Usage
-
-<Preview centered={false}>
-  <div className="flex items-center space-x-4">
-    <Skeleton className="h-12 w-12 rounded-full" />
-    <div className="space-y-2">
-      <Skeleton className="h-4 w-[250px]" />
-      <Skeleton className="h-4 w-[200px]" />
-    </div>
-  </div>
-</Preview>
-
-```tsx
-import { Skeleton } from "@voidhash/ui";
-
-<div className="flex items-center space-x-4">
-  <Skeleton className="h-12 w-12 rounded-full" />
-  <div className="space-y-2">
-    <Skeleton className="h-4 w-[250px]" />
-    <Skeleton className="h-4 w-[200px]" />
-  </div>
-</div>;
-```
-
-## Examples
-
-### Card Skeleton
-
-<Preview centered={false}>
-  <div className="flex flex-col space-y-3 w-full max-w-md">
-    <Skeleton className="h-[125px] w-full rounded-xl" />
-    <div className="space-y-2">
-      <Skeleton className="h-4 w-full" />
-      <Skeleton className="h-4 w-4/5" />
-    </div>
-  </div>
-</Preview>
-
-```tsx
-<div className="flex flex-col space-y-3">
-  <Skeleton className="h-[125px] w-full rounded-xl" />
-  <div className="space-y-2">
-    <Skeleton className="h-4 w-full" />
-    <Skeleton className="h-4 w-4/5" />
-  </div>
-</div>
-```
-
-### List Skeleton
-
-<Preview centered={false}>
-  <div className="space-y-4 w-full max-w-md">
-    {[1, 2, 3].map((i) => (
-      <div key={i} className="flex items-center space-x-4">
-        <Skeleton className="h-10 w-10 rounded-full" />
-        <div className="space-y-2 flex-1">
-          <Skeleton className="h-4 w-3/4" />
-          <Skeleton className="h-3 w-1/2" />
-        </div>
-      </div>
-    ))}
-  </div>
-</Preview>
-
-### Table Skeleton
-
-<Preview centered={false}>
-  <div className="w-full max-w-md space-y-2">
-    <Skeleton className="h-8 w-full" />
-    <Skeleton className="h-12 w-full" />
-    <Skeleton className="h-12 w-full" />
-    <Skeleton className="h-12 w-full" />
-  </div>
-</Preview>
-
-## Props
-
-<TypeTable
-  type={{
-    className: {
-      description: "CSS classes for width, height, and shape",
-      type: "string",
-      default: "undefined",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/slider.mdx b/apps/www/src/features/design/content/docs/components/slider.mdx
deleted file mode 100644
index 4430ab1fc..000000000
--- a/apps/www/src/features/design/content/docs/components/slider.mdx
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: Slider
-description: An input component for selecting a value from a range.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Slider defaultValue={[50]} max={100} step={1} className="w-full max-w-md" />
-</Preview>
-
-```tsx
-import { Slider } from "@voidhash/ui";
-
-<Slider defaultValue={[50]} max={100} step={1} />;
-```
-
-## Examples
-
-### Range Slider
-
-<Preview centered={false}>
-  <Slider defaultValue={[25, 75]} max={100} step={1} className="w-full max-w-md" />
-</Preview>
-
-```tsx
-<Slider defaultValue={[25, 75]} max={100} step={1} />
-```
-
-### With Step
-
-<Preview centered={false}>
-  <Slider defaultValue={[50]} max={100} step={10} className="w-full max-w-md" />
-</Preview>
-
-```tsx
-<Slider defaultValue={[50]} max={100} step={10} />
-```
-
-### Disabled
-
-<Preview centered={false}>
-  <Slider defaultValue={[50]} max={100} disabled className="w-full max-w-md" />
-</Preview>
-
-```tsx
-<Slider disabled defaultValue={[50]} />
-```
-
-### Vertical Orientation
-
-<Preview>
-  <Slider defaultValue={[50]} max={100} orientation="vertical" className="h-44" />
-</Preview>
-
-```tsx
-<Slider defaultValue={[50]} orientation="vertical" className="h-44" />
-```
-
-## Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "Controlled value(s)",
-      type: "number[]",
-      default: "undefined",
-    },
-    defaultValue: {
-      description: "Initial value(s)",
-      type: "number[]",
-      default: "[min, max]",
-    },
-    onValueChange: {
-      description: "Callback when value changes",
-      type: "(value: number[]) => void",
-      default: "undefined",
-    },
-    min: {
-      description: "Minimum value",
-      type: "number",
-      default: "0",
-    },
-    max: {
-      description: "Maximum value",
-      type: "number",
-      default: "100",
-    },
-    step: {
-      description: "Step increment",
-      type: "number",
-      default: "1",
-    },
-    orientation: {
-      description: "Slider orientation",
-      type: "'horizontal' | 'vertical'",
-      default: "'horizontal'",
-    },
-    disabled: {
-      description: "Whether the slider is disabled",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/sonner.mdx b/apps/www/src/features/design/content/docs/components/sonner.mdx
deleted file mode 100644
index 090024575..000000000
--- a/apps/www/src/features/design/content/docs/components/sonner.mdx
+++ /dev/null
@@ -1,120 +0,0 @@
----
-title: Sonner (Toast)
-description: A toast notification component for displaying brief messages.
----
-
-## Usage
-
-To use toasts, add the `Toaster` component to your app layout:
-
-```tsx
-import { Toaster } from "@voidhash/ui";
-
-export default function Layout({ children }) {
-  return (
-    <>
-      {children}
-      <Toaster />
-    </>
-  );
-}
-```
-
-Then use the `toast` function from sonner to show notifications:
-
-```tsx
-import { toast } from "sonner";
-
-toast("Event has been created", {
-  description: "Sunday, December 03, 2023 at 9:00 AM",
-});
-```
-
-## Examples
-
-### Success Toast
-
-```tsx
-toast.success("Success!", {
-  description: "Your changes have been saved.",
-});
-```
-
-### Error Toast
-
-```tsx
-toast.error("Error!", {
-  description: "Something went wrong.",
-});
-```
-
-### Warning Toast
-
-```tsx
-toast.warning("Warning!", {
-  description: "Please check your input.",
-});
-```
-
-### Info Toast
-
-```tsx
-toast.info("Info", {
-  description: "Here's some information.",
-});
-```
-
-### With Action
-
-```tsx
-toast("Event deleted", {
-  action: {
-    label: "Undo",
-    onClick: () => console.log("Undo"),
-  },
-});
-```
-
-### Promise Toast
-
-```tsx
-toast.promise(saveData(), {
-  loading: "Saving...",
-  success: "Data saved!",
-  error: "Failed to save.",
-});
-```
-
-## Props
-
-### Toaster Props
-
-<TypeTable
-  type={{
-    position: {
-      description: "Position of the toasts",
-      type: "'top-left' | 'top-right' | 'bottom-left' | 'bottom-right' | 'top-center' | 'bottom-center'",
-      default: "'bottom-right'",
-    },
-    richColors: {
-      description: "Use rich colors for toast types",
-      type: "boolean",
-      default: "false",
-    },
-    expand: {
-      description: "Expand toasts by default",
-      type: "boolean",
-      default: "false",
-    },
-    duration: {
-      description: "Default duration in ms",
-      type: "number",
-      default: "4000",
-    },
-    closeButton: {
-      description: "Show close button",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/switch.mdx b/apps/www/src/features/design/content/docs/components/switch.mdx
deleted file mode 100644
index 4aed7def8..000000000
--- a/apps/www/src/features/design/content/docs/components/switch.mdx
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: Switch
-description: A control that allows the user to toggle between on and off states.
----
-
-## Usage
-
-<Preview>
-  <div className="flex items-center gap-2">
-    <Switch id="airplane-mode" />
-    <Label htmlFor="airplane-mode">Airplane Mode</Label>
-  </div>
-</Preview>
-
-```tsx
-import { Switch } from "@voidhash/ui";
-import { Label } from "@voidhash/ui";
-
-<div className="flex items-center gap-2">
-  <Switch id="airplane-mode" />
-  <Label htmlFor="airplane-mode">Airplane Mode</Label>
-</div>;
-```
-
-## Examples
-
-### Checked by Default
-
-<Preview>
-  <div className="flex items-center gap-2">
-    <Switch id="default-on" defaultChecked />
-    <Label htmlFor="default-on">Notifications enabled</Label>
-  </div>
-</Preview>
-
-```tsx
-<Switch defaultChecked />
-```
-
-### Disabled
-
-<Preview>
-  <div className="flex flex-col gap-4">
-    <div className="flex items-center gap-2">
-      <Switch id="disabled-off" disabled />
-      <Label htmlFor="disabled-off">Disabled off</Label>
-    </div>
-    <div className="flex items-center gap-2">
-      <Switch id="disabled-on" disabled defaultChecked />
-      <Label htmlFor="disabled-on">Disabled on</Label>
-    </div>
-  </div>
-</Preview>
-
-```tsx
-<Switch disabled />
-<Switch disabled defaultChecked />
-```
-
-### In a Form
-
-<Preview centered={false}>
-  <div className="grid gap-4 w-full max-w-sm">
-    <div className="flex items-center justify-between">
-      <Label htmlFor="marketing">Marketing emails</Label>
-      <Switch id="marketing" />
-    </div>
-    <div className="flex items-center justify-between">
-      <Label htmlFor="security">Security alerts</Label>
-      <Switch id="security" defaultChecked />
-    </div>
-  </div>
-</Preview>
-
-## Props
-
-<TypeTable
-  type={{
-    checked: {
-      description: "Controlled checked state",
-      type: "boolean",
-      default: "undefined",
-    },
-    defaultChecked: {
-      description: "Initial checked state",
-      type: "boolean",
-      default: "false",
-    },
-    onCheckedChange: {
-      description: "Callback when checked state changes",
-      type: "(checked: boolean) => void",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the switch is disabled",
-      type: "boolean",
-      default: "false",
-    },
-    required: {
-      description: "Whether the switch is required",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/table.mdx b/apps/www/src/features/design/content/docs/components/table.mdx
deleted file mode 100644
index 94266f5c5..000000000
--- a/apps/www/src/features/design/content/docs/components/table.mdx
+++ /dev/null
@@ -1,148 +0,0 @@
----
-title: Table
-description: A responsive table component for displaying tabular data.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Table>
-    <TableHeader>
-      <TableRow>
-        <TableHead>Name</TableHead>
-        <TableHead>Email</TableHead>
-        <TableHead>Role</TableHead>
-      </TableRow>
-    </TableHeader>
-    <TableBody>
-      <TableRow>
-        <TableCell>John Doe</TableCell>
-        <TableCell>john@example.com</TableCell>
-        <TableCell>Admin</TableCell>
-      </TableRow>
-      <TableRow>
-        <TableCell>Jane Smith</TableCell>
-        <TableCell>jane@example.com</TableCell>
-        <TableCell>User</TableCell>
-      </TableRow>
-      <TableRow>
-        <TableCell>Bob Wilson</TableCell>
-        <TableCell>bob@example.com</TableCell>
-        <TableCell>User</TableCell>
-      </TableRow>
-    </TableBody>
-  </Table>
-</Preview>
-
-```tsx
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from "@voidhash/ui";
-
-<Table>
-  <TableHeader>
-    <TableRow>
-      <TableHead>Name</TableHead>
-      <TableHead>Email</TableHead>
-    </TableRow>
-  </TableHeader>
-  <TableBody>
-    <TableRow>
-      <TableCell>John Doe</TableCell>
-      <TableCell>john@example.com</TableCell>
-    </TableRow>
-  </TableBody>
-</Table>;
-```
-
-## Components
-
-### Table
-
-The root table container with horizontal scroll support.
-
-### TableHeader
-
-The table header section containing column headers.
-
-### TableBody
-
-The table body section containing data rows.
-
-### TableFooter
-
-The table footer section for summary data.
-
-### TableRow
-
-A single row in the table.
-
-### TableHead
-
-A header cell in the table.
-
-### TableCell
-
-A data cell in the table.
-
-### TableCaption
-
-An optional caption describing the table.
-
-## Examples
-
-### With Caption and Footer
-
-<Preview centered={false}>
-  <Table>
-    <TableCaption>A list of recent invoices.</TableCaption>
-    <TableHeader>
-      <TableRow>
-        <TableHead>Invoice</TableHead>
-        <TableHead>Status</TableHead>
-        <TableHead className="text-right">Amount</TableHead>
-      </TableRow>
-    </TableHeader>
-    <TableBody>
-      <TableRow>
-        <TableCell>INV001</TableCell>
-        <TableCell>Paid</TableCell>
-        <TableCell className="text-right">$250.00</TableCell>
-      </TableRow>
-      <TableRow>
-        <TableCell>INV002</TableCell>
-        <TableCell>Pending</TableCell>
-        <TableCell className="text-right">$150.00</TableCell>
-      </TableRow>
-    </TableBody>
-    <TableFooter>
-      <TableRow>
-        <TableCell colSpan={2}>Total</TableCell>
-        <TableCell className="text-right">$400.00</TableCell>
-      </TableRow>
-    </TableFooter>
-  </Table>
-</Preview>
-
-```tsx
-<Table>
-  <TableCaption>A list of recent invoices.</TableCaption>
-  <TableHeader>...</TableHeader>
-  <TableBody>...</TableBody>
-  <TableFooter>
-    <TableRow>
-      <TableCell colSpan={2}>Total</TableCell>
-      <TableCell className="text-right">$400.00</TableCell>
-    </TableRow>
-  </TableFooter>
-</Table>
-```
-
-## Props
-
-All table components accept standard HTML table element props.
diff --git a/apps/www/src/features/design/content/docs/components/tabs.mdx b/apps/www/src/features/design/content/docs/components/tabs.mdx
deleted file mode 100644
index fd1c2bce0..000000000
--- a/apps/www/src/features/design/content/docs/components/tabs.mdx
+++ /dev/null
@@ -1,126 +0,0 @@
----
-title: Tabs
-description: A set of layered sections of content that display one panel at a time.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Tabs defaultValue="account" className="w-full max-w-md">
-    <TabsList>
-      <TabsTrigger value="account">Account</TabsTrigger>
-      <TabsTrigger value="password">Password</TabsTrigger>
-    </TabsList>
-    <TabsContent value="account">
-      <Card>
-        <CardHeader>
-          <CardTitle>Account</CardTitle>
-          <CardDescription>Manage your account settings.</CardDescription>
-        </CardHeader>
-        <CardContent>
-          <p>Account settings content here.</p>
-        </CardContent>
-      </Card>
-    </TabsContent>
-    <TabsContent value="password">
-      <Card>
-        <CardHeader>
-          <CardTitle>Password</CardTitle>
-          <CardDescription>Change your password.</CardDescription>
-        </CardHeader>
-        <CardContent>
-          <p>Password settings content here.</p>
-        </CardContent>
-      </Card>
-    </TabsContent>
-  </Tabs>
-</Preview>
-
-```tsx
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@voidhash/ui";
-
-<Tabs defaultValue="account">
-  <TabsList>
-    <TabsTrigger value="account">Account</TabsTrigger>
-    <TabsTrigger value="password">Password</TabsTrigger>
-  </TabsList>
-  <TabsContent value="account">Account content here.</TabsContent>
-  <TabsContent value="password">Password content here.</TabsContent>
-</Tabs>;
-```
-
-## Components
-
-### Tabs
-
-The root container that manages tab state.
-
-### TabsList
-
-The container for tab triggers.
-
-### TabsTrigger
-
-A button that activates its associated content panel.
-
-### TabsContent
-
-The content panel associated with a trigger.
-
-## Examples
-
-### With Icons
-
-<Preview centered={false}>
-  <Tabs defaultValue="overview" className="w-full max-w-md">
-    <TabsList>
-      <TabsTrigger value="overview">
-        <UserIcon /> Overview
-      </TabsTrigger>
-      <TabsTrigger value="settings">
-        <SettingsIcon /> Settings
-      </TabsTrigger>
-    </TabsList>
-    <TabsContent value="overview" className="p-4">
-      Overview content
-    </TabsContent>
-    <TabsContent value="settings" className="p-4">
-      Settings content
-    </TabsContent>
-  </Tabs>
-</Preview>
-
-```tsx
-<TabsTrigger value="overview">
-  <UserIcon /> Overview
-</TabsTrigger>
-```
-
-## Props
-
-### Tabs Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "Controlled active tab",
-      type: "string",
-      default: "undefined",
-    },
-    defaultValue: {
-      description: "Initial active tab",
-      type: "string",
-      default: "undefined",
-    },
-    onValueChange: {
-      description: "Callback when active tab changes",
-      type: "(value: string) => void",
-      default: "undefined",
-    },
-    orientation: {
-      description: "Orientation of the tabs",
-      type: "'horizontal' | 'vertical'",
-      default: "'horizontal'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/textarea.mdx b/apps/www/src/features/design/content/docs/components/textarea.mdx
deleted file mode 100644
index f08c262d2..000000000
--- a/apps/www/src/features/design/content/docs/components/textarea.mdx
+++ /dev/null
@@ -1,96 +0,0 @@
----
-title: Textarea
-description: A multi-line text input for longer form content.
----
-
-## Usage
-
-<Preview centered={false}>
-  <Textarea placeholder="Type your message here..." className="w-full max-w-md" />
-</Preview>
-
-```tsx
-import { Textarea } from "@voidhash/ui";
-
-<Textarea placeholder="Type your message here..." />;
-```
-
-## Examples
-
-### With Label
-
-<Preview centered={false}>
-  <div className="grid gap-2 w-full max-w-md">
-    <Label htmlFor="message">Message</Label>
-    <Textarea id="message" placeholder="Enter your message..." />
-  </div>
-</Preview>
-
-```tsx
-<div className="grid gap-2">
-  <Label htmlFor="message">Message</Label>
-  <Textarea id="message" placeholder="Enter your message..." />
-</div>
-```
-
-### Disabled
-
-<Preview centered={false}>
-  <Textarea disabled placeholder="Disabled textarea" className="w-full max-w-md" />
-</Preview>
-
-```tsx
-<Textarea disabled placeholder="Disabled textarea" />
-```
-
-### With Error State
-
-<Preview centered={false}>
-  <Textarea aria-invalid placeholder="Invalid textarea" className="w-full max-w-md" />
-</Preview>
-
-```tsx
-<Textarea aria-invalid placeholder="Invalid textarea" />
-```
-
-### With Default Value
-
-<Preview centered={false}>
-  <Textarea
-    defaultValue="This is the default content of the textarea."
-    className="w-full max-w-md"
-  />
-</Preview>
-
-```tsx
-<Textarea defaultValue="This is the default content..." />
-```
-
-## Props
-
-The Textarea component accepts all standard HTML textarea attributes.
-
-<TypeTable
-  type={{
-    placeholder: {
-      description: "Placeholder text",
-      type: "string",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the textarea is disabled",
-      type: "boolean",
-      default: "false",
-    },
-    rows: {
-      description: "Number of visible text lines",
-      type: "number",
-      default: "undefined",
-    },
-    "aria-invalid": {
-      description: "Indicates an error state",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/toggle-group.mdx b/apps/www/src/features/design/content/docs/components/toggle-group.mdx
deleted file mode 100644
index 442ae0d77..000000000
--- a/apps/www/src/features/design/content/docs/components/toggle-group.mdx
+++ /dev/null
@@ -1,136 +0,0 @@
----
-title: Toggle Group
-description: A set of two-state buttons that can be toggled on or off.
----
-
-## Usage
-
-<Preview>
-  <ToggleGroup type="single" defaultValue="center">
-    <ToggleGroupItem value="left" aria-label="Align left">
-      <ChevronLeftIcon />
-    </ToggleGroupItem>
-    <ToggleGroupItem value="center" aria-label="Align center">
-      <MenuIcon />
-    </ToggleGroupItem>
-    <ToggleGroupItem value="right" aria-label="Align right">
-      <ChevronRightIcon />
-    </ToggleGroupItem>
-  </ToggleGroup>
-</Preview>
-
-```tsx
-import { ToggleGroup, ToggleGroupItem } from "@voidhash/ui";
-
-<ToggleGroup type="single" defaultValue="center">
-  <ToggleGroupItem value="left" aria-label="Align left">
-    <AlignLeftIcon />
-  </ToggleGroupItem>
-  <ToggleGroupItem value="center" aria-label="Align center">
-    <AlignCenterIcon />
-  </ToggleGroupItem>
-  <ToggleGroupItem value="right" aria-label="Align right">
-    <AlignRightIcon />
-  </ToggleGroupItem>
-</ToggleGroup>;
-```
-
-## Components
-
-### ToggleGroup
-
-The root container managing toggle group state.
-
-### ToggleGroupItem
-
-An individual toggle button within the group.
-
-## Examples
-
-### Multiple Selection
-
-<Preview>
-  <ToggleGroup type="multiple">
-    <ToggleGroupItem value="bold" aria-label="Bold">
-      <BoldIcon />
-    </ToggleGroupItem>
-    <ToggleGroupItem value="italic" aria-label="Italic">
-      <ItalicIcon />
-    </ToggleGroupItem>
-    <ToggleGroupItem value="underline" aria-label="Underline">
-      <UnderlineIcon />
-    </ToggleGroupItem>
-  </ToggleGroup>
-</Preview>
-
-```tsx
-<ToggleGroup type="multiple">
-  <ToggleGroupItem value="bold">Bold</ToggleGroupItem>
-  <ToggleGroupItem value="italic">Italic</ToggleGroupItem>
-</ToggleGroup>
-```
-
-### With Spacing
-
-<Preview>
-  <ToggleGroup type="single" spacing={4} defaultValue="a">
-    <ToggleGroupItem value="a">A</ToggleGroupItem>
-    <ToggleGroupItem value="b">B</ToggleGroupItem>
-    <ToggleGroupItem value="c">C</ToggleGroupItem>
-  </ToggleGroup>
-</Preview>
-
-```tsx
-<ToggleGroup type="single" spacing={4}>
-  ...
-</ToggleGroup>
-```
-
-## Props
-
-### ToggleGroup Props
-
-<TypeTable
-  type={{
-    type: {
-      description: "Single or multiple selection",
-      type: "'single' | 'multiple'",
-      default: "Required",
-    },
-    value: {
-      description: "Controlled value(s)",
-      type: "string | string[]",
-      default: "undefined",
-    },
-    defaultValue: {
-      description: "Initial value(s)",
-      type: "string | string[]",
-      default: "undefined",
-    },
-    onValueChange: {
-      description: "Callback when value changes",
-      type: "(value: string | string[]) => void",
-      default: "undefined",
-    },
-    variant: {
-      description: "Visual variant",
-      type: "'default' | 'primary'",
-      default: "'default'",
-    },
-    size: {
-      description: "Size of toggle items",
-      type: "'default' | 'sm' | 'lg'",
-      default: "'default'",
-    },
-    spacing: {
-      description: "Gap between items in pixels",
-      type: "number",
-      default: "0",
-    },
-    disabled: {
-      description: "Disable all items",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/toggle.mdx b/apps/www/src/features/design/content/docs/components/toggle.mdx
deleted file mode 100644
index 78599b86a..000000000
--- a/apps/www/src/features/design/content/docs/components/toggle.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-title: Toggle
-description: A two-state button that can be either on or off.
----
-
-## Usage
-
-<Preview>
-  <Toggle aria-label="Toggle bold">
-    <BoldIcon />
-  </Toggle>
-</Preview>
-
-```tsx
-import { Toggle } from "@voidhash/ui";
-import { BoldIcon } from "lucide-react";
-
-<Toggle aria-label="Toggle bold">
-  <BoldIcon />
-</Toggle>;
-```
-
-## Variants
-
-<div className="flex flex-wrap gap-4">
-  <Preview className="p-4">
-    <Toggle variant="default" aria-label="Default">
-      <BoldIcon />
-    </Toggle>
-  </Preview>
-  <Preview className="p-4">
-    <Toggle variant="primary" aria-label="Primary">
-      <UnderlineIcon />
-    </Toggle>
-  </Preview>
-</div>
-
-```tsx
-<Toggle variant="default">...</Toggle>
-<Toggle variant="primary">...</Toggle>
-```
-
-## Sizes
-
-<div className="flex flex-wrap items-center gap-4">
-  <Preview className="p-4">
-    <Toggle size="sm" aria-label="Small">
-      <BoldIcon />
-    </Toggle>
-  </Preview>
-  <Preview className="p-4">
-    <Toggle size="default" aria-label="Default">
-      <BoldIcon />
-    </Toggle>
-  </Preview>
-  <Preview className="p-4">
-    <Toggle size="lg" aria-label="Large">
-      <BoldIcon />
-    </Toggle>
-  </Preview>
-</div>
-
-```tsx
-<Toggle size="sm">...</Toggle>
-<Toggle size="default">...</Toggle>
-<Toggle size="lg">...</Toggle>
-```
-
-## Examples
-
-### With Text
-
-<Preview>
-  <Toggle aria-label="Toggle italic">
-    <ItalicIcon /> Italic
-  </Toggle>
-</Preview>
-
-```tsx
-<Toggle aria-label="Toggle italic">
-  <ItalicIcon /> Italic
-</Toggle>
-```
-
-### Pressed by Default
-
-<Preview>
-  <Toggle defaultPressed aria-label="Toggle">
-    <BoldIcon />
-  </Toggle>
-</Preview>
-
-```tsx
-<Toggle defaultPressed>
-  <BoldIcon />
-</Toggle>
-```
-
-### Disabled
-
-<Preview>
-  <Toggle disabled aria-label="Disabled">
-    <BoldIcon />
-  </Toggle>
-</Preview>
-
-```tsx
-<Toggle disabled>...</Toggle>
-```
-
-## Props
-
-<TypeTable
-  type={{
-    variant: {
-      description: "The visual style of the toggle",
-      type: "'default' | 'primary'",
-      default: "'default'",
-    },
-    size: {
-      description: "The size of the toggle",
-      type: "'default' | 'sm' | 'lg'",
-      default: "'default'",
-    },
-    pressed: {
-      description: "Controlled pressed state",
-      type: "boolean",
-      default: "undefined",
-    },
-    defaultPressed: {
-      description: "Initial pressed state",
-      type: "boolean",
-      default: "false",
-    },
-    onPressedChange: {
-      description: "Callback when pressed state changes",
-      type: "(pressed: boolean) => void",
-      default: "undefined",
-    },
-    disabled: {
-      description: "Whether the toggle is disabled",
-      type: "boolean",
-      default: "false",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/tooltip.mdx b/apps/www/src/features/design/content/docs/components/tooltip.mdx
deleted file mode 100644
index bf4f9ddad..000000000
--- a/apps/www/src/features/design/content/docs/components/tooltip.mdx
+++ /dev/null
@@ -1,140 +0,0 @@
----
-title: Tooltip
-description: A popup that displays information related to an element when focused or hovered.
----
-
-## Usage
-
-<Preview>
-  <Tooltip>
-    <TooltipTrigger render={<Button variant="outline">Hover me</Button>} />
-    <TooltipPopup>
-      <p>This is a tooltip</p>
-    </TooltipPopup>
-  </Tooltip>
-</Preview>
-
-```tsx
-import { Tooltip, TooltipPopup, TooltipTrigger } from "@voidhash/ui";
-
-<Tooltip>
-  <TooltipTrigger render={<Button variant="outline">Hover me</Button>} />
-  <TooltipPopup>
-    <p>This is a tooltip</p>
-  </TooltipPopup>
-</Tooltip>;
-```
-
-## Components
-
-### Tooltip
-
-The root component that wraps the trigger and popup. Automatically provides a
-`TooltipProvider` with a zero open delay, so isolated tooltips work without any
-extra setup.
-
-### TooltipTrigger
-
-The element that triggers the tooltip on hover/focus. Pass the rendered element
-via the `render` prop, or use the legacy `asChild` pattern for backwards
-compatibility.
-
-### TooltipPopup
-
-The popup content displayed when triggered. Internally renders a Base UI
-`Portal`, `Positioner`, `Popup`, and `Viewport`. `TooltipContent` is exported as
-an alias for backwards compatibility.
-
-### TooltipProvider
-
-Provides shared delay / grouping behavior for nested tooltips. Mount this once
-near the root of the app (or sidebar) when many tooltips should share a single
-delay timer.
-
-### IconButtonTooltip
-
-Convenience wrapper for the common pattern of tooltipping an icon button.
-
-## Examples
-
-### Icon button
-
-<Preview>
-  <IconButtonTooltip label="Add item">
-    <Button variant="ghost" size="icon">
-      <PlusIcon />
-    </Button>
-  </IconButtonTooltip>
-</Preview>
-
-```tsx
-import { IconButtonTooltip } from "@voidhash/ui";
-
-<IconButtonTooltip label="Add item">
-  <Button variant="ghost" size="icon">
-    <PlusIcon />
-  </Button>
-</IconButtonTooltip>;
-```
-
-### Different Positions
-
-<Preview>
-  <div className="flex gap-4">
-    <Tooltip>
-      <TooltipTrigger render={<Button variant="outline" size="icon"><ChevronUpIcon /></Button>} />
-      <TooltipPopup side="top">
-        <p>Top</p>
-      </TooltipPopup>
-    </Tooltip>
-    <Tooltip>
-      <TooltipTrigger render={<Button variant="outline" size="icon"><ChevronRightIcon /></Button>} />
-      <TooltipPopup side="right">
-        <p>Right</p>
-      </TooltipPopup>
-    </Tooltip>
-    <Tooltip>
-      <TooltipTrigger render={<Button variant="outline" size="icon"><ChevronDownIcon /></Button>} />
-      <TooltipPopup side="bottom">
-        <p>Bottom</p>
-      </TooltipPopup>
-    </Tooltip>
-    <Tooltip>
-      <TooltipTrigger render={<Button variant="outline" size="icon"><ChevronLeftIcon /></Button>} />
-      <TooltipPopup side="left">
-        <p>Left</p>
-      </TooltipPopup>
-    </Tooltip>
-  </div>
-</Preview>
-
-```tsx
-<TooltipPopup side="top">Top</TooltipPopup>
-<TooltipPopup side="right">Right</TooltipPopup>
-<TooltipPopup side="bottom">Bottom</TooltipPopup>
-<TooltipPopup side="left">Left</TooltipPopup>
-```
-
-## Props
-
-### TooltipPopup Props
-
-<TypeTable
-  type={{
-    side: {
-      description: "The side of the trigger to show the tooltip",
-      type: "'top' | 'right' | 'bottom' | 'left'",
-      default: "'top'",
-    },
-    sideOffset: {
-      description: "Distance from the trigger in pixels",
-      type: "number",
-      default: "4",
-    },
-    align: {
-      description: "Alignment along the side",
-      type: "'start' | 'center' | 'end'",
-      default: "'center'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/components/underline-tabs.mdx b/apps/www/src/features/design/content/docs/components/underline-tabs.mdx
deleted file mode 100644
index 6c70e8c49..000000000
--- a/apps/www/src/features/design/content/docs/components/underline-tabs.mdx
+++ /dev/null
@@ -1,97 +0,0 @@
----
-title: Underline Tabs
-description: A tabs component with an underline indicator style.
----
-
-## Usage
-
-<Preview centered={false}>
-  <UnderlineTabs defaultValue="account" className="w-full max-w-md">
-    <UnderlineTabsList>
-      <UnderlineTabsTrigger value="account">Account</UnderlineTabsTrigger>
-      <UnderlineTabsTrigger value="password">Password</UnderlineTabsTrigger>
-      <UnderlineTabsTrigger value="settings">Settings</UnderlineTabsTrigger>
-    </UnderlineTabsList>
-    <UnderlineTabsContent value="account" className="pt-4">
-      <p>Account settings content.</p>
-    </UnderlineTabsContent>
-    <UnderlineTabsContent value="password" className="pt-4">
-      <p>Password settings content.</p>
-    </UnderlineTabsContent>
-    <UnderlineTabsContent value="settings" className="pt-4">
-      <p>Other settings content.</p>
-    </UnderlineTabsContent>
-  </UnderlineTabs>
-</Preview>
-
-```tsx
-import {
-  UnderlineTabs,
-  UnderlineTabsContent,
-  UnderlineTabsList,
-  UnderlineTabsTrigger,
-} from "@voidhash/ui";
-
-<UnderlineTabs defaultValue="account">
-  <UnderlineTabsList>
-    <UnderlineTabsTrigger value="account">Account</UnderlineTabsTrigger>
-    <UnderlineTabsTrigger value="password">Password</UnderlineTabsTrigger>
-  </UnderlineTabsList>
-  <UnderlineTabsContent value="account">Account content</UnderlineTabsContent>
-  <UnderlineTabsContent value="password">Password content</UnderlineTabsContent>
-</UnderlineTabs>;
-```
-
-## Components
-
-### UnderlineTabs
-
-The root container managing tab state.
-
-### UnderlineTabsList
-
-The container for tab triggers with underline styling.
-
-### UnderlineTabsTrigger
-
-A tab button with underline indicator.
-
-### UnderlineTabsContent
-
-The content panel for each tab.
-
-## Comparison with Tabs
-
-The UnderlineTabs component uses an underline indicator style, while the regular Tabs component uses a pill/segment style. Choose based on your design needs:
-
-- **UnderlineTabs**: Minimal, underline indicator, good for content sections
-- **Tabs**: Pill/segment style, good for switching between views
-
-## Props
-
-### UnderlineTabs Props
-
-<TypeTable
-  type={{
-    value: {
-      description: "Controlled active tab",
-      type: "string",
-      default: "undefined",
-    },
-    defaultValue: {
-      description: "Initial active tab",
-      type: "string",
-      default: "undefined",
-    },
-    onValueChange: {
-      description: "Callback when active tab changes",
-      type: "(value: string) => void",
-      default: "undefined",
-    },
-    orientation: {
-      description: "Layout orientation",
-      type: "'horizontal' | 'vertical'",
-      default: "'horizontal'",
-    },
-  }}
-/>
diff --git a/apps/www/src/features/design/content/docs/foundations/colors.mdx b/apps/www/src/features/design/content/docs/foundations/colors.mdx
deleted file mode 100644
index bc5051330..000000000
--- a/apps/www/src/features/design/content/docs/foundations/colors.mdx
+++ /dev/null
@@ -1,116 +0,0 @@
----
-title: Colors
-description: The Voidhash color system — semantic tokens, what each one means, and the brand scales behind them.
-full: true
----
-
-Colors are exposed as CSS custom properties on `:root`, remapped under `.dark`, and re-exported to Tailwind through `@theme inline` in [`@voidhash/ui/styles/brand-theme.css`](https://github.com/voidhashcom/voidhash/blob/main/packages/ui/styles/brand-theme.css). Every token below therefore exists in three forms:
-
-<DocsTabs items={["CSS variable", "Tailwind utility", "Inline style"]}>
-  <DocsTab value="CSS variable">
-    ```css
-    .thing {
-      background: var(--card);
-      color: var(--card-foreground);
-      border-color: var(--border);
-    }
-    ```
-  </DocsTab>
-  <DocsTab value="Tailwind utility">
-    ```tsx
-    <div className="border bg-card text-card-foreground" />
-    ```
-  </DocsTab>
-  <DocsTab value="Inline style">
-    ```tsx
-    <div style={{ background: "var(--card)" }} />
-    ```
-  </DocsTab>
-</DocsTabs>
-
-There are two layers. **Semantic tokens** (`--primary`, `--muted-foreground`, `--border`) describe a role and swap value between light and dark. **Brand scales** (`--blue-ribbon-600`, `--zinc-200`) are the fixed ramps those roles point at. Product UI uses the semantic layer; the scales exist to build tokens from, and for the rare case where a specific step is genuinely the right answer.
-
-<Callout type="warn">
-  Reaching for a scale step directly in product UI is how dark mode breaks — `bg-zinc-100` stays
-  near-white when the theme flips. If nothing in the semantic layer fits, that is usually a missing
-  token, not a reason to skip it.
-</Callout>
-
-## Semantic tokens
-
-Click any variable or value to copy it. Each card shows the light value on the left and the dark value on the right, with `Aa` rendered in the token's paired foreground so you can see the contrast the pairing produces.
-
-<SemanticColorTokens />
-
-## Brand scales
-
-These are theme-independent — the same value in light and dark. Steps run 50 (lightest) to 950 (darkest); the 500–600 range is where the hue is at full strength and where most semantic tokens land.
-
-Two literals sit outside the ramps: `--white` (`oklch(100% 0 0)`) and `--black` (`oklch(0% 0 0)`). They back the canvas in light mode and the sidebar in dark mode — reference the semantic token rather than the literal, or the surface will not flip with the theme.
-
-<BrandColorScales />
-
-## Choosing a color
-
-<Steps>
-
-<Step>
-
-### Start from the role, not the hue
-
-Ask what the element _is_ — a raised surface, secondary text, a danger action — and take the token for that role. `--destructive` says "this deletes something" in a way `--radical-red-600` does not, and it keeps the meaning if the palette is retuned later.
-
-</Step>
-
-<Step>
-
-### Take the paired foreground
-
-Backgrounds with a `-foreground` partner (`--primary`/`--primary-foreground`, `--card`/`--card-foreground`) are contrast-checked as pairs. Mixing across pairs — `--foreground` on a `--primary` fill — is where contrast quietly fails, usually only in one theme.
-
-</Step>
-
-<Step>
-
-### Step down for emphasis, don't fade out
-
-Quieter text is `--muted-foreground`, not `--foreground` at 60% opacity. Opacity compounds against whatever surface it lands on, so the result is unpredictable across the surface stack; the muted token is tuned per theme.
-
-</Step>
-
-<Step>
-
-### Check both themes
-
-Dark mode is not a filter — `--card` goes _lighter_ than the canvas while `--sidebar` goes to pure black. Anything hardcoded, or built out of opacity over a hardcoded color, will look wrong in exactly one of the two.
-
-</Step>
-
-</Steps>
-
-## Gaps worth knowing
-
-- **No `--warning` token.** Use `--amber-500` (dark surfaces) or `--amber-600` (light surfaces) for caution states, and keep `--destructive` for genuine danger.
-- **No info token.** Informational states use `--primary` or the muted surface stack.
-- **`--blaze-orange-*` is unmapped.** It ships in the theme but no semantic token points at it yet.
-- **Charts don't use the semantic layer.** `--chart-1` through `--chart-5` are assigned in order so a given series index keeps its color across every chart in the product.
-
-## Adding a token
-
-Semantic tokens are added in three places in `brand-theme.css`, and all three are required — a token missing from `@theme inline` exists in CSS but has no Tailwind utility:
-
-```css
-:root {
-  --warning: var(--amber-600);
-}
-
-.dark {
-  --warning: var(--amber-500);
-}
-
-@theme inline {
-  --color-warning: var(--warning);
-}
-```
-
-Point new tokens at a scale step rather than a literal color, so the ramp stays the single source of truth. This page reads the stylesheet directly, so a new token shows up here as soon as it is added to `SEMANTIC_GROUPS` with its meaning.
diff --git a/apps/www/src/features/design/content/docs/foundations/meta.yaml b/apps/www/src/features/design/content/docs/foundations/meta.yaml
deleted file mode 100644
index bea8cd0ff..000000000
--- a/apps/www/src/features/design/content/docs/foundations/meta.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-icon: Palette
-title: Foundations
-pages:
-  - colors
diff --git a/apps/www/src/features/design/content/docs/introduction.mdx b/apps/www/src/features/design/content/docs/introduction.mdx
deleted file mode 100644
index abb6a1772..000000000
--- a/apps/www/src/features/design/content/docs/introduction.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
----
-title: Voidhash Design System
-description: Introduction to Voidhash Design System.
----
diff --git a/apps/www/src/features/design/content/docs/meta.yaml b/apps/www/src/features/design/content/docs/meta.yaml
deleted file mode 100644
index 090061631..000000000
--- a/apps/www/src/features/design/content/docs/meta.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-title: guide
-root: true
-pages:
-  - introduction
-  - foundations
-  - components
diff --git a/apps/www/src/features/design/lib/basepath.ts b/apps/www/src/features/design/lib/basepath.ts
deleted file mode 100644
index c99d371e3..000000000
--- a/apps/www/src/features/design/lib/basepath.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { DESIGN_PATH as BASE_PATH } from "@/lib/paths";
diff --git a/apps/www/src/features/design/lib/cn.ts b/apps/www/src/features/design/lib/cn.ts
deleted file mode 100644
index 8e473dac8..000000000
--- a/apps/www/src/features/design/lib/cn.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { twMerge as cn } from "tailwind-merge";
diff --git a/apps/www/src/features/design/lib/layout.shared.tsx b/apps/www/src/features/design/lib/layout.shared.tsx
deleted file mode 100644
index 5d392edbb..000000000
--- a/apps/www/src/features/design/lib/layout.shared.tsx
+++ /dev/null
@@ -1,8 +0,0 @@
-import type { BaseLayoutProps } from "fumadocs-ui/layouts/shared";
-
-export const baseOptions: BaseLayoutProps = {
-  links: [],
-  nav: {
-    title: "Voidhash Design System",
-  },
-};
diff --git a/apps/www/src/features/design/lib/source.ts b/apps/www/src/features/design/lib/source.ts
deleted file mode 100644
index 6765ecb8e..000000000
--- a/apps/www/src/features/design/lib/source.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { loader } from "fumadocs-core/source";
-import * as icons from "lucide-static";
-
-import { design } from "@generated/server";
-import { DESIGN_PATH } from "@/lib/paths";
-
-type DesignSource = ReturnType<typeof loader>;
-
-let sourcePromise: Promise<DesignSource> | undefined;
-
-/**
- * Returns the loaded design documentation source. fumadocs-mdx's server runtime
- * builds the collection eagerly (top-level await in the generated
- * `.source/server.ts`), so `toFumadocsSource()` is synchronous here; the promise
- * memoizes the loader.
- */
-export const getSource = (): Promise<DesignSource> => {
-  sourcePromise ??= Promise.resolve(
-    loader({
-      baseUrl: DESIGN_PATH,
-      icon(icon) {
-        if (!icon) {
-          return;
-        }
-
-        if (icon in icons) {
-          return icons[icon as keyof typeof icons] as unknown as React.ReactElement;
-        }
-      },
-      source: design.toFumadocsSource(),
-    }),
-  );
-
-  return sourcePromise;
-};
diff --git a/apps/www/src/features/design/source.config.ts b/apps/www/src/features/design/source.config.ts
deleted file mode 100644
index a5283b326..000000000
--- a/apps/www/src/features/design/source.config.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import {
-  defineConfig,
-  defineDocs,
-  frontmatterSchema,
-  metaSchema,
-} from "../fumadocs-config.ts";
-
-// You can customise Zod schemas for frontmatter and `meta.json` here
-// see https://fumadocs.vercel.app/docs/mdx/collections#define-docs
-export const docs = defineDocs({
-  dir: "src/features/design/content/docs",
-  docs: {
-    schema: frontmatterSchema,
-  },
-  meta: {
-    schema: metaSchema,
-  },
-});
-
-export default defineConfig({
-  mdxOptions: {
-    // MDX options
-    remarkNpmOptions: {
-      persist: {
-        id: "package-manager",
-      },
-    },
-    valueToExport: ["elementIds", "toc"],
-  },
-});
diff --git a/apps/www/src/features/design/styles/globals.css b/apps/www/src/features/design/styles/globals.css
deleted file mode 100644
index f3ca99483..000000000
--- a/apps/www/src/features/design/styles/globals.css
+++ /dev/null
@@ -1,32 +0,0 @@
-@import "@fontsource-variable/geist";
-@import "tailwindcss";
-@import "fumadocs-ui/css/shadcn.css";
-@import "fumadocs-ui/css/preset.css";
-@import "@voidhash/ui/styles/brand-theme.css";
-
-@source "../../../../packages/ui";
-@source "../../src";
-
-@custom-variant dark (&:is(.dark *));
-
-::selection {
-  background: var(--blue-ribbon-600);
-  color: #fff;
-}
-
-:root {
-  --color-fd-primary: var(--primary);
-}
-
-.dark {
-  --color-fd-primary: var(--primary);
-}
-
-@layer base {
-  * {
-    @apply border-border outline-ring/50;
-  }
-  body {
-    @apply bg-background text-foreground;
-  }
-}
diff --git a/apps/www/src/features/docs/components/layout/docs.tsx b/apps/www/src/features/docs/components/layout/docs.tsx
index dac008cc1..f7d95bd70 100644
--- a/apps/www/src/features/docs/components/layout/docs.tsx
+++ b/apps/www/src/features/docs/components/layout/docs.tsx
@@ -364,7 +364,7 @@ function NodeIcon({ icon }: { icon?: ReactElement }) {
     return (
       <span
         className="*:size-4 shrink-0 text-muted-foreground"
-        // biome-ignore lint/security/noDangerouslySetInnerHtml: It is safe - static icon markup
+        // It is safe - static icon markup
         dangerouslySetInnerHTML={{ __html: icon }}
       />
     );
diff --git a/apps/www/src/features/docs/styles/globals.css b/apps/www/src/features/docs/styles/globals.css
index e22251b72..faeed2313 100644
--- a/apps/www/src/features/docs/styles/globals.css
+++ b/apps/www/src/features/docs/styles/globals.css
@@ -1,5 +1,3 @@
-/** biome-ignore-all lint/nursery/noUnknownAtRule: tailwind */
-
 /*
  * Docs-site theme.
  *
diff --git a/apps/www/src/features/source.config.ts b/apps/www/src/features/source.config.ts
index 081da7c30..bc1cbe7ee 100644
--- a/apps/www/src/features/source.config.ts
+++ b/apps/www/src/features/source.config.ts
@@ -1,10 +1,11 @@
 import { defineConfig, defineDocs, frontmatterSchema, metaSchema } from "./fumadocs-config.ts";
 import { voidhashShikiDark, voidhashShikiLight } from "./docs/lib/shiki-theme.ts";
 
-// Both documentation surfaces (product docs + design system) are declared as
-// collections in a single config so fumadocs-mdx emits one `.source` runtime
-// bundle. Keeping them in one config avoids running two `mdx()` plugin
-// instances against the same output directory (which would clobber each other).
+// A host that adds documentation surfaces of its own replaces this config
+// wholesale rather than registering a second `mdx()` plugin — two instances
+// writing the same output directory clobber each other. See
+// `apps/www/src/features/source.config.ts` in voidhash-mono, which re-declares
+// this collection alongside its own.
 export const docs = defineDocs({
   dir: "src/features/docs/content/docs",
   docs: {
@@ -15,16 +16,6 @@ export const docs = defineDocs({
   },
 });
 
-export const design = defineDocs({
-  dir: "src/features/design/content/docs",
-  docs: {
-    schema: frontmatterSchema,
-  },
-  meta: {
-    schema: metaSchema,
-  },
-});
-
 export default defineConfig({
   mdxOptions: {
     remarkNpmOptions: {
diff --git a/apps/www/src/features/studio/experiments/components/experiment-detail-page/experiment-detail-header.tsx b/apps/www/src/features/studio/experiments/components/experiment-detail-page/experiment-detail-header.tsx
index 39c2e8a5b..ea190b68d 100644
--- a/apps/www/src/features/studio/experiments/components/experiment-detail-page/experiment-detail-header.tsx
+++ b/apps/www/src/features/studio/experiments/components/experiment-detail-page/experiment-detail-header.tsx
@@ -67,7 +67,7 @@ function InlineTextarea({
   }
   return (
     <Textarea
-      // biome-ignore lint/a11y/noAutofocus: the field only exists once the user opts into editing
+      // the field only exists once the user opts into editing
       autoFocus
       aria-label={ariaLabel}
       className="-mx-2 min-h-0 w-[calc(100%+1rem)] resize-none border-transparent bg-muted/60 px-2 py-0.5 text-sm shadow-none"
@@ -123,7 +123,7 @@ export function ExperimentDetailHeader() {
           </button>
         ) : (
           <Input
-            // biome-ignore lint/a11y/noAutofocus: the field only exists once the user opts into editing
+            // the field only exists once the user opts into editing
             autoFocus
             aria-label="A/B test name"
             className="-mx-2 h-auto w-[calc(100%+1rem)] border-transparent bg-muted/60 px-2 py-0.5 font-semibold text-3xl tracking-tight shadow-none md:text-3xl"
diff --git a/apps/www/src/features/studio/experiments/components/experiments-page/experiments-page-skeleton.tsx b/apps/www/src/features/studio/experiments/components/experiments-page/experiments-page-skeleton.tsx
index 2831bc9e3..5f9744527 100644
--- a/apps/www/src/features/studio/experiments/components/experiments-page/experiments-page-skeleton.tsx
+++ b/apps/www/src/features/studio/experiments/components/experiments-page/experiments-page-skeleton.tsx
@@ -10,7 +10,6 @@ export function ExperimentsPageSkeleton() {
       <PageBar className="pl-2">
         <div className="flex items-center gap-4">
           {Array.from({ length: 6 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
             <div className="h-5 w-14 rounded bg-muted" key={index} />
           ))}
         </div>
diff --git a/apps/www/src/features/studio/feature-flags/components/flag-detail-page/flag-detail-header.tsx b/apps/www/src/features/studio/feature-flags/components/flag-detail-page/flag-detail-header.tsx
index 062beb8f8..57b2b52ae 100644
--- a/apps/www/src/features/studio/feature-flags/components/flag-detail-page/flag-detail-header.tsx
+++ b/apps/www/src/features/studio/feature-flags/components/flag-detail-page/flag-detail-header.tsx
@@ -78,7 +78,7 @@ export function FlagDetailHeader({ flagType, slug }: FlagDetailHeaderProps) {
         </button>
       ) : (
         <Textarea
-          // biome-ignore lint/a11y/noAutofocus: the field only exists once the user opts into editing
+          // the field only exists once the user opts into editing
           autoFocus
           aria-label="Flag description"
           className="-mx-2 min-h-0 w-[calc(100%+1rem)] resize-none border-transparent bg-muted/60 px-2 py-0.5 text-sm shadow-none"
diff --git a/apps/www/src/features/studio/feature-flags/components/flags-page/flags-page-skeleton.tsx b/apps/www/src/features/studio/feature-flags/components/flags-page/flags-page-skeleton.tsx
index 1a4edd20b..0bce2ef91 100644
--- a/apps/www/src/features/studio/feature-flags/components/flags-page/flags-page-skeleton.tsx
+++ b/apps/www/src/features/studio/feature-flags/components/flags-page/flags-page-skeleton.tsx
@@ -10,7 +10,6 @@ export function FlagsPageSkeleton() {
       <PageBar className="pl-2">
         <div className="flex items-center gap-4">
           {Array.from({ length: 4 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
             <div className="h-5 w-14 rounded bg-muted" key={index} />
           ))}
         </div>
diff --git a/apps/www/src/features/studio/feature-flags/components/shared/flag-type-indicator.tsx b/apps/www/src/features/studio/feature-flags/components/shared/flag-type-indicator.tsx
index 6f3fd218c..c3f63dd15 100644
--- a/apps/www/src/features/studio/feature-flags/components/shared/flag-type-indicator.tsx
+++ b/apps/www/src/features/studio/feature-flags/components/shared/flag-type-indicator.tsx
@@ -1,5 +1,5 @@
 import { cn } from "@voidhash/ui";
-import { Braces, CaseSensitive, Hash, ToggleRight } from "lucide-react";
+import { Braces, CaseSensitive, Hash, ToggleRight, type LucideIcon } from "lucide-react";
 
 import { FLAG_TYPE_LABELS, type FlagType } from "../../lib/flag-type";
 
@@ -10,7 +10,7 @@ import { FLAG_TYPE_LABELS, type FlagType } from "../../lib/flag-type";
  */
 export const FLAG_TYPE_PRESENTATION: Record<
   FlagType,
-  { accentClassName: string; icon: React.ElementType }
+  { accentClassName: string; icon: LucideIcon }
 > = {
   boolean: { accentClassName: "text-chart-1", icon: ToggleRight },
   json: { accentClassName: "text-chart-3", icon: Braces },
diff --git a/apps/www/src/features/studio/organizations/projects/projects-skeleton.tsx b/apps/www/src/features/studio/organizations/projects/projects-skeleton.tsx
index ecfb1a171..dad8c2d70 100644
--- a/apps/www/src/features/studio/organizations/projects/projects-skeleton.tsx
+++ b/apps/www/src/features/studio/organizations/projects/projects-skeleton.tsx
@@ -6,7 +6,6 @@ export function ProjectsSkeleton() {
       {Array.from({ length: 3 }).map((_, index) => (
         <div
           className="group relative isolate px-6 py-4 hover:bg-accent/30"
-          // biome-ignore lint/suspicious/noArrayIndexKey: just a skeleton
           key={index}
         >
           <div className="flex flex-row items-center justify-between">
diff --git a/apps/www/src/features/studio/paywall-assets/asset-library.tsx b/apps/www/src/features/studio/paywall-assets/asset-library.tsx
index 3ea0222f9..d25d90a05 100644
--- a/apps/www/src/features/studio/paywall-assets/asset-library.tsx
+++ b/apps/www/src/features/studio/paywall-assets/asset-library.tsx
@@ -137,7 +137,6 @@ export function AssetLibrary({
       {isPending ? (
         <div className={GRID_CLASSES}>
           {Array.from({ length: 10 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: fixed-length skeleton grid
             <Skeleton className="aspect-square w-full rounded-md" key={index} />
           ))}
         </div>
diff --git a/apps/www/src/features/studio/paywalls/designer/canvas/node-renderers/text-node-renderer.tsx b/apps/www/src/features/studio/paywalls/designer/canvas/node-renderers/text-node-renderer.tsx
index 4889c8280..7516ac0b0 100644
--- a/apps/www/src/features/studio/paywalls/designer/canvas/node-renderers/text-node-renderer.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/canvas/node-renderers/text-node-renderer.tsx
@@ -210,8 +210,7 @@ export function TextNodeRenderer({
         const { role, onMouseDown, onDoubleClick: _, ...otherSelectableProps } = selectableProps;
         const elementRole = isFocused ? "textbox" : role;
         return (
-          // biome-ignore lint/a11y/noStaticElementInteractions: We need a div to support both selectable (button role) and editable (textbox role) modes
-          // biome-ignore lint/nursery/noNoninteractiveElementInteractions: We need a div to support both selectable (button role) and editable (textbox role) modes
+          // We need a div to support both selectable (button role) and editable (textbox role) modes
           <div
             contentEditable={isTextEditingMode}
             data-text-node="true"
diff --git a/apps/www/src/features/studio/paywalls/designer/canvas/overlay/selection-overlay.tsx b/apps/www/src/features/studio/paywalls/designer/canvas/overlay/selection-overlay.tsx
index 381df1776..5f1e86dc0 100644
--- a/apps/www/src/features/studio/paywalls/designer/canvas/overlay/selection-overlay.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/canvas/overlay/selection-overlay.tsx
@@ -290,7 +290,7 @@ export function SelectionOverlay({ containerRef }: SelectionOverlayProps) {
   const [showHandles, setShowHandles] = useState(false);
 
   // Draw function that reads directly from store - use ref to avoid stale closures
-  // biome-ignore lint/suspicious/noEmptyBlockStatements: Initial no-op function for ref
+  // Initial no-op function for ref
   const drawRef = useRef<() => void>(() => {});
 
   // Update drawRef to always have the latest implementation
diff --git a/apps/www/src/features/studio/paywalls/designer/code-mode/component-preview-pane.tsx b/apps/www/src/features/studio/paywalls/designer/code-mode/component-preview-pane.tsx
index 50692ae1b..536449df3 100644
--- a/apps/www/src/features/studio/paywalls/designer/code-mode/component-preview-pane.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/code-mode/component-preview-pane.tsx
@@ -98,7 +98,7 @@ export function ComponentPreviewPane({ definitionId }: { definitionId: string })
           {compiled.diagnostics.map((diagnostic, index) => (
             <div
               className="flex items-start gap-2 py-0.5 font-mono text-[11px] text-destructive"
-              // biome-ignore lint/suspicious/noArrayIndexKey: diagnostics are positional and ephemeral
+              // diagnostics are positional and ephemeral
               key={index}
             >
               <span className="shrink-0 rounded-sm bg-destructive/10 px-1 uppercase">
diff --git a/apps/www/src/features/studio/paywalls/designer/components/component-preview/preview-tree-renderer.tsx b/apps/www/src/features/studio/paywalls/designer/components/component-preview/preview-tree-renderer.tsx
index 9a1732b14..3ddece122 100644
--- a/apps/www/src/features/studio/paywalls/designer/components/component-preview/preview-tree-renderer.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/components/component-preview/preview-tree-renderer.tsx
@@ -29,7 +29,7 @@ function PreviewNodeView({
         <div style={buildPreviewNodeStyles(node.style, node.type, node.motion)}>
           {node.children.map((child, index) => (
             <PreviewNodeView
-              // biome-ignore lint/suspicious/noArrayIndexKey: preview trees are immutable per contentHash+state
+              // preview trees are immutable per contentHash+state
               key={index}
               node={child}
               renderSlot={renderSlot}
diff --git a/apps/www/src/features/studio/paywalls/designer/global.d.ts b/apps/www/src/features/studio/paywalls/designer/global.d.ts
index 1794cd359..a95e580ab 100644
--- a/apps/www/src/features/studio/paywalls/designer/global.d.ts
+++ b/apps/www/src/features/studio/paywalls/designer/global.d.ts
@@ -1,5 +1,3 @@
-/** biome-ignore-all lint/style/noNamespace: <explanation> */
-
 // import type { LayoutContainer } from '@pixi/layout/components';
 import type { PixiReactElementProps } from "@pixi/react";
 // import type { Input } from '@pixi/ui';
diff --git a/apps/www/src/features/studio/paywalls/designer/panel-kit/alignment-grid.tsx b/apps/www/src/features/studio/paywalls/designer/panel-kit/alignment-grid.tsx
index ffd8b7aa2..a8bc0eb1d 100644
--- a/apps/www/src/features/studio/paywalls/designer/panel-kit/alignment-grid.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/panel-kit/alignment-grid.tsx
@@ -139,8 +139,6 @@ export function FlexAlignmentInput({
                   const selected = isSelected(item.alignItems, item.justifyContent);
 
                   return (
-                    // biome-ignore lint/a11y/noStaticElementInteractions: Grid cell interaction
-                    // biome-ignore lint/a11y/useKeyWithClickEvents: Grid cell interaction
                     <div
                       className="group relative w-7 flex-1 items-center justify-center py-1 hover:bg-input/80"
                       key={`cell-${rowIndex}-${columnIndex}-${flexDirection}`}
@@ -177,8 +175,6 @@ export function FlexAlignmentInput({
               const selected = itemAlignItems === alignItems;
 
               return (
-                // biome-ignore lint/a11y/noStaticElementInteractions: Grid cell interaction
-                // biome-ignore lint/a11y/useKeyWithClickEvents: Grid cell interaction
                 <div
                   className={cn(
                     "group group relative flex w-21 flex-1 flex-row items-center justify-center py-1 text-gray-400 hover:bg-input/80",
@@ -212,8 +208,6 @@ export function FlexAlignmentInput({
               const selected = itemAlignItems === alignItems;
 
               return (
-                // biome-ignore lint/a11y/noStaticElementInteractions: Grid cell interaction
-                // biome-ignore lint/a11y/useKeyWithClickEvents: Grid cell interaction
                 <div
                   className={cn(
                     "group group relative flex h-full w-7 flex-1 flex-col items-center justify-center py-1 text-gray-400 hover:bg-input/80",
@@ -248,8 +242,6 @@ export function FlexAlignmentInput({
               const selected = itemJustify === justifyContent;
 
               return (
-                // biome-ignore lint/a11y/noStaticElementInteractions: Grid cell interaction
-                // biome-ignore lint/a11y/useKeyWithClickEvents: Grid cell interaction
                 <div
                   className={cn(
                     "group group relative flex h-full w-7 flex-1 flex-col items-center justify-center py-1 text-gray-400 hover:bg-input/80",
@@ -283,8 +275,6 @@ export function FlexAlignmentInput({
               const selected = itemJustify === justifyContent;
 
               return (
-                // biome-ignore lint/a11y/noStaticElementInteractions: Grid cell interaction
-                // biome-ignore lint/a11y/useKeyWithClickEvents: Grid cell interaction
                 <div
                   className={cn(
                     "group group relative flex w-21 flex-1 flex-row items-center justify-center py-1 text-gray-400 hover:bg-input/80",
diff --git a/apps/www/src/features/studio/paywalls/designer/panel-kit/color-picker/saturation-brightness-picker.tsx b/apps/www/src/features/studio/paywalls/designer/panel-kit/color-picker/saturation-brightness-picker.tsx
index 8f468a61e..231bbe35a 100644
--- a/apps/www/src/features/studio/paywalls/designer/panel-kit/color-picker/saturation-brightness-picker.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/panel-kit/color-picker/saturation-brightness-picker.tsx
@@ -87,7 +87,7 @@ export function SaturationBrightnessPicker({
   const hueColor = `rgb(${hueRgb.r}, ${hueRgb.g}, ${hueRgb.b})`;
 
   return (
-    // biome-ignore lint/nursery/noNoninteractiveElementInteractions: TODO: Fix accessibility issues
+    // TODO: Fix accessibility issues
     <div
       aria-label={`Color picker. Saturation: ${Math.round(saturation * 100)}%, Brightness: ${Math.round(brightness * 100)}%`}
       className="relative h-[200px] w-full cursor-crosshair rounded-md"
@@ -111,7 +111,7 @@ export function SaturationBrightnessPicker({
       ref={containerRef}
       role="application"
       style={{ backgroundColor: hueColor }}
-      // biome-ignore lint/a11y/noNoninteractiveTabindex: TODO: Fix accessibility issues
+      // TODO: Fix accessibility issues
       tabIndex={0}
     >
       {/* White gradient (left to right) */}
diff --git a/apps/www/src/features/studio/paywalls/designer/panel-kit/fill-field.tsx b/apps/www/src/features/studio/paywalls/designer/panel-kit/fill-field.tsx
index 5d146eb73..ee3e85d9c 100644
--- a/apps/www/src/features/studio/paywalls/designer/panel-kit/fill-field.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/panel-kit/fill-field.tsx
@@ -427,7 +427,6 @@ function FillEditorPopoverContent({
             {gradient.stops.map((stop, index) => (
               // Stops are positional; no stable id exists on the write shape, so
               // the index is the key.
-              // biome-ignore lint/suspicious/noArrayIndexKey: positional stop row
               <div
                 className="flex flex-row items-center gap-2"
                 key={index}
diff --git a/apps/www/src/features/studio/paywalls/designer/panel-kit/gradient-stop-bar.tsx b/apps/www/src/features/studio/paywalls/designer/panel-kit/gradient-stop-bar.tsx
index 59c850516..d8548dded 100644
--- a/apps/www/src/features/studio/paywalls/designer/panel-kit/gradient-stop-bar.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/panel-kit/gradient-stop-bar.tsx
@@ -164,7 +164,6 @@ export function GradientStopBar({
       {stops.map((stop, index) => (
         // Stops are positional; the logical write shape has no stable id, so the
         // index is the key.
-        // biome-ignore lint/suspicious/noArrayIndexKey: positional stop marker
         <button
           aria-label={`Gradient stop ${index + 1}`}
           className={cn(
diff --git a/apps/www/src/features/studio/paywalls/designer/panel-kit/kit.ts b/apps/www/src/features/studio/paywalls/designer/panel-kit/kit.ts
index acc47fd35..b75cb04df 100644
--- a/apps/www/src/features/studio/paywalls/designer/panel-kit/kit.ts
+++ b/apps/www/src/features/studio/paywalls/designer/panel-kit/kit.ts
@@ -32,7 +32,7 @@ import { VariableBindingField } from "./variable-binding-field";
  * wire props/events onto each component's concrete signature, so this map only
  * needs to centralize the type → component association.
  */
-// biome-ignore lint/suspicious/noExplicitAny: renderer supplies the adapted props per node type
+// renderer supplies the adapted props per node type
 type KitComponent = ComponentType<any>;
 
 /**
diff --git a/apps/www/src/features/studio/paywalls/designer/panel-kit/prop-field-row.tsx b/apps/www/src/features/studio/paywalls/designer/panel-kit/prop-field-row.tsx
index 0b43178dc..0ebfbba8f 100644
--- a/apps/www/src/features/studio/paywalls/designer/panel-kit/prop-field-row.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/panel-kit/prop-field-row.tsx
@@ -366,7 +366,7 @@ function ArrayPropRow({
       {items.length > 0 && (
         <div className="flex flex-col gap-1">
           {items.map((item, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: rows are positional; the whole binding is rewritten per change
+            // rows are positional; the whole binding is rewritten per change
             <div className="flex flex-row items-center gap-1" key={index}>
               {arrayKey === "string-array" && (
                 <StringInput
diff --git a/apps/www/src/features/studio/paywalls/designer/panel-kit/text-input.tsx b/apps/www/src/features/studio/paywalls/designer/panel-kit/text-input.tsx
index efc35aa0d..6794e7987 100644
--- a/apps/www/src/features/studio/paywalls/designer/panel-kit/text-input.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/panel-kit/text-input.tsx
@@ -325,9 +325,7 @@ export function TextInput({
       {icon ? (
         <InputGroupAddon className="py-1 pr-0.5 pl-2">
           {type === "number" ? (
-            // biome-ignore lint/a11y/noStaticElementInteractions: We need to use a div to get the pointer lock to work
-            // biome-ignore lint/nursery/noNoninteractiveElementInteractions: We need to use a div to get the pointer lock to work
-            // biome-ignore lint/a11y/useAriaPropsSupportedByRole: We need to use a div to get the pointer lock to work
+            // We need to use a div to get the pointer lock to work
             <div
               aria-label="Drag to adjust value"
               className={cn(
diff --git a/apps/www/src/features/studio/paywalls/designer/panels/left-panel/layers-section.tsx b/apps/www/src/features/studio/paywalls/designer/panels/left-panel/layers-section.tsx
index fc7c6d5ff..5e9589ed2 100644
--- a/apps/www/src/features/studio/paywalls/designer/panels/left-panel/layers-section.tsx
+++ b/apps/www/src/features/studio/paywalls/designer/panels/left-panel/layers-section.tsx
@@ -662,8 +662,8 @@ function SortableTreeItem({
           />
         )}
 
-        {/* biome-ignore lint/a11y/noStaticElementInteractions: dnd-kit requires a div for drag handling */}
-        {/* biome-ignore lint/a11y/useKeyWithClickEvents: dnd-kit handles keyboard interactions via attributes */}
+        {/* dnd-kit requires a div for drag handling */}
+        {/* dnd-kit handles keyboard interactions via attributes */}
         <div
           className={cn(
             "flex h-7 items-center gap-1 rounded-sm px-1",
diff --git a/apps/www/src/features/studio/perks/perks-page-skeleton.tsx b/apps/www/src/features/studio/perks/perks-page-skeleton.tsx
index 66637e7d8..1a4320fa9 100644
--- a/apps/www/src/features/studio/perks/perks-page-skeleton.tsx
+++ b/apps/www/src/features/studio/perks/perks-page-skeleton.tsx
@@ -15,7 +15,6 @@ export function PerksPageSkeleton() {
       <div className="mt-8">
         <Card className="grid gap-0 divide-y p-0">
           {Array.from({ length: 3 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
             <PerkRecordSkeleton key={index} />
           ))}
         </Card>
diff --git a/apps/www/src/features/studio/persons/persons-table/skeleton.tsx b/apps/www/src/features/studio/persons/persons-table/skeleton.tsx
index dcc3e8de6..9f322ee8c 100644
--- a/apps/www/src/features/studio/persons/persons-table/skeleton.tsx
+++ b/apps/www/src/features/studio/persons/persons-table/skeleton.tsx
@@ -21,7 +21,6 @@ export function PersonsTableSkeleton() {
         </TableHeader>
         <TableBody>
           {Array.from({ length: 8 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
             <TableRow key={`persons-skeleton-${index}`}>
               <TableCell>
                 <Skeleton className="h-4 w-40" />
diff --git a/apps/www/src/features/studio/products/product-detail-add-perk-button.tsx b/apps/www/src/features/studio/products/product-detail-add-perk-button.tsx
index 3cea8e6a6..5357b5f09 100644
--- a/apps/www/src/features/studio/products/product-detail-add-perk-button.tsx
+++ b/apps/www/src/features/studio/products/product-detail-add-perk-button.tsx
@@ -57,7 +57,6 @@ export function ProductDetailAddPerkButton({
   return (
     <Popover onOpenChange={setOpen} open={open}>
       <PopoverTrigger asChild>
-        {/** biome-ignore lint/a11y/useSemanticElements: custom component */}
         <Button aria-expanded={open} role="combobox" variant={variant}>
           Add perk
         </Button>
diff --git a/apps/www/src/features/studio/products/product-detail-page-skeleton.tsx b/apps/www/src/features/studio/products/product-detail-page-skeleton.tsx
index 615ca8ae8..7f157df2f 100644
--- a/apps/www/src/features/studio/products/product-detail-page-skeleton.tsx
+++ b/apps/www/src/features/studio/products/product-detail-page-skeleton.tsx
@@ -21,7 +21,6 @@ export function ProductsDetailPageSkeleton() {
         </div>
         <div className="mt-8">
           {Array.from({ length: 2 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
             <SettingsCardSkeleton key={index} />
           ))}
         </div>
diff --git a/apps/www/src/features/studio/products/product-detail-product-perk-record.tsx b/apps/www/src/features/studio/products/product-detail-product-perk-record.tsx
index 7783c849f..84ff110a1 100644
--- a/apps/www/src/features/studio/products/product-detail-product-perk-record.tsx
+++ b/apps/www/src/features/studio/products/product-detail-product-perk-record.tsx
@@ -21,7 +21,7 @@ export function ProductDetailPerkRecord({
   perks,
 }: {
   productPerk: typeof ProductPerk.Type;
-  // biome-ignore lint/style/useConsistentArrayType: We need to use ReadonlyArray to avoid mutation
+  // We need to use ReadonlyArray to avoid mutation
   perks: readonly (typeof Perk.Type)[];
 }) {
   const perk = perks.find((p) => p.id === productPerk.perkId);
diff --git a/apps/www/src/features/studio/products/products-page-skeleton.tsx b/apps/www/src/features/studio/products/products-page-skeleton.tsx
index 43afdee86..f2a666c48 100644
--- a/apps/www/src/features/studio/products/products-page-skeleton.tsx
+++ b/apps/www/src/features/studio/products/products-page-skeleton.tsx
@@ -11,7 +11,6 @@ export function ProductsPageSkeleton() {
         </PageHeader>
         <div className="min-h-0 flex-1 divide-y divide-border/60 overflow-y-auto">
           {Array.from({ length: 3 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
             <ProductRecordSkeleton key={index} />
           ))}
         </div>
diff --git a/apps/www/src/features/studio/products/provider-product-sheet.tsx b/apps/www/src/features/studio/products/provider-product-sheet.tsx
index ec152e68a..2e2fc4529 100644
--- a/apps/www/src/features/studio/products/provider-product-sheet.tsx
+++ b/apps/www/src/features/studio/products/provider-product-sheet.tsx
@@ -1,4 +1,3 @@
-/** biome-ignore-all lint/suspicious/noExplicitAny: any */
 "use client";
 
 import { zodResolver } from "@hookform/resolvers/zod";
diff --git a/apps/www/src/features/studio/shell/components/nav-bar/nav-bar-logo.tsx b/apps/www/src/features/studio/shell/components/nav-bar/nav-bar-logo.tsx
index 8e6917995..8b5a0572d 100644
--- a/apps/www/src/features/studio/shell/components/nav-bar/nav-bar-logo.tsx
+++ b/apps/www/src/features/studio/shell/components/nav-bar/nav-bar-logo.tsx
@@ -25,7 +25,6 @@ export function NavBarLogo({
   })();
 
   return (
-    // biome-ignore lint/suspicious/noExplicitAny: Any link
     <Link to={homeLink?.href as any}>
       <Logo className="ml-2 h-4" color="mono" variant="symbol" />
     </Link>
diff --git a/apps/www/src/features/studio/shell/components/nav-bar/nav-user/nav-user-dropdown.tsx b/apps/www/src/features/studio/shell/components/nav-bar/nav-user/nav-user-dropdown.tsx
index 23bf880fb..dd8f45b82 100644
--- a/apps/www/src/features/studio/shell/components/nav-bar/nav-user/nav-user-dropdown.tsx
+++ b/apps/www/src/features/studio/shell/components/nav-bar/nav-user/nav-user-dropdown.tsx
@@ -15,7 +15,7 @@ import type { User } from "@voidhash/rpc";
 import { BadgeCheck, LogOut, Settings, Settings2 } from "lucide-react";
 import { useTheme } from "next-themes";
 
-import { redirectToSignOut } from "@/features/auth/lib/workos";
+import { redirectToSignOut } from "@/features/auth/lib/sign-out";
 
 export function NavUserDropdown({
   user,
diff --git a/apps/www/src/features/studio/shell/components/nav-bar/organization-project-switcher.tsx b/apps/www/src/features/studio/shell/components/nav-bar/organization-project-switcher.tsx
index d16f96a3c..9f6c58a06 100644
--- a/apps/www/src/features/studio/shell/components/nav-bar/organization-project-switcher.tsx
+++ b/apps/www/src/features/studio/shell/components/nav-bar/organization-project-switcher.tsx
@@ -127,8 +127,6 @@ export function OrganizationProjectSwitcher({
         sideOffset={4}
       >
         {activeOrganization && (
-          // biome-ignore lint/a11y/noStaticElementInteractions: visual effect
-          // biome-ignore lint/nursery/noNoninteractiveElementInteractions: visual effect
           <div
             className="flex flex-row divide-x divide-border"
             onMouseLeave={() => setHighlightedOrganizationIndex(null)}
diff --git a/apps/www/src/features/studio/shell/components/sidebar/sidebar-shell.tsx b/apps/www/src/features/studio/shell/components/sidebar/sidebar-shell.tsx
index b8e8db29a..46071d982 100644
--- a/apps/www/src/features/studio/shell/components/sidebar/sidebar-shell.tsx
+++ b/apps/www/src/features/studio/shell/components/sidebar/sidebar-shell.tsx
@@ -92,9 +92,7 @@ export function SidebarShell({
                               setSubmenuOpen(true);
                             }
                           }}
-                          // biome-ignore lint/suspicious/noExplicitAny: <explanation>
                           params={{ ...(item as any).params } as any}
-                          // biome-ignore lint/suspicious/noExplicitAny: <explanation>
                           to={item.url as any}
                         >
                           {item.icon && <item.icon />}
@@ -134,7 +132,6 @@ export function SidebarShell({
                         <SidebarMenuItem key={subItem.title}>
                           <SidebarMenuButton asChild isActive={subItem.isActive?.()}>
                             <TanstackLink
-                              // biome-ignore lint/suspicious/noExplicitAny: <explanation>
                               to={subItem.url as any}
                             >
                               {subItem.icon && <subItem.icon />}
diff --git a/apps/www/src/features/studio/shell/components/skeleton/organization-layout-skeleton.tsx b/apps/www/src/features/studio/shell/components/skeleton/organization-layout-skeleton.tsx
index 9fe8fefe6..a555bcf79 100644
--- a/apps/www/src/features/studio/shell/components/skeleton/organization-layout-skeleton.tsx
+++ b/apps/www/src/features/studio/shell/components/skeleton/organization-layout-skeleton.tsx
@@ -65,7 +65,6 @@ export function OrganizationLayoutSkeleton({ organizationSlug }: { organizationS
                   <Skeleton className="size-7 rounded-md" />
                 </div>
                 {Array.from({ length: 4 }).map((_, index) => (
-                  // biome-ignore lint/suspicious/noArrayIndexKey: skeleton row
                   <SidebarMenuItem key={index}>
                     <div className="flex h-9 w-full items-center gap-3 rounded-md p-2">
                       <Skeleton className="size-5 shrink-0 rounded" />
diff --git a/apps/www/src/features/studio/shell/components/skeleton/project-layout-skeleton.tsx b/apps/www/src/features/studio/shell/components/skeleton/project-layout-skeleton.tsx
index 122082db2..3e5999e4c 100644
--- a/apps/www/src/features/studio/shell/components/skeleton/project-layout-skeleton.tsx
+++ b/apps/www/src/features/studio/shell/components/skeleton/project-layout-skeleton.tsx
@@ -232,7 +232,6 @@ export function ProjectLayoutSkeleton({
                                 setSubmenuOpen(true);
                               }
                             }}
-                            // biome-ignore lint/suspicious/noExplicitAny: mirrors SidebarShell typing
                             to={item.url as any}
                           >
                             {item.icon && <item.icon />}
@@ -275,7 +274,6 @@ export function ProjectLayoutSkeleton({
                               isActive={subItem.isActive()}
                             >
                               <TanstackLink
-                                // biome-ignore lint/suspicious/noExplicitAny: mirrors SidebarShell typing
                                 to={subItem.url as any}
                               >
                                 {subItem.icon && <subItem.icon />}
diff --git a/apps/www/src/features/studio/styles/globals.css b/apps/www/src/features/studio/styles/globals.css
index 1f64ef057..f049e2cf6 100644
--- a/apps/www/src/features/studio/styles/globals.css
+++ b/apps/www/src/features/studio/styles/globals.css
@@ -1,4 +1,3 @@
-/** biome-ignore-all lint/nursery/noUnknownAtRule: tailwind */
 @import "tailwindcss";
 
 @import "tw-animate-css";
diff --git a/apps/www/src/features/www/button.tsx b/apps/www/src/features/www/button.tsx
deleted file mode 100644
index 40db04fcc..000000000
--- a/apps/www/src/features/www/button.tsx
+++ /dev/null
@@ -1,58 +0,0 @@
-import type * as React from "react";
-
-import { Slot } from "@radix-ui/react-slot";
-import { type VariantProps, cva } from "class-variance-authority";
-
-import { cn } from "@/lib/utils";
-
-const buttonVariants = cva(
-  "inline-flex shrink-0 cursor-pointer items-center justify-center gap-2 whitespace-nowrap rounded-md font-medium text-sm outline-none transition-all focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 [&_svg:not([class*='size-'])]:size-4 [&_svg]:pointer-events-none [&_svg]:shrink-0",
-  {
-    defaultVariants: {
-      size: "default",
-      variant: "default",
-    },
-    variants: {
-      size: {
-        default: "h-9 px-4 py-2 has-[>svg]:px-3",
-        icon: "size-9",
-        lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
-        sm: "h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5",
-      },
-      variant: {
-        default: "bg-primary text-primary-foreground shadow-xs hover:bg-primary/90",
-        destructive:
-          "bg-destructive text-white shadow-xs hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:bg-destructive/60 dark:focus-visible:ring-destructive/40",
-        ghost: "hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50",
-        link: "text-primary underline-offset-4 hover:underline",
-        outline:
-          "border bg-card shadow-xs hover:bg-accent hover:text-accent-foreground dark:border-border dark:bg-input/30 dark:hover:bg-input/80",
-        success:
-          "bg-success text-success-foreground shadow-xs hover:bg-success/90 focus-visible:ring-success/20 dark:focus-visible:ring-success/40 ",
-      },
-    },
-  },
-);
-
-function Button({
-  className,
-  variant,
-  size,
-  asChild = false,
-  ...props
-}: React.ComponentProps<"button"> &
-  VariantProps<typeof buttonVariants> & {
-    asChild?: boolean;
-  }) {
-  const Comp = asChild ? Slot : "button";
-
-  return (
-    <Comp
-      className={cn(buttonVariants({ className, size, variant }))}
-      data-slot="button"
-      {...props}
-    />
-  );
-}
-
-export { Button, buttonVariants };
diff --git a/apps/www/src/features/www/hero/footer.tsx b/apps/www/src/features/www/hero/footer.tsx
deleted file mode 100644
index 1d3a34d57..000000000
--- a/apps/www/src/features/www/hero/footer.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-import { Logo } from "../logo";
-
-export function Footer() {
-  return (
-    <footer className="flex w-full max-w-7xl flex-col md:mx-auto">
-      <div className="w-full">
-        <div className="flex w-full justify-between px-4 py-12">
-          <p className="text-center text-muted-foreground text-sm">
-            &copy; {new Date().getFullYear()} Voidhash s.r.o. All rights reserved.
-          </p>
-          <div className="flex gap-9 ">
-            <a
-              className="text-muted-foreground hover:text-foreground"
-              href="https://x.com/voidhashcom"
-              rel="noopener noreferrer"
-              target="_blank"
-            >
-              <svg
-                className="h-6"
-                fill="none"
-                viewBox="0 0 1200 1227"
-                xmlns="http://www.w3.org/2000/svg"
-              >
-                <title>X.com (Twitter) Logo</title>
-                <path
-                  d="M714.163 519.284 1160.89 0h-105.86L667.137 450.887 357.328 0H0l468.492 681.821L0 1226.37h105.866l409.625-476.152 327.181 476.152H1200L714.137 519.284h.026ZM569.165 687.828l-47.468-67.894-377.686-540.24h162.604l304.797 435.991 47.468 67.894 396.2 566.721H892.476L569.165 687.854v-.026Z"
-                  fill="currentColor"
-                />
-              </svg>
-            </a>
-            <a
-              className="text-muted-foreground hover:text-foreground"
-              href="https://github.com/voidhashcom/voidhash"
-              rel="noopener noreferrer"
-              target="_blank"
-            >
-              <svg
-                className="h-6"
-                fill="none"
-                viewBox="0 0 1024 1024"
-                xmlns="http://www.w3.org/2000/svg"
-              >
-                <title>GitHub Logo</title>
-                <path
-                  clipRule="evenodd"
-                  d="M8 0C3.58 0 0 3.58 0 8C0 11.54 2.29 14.53 5.47 15.59C5.87 15.66 6.02 15.42 6.02 15.21C6.02 15.02 6.01 14.39 6.01 13.72C4 14.09 3.48 13.23 3.32 12.78C3.23 12.55 2.84 11.84 2.5 11.65C2.22 11.5 1.82 11.13 2.49 11.12C3.12 11.11 3.57 11.7 3.72 11.94C4.44 13.15 5.59 12.81 6.05 12.6C6.12 12.08 6.33 11.73 6.56 11.53C4.78 11.33 2.92 10.64 2.92 7.58C2.92 6.71 3.23 5.99 3.74 5.43C3.66 5.23 3.38 4.41 3.82 3.31C3.82 3.31 4.49 3.1 6.02 4.13C6.66 3.95 7.34 3.86 8.02 3.86C8.7 3.86 9.38 3.95 10.02 4.13C11.55 3.09 12.22 3.31 12.22 3.31C12.66 4.41 12.38 5.23 12.3 5.43C12.81 5.99 13.12 6.7 13.12 7.58C13.12 10.65 11.25 11.33 9.47 11.53C9.76 11.78 10.01 12.26 10.01 13.01C10.01 14.08 10 14.94 10 15.21C10 15.42 10.15 15.67 10.55 15.59C13.71 14.53 16 11.53 16 8C16 3.58 12.42 0 8 0Z"
-                  fill="currentColor"
-                  fillRule="evenodd"
-                  transform="scale(64)"
-                />
-              </svg>
-            </a>
-          </div>
-        </div>
-        <div className="pb-12">
-          <Logo className="h-auto w-full text-muted dark:text-muted" />
-        </div>
-      </div>
-    </footer>
-  );
-}
diff --git a/apps/www/src/features/www/hero/hero.tsx b/apps/www/src/features/www/hero/hero.tsx
deleted file mode 100644
index a26b6fc25..000000000
--- a/apps/www/src/features/www/hero/hero.tsx
+++ /dev/null
@@ -1,72 +0,0 @@
-"use client";
-// import { ChevronRight } from 'lucide-react';
-
-import { VoidhashGradientBackground } from "@/components/voidhash-gradient-background";
-
-import { Button } from "../button";
-// import { Button } from '../button';
-import { SectionContainer } from "../section/section-container";
-
-export function Hero() {
-  return (
-    <SectionContainer className="w-full">
-      <section className="relative isolate flex min-h-[760px] flex-col items-center overflow-hidden pt-26 sm:min-h-[780px] lg:min-h-[820px]">
-        <div className="absolute inset-x-0 bottom-0 z-0 h-[430px] sm:h-[470px] lg:h-[520px]">
-          <VoidhashGradientBackground
-            controlsQueryParam="heroControls"
-            controlsStorageKey="voidhash:hero-three-controls"
-            controlsTitle="Hero FX"
-            settingsStorageKey="voidhash:hero-three-settings"
-          />
-        </div>
-
-        <div className="relative z-10 flex flex-col items-center justify-center">
-          <div className="rounded-full border border-border bg-card px-4 py-1 font-semibold text-muted-foreground text-sm">
-            Closed Alpha Preview - Now Available
-          </div>
-          <h1 className="mt-6 max-w-xl text-balance text-center font-semibold text-5xl leading-tight tracking-tight">
-            Add in-app purchases to React Native in seconds.
-          </h1>
-          <p className="mt-4 max-w-2xl text-balance text-center text-muted-foreground">
-            Voidhash is an open-source subscription management platform for React Native that allows
-            you to integrate Google Play and App Store purchases with single command.
-          </p>
-          <div className="mt-10 flex w-full items-center justify-center gap-4">
-            <form
-              action="https://formspree.io/f/mpwjvpve"
-              aria-label="Join waitlist"
-              className="flex w-full max-w-md flex-col items-center gap-2 rounded-xl border bg-card p-1 sm:flex-row"
-              method="POST"
-            >
-              <label className="sr-only" htmlFor="waitlist-email">
-                Email address
-              </label>
-              <input
-                aria-label="Email address"
-                autoComplete="email"
-                className="flex-1 rounded-md bg-background px-4 py-2 text-base text-foreground placeholder:text-muted-foreground focus:border-primary focus:outline-none"
-                id="waitlist-email"
-                name="email"
-                placeholder="Enter your email"
-                required
-                type="email"
-              />
-
-              <Button className="w-full sm:w-auto" type="submit">
-                Join Waitlist
-              </Button>
-            </form>
-            {/* <Button>
-              <span>Get Started</span>
-              <ChevronRight className="size-4 opacity-50" />
-            </Button>
-            <Button variant="ghost">
-              <span>Documentation</span>
-              <ChevronRight className="size-4 opacity-50" />
-            </Button> */}
-          </div>
-        </div>
-      </section>
-    </SectionContainer>
-  );
-}
diff --git a/apps/www/src/features/www/landing/assets/agent-icons/antigravity.png b/apps/www/src/features/www/landing/assets/agent-icons/antigravity.png
deleted file mode 100644
index 83e7e5370..000000000
Binary files a/apps/www/src/features/www/landing/assets/agent-icons/antigravity.png and /dev/null differ
diff --git a/apps/www/src/features/www/landing/assets/agent-icons/claude-code.png b/apps/www/src/features/www/landing/assets/agent-icons/claude-code.png
deleted file mode 100644
index a551af3de..000000000
Binary files a/apps/www/src/features/www/landing/assets/agent-icons/claude-code.png and /dev/null differ
diff --git a/apps/www/src/features/www/landing/assets/agent-icons/codex.png b/apps/www/src/features/www/landing/assets/agent-icons/codex.png
deleted file mode 100644
index 8eb519927..000000000
Binary files a/apps/www/src/features/www/landing/assets/agent-icons/codex.png and /dev/null differ
diff --git a/apps/www/src/features/www/landing/assets/agent-icons/cursor.png b/apps/www/src/features/www/landing/assets/agent-icons/cursor.png
deleted file mode 100644
index 22b3da450..000000000
Binary files a/apps/www/src/features/www/landing/assets/agent-icons/cursor.png and /dev/null differ
diff --git a/apps/www/src/features/www/landing/assets/agent-icons/opencode.png b/apps/www/src/features/www/landing/assets/agent-icons/opencode.png
deleted file mode 100644
index b70bcbe21..000000000
Binary files a/apps/www/src/features/www/landing/assets/agent-icons/opencode.png and /dev/null differ
diff --git a/apps/www/src/features/www/landing/assets/lenscal/boiled-egg.webp b/apps/www/src/features/www/landing/assets/lenscal/boiled-egg.webp
deleted file mode 100644
index 069600931..000000000
Binary files a/apps/www/src/features/www/landing/assets/lenscal/boiled-egg.webp and /dev/null differ
diff --git a/apps/www/src/features/www/landing/assets/lenscal/calorie-tracker.webp b/apps/www/src/features/www/landing/assets/lenscal/calorie-tracker.webp
deleted file mode 100644
index d104bffc1..000000000
Binary files a/apps/www/src/features/www/landing/assets/lenscal/calorie-tracker.webp and /dev/null differ
diff --git a/apps/www/src/features/www/landing/asteroids/engine.ts b/apps/www/src/features/www/landing/asteroids/engine.ts
deleted file mode 100644
index b2cb52b04..000000000
--- a/apps/www/src/features/www/landing/asteroids/engine.ts
+++ /dev/null
@@ -1,1088 +0,0 @@
-/**
- * Vector-arcade engine behind the landing page's Asteroids easter egg.
- *
- * Deliberately framework-free and allocation-free: every entity lives in a pre-sized typed array,
- * the loop only runs while the board is on screen and being played, and `destroy()` hands the
- * canvas' backing store back to the browser. Nothing here touches React, so the whole module can
- * be code-split away from the landing bundle.
- */
-
-const TAU = Math.PI * 2;
-
-/** Fixed simulation step. Decoupling it from the display refresh keeps a 120Hz screen fair. */
-const STEP_SECONDS = 1 / 60;
-
-/** Clamp on a single frame's delta, so a backgrounded tab does not resume with a huge catch-up. */
-const MAX_FRAME_SECONDS = 0.1;
-
-const MAX_BULLETS = 16;
-const MAX_ASTEROIDS = 48;
-const MAX_PARTICLES = 320;
-const STAR_COUNT = 70;
-
-/** Radius per asteroid tier: large, medium, small. */
-const TIER_RADII = [44, 25, 13];
-const TIER_SCORES = [20, 50, 100];
-const TIER_SPEEDS = [46, 68, 96];
-const SHAPE_VARIANTS = 4;
-
-const SHIP_TURN = 3.4;
-const SHIP_THRUST = 330;
-const SHIP_DRAG = 0.35;
-const SHIP_MAX_SPEED = 400;
-const SHIP_RADIUS = 11;
-
-const BULLET_SPEED = 520;
-const BULLET_LIFE = 1.05;
-const FIRE_INTERVAL = 0.2;
-
-const START_LIVES = 3;
-const RESPAWN_DELAY = 1.1;
-const INVULNERABLE_SECONDS = 2.4;
-const WAVE_DELAY = 1.4;
-
-/** Radius around the spawn point that must be clear of rocks before the ship comes back. */
-const SPAWN_CLEARANCE = 90;
-
-/**
- * Cap on the backing store so a wide monitor at dpr 3 does not allocate a 30MB canvas. Kept modest
- * because the CRT pass doubles the buffers (2D scene + WebGL target) and uploads the scene as a
- * texture every frame; the shader's softness hides the reduced sampling anyway.
- */
-const MAX_DEVICE_PIXELS = 2_600_000;
-
-const BACKDROP = "#000000";
-const STAR_DIM = "#27272a";
-const STAR_BRIGHT = "#3f3f46";
-const SHIP_COLOR = "#fafafa";
-const BULLET_COLOR = "#1e93ff";
-const BULLET_HALO = "rgba(30, 147, 255, 0.3)";
-const THRUST_COLOR = "#e4e4e7";
-
-/** Grayscale per tier — large rocks read as background, small ones as threats. */
-const TIER_COLORS = ["#52525c", "#71717b", "#a1a1aa"];
-
-/** Monochrome sparks: the missiles stay the only colour on the board. */
-const PARTICLE_COLORS = ["#fafafa", "#a1a1aa", "#52525c"];
-
-/**
- * Distance of the virtual camera from a rock's centre, in radii. Governs how hard the wireframe's
- * near side is magnified against its far side — lower reads more 3D, higher more orthographic.
- */
-const ROCK_FOCAL_RADII = 6;
-
-export type AsteroidsStatus = "idle" | "playing" | "paused" | "over";
-
-export type AsteroidsHud = {
-  score: number;
-  lives: number;
-  wave: number;
-};
-
-export type AsteroidsAction = "left" | "right" | "thrust" | "fire";
-
-/**
- * Optional post-processing stage: the engine renders the scene into its own 2D canvas and hands
- * every finished frame over instead of showing that canvas directly.
- */
-export type AsteroidsCompositor = {
-  resize: (width: number, height: number, scale: number) => void;
-  draw: (scene: HTMLCanvasElement, timeSeconds: number) => void;
-};
-
-export type AsteroidsEngineOptions = {
-  canvas: HTMLCanvasElement;
-  compositor?: AsteroidsCompositor | null;
-  reducedMotion: boolean;
-  onHud: (hud: AsteroidsHud) => void;
-  onStatus: (status: AsteroidsStatus) => void;
-};
-
-/** Small deterministic PRNG, used so the rock silhouettes are identical on every visit. */
-function mulberry32(seed: number): () => number {
-  let state = seed >>> 0;
-  return () => {
-    state = (state + 0x6d_2b_79_f5) | 0;
-    let t = Math.imul(state ^ (state >>> 15), 1 | state);
-    t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;
-    return ((t ^ (t >>> 14)) >>> 0) / 4_294_967_296;
-  };
-}
-
-const GOLDEN = (1 + Math.sqrt(5)) / 2;
-
-/** Unit icosahedron vertices; every rock mesh is a radially deformed copy of these 12 points. */
-const ICO_VERTICES = [
-  [-1, GOLDEN, 0],
-  [1, GOLDEN, 0],
-  [-1, -GOLDEN, 0],
-  [1, -GOLDEN, 0],
-  [0, -1, GOLDEN],
-  [0, 1, GOLDEN],
-  [0, -1, -GOLDEN],
-  [0, 1, -GOLDEN],
-  [GOLDEN, 0, -1],
-  [GOLDEN, 0, 1],
-  [-GOLDEN, 0, -1],
-  [-GOLDEN, 0, 1],
-] as const;
-
-const ROCK_VERTEX_COUNT = ICO_VERTICES.length;
-
-/**
- * The icosahedron's 30 edges as flat index pairs. Radial deformation moves vertices along their own
- * axis only, so the connectivity is shared by every variant.
- */
-let sharedRockEdges: Uint8Array | null = null;
-
-function rockEdges(): Uint8Array {
-  if (sharedRockEdges) {
-    return sharedRockEdges;
-  }
-
-  const pairs: number[] = [];
-  for (let a = 0; a < ROCK_VERTEX_COUNT; a += 1) {
-    for (let b = a + 1; b < ROCK_VERTEX_COUNT; b += 1) {
-      const dx = ICO_VERTICES[a][0] - ICO_VERTICES[b][0];
-      const dy = ICO_VERTICES[a][1] - ICO_VERTICES[b][1];
-      const dz = ICO_VERTICES[a][2] - ICO_VERTICES[b][2];
-      // Adjacent icosahedron vertices sit exactly 2 apart at this scale.
-      if (dx * dx + dy * dy + dz * dz < 4.1) {
-        pairs.push(a, b);
-      }
-    }
-  }
-
-  sharedRockEdges = new Uint8Array(pairs);
-  return sharedRockEdges;
-}
-
-/**
- * Deformed rock meshes per tier and variant, as flat `x, y, z` vertex triples.
- *
- * Built lazily so the module stays importable during server rendering, and seeded so every visit
- * tumbles the same rocks.
- */
-let sharedRockMeshes: Float32Array[][] | null = null;
-
-function rockMeshes(): Float32Array[][] {
-  if (sharedRockMeshes) {
-    return sharedRockMeshes;
-  }
-
-  const random = mulberry32(0x5e_ed_10_23);
-  const norm = Math.hypot(1, GOLDEN);
-
-  sharedRockMeshes = TIER_RADII.map((radius) => {
-    const variants: Float32Array[] = [];
-    for (let variant = 0; variant < SHAPE_VARIANTS; variant += 1) {
-      const mesh = new Float32Array(ROCK_VERTEX_COUNT * 3);
-      for (let vertex = 0; vertex < ROCK_VERTEX_COUNT; vertex += 1) {
-        const reach = (radius * (0.74 + random() * 0.38)) / norm;
-        mesh[vertex * 3] = ICO_VERTICES[vertex][0] * reach;
-        mesh[vertex * 3 + 1] = ICO_VERTICES[vertex][1] * reach;
-        mesh[vertex * 3 + 2] = ICO_VERTICES[vertex][2] * reach;
-      }
-      variants.push(mesh);
-    }
-    return variants;
-  });
-
-  return sharedRockMeshes;
-}
-
-let sharedShipPath: Path2D | null = null;
-let sharedFlamePath: Path2D | null = null;
-
-function shipPath(): Path2D {
-  if (!sharedShipPath) {
-    const path = new Path2D();
-    path.moveTo(15, 0);
-    path.lineTo(-10, 9);
-    path.lineTo(-6, 0);
-    path.lineTo(-10, -9);
-    path.closePath();
-    sharedShipPath = path;
-  }
-  return sharedShipPath;
-}
-
-function flamePath(): Path2D {
-  if (!sharedFlamePath) {
-    const path = new Path2D();
-    path.moveTo(-7, 5);
-    path.lineTo(-17, 0);
-    path.lineTo(-7, -5);
-    sharedFlamePath = path;
-  }
-  return sharedFlamePath;
-}
-
-/** Shortest signed distance between two coordinates on a wrapping axis. */
-function wrapDelta(delta: number, size: number): number {
-  if (delta > size * 0.5) {
-    return delta - size;
-  }
-  if (delta < -size * 0.5) {
-    return delta + size;
-  }
-  return delta;
-}
-
-export class AsteroidsEngine {
-  private readonly canvas: HTMLCanvasElement;
-  private readonly ctx: CanvasRenderingContext2D;
-  private readonly compositor: AsteroidsCompositor | null;
-  private readonly reducedMotion: boolean;
-  private readonly onHud: (hud: AsteroidsHud) => void;
-  private readonly onStatus: (status: AsteroidsStatus) => void;
-
-  private width = 0;
-  private height = 0;
-  private scale = 1;
-
-  private status: AsteroidsStatus = "idle";
-  private destroyed = false;
-  private frameHandle = 0;
-  private lastFrameTime = 0;
-  private accumulator = 0;
-  private elapsed = 0;
-
-  private score = 0;
-  private lives = START_LIVES;
-  private wave = 0;
-
-  private readonly input = { left: false, right: false, thrust: false, fire: false };
-
-  private shipX = 0;
-  private shipY = 0;
-  private shipVx = 0;
-  private shipVy = 0;
-  private shipAngle = -Math.PI / 2;
-  private shipAlive = false;
-  private respawnTimer = 0;
-  private invulnerableTimer = 0;
-  private fireTimer = 0;
-  private waveTimer = 0;
-  private shake = 0;
-
-  private readonly bulletX = new Float32Array(MAX_BULLETS);
-  private readonly bulletY = new Float32Array(MAX_BULLETS);
-  private readonly bulletVx = new Float32Array(MAX_BULLETS);
-  private readonly bulletVy = new Float32Array(MAX_BULLETS);
-  private readonly bulletLife = new Float32Array(MAX_BULLETS);
-  private bulletCount = 0;
-
-  private readonly rockX = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockY = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockVx = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockVy = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockPitch = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockYaw = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockPitchSpin = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockYawSpin = new Float32Array(MAX_ASTEROIDS);
-  private readonly rockTier = new Uint8Array(MAX_ASTEROIDS);
-  private readonly rockVariant = new Uint8Array(MAX_ASTEROIDS);
-  private rockCount = 0;
-
-  /** Scratch for a single rock's projected vertices during rendering. */
-  private readonly projectedX = new Float32Array(ROCK_VERTEX_COUNT);
-  private readonly projectedY = new Float32Array(ROCK_VERTEX_COUNT);
-
-  private readonly particleX = new Float32Array(MAX_PARTICLES);
-  private readonly particleY = new Float32Array(MAX_PARTICLES);
-  private readonly particleVx = new Float32Array(MAX_PARTICLES);
-  private readonly particleVy = new Float32Array(MAX_PARTICLES);
-  private readonly particleLife = new Float32Array(MAX_PARTICLES);
-  private readonly particleSpan = new Float32Array(MAX_PARTICLES);
-  private readonly particleColor = new Uint8Array(MAX_PARTICLES);
-  private particleCount = 0;
-
-  /** Star field as flat `x, y, size` triples — cheaper to keep than an offscreen canvas. */
-  private readonly stars = new Float32Array(STAR_COUNT * 3);
-
-  /** Scratch buffers for `spreadWrapped`, at most one copy per screen corner. */
-  private readonly wrapSpreadX = new Float32Array(4);
-  private readonly wrapSpreadY = new Float32Array(4);
-
-  constructor({ canvas, compositor, reducedMotion, onHud, onStatus }: AsteroidsEngineOptions) {
-    const ctx = canvas.getContext("2d", { alpha: false });
-    if (!ctx) {
-      throw new Error("Asteroids needs a 2D canvas context");
-    }
-
-    this.canvas = canvas;
-    this.ctx = ctx;
-    this.compositor = compositor ?? null;
-    this.reducedMotion = reducedMotion;
-    this.onHud = onHud;
-    this.onStatus = onStatus;
-  }
-
-  /** Resizes the backing store to `width` x `height` CSS pixels and repaints once. */
-  resize(width: number, height: number): void {
-    if (this.destroyed || width <= 0 || height <= 0) {
-      return;
-    }
-
-    const requested = Math.min(window.devicePixelRatio || 1, 2);
-    const budget = Math.sqrt(MAX_DEVICE_PIXELS / (width * height));
-    const scale = Math.max(1, Math.min(requested, budget));
-    const sizeChanged = width !== this.width || height !== this.height;
-
-    this.width = width;
-    this.height = height;
-    this.scale = scale;
-    this.canvas.width = Math.round(width * scale);
-    this.canvas.height = Math.round(height * scale);
-    this.ctx.setTransform(scale, 0, 0, scale, 0, 0);
-    this.compositor?.resize(width, height, scale);
-
-    if (sizeChanged) {
-      this.seedStars();
-      if (this.status === "idle") {
-        this.layoutAttractField();
-      } else {
-        this.containEntities();
-      }
-    }
-
-    this.render();
-  }
-
-  /** Starts a fresh run from wave one. */
-  start(): void {
-    if (this.destroyed) {
-      return;
-    }
-
-    this.score = 0;
-    this.lives = START_LIVES;
-    this.wave = 0;
-    this.elapsed = 0;
-    this.accumulator = 0;
-    this.shake = 0;
-    this.bulletCount = 0;
-    this.rockCount = 0;
-    this.particleCount = 0;
-    this.input.left = false;
-    this.input.right = false;
-    this.input.thrust = false;
-    this.input.fire = false;
-
-    this.spawnShip();
-    this.startWave();
-    this.emitHud();
-    this.setStatus("playing");
-    this.runLoop();
-  }
-
-  /** Suspends the loop, keeping the board exactly as it stands. */
-  pause(): void {
-    if (this.status !== "playing") {
-      return;
-    }
-    this.setStatus("paused");
-    this.stopLoop();
-    this.render();
-  }
-
-  /** Resumes a paused run. */
-  resume(): void {
-    if (this.status !== "paused" || this.destroyed) {
-      return;
-    }
-    this.setStatus("playing");
-    this.runLoop();
-  }
-
-  /**
-   * Gates the render loop on the board being worth animating — on screen, in a visible tab.
-   *
-   * Separate from `pause()`: that is the player's own pause and shows an overlay, whereas this is
-   * the page telling the engine nobody can see it, which should cost nothing at all.
-   */
-  setActive(active: boolean): void {
-    if (this.destroyed) {
-      return;
-    }
-
-    if (!active) {
-      this.stopLoop();
-      return;
-    }
-    if (this.status === "idle" || this.status === "playing") {
-      this.runLoop();
-    }
-  }
-
-  setInput(action: AsteroidsAction, pressed: boolean): void {
-    this.input[action] = pressed;
-  }
-
-  /** Cancels the loop, drops listeners' last frame and releases the canvas' backing store. */
-  destroy(): void {
-    this.destroyed = true;
-    this.stopLoop();
-    this.canvas.width = 0;
-    this.canvas.height = 0;
-  }
-
-  private setStatus(status: AsteroidsStatus): void {
-    if (this.status !== status) {
-      this.status = status;
-      this.onStatus(status);
-    }
-  }
-
-  private emitHud(): void {
-    this.onHud({ lives: this.lives, score: this.score, wave: this.wave });
-  }
-
-  private runLoop(): void {
-    if (this.frameHandle !== 0 || this.destroyed) {
-      return;
-    }
-    this.lastFrameTime = performance.now();
-    this.frameHandle = requestAnimationFrame(this.frame);
-  }
-
-  private stopLoop(): void {
-    if (this.frameHandle !== 0) {
-      cancelAnimationFrame(this.frameHandle);
-      this.frameHandle = 0;
-    }
-  }
-
-  private readonly frame = (time: number): void => {
-    this.frameHandle = requestAnimationFrame(this.frame);
-
-    const delta = Math.min((time - this.lastFrameTime) / 1000, MAX_FRAME_SECONDS);
-    this.lastFrameTime = time;
-    this.accumulator += delta;
-
-    while (this.accumulator >= STEP_SECONDS) {
-      this.step(STEP_SECONDS);
-      this.accumulator -= STEP_SECONDS;
-    }
-
-    this.render();
-
-    // Once the wreckage has settled there is nothing left to animate on the game-over board, so the
-    // loop retires itself instead of burning a frame budget behind the overlay.
-    if (this.status === "over" && this.particleCount === 0 && this.shake === 0) {
-      this.stopLoop();
-    }
-  };
-
-  private step(delta: number): void {
-    this.elapsed += delta;
-    this.shake = Math.max(0, this.shake - delta * 26);
-
-    if (this.status === "playing") {
-      this.stepShip(delta);
-      this.stepBullets(delta);
-    }
-
-    this.stepRocks(delta);
-    this.stepParticles(delta);
-
-    if (this.status !== "playing") {
-      return;
-    }
-
-    this.resolveBulletHits();
-    this.resolveShipHits();
-
-    if (this.rockCount === 0) {
-      this.waveTimer -= delta;
-      if (this.waveTimer <= 0) {
-        this.startWave();
-      }
-    }
-
-    if (!this.shipAlive && this.lives > 0) {
-      this.respawnTimer -= delta;
-      if (this.respawnTimer <= 0 && this.spawnPointIsClear()) {
-        this.spawnShip();
-      }
-    }
-  }
-
-  private stepShip(delta: number): void {
-    this.invulnerableTimer = Math.max(0, this.invulnerableTimer - delta);
-    this.fireTimer = Math.max(0, this.fireTimer - delta);
-
-    if (!this.shipAlive) {
-      return;
-    }
-
-    if (this.input.left) {
-      this.shipAngle -= SHIP_TURN * delta;
-    }
-    if (this.input.right) {
-      this.shipAngle += SHIP_TURN * delta;
-    }
-
-    if (this.input.thrust) {
-      this.shipVx += Math.cos(this.shipAngle) * SHIP_THRUST * delta;
-      this.shipVy += Math.sin(this.shipAngle) * SHIP_THRUST * delta;
-
-      const speed = Math.hypot(this.shipVx, this.shipVy);
-      if (speed > SHIP_MAX_SPEED) {
-        const clamp = SHIP_MAX_SPEED / speed;
-        this.shipVx *= clamp;
-        this.shipVy *= clamp;
-      }
-      if (!this.reducedMotion) {
-        this.emitThrustSpark();
-      }
-    }
-
-    const drag = Math.max(0, 1 - SHIP_DRAG * delta);
-    this.shipVx *= drag;
-    this.shipVy *= drag;
-    this.shipX = this.wrapX(this.shipX + this.shipVx * delta);
-    this.shipY = this.wrapY(this.shipY + this.shipVy * delta);
-
-    if (this.input.fire && this.fireTimer === 0) {
-      this.fireBullet();
-    }
-  }
-
-  private stepBullets(delta: number): void {
-    for (let index = this.bulletCount - 1; index >= 0; index -= 1) {
-      this.bulletLife[index] -= delta;
-      if (this.bulletLife[index] <= 0) {
-        this.removeBullet(index);
-        continue;
-      }
-      this.bulletX[index] = this.wrapX(this.bulletX[index] + this.bulletVx[index] * delta);
-      this.bulletY[index] = this.wrapY(this.bulletY[index] + this.bulletVy[index] * delta);
-    }
-  }
-
-  private stepRocks(delta: number): void {
-    for (let index = 0; index < this.rockCount; index += 1) {
-      this.rockX[index] = this.wrapX(this.rockX[index] + this.rockVx[index] * delta);
-      this.rockY[index] = this.wrapY(this.rockY[index] + this.rockVy[index] * delta);
-      this.rockPitch[index] += this.rockPitchSpin[index] * delta;
-      this.rockYaw[index] += this.rockYawSpin[index] * delta;
-    }
-  }
-
-  private stepParticles(delta: number): void {
-    for (let index = this.particleCount - 1; index >= 0; index -= 1) {
-      this.particleLife[index] -= delta;
-      if (this.particleLife[index] <= 0) {
-        this.removeParticle(index);
-        continue;
-      }
-      this.particleX[index] += this.particleVx[index] * delta;
-      this.particleY[index] += this.particleVy[index] * delta;
-      this.particleVx[index] *= 0.98;
-      this.particleVy[index] *= 0.98;
-    }
-  }
-
-  private resolveBulletHits(): void {
-    for (let bullet = this.bulletCount - 1; bullet >= 0; bullet -= 1) {
-      for (let rock = this.rockCount - 1; rock >= 0; rock -= 1) {
-        const radius = TIER_RADII[this.rockTier[rock]];
-        const dx = wrapDelta(this.bulletX[bullet] - this.rockX[rock], this.width);
-        const dy = wrapDelta(this.bulletY[bullet] - this.rockY[rock], this.height);
-        if (dx * dx + dy * dy > radius * radius) {
-          continue;
-        }
-
-        this.removeBullet(bullet);
-        this.breakRock(rock);
-        break;
-      }
-    }
-  }
-
-  private resolveShipHits(): void {
-    if (!this.shipAlive || this.invulnerableTimer > 0) {
-      return;
-    }
-
-    for (let rock = this.rockCount - 1; rock >= 0; rock -= 1) {
-      const radius = TIER_RADII[this.rockTier[rock]] + SHIP_RADIUS * 0.7;
-      const dx = wrapDelta(this.shipX - this.rockX[rock], this.width);
-      const dy = wrapDelta(this.shipY - this.rockY[rock], this.height);
-      if (dx * dx + dy * dy > radius * radius) {
-        continue;
-      }
-
-      this.breakRock(rock);
-      this.destroyShip();
-      return;
-    }
-  }
-
-  private breakRock(index: number): void {
-    const tier = this.rockTier[index];
-    const x = this.rockX[index];
-    const y = this.rockY[index];
-
-    this.score += TIER_SCORES[tier];
-    this.shake = Math.min(this.shake + (tier === 0 ? 6 : 3), 12);
-    this.emitBurst(x, y, tier === 0 ? 16 : 10, 130 + tier * 40);
-    this.removeRock(index);
-
-    if (tier < TIER_RADII.length - 1) {
-      const childTier = tier + 1;
-      const base = Math.random() * TAU;
-      for (let child = 0; child < 2; child += 1) {
-        this.addRock(x, y, childTier, base + child * Math.PI + (Math.random() - 0.5));
-      }
-    }
-
-    this.emitHud();
-    if (this.rockCount === 0) {
-      this.waveTimer = WAVE_DELAY;
-    }
-  }
-
-  private destroyShip(): void {
-    this.shipAlive = false;
-    this.lives -= 1;
-    this.shake = 14;
-    this.emitBurst(this.shipX, this.shipY, 26, 190);
-    this.emitHud();
-
-    if (this.lives <= 0) {
-      this.setStatus("over");
-      return;
-    }
-    this.respawnTimer = RESPAWN_DELAY;
-  }
-
-  private spawnShip(): void {
-    this.shipX = this.width * 0.5;
-    this.shipY = this.height * 0.5;
-    this.shipVx = 0;
-    this.shipVy = 0;
-    this.shipAngle = -Math.PI / 2;
-    this.shipAlive = true;
-    this.invulnerableTimer = INVULNERABLE_SECONDS;
-  }
-
-  private spawnPointIsClear(): boolean {
-    const centerX = this.width * 0.5;
-    const centerY = this.height * 0.5;
-
-    for (let rock = 0; rock < this.rockCount; rock += 1) {
-      const reach = SPAWN_CLEARANCE + TIER_RADII[this.rockTier[rock]];
-      const dx = wrapDelta(centerX - this.rockX[rock], this.width);
-      const dy = wrapDelta(centerY - this.rockY[rock], this.height);
-      if (dx * dx + dy * dy < reach * reach) {
-        return false;
-      }
-    }
-    return true;
-  }
-
-  private startWave(): void {
-    this.wave += 1;
-    const count = Math.min(3 + this.wave, 9);
-
-    for (let index = 0; index < count; index += 1) {
-      // Rocks enter from the rim so a wave never materialises on top of the ship.
-      const alongEdge = Math.random();
-      const onVerticalEdge = Math.random() < 0.5;
-      const x = onVerticalEdge ? (Math.random() < 0.5 ? 0 : this.width) : alongEdge * this.width;
-      const y = onVerticalEdge ? alongEdge * this.height : Math.random() < 0.5 ? 0 : this.height;
-      this.addRock(x, y, 0, Math.random() * TAU);
-    }
-
-    this.emitHud();
-  }
-
-  private addRock(x: number, y: number, tier: number, heading: number): void {
-    if (this.rockCount >= MAX_ASTEROIDS) {
-      return;
-    }
-
-    const index = this.rockCount;
-    this.rockCount += 1;
-
-    const speed = TIER_SPEEDS[tier] * (0.7 + Math.random() * 0.6) * (1 + this.wave * 0.04);
-    this.rockX[index] = x;
-    this.rockY[index] = y;
-    this.rockVx[index] = Math.cos(heading) * speed;
-    this.rockVy[index] = Math.sin(heading) * speed;
-    this.rockPitch[index] = Math.random() * TAU;
-    this.rockYaw[index] = Math.random() * TAU;
-    this.rockPitchSpin[index] = (Math.random() - 0.5) * 1.4;
-    this.rockYawSpin[index] = (Math.random() - 0.5) * 1.4;
-    this.rockTier[index] = tier;
-    this.rockVariant[index] = Math.floor(Math.random() * SHAPE_VARIANTS);
-  }
-
-  private fireBullet(): void {
-    if (this.bulletCount >= MAX_BULLETS) {
-      return;
-    }
-
-    const index = this.bulletCount;
-    this.bulletCount += 1;
-    this.fireTimer = FIRE_INTERVAL;
-
-    const cos = Math.cos(this.shipAngle);
-    const sin = Math.sin(this.shipAngle);
-    this.bulletX[index] = this.shipX + cos * SHIP_RADIUS;
-    this.bulletY[index] = this.shipY + sin * SHIP_RADIUS;
-    this.bulletVx[index] = this.shipVx + cos * BULLET_SPEED;
-    this.bulletVy[index] = this.shipVy + sin * BULLET_SPEED;
-    this.bulletLife[index] = BULLET_LIFE;
-  }
-
-  private emitBurst(x: number, y: number, count: number, speed: number): void {
-    for (let index = 0; index < count; index += 1) {
-      const heading = Math.random() * TAU;
-      const reach = speed * (0.3 + Math.random() * 0.7);
-      this.addParticle(
-        x,
-        y,
-        Math.cos(heading) * reach,
-        Math.sin(heading) * reach,
-        0.4 + Math.random() * 0.5,
-        index % PARTICLE_COLORS.length,
-      );
-    }
-  }
-
-  private emitThrustSpark(): void {
-    const heading = this.shipAngle + Math.PI + (Math.random() - 0.5) * 0.6;
-    this.addParticle(
-      this.shipX + Math.cos(heading) * 9,
-      this.shipY + Math.sin(heading) * 9,
-      this.shipVx * 0.4 + Math.cos(heading) * 110,
-      this.shipVy * 0.4 + Math.sin(heading) * 110,
-      0.22,
-      1,
-    );
-  }
-
-  private addParticle(
-    x: number,
-    y: number,
-    vx: number,
-    vy: number,
-    span: number,
-    color: number,
-  ): void {
-    // The pool is a hard cap rather than a growable list: past it the newest spark is simply
-    // dropped, which is invisible in a burst and keeps the frame's memory ceiling fixed.
-    if (this.particleCount >= MAX_PARTICLES) {
-      return;
-    }
-
-    const index = this.particleCount;
-    this.particleCount += 1;
-    this.particleX[index] = x;
-    this.particleY[index] = y;
-    this.particleVx[index] = vx;
-    this.particleVy[index] = vy;
-    this.particleLife[index] = span;
-    this.particleSpan[index] = span;
-    this.particleColor[index] = color;
-  }
-
-  private removeBullet(index: number): void {
-    this.bulletCount -= 1;
-    const last = this.bulletCount;
-    if (index === last) {
-      return;
-    }
-    this.bulletX[index] = this.bulletX[last];
-    this.bulletY[index] = this.bulletY[last];
-    this.bulletVx[index] = this.bulletVx[last];
-    this.bulletVy[index] = this.bulletVy[last];
-    this.bulletLife[index] = this.bulletLife[last];
-  }
-
-  private removeRock(index: number): void {
-    this.rockCount -= 1;
-    const last = this.rockCount;
-    if (index === last) {
-      return;
-    }
-    this.rockX[index] = this.rockX[last];
-    this.rockY[index] = this.rockY[last];
-    this.rockVx[index] = this.rockVx[last];
-    this.rockVy[index] = this.rockVy[last];
-    this.rockPitch[index] = this.rockPitch[last];
-    this.rockYaw[index] = this.rockYaw[last];
-    this.rockPitchSpin[index] = this.rockPitchSpin[last];
-    this.rockYawSpin[index] = this.rockYawSpin[last];
-    this.rockTier[index] = this.rockTier[last];
-    this.rockVariant[index] = this.rockVariant[last];
-  }
-
-  private removeParticle(index: number): void {
-    this.particleCount -= 1;
-    const last = this.particleCount;
-    if (index === last) {
-      return;
-    }
-    this.particleX[index] = this.particleX[last];
-    this.particleY[index] = this.particleY[last];
-    this.particleVx[index] = this.particleVx[last];
-    this.particleVy[index] = this.particleVy[last];
-    this.particleLife[index] = this.particleLife[last];
-    this.particleSpan[index] = this.particleSpan[last];
-    this.particleColor[index] = this.particleColor[last];
-  }
-
-  private wrapX(value: number): number {
-    if (value < 0) {
-      return value + this.width;
-    }
-    if (value >= this.width) {
-      return value - this.width;
-    }
-    return value;
-  }
-
-  private wrapY(value: number): number {
-    if (value < 0) {
-      return value + this.height;
-    }
-    if (value >= this.height) {
-      return value - this.height;
-    }
-    return value;
-  }
-
-  private containEntities(): void {
-    this.shipX = Math.min(this.shipX, this.width);
-    this.shipY = Math.min(this.shipY, this.height);
-    for (let rock = 0; rock < this.rockCount; rock += 1) {
-      this.rockX[rock] = Math.min(this.rockX[rock], this.width);
-      this.rockY[rock] = Math.min(this.rockY[rock], this.height);
-    }
-  }
-
-  private seedStars(): void {
-    for (let index = 0; index < STAR_COUNT; index += 1) {
-      const offset = index * 3;
-      this.stars[offset] = Math.random() * this.width;
-      this.stars[offset + 1] = Math.random() * this.height;
-      this.stars[offset + 2] = Math.random() < 0.2 ? 2 : 1;
-    }
-  }
-
-  /** Drifting rocks behind the idle overlay, so the board is never an empty rectangle. */
-  private layoutAttractField(): void {
-    this.rockCount = 0;
-    this.bulletCount = 0;
-    this.particleCount = 0;
-    this.shipAlive = false;
-
-    for (let index = 0; index < 5; index += 1) {
-      this.addRock(
-        Math.random() * this.width,
-        Math.random() * this.height,
-        index % 2,
-        Math.random() * TAU,
-      );
-    }
-  }
-
-  private render(): void {
-    const ctx = this.ctx;
-    ctx.fillStyle = BACKDROP;
-    ctx.fillRect(0, 0, this.width, this.height);
-
-    this.renderStars();
-
-    const shakeX = this.shake === 0 ? 0 : (Math.random() - 0.5) * this.shake;
-    const shakeY = this.shake === 0 ? 0 : (Math.random() - 0.5) * this.shake;
-    ctx.save();
-    ctx.translate(shakeX, shakeY);
-
-    ctx.lineJoin = "round";
-    this.renderRocks();
-    this.renderBullets();
-    this.renderParticles();
-    if (this.shipAlive) {
-      this.renderShip();
-    }
-
-    ctx.restore();
-
-    this.compositor?.draw(this.canvas, this.elapsed);
-  }
-
-  private renderStars(): void {
-    const ctx = this.ctx;
-    ctx.fillStyle = STAR_DIM;
-    for (let index = 0; index < STAR_COUNT; index += 1) {
-      const offset = index * 3;
-      const size = this.stars[offset + 2];
-      if (size > 1) {
-        continue;
-      }
-      ctx.fillRect(this.stars[offset], this.stars[offset + 1], 1, 1);
-    }
-
-    ctx.fillStyle = STAR_BRIGHT;
-    for (let index = 0; index < STAR_COUNT; index += 1) {
-      const offset = index * 3;
-      if (this.stars[offset + 2] <= 1) {
-        continue;
-      }
-      ctx.fillRect(this.stars[offset], this.stars[offset + 1], 2, 2);
-    }
-  }
-
-  /**
-   * Draws each rock as a tumbling 3D wireframe: the mesh is rotated around two axes, projected
-   * with a mild perspective, and its 30 edges stroked in a single path per rock.
-   */
-  private renderRocks(): void {
-    const ctx = this.ctx;
-    const meshes = rockMeshes();
-    const edges = rockEdges();
-    ctx.lineWidth = 1.25;
-
-    for (let index = 0; index < this.rockCount; index += 1) {
-      const tier = this.rockTier[index];
-      const mesh = meshes[tier][this.rockVariant[index]];
-      const radius = TIER_RADII[tier];
-      const focal = radius * ROCK_FOCAL_RADII;
-
-      const cosPitch = Math.cos(this.rockPitch[index]);
-      const sinPitch = Math.sin(this.rockPitch[index]);
-      const cosYaw = Math.cos(this.rockYaw[index]);
-      const sinYaw = Math.sin(this.rockYaw[index]);
-
-      for (let vertex = 0; vertex < ROCK_VERTEX_COUNT; vertex += 1) {
-        const x = mesh[vertex * 3];
-        const y = mesh[vertex * 3 + 1];
-        const z = mesh[vertex * 3 + 2];
-        const rotatedY = y * cosPitch - z * sinPitch;
-        const pitchedZ = y * sinPitch + z * cosPitch;
-        const rotatedX = x * cosYaw + pitchedZ * sinYaw;
-        const rotatedZ = -x * sinYaw + pitchedZ * cosYaw;
-        const perspective = focal / (focal - rotatedZ);
-        this.projectedX[vertex] = rotatedX * perspective;
-        this.projectedY[vertex] = rotatedY * perspective;
-      }
-
-      const copies = this.spreadWrapped(this.rockX[index], this.rockY[index], radius * 1.4);
-      ctx.strokeStyle = TIER_COLORS[tier];
-      ctx.beginPath();
-      for (let copy = 0; copy < copies; copy += 1) {
-        const offsetX = this.wrapSpreadX[copy];
-        const offsetY = this.wrapSpreadY[copy];
-        for (let edge = 0; edge < edges.length; edge += 2) {
-          const a = edges[edge];
-          const b = edges[edge + 1];
-          ctx.moveTo(offsetX + this.projectedX[a], offsetY + this.projectedY[a]);
-          ctx.lineTo(offsetX + this.projectedX[b], offsetY + this.projectedY[b]);
-        }
-      }
-      ctx.stroke();
-    }
-  }
-
-  private renderBullets(): void {
-    const ctx = this.ctx;
-
-    ctx.fillStyle = BULLET_HALO;
-    for (let index = 0; index < this.bulletCount; index += 1) {
-      ctx.beginPath();
-      ctx.arc(this.bulletX[index], this.bulletY[index], 6, 0, TAU);
-      ctx.fill();
-    }
-
-    ctx.fillStyle = BULLET_COLOR;
-    for (let index = 0; index < this.bulletCount; index += 1) {
-      ctx.beginPath();
-      ctx.arc(this.bulletX[index], this.bulletY[index], 2.4, 0, TAU);
-      ctx.fill();
-    }
-  }
-
-  private renderParticles(): void {
-    const ctx = this.ctx;
-
-    // Grouped by colour so a 300-spark burst costs three `fillStyle` writes instead of three
-    // hundred.
-    for (let color = 0; color < PARTICLE_COLORS.length; color += 1) {
-      ctx.fillStyle = PARTICLE_COLORS[color];
-      for (let index = 0; index < this.particleCount; index += 1) {
-        if (this.particleColor[index] !== color) {
-          continue;
-        }
-        ctx.globalAlpha = this.particleLife[index] / this.particleSpan[index];
-        ctx.fillRect(this.particleX[index] - 1, this.particleY[index] - 1, 2, 2);
-      }
-    }
-
-    ctx.globalAlpha = 1;
-  }
-
-  private renderShip(): void {
-    // Blink through the grace period so the player can see they are not yet solid.
-    if (this.invulnerableTimer > 0 && Math.floor(this.elapsed * 10) % 2 === 0) {
-      return;
-    }
-
-    const ctx = this.ctx;
-    const flaming = this.input.thrust && Math.floor(this.elapsed * 30) % 2 === 0;
-    ctx.lineWidth = 2;
-
-    const copies = this.spreadWrapped(this.shipX, this.shipY, SHIP_RADIUS + 6);
-    for (let copy = 0; copy < copies; copy += 1) {
-      ctx.save();
-      ctx.translate(this.wrapSpreadX[copy], this.wrapSpreadY[copy]);
-      ctx.rotate(this.shipAngle);
-      if (flaming) {
-        ctx.strokeStyle = THRUST_COLOR;
-        ctx.stroke(flamePath());
-      }
-      ctx.strokeStyle = SHIP_COLOR;
-      ctx.stroke(shipPath());
-      ctx.restore();
-    }
-  }
-
-  /**
-   * Fills `wrapSpreadX/Y` with the entity's position plus a mirrored copy for every board edge it
-   * currently straddles, so shapes cross the seam whole instead of popping to the other side.
-   *
-   * Returns the number of copies to draw. Writing into shared buffers rather than returning a list
-   * — or taking a draw callback — keeps the render pass free of per-entity allocations.
-   */
-  private spreadWrapped(x: number, y: number, radius: number): number {
-    this.wrapSpreadX[0] = x;
-    this.wrapSpreadY[0] = y;
-    let count = 1;
-
-    const offsetX = x < radius ? this.width : x > this.width - radius ? -this.width : 0;
-    const offsetY = y < radius ? this.height : y > this.height - radius ? -this.height : 0;
-
-    if (offsetX !== 0) {
-      this.wrapSpreadX[count] = x + offsetX;
-      this.wrapSpreadY[count] = y;
-      count += 1;
-    }
-    if (offsetY !== 0) {
-      this.wrapSpreadX[count] = x;
-      this.wrapSpreadY[count] = y + offsetY;
-      count += 1;
-    }
-    if (offsetX !== 0 && offsetY !== 0) {
-      this.wrapSpreadX[count] = x + offsetX;
-      this.wrapSpreadY[count] = y + offsetY;
-      count += 1;
-    }
-
-    return count;
-  }
-}
diff --git a/apps/www/src/features/www/landing/asteroids/frame.ts b/apps/www/src/features/www/landing/asteroids/frame.ts
deleted file mode 100644
index b7ea49fa0..000000000
--- a/apps/www/src/features/www/landing/asteroids/frame.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Stage shared by the board and the placeholder that stands in for it.
- *
- * Kept in its own module so the section can reserve the board's exact full-screen footprint
- * without importing — and therefore eagerly bundling — the game itself.
- */
-export const ASTEROIDS_STAGE_CLASS = "relative h-svh w-full overflow-hidden bg-black";
diff --git a/apps/www/src/features/www/landing/asteroids/game.tsx b/apps/www/src/features/www/landing/asteroids/game.tsx
deleted file mode 100644
index 202f3a48c..000000000
--- a/apps/www/src/features/www/landing/asteroids/game.tsx
+++ /dev/null
@@ -1,444 +0,0 @@
-"use client";
-
-import { cn } from "@voidhash/ui";
-import { useReducedMotion } from "motion/react";
-import { useCallback, useEffect, useRef, useState } from "react";
-
-import { type AsteroidsAction, AsteroidsEngine, type AsteroidsStatus } from "./engine";
-import { ASTEROIDS_STAGE_CLASS } from "./frame";
-import { createCrtCompositor } from "./post";
-
-/** Keyed by `KeyboardEvent.code`, so the layout works the same on QWERTZ and AZERTY. */
-const KEY_ACTIONS: Record<string, AsteroidsAction> = {
-  ArrowLeft: "left",
-  ArrowRight: "right",
-  ArrowUp: "thrust",
-  KeyA: "left",
-  KeyD: "right",
-  KeyW: "thrust",
-  Space: "fire",
-};
-
-const ALL_ACTIONS = ["left", "right", "thrust", "fire"] as const;
-
-const BEST_SCORE_KEY = "voidhash.asteroids.best";
-
-function readBestScore(): number {
-  try {
-    return Number(window.localStorage.getItem(BEST_SCORE_KEY)) || 0;
-  } catch {
-    // Private-mode Safari and blocked-storage setups throw on access; a missing high score is not
-    // worth breaking the game over.
-    return 0;
-  }
-}
-
-function writeBestScore(score: number): void {
-  try {
-    window.localStorage.setItem(BEST_SCORE_KEY, String(score));
-  } catch {
-    // Ignored for the same reason as above.
-  }
-}
-
-function pad(value: number, digits: number): string {
-  return String(value).padStart(digits, "0");
-}
-
-function ShipGlyph({ className }: { className?: string }) {
-  return (
-    <svg aria-hidden="true" className={className} fill="none" viewBox="0 0 12 14" width="11">
-      <path d="M6 1 11 13 6 10.2 1 13Z" stroke="currentColor" strokeLinejoin="round" />
-    </svg>
-  );
-}
-
-const HUD_ALIGN = {
-  center: "items-center",
-  end: "items-end",
-  start: "items-start",
-} as const;
-
-function HudStat({
-  align = "start",
-  label,
-  children,
-}: {
-  align?: keyof typeof HUD_ALIGN;
-  label: string;
-  children: React.ReactNode;
-}) {
-  return (
-    <div className={cn("flex flex-col gap-1", HUD_ALIGN[align])}>
-      <div className="text-[11px]/3.5 text-zinc-600 tracking-[0.06em]">{label}</div>
-      <div className="text-white text-xl/6 tabular-nums">{children}</div>
-    </div>
-  );
-}
-
-/**
- * One button of the on-screen pad, held for as long as the finger stays down.
- *
- * Pointer capture keeps the hold alive when the thumb drifts off the circle, which it always does
- * during a long burn.
- */
-function TouchButton({
-  className,
-  label,
-  onHold,
-  children,
-}: {
-  className?: string;
-  label: string;
-  onHold: (pressed: boolean) => void;
-  children: React.ReactNode;
-}) {
-  return (
-    <button
-      aria-label={label}
-      className={cn(
-        // `touch-none` is what makes the pad playable rather than merely present: without it a
-        // thumb that drifts while held pans the page, and panning scrolls the board out of view,
-        // which pauses the run mid-press.
-        "flex size-16 touch-none select-none items-center justify-center rounded-full border border-zinc-700 bg-black/40 text-[15px] text-zinc-300 backdrop-blur-sm transition-colors active:border-zinc-300 active:bg-zinc-300/15 active:text-white",
-        className,
-      )}
-      onContextMenu={(event) => event.preventDefault()}
-      onPointerCancel={() => onHold(false)}
-      onPointerDown={(event) => {
-        event.preventDefault();
-        onHold(true);
-        // Capture is an optimisation for the drifting thumb, not a precondition for the press:
-        // it throws NotFoundError when the pointer is already gone, which must not cost the hold.
-        try {
-          event.currentTarget.setPointerCapture(event.pointerId);
-        } catch {
-          // Without capture the button still gets its own pointerup; only drift stops working.
-        }
-      }}
-      onPointerUp={() => onHold(false)}
-      type="button"
-    >
-      {children}
-    </button>
-  );
-}
-
-/**
- * Full-screen playable board for the landing page's unexplained finale.
- *
- * Owns the canvases and the arcade chrome; all simulation lives in {@link AsteroidsEngine} and the
- * CRT look in the `post` shader pass. The loop is gated on the board being on screen in a visible
- * tab, and a run that scrolls out of view pauses itself so the page never quietly holds the arrow
- * keys hostage. With `autoStart` the run begins the moment the board has a size — the section only
- * mounts this component once the player has already pressed play.
- */
-export function AsteroidsGame({ autoStart = false }: { autoStart?: boolean }) {
-  const frameRef = useRef<HTMLDivElement>(null);
-  const engineRef = useRef<AsteroidsEngine | null>(null);
-  const prefersReducedMotion = useReducedMotion();
-
-  const [status, setStatus] = useState<AsteroidsStatus>("idle");
-  const [hud, setHud] = useState({ lives: 3, score: 0, wave: 1 });
-  const [bestScore, setBestScore] = useState(0);
-  const [isTouch, setIsTouch] = useState(false);
-
-  useEffect(() => {
-    setBestScore(readBestScore());
-    setIsTouch(window.matchMedia("(pointer: coarse)").matches);
-  }, []);
-
-  // Hybrids (touch laptops, tablets with a trackpad) report a fine pointer until a finger actually
-  // lands, so the first touch anywhere on the page arms the pad as well.
-  useEffect(() => {
-    if (isTouch) {
-      return;
-    }
-
-    const onPointerDown = (event: PointerEvent) => {
-      if (event.pointerType === "touch") {
-        setIsTouch(true);
-      }
-    };
-
-    window.addEventListener("pointerdown", onPointerDown, { passive: true });
-    return () => window.removeEventListener("pointerdown", onPointerDown);
-  }, [isTouch]);
-
-  useEffect(() => {
-    const frame = frameRef.current;
-    if (!frame) {
-      return;
-    }
-
-    // The visible canvas is created per effect run rather than rendered once and held in a ref: a
-    // canvas keeps its context type for life, so a board that reruns this effect (reduced-motion
-    // resolving after mount, a remount in dev) would hand a canvas whose WebGL context the previous
-    // compositor already lost to a fresh compositor that cannot use it — and then to the engine,
-    // whose `getContext("2d")` on a WebGL canvas returns null. A new element sidesteps all of it.
-    const canvas = document.createElement("canvas");
-    canvas.className = "block size-full";
-    frame.prepend(canvas);
-
-    // With the CRT pass the visible canvas is WebGL and the engine draws into an offscreen scene;
-    // without it the engine draws straight onto the visible canvas.
-    const compositor = createCrtCompositor(canvas, prefersReducedMotion === true);
-    const engine = new AsteroidsEngine({
-      canvas: compositor ? document.createElement("canvas") : canvas,
-      compositor,
-      onHud: setHud,
-      onStatus: setStatus,
-      reducedMotion: prefersReducedMotion === true,
-    });
-    engineRef.current = engine;
-
-    let onScreen = false;
-    const syncActive = () => engine.setActive(onScreen && !document.hidden);
-
-    let started = false;
-    const resizeObserver = new ResizeObserver(([entry]) => {
-      const box = entry.contentRect;
-      engine.resize(Math.round(box.width), Math.round(box.height));
-      if (autoStart && !started && box.width > 0) {
-        started = true;
-        engine.start();
-      }
-    });
-    resizeObserver.observe(frame);
-
-    // A run that leaves the viewport pauses rather than merely freezing, so the overlay tells the
-    // player why the ship stopped — and so the key handler unbinds with it.
-    const intersectionObserver = new IntersectionObserver(
-      ([entry]) => {
-        onScreen = entry.isIntersecting;
-        if (!onScreen) {
-          engine.pause();
-        }
-        syncActive();
-      },
-      { threshold: 0.35 },
-    );
-    intersectionObserver.observe(frame);
-
-    const onVisibilityChange = () => {
-      if (document.hidden) {
-        engine.pause();
-      }
-      syncActive();
-    };
-    const onBlur = () => engine.pause();
-
-    document.addEventListener("visibilitychange", onVisibilityChange);
-    window.addEventListener("blur", onBlur);
-
-    return () => {
-      resizeObserver.disconnect();
-      intersectionObserver.disconnect();
-      document.removeEventListener("visibilitychange", onVisibilityChange);
-      window.removeEventListener("blur", onBlur);
-      engine.destroy();
-      compositor?.destroy();
-      canvas.remove();
-      engineRef.current = null;
-    };
-  }, [autoStart, prefersReducedMotion]);
-
-  // Bound only while a run is live: the arrow keys and space belong to the page the rest of the
-  // time, and an unbound handler cannot swallow a scroll.
-  useEffect(() => {
-    if (status !== "playing") {
-      return;
-    }
-
-    const onKeyDown = (event: KeyboardEvent) => {
-      if (event.metaKey || event.ctrlKey || event.altKey) {
-        return;
-      }
-      if (event.code === "Escape") {
-        engineRef.current?.pause();
-        return;
-      }
-      // ArrowDown/S do nothing but must not scroll the page away from a live game.
-      if (event.code === "ArrowDown" || event.code === "KeyS") {
-        event.preventDefault();
-        return;
-      }
-      const action = KEY_ACTIONS[event.code];
-      if (!action) {
-        return;
-      }
-      event.preventDefault();
-      engineRef.current?.setInput(action, true);
-    };
-
-    const onKeyUp = (event: KeyboardEvent) => {
-      const action = KEY_ACTIONS[event.code];
-      if (action) {
-        event.preventDefault();
-        engineRef.current?.setInput(action, false);
-      }
-    };
-
-    window.addEventListener("keydown", onKeyDown);
-    window.addEventListener("keyup", onKeyUp);
-
-    return () => {
-      window.removeEventListener("keydown", onKeyDown);
-      window.removeEventListener("keyup", onKeyUp);
-    };
-  }, [status]);
-
-  // A pad button that unmounts mid-press — a scroll pauses the run while thrust is held — never
-  // sees its own pointerup, so without this the action stays latched into the resumed run. Same
-  // for a key still down when the window blurs.
-  useEffect(() => {
-    if (status === "playing") {
-      return;
-    }
-    for (const action of ALL_ACTIONS) {
-      engineRef.current?.setInput(action, false);
-    }
-  }, [status]);
-
-  // Space/Enter starts or resumes a run, but only while the board fills the view — half a screen
-  // up the page those keys still belong to scrolling.
-  useEffect(() => {
-    if (status === "playing") {
-      return;
-    }
-
-    const onKeyDown = (event: KeyboardEvent) => {
-      if (
-        (event.code !== "Space" && event.code !== "Enter") ||
-        event.metaKey ||
-        event.ctrlKey ||
-        event.altKey
-      ) {
-        return;
-      }
-      const rect = frameRef.current?.getBoundingClientRect();
-      const midscreen = window.innerHeight * 0.5;
-      if (!rect || rect.top > midscreen || rect.bottom < midscreen) {
-        return;
-      }
-      event.preventDefault();
-      if (status === "paused") {
-        engineRef.current?.resume();
-      } else {
-        engineRef.current?.start();
-      }
-    };
-
-    window.addEventListener("keydown", onKeyDown);
-    return () => window.removeEventListener("keydown", onKeyDown);
-  }, [status]);
-
-  useEffect(() => {
-    if (status === "over" && hud.score > bestScore) {
-      setBestScore(hud.score);
-      writeBestScore(hud.score);
-    }
-  }, [bestScore, hud.score, status]);
-
-  const hold = useCallback((action: AsteroidsAction, pressed: boolean) => {
-    engineRef.current?.setInput(action, pressed);
-  }, []);
-
-  const primaryAction = useCallback(() => {
-    if (status === "paused") {
-      engineRef.current?.resume();
-    } else {
-      engineRef.current?.start();
-    }
-  }, [status]);
-
-  const showPad = isTouch && status === "playing";
-
-  return (
-    <div className={cn(ASTEROIDS_STAGE_CLASS, "select-none font-mono")} ref={frameRef}>
-      {/* The board's canvas is prepended here by the engine effect above. */}
-
-      {/* The landing navbar stays sticky over the stage, so the HUD starts below it. */}
-      <div className="pointer-events-none absolute inset-x-0 top-20 flex items-start justify-between px-6 md:px-10">
-        <HudStat label="SCORE">{pad(hud.score, 6)}</HudStat>
-        <HudStat align="center" label="WAVE">
-          {pad(hud.wave, 2)}
-        </HudStat>
-        <HudStat align="end" label="SHIPS">
-          <div className="flex h-6 items-center gap-1.5">
-            {hud.lives > 0 ? (
-              Array.from({ length: hud.lives }, (_, index) => <ShipGlyph key={index} />)
-            ) : (
-              <span className="text-zinc-600">—</span>
-            )}
-          </div>
-        </HudStat>
-      </div>
-
-      {/* One bar, so the pad, the high score and the home indicator never fight for the same
-          corner. Each pointer captures its own button, so steering while thrusting and firing is
-          just three fingers. */}
-      <div className="pointer-events-none absolute inset-x-0 bottom-0 flex items-end justify-between gap-4 px-6 pb-[max(1.25rem,env(safe-area-inset-bottom))] md:px-10">
-        {/* High score above the steering pad, so both clusters still bottom-align on the bar. */}
-        <div className="flex flex-col items-start gap-4">
-          <div className="text-[11px]/3.5 text-zinc-700 tracking-[0.06em]">
-            HI {pad(Math.max(bestScore, hud.score), 6)}
-          </div>
-          {showPad ? (
-            <div className="pointer-events-auto flex gap-3">
-              <TouchButton label="Rotate left" onHold={(down) => hold("left", down)}>
-                <span aria-hidden="true">◀</span>
-              </TouchButton>
-              <TouchButton label="Rotate right" onHold={(down) => hold("right", down)}>
-                <span aria-hidden="true">▶</span>
-              </TouchButton>
-            </div>
-          ) : null}
-        </div>
-        {showPad ? (
-          <div className="pointer-events-auto flex gap-3">
-            <TouchButton label="Thrust" onHold={(down) => hold("thrust", down)}>
-              <span aria-hidden="true">▲</span>
-            </TouchButton>
-            <TouchButton
-              className="border-blue-ribbon-600/70 text-blue-ribbon-400 active:border-blue-ribbon-400 active:bg-blue-ribbon-500/20 active:text-blue-ribbon-200"
-              label="Fire"
-              onHold={(down) => hold("fire", down)}
-            >
-              <span aria-hidden="true">●</span>
-            </TouchButton>
-          </div>
-        ) : null}
-      </div>
-
-      {/* No idle overlay: with autoStart the run begins before a frame of idle is ever visible. */}
-      {status === "paused" || status === "over" ? (
-        <div className="absolute inset-0 flex flex-col items-center justify-center gap-10 bg-black/55 px-6 text-center">
-          <div className="flex flex-col items-center gap-4">
-            <div className="text-4xl text-white tracking-[0.3em] md:text-6xl">
-              {status === "paused" ? "PAUSED" : "GAME OVER"}
-            </div>
-            {status === "over" ? (
-              <div className="text-[15px] text-zinc-400 tabular-nums tracking-[0.1em]">
-                SCORE {pad(hud.score, 6)}
-                {hud.score > 0 && hud.score >= bestScore ? " · NEW RECORD" : ""}
-              </div>
-            ) : null}
-          </div>
-          <button
-            className="border border-zinc-500 px-10 py-3.5 text-sm text-white tracking-[0.25em] transition-colors hover:border-white hover:bg-white hover:text-black"
-            onClick={primaryAction}
-            type="button"
-          >
-            {status === "paused" ? "RESUME" : "PLAY AGAIN"}
-          </button>
-          {isTouch ? null : (
-            <div className="animate-pulse text-[12px] text-zinc-500 tracking-[0.25em]">
-              {status === "paused" ? "PRESS SPACE TO RESUME" : "PRESS SPACE TO PLAY AGAIN"}
-            </div>
-          )}
-        </div>
-      ) : null}
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/asteroids/post.ts b/apps/www/src/features/www/landing/asteroids/post.ts
deleted file mode 100644
index cb3e2286d..000000000
--- a/apps/www/src/features/www/landing/asteroids/post.ts
+++ /dev/null
@@ -1,209 +0,0 @@
-/**
- * CRT-style WebGL post-processing pass for the Asteroids board.
- *
- * The engine renders the scene into an offscreen 2D canvas; every finished frame is uploaded here
- * as a texture and redrawn onto the visible canvas with barrel curvature, bloom, chromatic
- * aberration, scanlines and a vignette. Kept dependency-free (raw WebGL1, one program, one
- * texture, a single fullscreen triangle) so the whole pass costs one draw call per frame and no
- * per-frame allocations.
- */
-
-const VERTEX_SOURCE = `
-attribute vec2 aPosition;
-varying vec2 vUv;
-
-void main() {
-  vUv = aPosition * 0.5 + 0.5;
-  gl_Position = vec4(aPosition, 0.0, 1.0);
-}
-`;
-
-const FRAGMENT_SOURCE = `
-precision mediump float;
-
-uniform sampler2D uScene;
-uniform vec2 uResolution;
-uniform float uTime;
-uniform float uMotion;
-
-varying vec2 vUv;
-
-void main() {
-  vec2 centered = vUv - 0.5;
-  float r2 = dot(centered, centered);
-
-  // Barrel curvature: samples pull outward towards the edges, leaving a thin curved black rim.
-  vec2 uv = 0.5 + centered * (1.0 + 0.06 * r2);
-  if (uv.x < 0.0 || uv.x > 1.0 || uv.y < 0.0 || uv.y > 1.0) {
-    gl_FragColor = vec4(0.0, 0.0, 0.0, 1.0);
-    return;
-  }
-
-  // Chromatic aberration grows with distance from the centre; frozen under reduced motion. Kept
-  // subtle so the monochrome wireframes fringe rather than visibly split into colours.
-  vec2 fringe = centered * r2 * 0.015 * uMotion;
-  vec3 color = vec3(
-    texture2D(uScene, uv + fringe).r,
-    texture2D(uScene, uv).g,
-    texture2D(uScene, uv - fringe).b
-  );
-
-  // Cheap bloom: eight taps, squared so only bright strokes glow and the void stays black.
-  vec2 px = 1.0 / uResolution;
-  vec3 glow = texture2D(uScene, uv + px * vec2(2.0, 2.0)).rgb
-    + texture2D(uScene, uv + px * vec2(-2.0, 2.0)).rgb
-    + texture2D(uScene, uv + px * vec2(2.0, -2.0)).rgb
-    + texture2D(uScene, uv + px * vec2(-2.0, -2.0)).rgb
-    + texture2D(uScene, uv + px * vec2(5.0, 0.0)).rgb
-    + texture2D(uScene, uv + px * vec2(-5.0, 0.0)).rgb
-    + texture2D(uScene, uv + px * vec2(0.0, 5.0)).rgb
-    + texture2D(uScene, uv + px * vec2(0.0, -5.0)).rgb;
-  glow *= 0.125;
-  color += glow * glow * 1.2;
-
-  float scanline = 0.92 + 0.08 * sin(uv.y * uResolution.y * 3.14159);
-  float flicker = 1.0 + 0.012 * uMotion * sin(uTime * 82.0);
-  float vignette = 1.0 - 0.55 * r2 * 1.6;
-
-  gl_FragColor = vec4(color * scanline * flicker * vignette, 1.0);
-}
-`;
-
-function compileShader(gl: WebGLRenderingContext, type: number, source: string): WebGLShader {
-  const shader = gl.createShader(type);
-  if (!shader) {
-    throw new Error("CRT pass: shader allocation failed");
-  }
-  gl.shaderSource(shader, source);
-  gl.compileShader(shader);
-  if (!gl.getShaderParameter(shader, gl.COMPILE_STATUS)) {
-    const info = gl.getShaderInfoLog(shader);
-    gl.deleteShader(shader);
-    throw new Error(`CRT pass: shader compile failed: ${info}`);
-  }
-  return shader;
-}
-
-/** Implements the engine's `AsteroidsCompositor` contract on a WebGL canvas. */
-export class CrtCompositor {
-  private readonly canvas: HTMLCanvasElement;
-  private readonly gl: WebGLRenderingContext;
-  private readonly texture: WebGLTexture;
-  private readonly timeUniform: WebGLUniformLocation | null;
-  private readonly resolutionUniform: WebGLUniformLocation | null;
-
-  private textureWidth = 0;
-  private textureHeight = 0;
-  private destroyed = false;
-
-  constructor(canvas: HTMLCanvasElement, reducedMotion: boolean) {
-    const gl = canvas.getContext("webgl", {
-      alpha: false,
-      antialias: false,
-      depth: false,
-      powerPreference: "high-performance",
-      stencil: false,
-    });
-    if (!gl) {
-      throw new Error("CRT pass: WebGL unavailable");
-    }
-
-    const program = gl.createProgram();
-    if (!program) {
-      throw new Error("CRT pass: program allocation failed");
-    }
-    gl.attachShader(program, compileShader(gl, gl.VERTEX_SHADER, VERTEX_SOURCE));
-    gl.attachShader(program, compileShader(gl, gl.FRAGMENT_SHADER, FRAGMENT_SOURCE));
-    gl.linkProgram(program);
-    if (!gl.getProgramParameter(program, gl.LINK_STATUS)) {
-      throw new Error(`CRT pass: program link failed: ${gl.getProgramInfoLog(program)}`);
-    }
-    gl.useProgram(program);
-
-    // One triangle overshooting the viewport beats a quad: no index buffer, no diagonal seam.
-    const buffer = gl.createBuffer();
-    gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
-    gl.bufferData(gl.ARRAY_BUFFER, new Float32Array([-1, -1, 3, -1, -1, 3]), gl.STATIC_DRAW);
-    const position = gl.getAttribLocation(program, "aPosition");
-    gl.enableVertexAttribArray(position);
-    gl.vertexAttribPointer(position, 2, gl.FLOAT, false, 0, 0);
-
-    const texture = gl.createTexture();
-    if (!texture) {
-      throw new Error("CRT pass: texture allocation failed");
-    }
-    gl.bindTexture(gl.TEXTURE_2D, texture);
-    gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR);
-    gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
-    gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_S, gl.CLAMP_TO_EDGE);
-    gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_T, gl.CLAMP_TO_EDGE);
-    gl.pixelStorei(gl.UNPACK_FLIP_Y_WEBGL, true);
-
-    gl.uniform1i(gl.getUniformLocation(program, "uScene"), 0);
-    gl.uniform1f(gl.getUniformLocation(program, "uMotion"), reducedMotion ? 0 : 1);
-    this.timeUniform = gl.getUniformLocation(program, "uTime");
-    this.resolutionUniform = gl.getUniformLocation(program, "uResolution");
-
-    this.canvas = canvas;
-    this.gl = gl;
-    this.texture = texture;
-  }
-
-  /** Matches the visible canvas to the scene canvas' device-pixel size. */
-  resize(width: number, height: number, scale: number): void {
-    if (this.destroyed) {
-      return;
-    }
-    this.canvas.width = Math.round(width * scale);
-    this.canvas.height = Math.round(height * scale);
-    this.gl.viewport(0, 0, this.gl.drawingBufferWidth, this.gl.drawingBufferHeight);
-    this.gl.uniform2f(this.resolutionUniform, this.canvas.width, this.canvas.height);
-  }
-
-  /** Uploads the finished scene frame and redraws it through the CRT shader. */
-  draw(scene: HTMLCanvasElement, timeSeconds: number): void {
-    if (this.destroyed || scene.width === 0 || scene.height === 0) {
-      return;
-    }
-    const gl = this.gl;
-
-    // texSubImage2D skips the driver-side reallocation that texImage2D does per call, so the full
-    // upload only happens when the scene canvas actually changed size.
-    if (scene.width === this.textureWidth && scene.height === this.textureHeight) {
-      gl.texSubImage2D(gl.TEXTURE_2D, 0, 0, 0, gl.RGBA, gl.UNSIGNED_BYTE, scene);
-    } else {
-      gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, scene);
-      this.textureWidth = scene.width;
-      this.textureHeight = scene.height;
-    }
-
-    gl.uniform1f(this.timeUniform, timeSeconds);
-    gl.drawArrays(gl.TRIANGLES, 0, 3);
-  }
-
-  /** Releases the GL context and the canvas' backing store. */
-  destroy(): void {
-    if (this.destroyed) {
-      return;
-    }
-    this.destroyed = true;
-    this.gl.getExtension("WEBGL_lose_context")?.loseContext();
-    this.canvas.width = 0;
-    this.canvas.height = 0;
-  }
-}
-
-/**
- * Builds the CRT pass, or returns `null` where WebGL is unavailable so the caller can fall back to
- * showing the engine's own canvas — the game is fully playable without the shader.
- */
-export function createCrtCompositor(
-  canvas: HTMLCanvasElement,
-  reducedMotion: boolean,
-): CrtCompositor | null {
-  try {
-    return new CrtCompositor(canvas, reducedMotion);
-  } catch {
-    return null;
-  }
-}
diff --git a/apps/www/src/features/www/landing/landing-page.tsx b/apps/www/src/features/www/landing/landing-page.tsx
deleted file mode 100644
index b498c284f..000000000
--- a/apps/www/src/features/www/landing/landing-page.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-"use client";
-
-import { LandingAnalytics } from "./sections/analytics";
-import { LandingAsteroids } from "./sections/asteroids";
-import { LandingCrm } from "./sections/crm";
-import { LandingDevelopers } from "./sections/developers";
-import { LandingDivider } from "./sections/divider";
-import { LandingExperimentation } from "./sections/experimentation";
-import { LandingFooter } from "./sections/footer";
-import { LandingGetStarted } from "./sections/get-started";
-import { LandingHero } from "./sections/hero";
-import { LandingNavbar } from "./sections/navbar";
-import { LandingPaywalls } from "./sections/paywalls";
-import { LandingProblem } from "./sections/problem";
-
-/** Renders the Voidhash marketing landing page. */
-export function LandingPage() {
-  return (
-    <div className="dark w-full overflow-x-clip bg-zinc-950 text-xs/4 antialiased [font-synthesis:none]">
-      <LandingNavbar />
-      <div className="flex w-full flex-col items-start gap-px">
-        <LandingHero />
-        <LandingDivider />
-        <LandingProblem />
-        <LandingDivider />
-        <LandingPaywalls />
-        <LandingDivider />
-        <LandingAnalytics />
-        <LandingDivider />
-        <LandingExperimentation />
-        <LandingDivider />
-        <LandingCrm />
-        <LandingDivider />
-        <LandingDevelopers />
-        <LandingDivider />
-        <LandingGetStarted />
-        <LandingDivider />
-        <LandingFooter />
-        <LandingAsteroids />
-      </div>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/marketing-nav-config.ts b/apps/www/src/features/www/landing/marketing-nav-config.ts
deleted file mode 100644
index 3b31c5c67..000000000
--- a/apps/www/src/features/www/landing/marketing-nav-config.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { LucideIcon } from "lucide-react";
-
-/** A marketing navigation link. Hrefs are plain strings so hosts can add pages the OSS build has no route for. */
-export interface MarketingNavLink {
-  label: string;
-  href: string;
-  icon: LucideIcon;
-}
-
-/**
- * Company links rendered in the marketing navbar and footer. The community build
- * ships none; hosts replace this module to add the pages their deployment has.
- */
-export const MARKETING_COMPANY_LINKS: MarketingNavLink[] = [];
diff --git a/apps/www/src/features/www/landing/motion.tsx b/apps/www/src/features/www/landing/motion.tsx
deleted file mode 100644
index e700a5c36..000000000
--- a/apps/www/src/features/www/landing/motion.tsx
+++ /dev/null
@@ -1,236 +0,0 @@
-"use client";
-
-import {
-  animate,
-  type MotionValue,
-  motion,
-  useInView,
-  useReducedMotion,
-  useScroll,
-  useTransform,
-} from "motion/react";
-import {
-  createContext,
-  type CSSProperties,
-  type ReactNode,
-  useContext,
-  useEffect,
-  useMemo,
-  useRef,
-} from "react";
-
-/** Long, soft deceleration — reads well on data that is counting or growing towards a value. */
-const EASE_OUT = [0.16, 1, 0.3, 1] as const;
-
-/**
- * Whether the surrounding illustration has scrolled into view, or `null` outside one.
- *
- * The illustration owns the single observer and every animated part reads from it, so a mock's
- * charts, bars and figures all start together instead of tripping one by one. The `null` default
- * makes the parts render as plain static values when used outside an `Illustration`.
- */
-const IllustrationInViewContext = createContext<boolean | null>(null);
-
-/**
- * Marks a product mock whose contents animate in once it scrolls into view.
- *
- * Takes over an existing wrapper's `className` rather than adding a node of its own, because the
- * mocks are pixel-faithful exports whose layout is sensitive to extra boxes.
- */
-export function Illustration({
-  children,
-  className,
-  style,
-}: {
-  children: ReactNode;
-  className?: string;
-  style?: CSSProperties;
-}) {
-  const ref = useRef<HTMLDivElement>(null);
-  const inView = useInView(ref, { amount: 0.2, once: true });
-
-  return (
-    <div className={className} ref={ref} style={style}>
-      <IllustrationInViewContext.Provider value={inView}>
-        {children}
-      </IllustrationInViewContext.Provider>
-    </div>
-  );
-}
-
-type ParsedValue = { amount: number; format: (value: number) => string };
-
-/** Splits "−$2,130" or "+25.9%" into prefix, number and suffix so the count-up can reformat it. */
-function parseValue(value: string): ParsedValue | null {
-  const match = /^([^\d]*)(\d[\d,]*(?:\.\d+)?)(.*)$/.exec(value);
-  if (!match) {
-    return null;
-  }
-
-  const [, prefix, digits, suffix] = match;
-  const decimals = digits.includes(".") ? digits.split(".")[1].length : 0;
-  const useGrouping = digits.includes(",");
-
-  return {
-    amount: Number(digits.replace(/,/g, "")),
-    format: (current) =>
-      prefix +
-      current.toLocaleString("en-US", {
-        maximumFractionDigits: decimals,
-        minimumFractionDigits: decimals,
-        useGrouping,
-      }) +
-      suffix,
-  };
-}
-
-/**
- * Counts a figure up to its final value when its illustration scrolls into view.
- *
- * Renders the real value on the server and writes to the DOM node directly while animating, so a
- * mock full of figures neither breaks hydration nor re-renders React on every frame.
- */
-export function CountUp({
-  className,
-  delay = 0,
-  value,
-}: {
-  className?: string;
-  delay?: number;
-  value: string;
-}) {
-  const ref = useRef<HTMLSpanElement>(null);
-  const inView = useContext(IllustrationInViewContext);
-  const prefersReducedMotion = useReducedMotion();
-  const parsed = useMemo(() => parseValue(value), [value]);
-
-  useEffect(() => {
-    const node = ref.current;
-    if (!node || !parsed || inView === null || prefersReducedMotion) {
-      return;
-    }
-
-    if (!inView) {
-      node.textContent = parsed.format(0);
-      return;
-    }
-
-    const controls = animate(0, parsed.amount, {
-      delay,
-      duration: 1.2,
-      ease: EASE_OUT,
-      onUpdate: (current) => {
-        node.textContent = parsed.format(current);
-      },
-    });
-
-    return () => controls.stop();
-  }, [delay, inView, parsed, prefersReducedMotion]);
-
-  return (
-    <span className={className} ref={ref}>
-      {value}
-    </span>
-  );
-}
-
-/** Wipes a chart in from the left once its illustration scrolls into view. */
-export function ChartWipe({
-  children,
-  className,
-  delay = 0,
-}: {
-  children: ReactNode;
-  className?: string;
-  delay?: number;
-}) {
-  const inView = useContext(IllustrationInViewContext);
-  const prefersReducedMotion = useReducedMotion();
-  const drawn = inView !== false || prefersReducedMotion;
-
-  return (
-    <motion.div
-      animate={{ clipPath: drawn ? "inset(0 0% 0 0)" : "inset(0 100% 0 0)" }}
-      className={className}
-      initial={false}
-      transition={{ delay, duration: 1.3, ease: [0.33, 1, 0.68, 1] }}
-    >
-      {children}
-    </motion.div>
-  );
-}
-
-/** Grows a fixed-width bar out from its left edge once its illustration scrolls into view. */
-export function GrowBar({ className, delay = 0 }: { className?: string; delay?: number }) {
-  const inView = useContext(IllustrationInViewContext);
-  const prefersReducedMotion = useReducedMotion();
-  const grown = inView !== false || prefersReducedMotion;
-
-  return (
-    <motion.div
-      animate={{ scaleX: grown ? 1 : 0 }}
-      className={className}
-      initial={false}
-      style={{ transformOrigin: "left" }}
-      transition={{ delay, duration: 1, ease: EASE_OUT }}
-    />
-  );
-}
-
-// zinc-600 and white. Kept as literal hex rather than `var(--zinc-600)` because
-// these are motion tween endpoints — the interpolator needs a concrete colour.
-// Keep in sync with the ramp in packages/ui/styles/brand-theme.css.
-const WORD_DIM = "#52525C";
-const WORD_BRIGHT = "#FFFFFF";
-
-/** How many word slots a single word takes to go from dim to bright; >1 overlaps neighbours. */
-const WORD_WINDOW_SLOTS = 1.8;
-
-/**
- * Brightens copy word by word as the block scrolls through the viewport.
- *
- * Each word owns a slice of the block's scroll progress and neighbouring slices overlap, so the
- * sweep reads as a continuous wipe rather than a row of words flipping one at a time.
- */
-export function ScrollBrightenText({ className, text }: { className?: string; text: string }) {
-  const ref = useRef<HTMLParagraphElement>(null);
-  const { scrollYProgress } = useScroll({
-    offset: ["start 0.9", "end 0.3"],
-    target: ref,
-  });
-  const words = useMemo(() => text.split(" "), [text]);
-
-  const windowSize = Math.min(1, WORD_WINDOW_SLOTS / words.length);
-  const step = words.length > 1 ? (1 - windowSize) / (words.length - 1) : 0;
-
-  return (
-    <p className={className} ref={ref}>
-      {words.map((word, index) => (
-        <BrightenedWord
-          end={index * step + windowSize}
-          key={`${index}-${word}`}
-          progress={scrollYProgress}
-          start={index * step}
-        >
-          {index === words.length - 1 ? word : `${word} `}
-        </BrightenedWord>
-      ))}
-    </p>
-  );
-}
-
-function BrightenedWord({
-  children,
-  end,
-  progress,
-  start,
-}: {
-  children: string;
-  end: number;
-  progress: MotionValue<number>;
-  start: number;
-}) {
-  const color = useTransform(progress, [start, end], [WORD_DIM, WORD_BRIGHT]);
-
-  return <motion.span style={{ color }}>{children}</motion.span>;
-}
diff --git a/apps/www/src/features/www/landing/paywall-build/agent-transcript.tsx b/apps/www/src/features/www/landing/paywall-build/agent-transcript.tsx
deleted file mode 100644
index e584a7212..000000000
--- a/apps/www/src/features/www/landing/paywall-build/agent-transcript.tsx
+++ /dev/null
@@ -1,163 +0,0 @@
-"use client";
-
-import { cn } from "@voidhash/ui";
-import { useEffect, useRef, useState } from "react";
-
-import { AGENT_INTRO, AGENT_OUTRO, AGENT_PROMPT, TRANSCRIPT_STEPS } from "./transcript";
-import { PROMPT_CHAR_MS, type TranscriptPlayback } from "./use-transcript-playback";
-
-const TERMINAL_BACKGROUND =
-  "radial-gradient(ellipse 156.12% 100% at 100% -0.86% in oklab, var(--color-zinc-900) 0%, var(--color-zinc-950) 100%)";
-
-/** Types a string out one character at a time; renders it whole when `typing` is false. */
-function TypedText({ typing, text }: { typing: boolean; text: string }) {
-  const [count, setCount] = useState(typing ? 0 : text.length);
-
-  useEffect(() => {
-    if (!typing) {
-      setCount(text.length);
-      return;
-    }
-
-    setCount(0);
-    let typed = 0;
-    const interval = setInterval(() => {
-      typed += 1;
-      setCount(typed);
-      if (typed >= text.length) {
-        clearInterval(interval);
-      }
-    }, PROMPT_CHAR_MS);
-
-    return () => clearInterval(interval);
-  }, [typing, text]);
-
-  return <>{text.slice(0, count)}</>;
-}
-
-/** Renders a `key: value` argument line with the value picked out; free-form lines stay dim. */
-function ArgumentLine({ argument }: { argument: string }) {
-  const [, key, value] = /^([A-Za-z]+):\s(.*)$/.exec(argument) ?? [];
-
-  return (
-    <div className="pl-4 text-zinc-500">
-      {key ? (
-        <>
-          {key}: <span className="text-blue-ribbon-300">{value}</span>
-        </>
-      ) : (
-        argument
-      )}
-    </div>
-  );
-}
-
-/** One `⏺ voidhash – tool (MCP)` block with its arguments and result line. */
-function ToolCallBlock({
-  index,
-  playback,
-}: {
-  index: number;
-  playback: TranscriptPlayback;
-}) {
-  const step = TRANSCRIPT_STEPS[index];
-  const settled = index < playback.index || playback.phase !== "running";
-
-  return (
-    <div className="pt-3">
-      <div className="text-zinc-400">
-        {/* The marker goes green the moment the call comes back, as it does in Claude Code. */}
-        <span className={settled ? "text-pistachio-600" : "text-blue-ribbon-500"}>⏺</span> voidhash –{" "}
-        <span className="font-medium text-zinc-100">{step.tool}</span>{" "}
-        <span className="text-zinc-600">(MCP)</span>
-      </div>
-      {step.args.map((argument) => (
-        <ArgumentLine argument={argument} key={argument} />
-      ))}
-      <div className="text-zinc-400">
-        <span className="pl-1.5 text-zinc-700">⎿</span>
-        {"  "}
-        {settled ? (
-          step.result
-        ) : (
-          <span className="shimmer shimmer-duration-1600 text-zinc-500">Running…</span>
-        )}
-      </div>
-    </div>
-  );
-}
-
-/**
- * The Claude Code pane of the illustration: one user prompt followed by the Voidhash
- * MCP calls that compose the paywall. Scrolls itself so the newest call stays in view.
- * Fills its container's width; only the height is fixed.
- */
-export function AgentTranscript({ playback }: { playback: TranscriptPlayback }) {
-  const scrollerRef = useRef<HTMLDivElement>(null);
-  const [scrolled, setScrolled] = useState(false);
-  const started = playback.phase !== "idle";
-
-  useEffect(() => {
-    const scroller = scrollerRef.current;
-    if (scroller) {
-      scroller.scrollTo({ behavior: "smooth", top: scroller.scrollHeight });
-    }
-  }, [playback.index, playback.phase]);
-
-  return (
-    <div
-      className="relative h-129.25 w-full rounded-[16px] border border-zinc-800 border-solid bg-origin-border bg-zinc-950 [box-shadow:#00000040_0px_2px_16px]"
-      style={{ backgroundImage: TERMINAL_BACKGROUND }}
-    >
-      <div className="absolute top-3 left-3.25 size-3.25 rounded-full bg-zinc-700" />
-      <div className="absolute top-3 left-8.5 size-3.25 rounded-full bg-zinc-700" />
-      <div className="absolute top-3 left-13.75 size-3.25 rounded-full bg-zinc-700" />
-      <div className="absolute inset-x-0 top-2.5 text-center font-sans text-xs text-zinc-600 leading-[142.857%]">
-        Claude Code
-      </div>
-
-      <div
-        className="absolute inset-x-6 top-9.75 h-114.5 overflow-hidden font-mono text-xs text-zinc-400 leading-[142.857%]"
-        onScroll={(event) => setScrolled(event.currentTarget.scrollTop > 4)}
-        ref={scrollerRef}
-      >
-        {started ? (
-          <>
-            <div className="text-zinc-100">
-              <span className="text-blue-ribbon-500">&gt;</span>{" "}
-              <TypedText text={AGENT_PROMPT} typing={playback.phase === "prompt"} />
-            </div>
-            {playback.phase === "prompt" ? null : (
-              <div className="pt-3 text-zinc-400">
-                <span className="text-pistachio-600">⏺</span> {AGENT_INTRO}
-              </div>
-            )}
-            {TRANSCRIPT_STEPS.slice(0, playback.index + 1).map((step, index) => (
-              <ToolCallBlock index={index} key={step.tool + String(index)} playback={playback} />
-            ))}
-            {playback.phase === "done" ? (
-              <div className="pt-3 text-zinc-300">
-                <span className="text-pistachio-600">⏺</span> {AGENT_OUTRO}
-              </div>
-            ) : null}
-          </>
-        ) : null}
-      </div>
-
-      {/* Fades transcript lines out as they scroll past the top of the pane. Held back until
-          the pane actually scrolls so it never sits over the prompt as it types. Spans the whole
-          window (`-inset-px` covers the border box) so it repaints the window's own gradient in
-          the same coordinate space; the mask keeps only the fading band at the pane's top edge. */}
-      <div
-        className={cn(
-          "pointer-events-none absolute -inset-px rounded-[16px] transition-opacity duration-500",
-          scrolled ? "opacity-100" : "opacity-0",
-        )}
-        style={{
-          backgroundImage: TERMINAL_BACKGROUND,
-          maskImage: "linear-gradient(to bottom, transparent 39px, black 39px, transparent 63px)",
-        }}
-      />
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/paywall-build/lenscal-paywall.tsx b/apps/www/src/features/www/landing/paywall-build/lenscal-paywall.tsx
deleted file mode 100644
index 219963707..000000000
--- a/apps/www/src/features/www/landing/paywall-build/lenscal-paywall.tsx
+++ /dev/null
@@ -1,232 +0,0 @@
-import { cn } from "@voidhash/ui";
-import type { ReactNode } from "react";
-
-import boiledEggImage from "../assets/lenscal/boiled-egg.webp";
-import calorieTrackerImage from "../assets/lenscal/calorie-tracker.webp";
-import type { PaywallPart } from "./transcript";
-
-export const PAYWALL_WIDTH = 402;
-export const PAYWALL_HEIGHT = 874;
-
-interface PartProps {
-  children?: ReactNode;
-  className?: string;
-  /** Stagger within a group that lands on the same call, in milliseconds. */
-  delay?: number;
-  part: PaywallPart;
-  revealed: ReadonlySet<PaywallPart>;
-}
-
-/** Settles a paywall fragment onto the canvas once the edit that inserts it comes back. */
-function Part({ children, className, delay = 0, part, revealed }: PartProps) {
-  const shown = revealed.has(part);
-
-  return (
-    <div
-      className={cn(
-        "transition-[opacity,filter,translate] duration-700 ease-out",
-        shown ? "translate-y-0 opacity-100 blur-none" : "translate-y-1 opacity-0 blur-[6px]",
-        className,
-      )}
-      style={{ transitionDelay: shown ? `${delay}ms` : "0ms" }}
-    >
-      {children}
-    </div>
-  );
-}
-
-const OFFER_LINE = "font-sans text-[#FFFFFFB0] text-[15px]/5.5";
-
-const FINE_PRINT_LINE = "text-center font-sans text-[#FFFFFFB3] text-[11px]/3.75";
-
-/**
- * The Lenscal Pro paywall the landing-page agent builds, rendered at its native
- * 402×874 so the fragments can settle in one by one as the MCP calls land.
- */
-export function LenscalPaywall({ revealed }: { revealed: ReadonlySet<PaywallPart> }) {
-  return (
-    <div className="relative flex h-218.5 w-100.5 flex-col overflow-clip bg-black">
-      <Part className="absolute inset-0" part="backdrop" revealed={revealed}>
-        <div className="size-full bg-[#0088FF]" />
-        <div
-          className="absolute top-0 left-0 h-106.25 w-100.5"
-          style={{
-            backgroundImage:
-              "radial-gradient(ellipse 137.15% 95.41% at 52.16% 0% in oklab, oklab(48.2% 0.115 -0.237) 53.27%, oklab(0% 0 0 / 0%) 100%)",
-          }}
-        />
-        <div
-          className="absolute top-75 left-0 h-31 w-100.5"
-          style={{
-            backgroundImage:
-              "linear-gradient(in oklab 180deg, oklab(0% 0 0 / 0%) 0%, oklab(63.2% -0.055 -0.194 / 28%) 46%, oklab(63.2% -0.055 -0.194) 77.72%, oklab(63.2% -0.055 -0.194) 100%)",
-          }}
-        />
-      </Part>
-
-      <div className="relative h-106.25 w-100.5 shrink-0 overflow-clip">
-        <Part
-          className="absolute top-0 left-0 flex w-100.5 items-center gap-38.5 px-6 pt-5.25 pb-4.75"
-          part="statusBar"
-          revealed={revealed}
-        >
-          <div className="flex grow basis-[0%] flex-col items-center justify-center">
-            <div className="flex w-fit flex-wrap justify-center text-center font-sans font-semibold text-[17px]/5.5 text-white">
-              9:41
-            </div>
-          </div>
-          <div className="flex grow basis-[0%] flex-col items-center justify-center">
-            <svg
-              aria-hidden="true"
-              height="22"
-              style={{ flexShrink: 0 }}
-              viewBox="0 0 82 22"
-              width="82"
-              xmlns="http://www.w3.org/2000/svg"
-            >
-              <path
-                d="M3.7 13H2.5a1 1 0 0 0-1 1v2.5a1 1 0 0 0 1 1h1.2a1 1 0 0 0 1-1V14a1 1 0 0 0-1-1m5.2-2.5H7.7a1 1 0 0 0-1 1v5a1 1 0 0 0 1 1h1.2a1 1 0 0 0 1-1v-5a1 1 0 0 0-1-1M14.1 8h-1.2a1 1 0 0 0-1 1v7.5a1 1 0 0 0 1 1h1.2a1 1 0 0 0 1-1V9a1 1 0 0 0-1-1m5.2-2.5h-1.2a1 1 0 0 0-1 1v10a1 1 0 0 0 1 1h1.2a1 1 0 0 0 1-1v-10a1 1 0 0 0-1-1"
-                fill="#FFFFFF"
-              />
-              <path
-                clipRule="evenodd"
-                d="M36.57 7.8c2.49 0 4.88.92 6.68 2.58.14.13.36.12.49 0l1.3-1.27a.34.34 0 0 0 0-.5 12.55 12.55 0 0 0-16.93 0 .34.34 0 0 0 0 .5l1.3 1.26c.13.13.34.14.48 0a10 10 0 0 1 6.68-2.57m0 4.22a5.4 5.4 0 0 1 3.67 1.44c.14.13.35.13.48 0l1.3-1.33a.37.37 0 0 0-.01-.52 7.9 7.9 0 0 0-10.88 0 .37.37 0 0 0 0 .52l1.29 1.32c.13.14.34.14.48 0 1-.92 2.31-1.43 3.67-1.43m2.52 2.8q0 .15-.1.28l-2.18 2.45a.3.3 0 0 1-.24.11.3.3 0 0 1-.24-.1l-2.18-2.46a.43.43 0 0 1 .01-.56 3.44 3.44 0 0 1 4.82 0 .4.4 0 0 1 .11.28"
-                fill="#FFFFFF"
-                fillRule="evenodd"
-              />
-              <path
-                clipRule="evenodd"
-                d="M70.5 5c2.05 0 3.08 0 3.88.34a4.3 4.3 0 0 1 2.28 2.28c.34.8.34 1.83.34 3.88s0 3.08-.34 3.88a4.3 4.3 0 0 1-2.28 2.28c-.8.34-1.83.34-3.88.34h-12c-2.05 0-3.08 0-3.88-.34a4.3 4.3 0 0 1-2.28-2.28c-.34-.8-.34-1.83-.34-3.88s0-3.08.34-3.88a4.3 4.3 0 0 1 2.28-2.28C55.42 5 56.45 5 58.5 5zM58.28 6c-1.85 0-2.77 0-3.48.36a3.3 3.3 0 0 0-1.44 1.44C53 8.5 53 9.43 53 11.28v.44c0 1.85 0 2.77.36 3.48a3.3 3.3 0 0 0 1.44 1.44c.7.36 1.63.36 3.48.36h12.44c1.85 0 2.77 0 3.48-.36a3.3 3.3 0 0 0 1.44-1.44c.36-.7.36-1.63.36-3.48v-.44c0-1.85 0-2.77-.36-3.48a3.3 3.3 0 0 0-1.44-1.44C73.5 6 72.57 6 70.72 6z"
-                fill="#FFFFFF"
-                fillRule="evenodd"
-                style={{ opacity: "0.35" }}
-              />
-              <path
-                d="M54 11c0-1.4 0-2.1.27-2.63a2.5 2.5 0 0 1 1.1-1.1C55.9 7 56.6 7 58 7h13c1.4 0 2.1 0 2.64.27q.72.37 1.09 1.1C75 8.9 75 9.6 75 11v1c0 1.4 0 2.1-.27 2.64a2.5 2.5 0 0 1-1.1 1.09C73.1 16 72.4 16 71 16H58c-1.4 0-2.1 0-2.63-.27a2.5 2.5 0 0 1-1.1-1.1C54 14.1 54 13.4 54 12z"
-                fill="#FFFFFF"
-              />
-              <path
-                d="M78 9.5v4.08a2.2 2.2 0 0 0 1.33-2.04A2.2 2.2 0 0 0 78 9.5"
-                fill="#FFFFFF"
-                style={{ opacity: "0.35" }}
-              />
-            </svg>
-          </div>
-        </Part>
-
-        {/* Sits directly on the hero (not inside the phone Part) because mix-blend-overlay
-            must blend with the backdrop, and the Part's translate isolates its children. */}
-        <Part
-          className="absolute top-0 left-10.5 h-106.25 w-79.25 rounded-b-[64px] bg-[#0000003D] mix-blend-overlay"
-          part="screenshot"
-          revealed={revealed}
-        />
-        <Part className="absolute inset-0" part="screenshot" revealed={revealed}>
-          <div className="absolute -top-1.25 left-13.5 h-104.25 w-73.25 rounded-b-[54px] bg-[#DDDDDD]" />
-          <div
-            className="absolute -top-55 left-13.5 h-158 w-73.25 rounded-b-[54px] bg-center bg-cover"
-            style={{ backgroundImage: `url(${calorieTrackerImage})` }}
-          />
-        </Part>
-
-        <Part className="absolute inset-0" part="foodCard" revealed={revealed}>
-          <div
-            className="absolute top-1/2 left-1/2 h-[72.181px] w-[317.491px] origin-top-left rounded-[22px] bg-[#1A70FD] [box-shadow:#00000033_0px_2px_13px]"
-            style={{ rotate: "-0.41deg", translate: "calc(-50% - 1.258px) calc(-50% + 72.586px)" }}
-          >
-            <div
-              className="absolute top-1/2 left-1/2 h-[82.899px] w-87 origin-top-left rounded-[22px] [box-shadow:#FFFFFF_0px_2px_2px_inset,#00000033_0px_2px_7px]"
-              style={{
-                backgroundImage:
-                  "linear-gradient(in oklab 180deg, oklab(97.8% 0.011 -0.011) 0%, oklab(93.3% 0.009 -0.032) 100%)",
-                rotate: "1.25deg",
-                translate: "calc(-50% + 1.465px) calc(-50% - 23.74px)",
-              }}
-            >
-              <div
-                className="absolute top-3 left-4 h-14.75 w-15.5 rounded-[11px] bg-center bg-cover"
-                style={{ backgroundImage: `url(${boiledEggImage})` }}
-              />
-              <div className="absolute top-3.75 left-22.75 font-sans font-semibold text-base/8.5 text-black tracking-[-0.025em]">
-                Boiled Egg
-              </div>
-              <div className="absolute top-9.25 left-22.75 font-sans font-semibold text-[#9E9E9E] text-base/8.5 tracking-[-0.025em]">
-                2 large
-              </div>
-              <div className="absolute top-3.75 left-75 font-sans font-semibold text-base/8.5 text-black tracking-[-0.025em]">
-                180
-              </div>
-            </div>
-          </div>
-        </Part>
-      </div>
-
-      <div className="relative flex w-100.5 grow basis-[0%] flex-col items-center justify-center px-5 pt-2 pb-6">
-        <Part className="flex flex-col items-center self-stretch pt-7.5" part="title" revealed={revealed}>
-          <div className="flex flex-wrap justify-center whitespace-pre-wrap text-center font-bold font-sans text-3xl/8.5 text-[#FAFAFA] tracking-[-0.025em]">
-            Lenscal Pro
-            <br />
-            7-Day Free Trial
-          </div>
-        </Part>
-
-        <Part
-          className="flex flex-col items-center gap-0.75 self-stretch pt-3"
-          delay={120}
-          part="offer"
-          revealed={revealed}
-        >
-          <div className={OFFER_LINE}>Subscribe to Pro for just $29.99/year for a</div>
-          <div className="flex items-baseline gap-1">
-            <div className={OFFER_LINE}>limited time</div>
-            <div className="font-sans text-[15px]/5.5 text-white [text-decoration:line-through_1px] [text-underline-position:from-font]">
-              ($49.99/year)
-            </div>
-            <div className={OFFER_LINE}>and unlock</div>
-          </div>
-          <div className={OFFER_LINE}>unlimited scans.</div>
-        </Part>
-
-        <Part
-          className="flex items-center justify-center gap-3.5 self-stretch pt-6.5"
-          part="toggle"
-          revealed={revealed}
-        >
-          <div className="flex h-7.75 w-12.75 shrink-0 items-center rounded-[999px] bg-[#86BEFF] p-0.5">
-            <div className="size-6.25 shrink-0 rounded-[999px] bg-[#FAFAFA]" />
-          </div>
-          <div className="font-sans text-[#E4E4E7] text-[15px]/5">
-            Remind me before free trial ends
-          </div>
-        </Part>
-
-        <Part className="flex self-stretch pt-5" delay={120} part="cta" revealed={revealed}>
-          <div
-            className="flex h-14 grow basis-[0%] items-center justify-center rounded-[999px] [box-shadow:#FFFFFF_0px_2px_3px_inset,#00000033_0px_2px_7px]"
-            style={{
-              backgroundImage:
-                "radial-gradient(ellipse 94.235% 609.11% at 50% 50% in oklab, oklab(97.9% -0.002 -0.010) 0%, oklab(91.4% -0.008 -0.041) 100%)",
-            }}
-          >
-            <div className="font-sans font-semibold text-[17px]/5.5 text-black tracking-[-0.01em]">
-              Try It Free
-            </div>
-          </div>
-        </Part>
-
-        <Part className="flex flex-col gap-0.5 self-stretch pt-4" part="finePrint" revealed={revealed}>
-          <div className="flex flex-wrap items-baseline justify-center gap-x-0.75">
-            <div className={FINE_PRINT_LINE}>I have read and accept</div>
-            <div className="font-sans text-[#C4C4CB] text-[11px]/3.75 [text-decoration:underline_1px] [text-underline-position:from-font]">
-              Pricing Terms.
-            </div>
-            <div className={FINE_PRINT_LINE}>Auto renew plans, cancel</div>
-          </div>
-          <div className={FINE_PRINT_LINE}>
-            anytime. Auto renew at $29.99 / Y after the trial, cancel anytime.
-          </div>
-        </Part>
-      </div>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/paywall-build/paywall-build.tsx b/apps/www/src/features/www/landing/paywall-build/paywall-build.tsx
deleted file mode 100644
index fb21159e0..000000000
--- a/apps/www/src/features/www/landing/paywall-build/paywall-build.tsx
+++ /dev/null
@@ -1,102 +0,0 @@
-"use client";
-
-import { useInView } from "motion/react";
-import { createContext, type ReactNode, useContext, useRef } from "react";
-
-import { AgentTranscript } from "./agent-transcript";
-import { LenscalPaywall, PAYWALL_HEIGHT, PAYWALL_WIDTH } from "./lenscal-paywall";
-import { type TranscriptPlayback, useTranscriptPlayback } from "./use-transcript-playback";
-import { WorkingIndicator } from "./working-indicator";
-
-/**
- * How far down the paywall is displayed inside the designer mock. Matches the 242×525
- * slot the exported artboard occupied, so the surrounding chrome stays pixel-faithful.
- */
-const PAYWALL_SCALE = 0.6015;
-
-const PlaybackContext = createContext<TranscriptPlayback | null>(null);
-
-/**
- * Hosts the shared Claude Code session driving both halves of the paywalls illustration:
- * the full-width terminal and the designer canvas the paywall assembles on.
- */
-export function PaywallBuildProvider({
-  className,
-  children,
-}: {
-  className?: string;
-  children: ReactNode;
-}) {
-  const ref = useRef<HTMLDivElement>(null);
-  const started = useInView(ref, { amount: 0.35, once: true });
-  // The session would otherwise loop (timers, typing interval, pixi ticker) for the rest of the
-  // page's life once seen — pausing offscreen costs nothing visually because the loop replays
-  // from the prompt anyway.
-  const visible = useInView(ref);
-  const playback = useTranscriptPlayback(started && visible);
-
-  return (
-    <div className={className} ref={ref}>
-      <PlaybackContext.Provider value={playback}>{children}</PlaybackContext.Provider>
-    </div>
-  );
-}
-
-function usePlayback(): TranscriptPlayback {
-  const playback = useContext(PlaybackContext);
-  if (!playback) {
-    throw new Error("PaywallBuild pieces must render inside PaywallBuildProvider");
-  }
-  return playback;
-}
-
-/**
- * The Claude Code terminal rendered at natural size above the designer mock. Only shown
- * below xl — scaling the terminal down with the rest of the mock made it unreadable, so
- * small screens get it full width while desktop keeps it floating on the canvas.
- */
-export function PaywallBuildTerminal() {
-  return (
-    <div className="xl:hidden">
-      <AgentTranscript playback={usePlayback()} />
-    </div>
-  );
-}
-
-/**
- * Overlay for the designer mock: the paywall assembling itself on the canvas as each MCP
- * call comes back. On xl the terminal floats over the canvas as in the original design and
- * the phone keeps its artboard position. Below xl the terminal lives above the mock, the
- * mock's side panels and tab bar are trimmed, and the phone (with its working-indicator
- * effect) is bumped up 25% and centered on the now-free canvas — `top-35` leaves an even
- * 48px of artboard padding under the toolbar and above the window's bottom edge.
- */
-export function PaywallBuildCanvas() {
-  const playback = usePlayback();
-
-  return (
-    <div className="absolute inset-0">
-      <div className="absolute top-48.25 left-15.75 hidden h-129.25 w-99.75 xl:block">
-        <AgentTranscript playback={playback} />
-      </div>
-
-      <div
-        className="absolute top-35 left-1/2 origin-top -translate-x-1/2 scale-125 xl:top-37.75 xl:left-140.75 xl:translate-x-0 xl:scale-100"
-        style={{ height: PAYWALL_HEIGHT * PAYWALL_SCALE, width: PAYWALL_WIDTH * PAYWALL_SCALE }}
-      >
-        <div
-          className="origin-top-left"
-          style={{ transform: `scale(${PAYWALL_SCALE})`, width: PAYWALL_WIDTH }}
-        >
-          <LenscalPaywall revealed={playback.revealed} />
-        </div>
-        <WorkingIndicator
-          active={playback.working}
-          height={PAYWALL_HEIGHT}
-          scale={PAYWALL_SCALE}
-          width={PAYWALL_WIDTH}
-        />
-      </div>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/paywall-build/transcript.ts b/apps/www/src/features/www/landing/paywall-build/transcript.ts
deleted file mode 100644
index 6e31c7d3c..000000000
--- a/apps/www/src/features/www/landing/paywall-build/transcript.ts
+++ /dev/null
@@ -1,116 +0,0 @@
-/**
- * One fragment of the Lenscal paywall, revealed when the `edit_paywall` call that
- * inserts it comes back. Ordered the way the agent builds the screen.
- */
-export type PaywallPart =
-  | "backdrop"
-  | "statusBar"
-  | "screenshot"
-  | "foodCard"
-  | "title"
-  | "offer"
-  | "toggle"
-  | "cta"
-  | "finePrint";
-
-/** A single Voidhash MCP call as it appears in the agent transcript. */
-export interface TranscriptStep {
-  /** MCP tool name, as advertised by `apps/backend/src/mcp/tool-manifest.ts`. */
-  readonly tool: string;
-  /** Argument lines shown under the call header. */
-  readonly args: readonly string[];
-  /** The `⎿` result line shown once the call returns. */
-  readonly result: string;
-  /** Paywall fragments that appear on the canvas when this call returns. */
-  readonly reveals?: readonly PaywallPart[];
-  /** How long the call spends in flight before its result lands. */
-  readonly runningMs: number;
-}
-
-export const AGENT_PROMPT =
-  "Build the Lenscal Pro paywall: electric-blue hero, app shot with a scanned meal, 7-day free trial at $29.99/year.";
-
-export const AGENT_INTRO = "I'll compose it on the live document, then preview before publishing.";
-
-export const AGENT_OUTRO = "Lenscal Pro is live at 402×874 — trial toggle wired, pricing terms in place.";
-
-export const TRANSCRIPT_STEPS: readonly TranscriptStep[] = [
-  {
-    args: [],
-    result: "3 paywalls · lenscal-pro → pw_9f2a41",
-    runningMs: 900,
-    tool: "list_paywalls",
-  },
-  {
-    args: ['paywallId: "pw_9f2a41"'],
-    result: "editSessionId edit_7c31 · baseline v0",
-    runningMs: 900,
-    tool: "begin_paywall_edit",
-  },
-  {
-    args: ['editSessionId: "edit_7c31"', "depth: 3"],
-    result: 'screen "Paywall" 402×874 · 0 children',
-    runningMs: 850,
-    tool: "get_paywall",
-  },
-  {
-    args: ['editSessionId: "edit_7c31"'],
-    result: "9 builtin · 4 catalog · 0 local",
-    runningMs: 850,
-    tool: "get_components",
-  },
-  {
-    args: ["insert · column + brand-blue backdrop, status bar"],
-    result: "ok · 6 nodes minted · v1",
-    reveals: ["backdrop", "statusBar"],
-    runningMs: 1500,
-    tool: "edit_paywall",
-  },
-  {
-    args: ["insert · app screenshot in device frame"],
-    result: "ok · 4 nodes minted · v2",
-    reveals: ["screenshot"],
-    runningMs: 1500,
-    tool: "edit_paywall",
-  },
-  {
-    args: ["insert · scanned-meal card"],
-    result: "ok · 7 nodes minted · v3",
-    reveals: ["foodCard"],
-    runningMs: 1250,
-    tool: "edit_paywall",
-  },
-  {
-    args: ["insert · headline, offer copy"],
-    result: "ok · 8 nodes minted · v4",
-    reveals: ["title", "offer"],
-    runningMs: 1400,
-    tool: "edit_paywall",
-  },
-  {
-    args: ['insert · reminder toggle, "Try It Free"'],
-    result: "ok · 7 nodes minted · v5",
-    reveals: ["toggle", "cta"],
-    runningMs: 1400,
-    tool: "edit_paywall",
-  },
-  {
-    args: ["insert · pricing terms"],
-    result: "ok · 5 nodes minted · v6",
-    reveals: ["finePrint"],
-    runningMs: 1200,
-    tool: "edit_paywall",
-  },
-  {
-    args: ['editSessionId: "edit_7c31"'],
-    result: "PNG 402×874 · sig 4b91c0",
-    runningMs: 1900,
-    tool: "get_paywall_preview",
-  },
-  {
-    args: ['verdict: "matches the brief"', "unresolvedIssues: []"],
-    result: "session closed · published v6",
-    runningMs: 1100,
-    tool: "finish_paywall_edit",
-  },
-];
diff --git a/apps/www/src/features/www/landing/paywall-build/use-transcript-playback.ts b/apps/www/src/features/www/landing/paywall-build/use-transcript-playback.ts
deleted file mode 100644
index a6becf831..000000000
--- a/apps/www/src/features/www/landing/paywall-build/use-transcript-playback.ts
+++ /dev/null
@@ -1,118 +0,0 @@
-"use client";
-
-import { useReducedMotion } from "motion/react";
-import { useEffect, useMemo, useState } from "react";
-
-import { AGENT_PROMPT, type PaywallPart, TRANSCRIPT_STEPS } from "./transcript";
-
-/** Milliseconds each character of the user prompt takes to type. */
-export const PROMPT_CHAR_MS = 22;
-
-/** Beat between the prompt landing and the first tool call going out. */
-const INTRO_MS = 900;
-
-/** Beat between one call's result and the next call going out. */
-const SETTLE_GAP_MS = 240;
-
-/** How long the finished paywall is held before the session replays. */
-const LOOP_HOLD_MS = 5000;
-
-type Phase = "idle" | "prompt" | "running" | "settled" | "done";
-
-export interface TranscriptPlayback {
-  /** Index of the call currently on screen; `-1` while the prompt is still typing. */
-  readonly index: number;
-  readonly phase: Phase;
-  /** Paywall fragments whose insert has already come back. */
-  readonly revealed: ReadonlySet<PaywallPart>;
-  /** Whether the agent holds an open edit session — drives the canvas working indicator. */
-  readonly working: boolean;
-}
-
-const ALL_PARTS: ReadonlySet<PaywallPart> = new Set(
-  TRANSCRIPT_STEPS.flatMap((step) => step.reveals ?? []),
-);
-
-const FINISHED: TranscriptPlayback = {
-  index: TRANSCRIPT_STEPS.length - 1,
-  phase: "done",
-  revealed: ALL_PARTS,
-  working: false,
-};
-
-/**
- * Loops the scripted agent session once `active` turns true: the prompt types out, each
- * Voidhash MCP call goes out, hangs for its `runningMs`, and returns; the finished paywall
- * is held for a beat, then the whole session starts over. Turning `active` off rewinds to
- * the blank state, so a paused illustration schedules no timers and drives no animation.
- *
- * Under `prefers-reduced-motion` the session is presented already finished and never loops,
- * so the transcript and the paywall still read as a complete story without any movement.
- */
-export function useTranscriptPlayback(active: boolean): TranscriptPlayback {
-  const prefersReducedMotion = useReducedMotion();
-  const [cursor, setCursor] = useState<{ index: number; phase: Phase }>({
-    index: -1,
-    phase: "idle",
-  });
-
-  useEffect(() => {
-    if (!active) {
-      setCursor((current) =>
-        current.phase === "idle" ? current : { index: -1, phase: "idle" },
-      );
-      return;
-    }
-
-    if (prefersReducedMotion) {
-      setCursor({ index: FINISHED.index, phase: "done" });
-      return;
-    }
-
-    let timer: ReturnType<typeof setTimeout>;
-
-    const runStep = (index: number) => {
-      const step = TRANSCRIPT_STEPS[index];
-      if (!step) {
-        setCursor({ index: TRANSCRIPT_STEPS.length - 1, phase: "done" });
-        timer = setTimeout(startSession, LOOP_HOLD_MS);
-        return;
-      }
-
-      setCursor({ index, phase: "running" });
-      timer = setTimeout(() => {
-        setCursor({ index, phase: "settled" });
-        timer = setTimeout(() => runStep(index + 1), SETTLE_GAP_MS);
-      }, step.runningMs);
-    };
-
-    // Named so the last step can schedule the next run; the transcript and every
-    // revealed fragment fall back to their empty state while the prompt retypes.
-    function startSession() {
-      setCursor({ index: -1, phase: "prompt" });
-      timer = setTimeout(() => runStep(0), AGENT_PROMPT.length * PROMPT_CHAR_MS + INTRO_MS);
-    }
-
-    startSession();
-
-    return () => clearTimeout(timer);
-  }, [active, prefersReducedMotion]);
-
-  return useMemo(() => {
-    if (cursor.phase === "idle") {
-      return { index: -1, phase: "idle", revealed: new Set<PaywallPart>(), working: false };
-    }
-    if (cursor.phase === "done") {
-      return FINISHED;
-    }
-
-    // An insert only shows on the canvas once its call has come back.
-    const landed = cursor.phase === "settled" ? cursor.index : cursor.index - 1;
-    return {
-      index: cursor.index,
-      phase: cursor.phase,
-      revealed: new Set(TRANSCRIPT_STEPS.slice(0, landed + 1).flatMap((step) => step.reveals ?? [])),
-      working: cursor.phase !== "prompt",
-    };
-  }, [cursor]);
-}
diff --git a/apps/www/src/features/www/landing/paywall-build/working-indicator.tsx b/apps/www/src/features/www/landing/paywall-build/working-indicator.tsx
deleted file mode 100644
index 7d7d100ed..000000000
--- a/apps/www/src/features/www/landing/paywall-build/working-indicator.tsx
+++ /dev/null
@@ -1,147 +0,0 @@
-"use client";
-
-import { useEffect, useRef } from "react";
-
-import {
-  advanceWorkingIndicator,
-  createWorkingIndicatorAnimation,
-  forEachWorkingIndicatorDot,
-  getWorkingIndicatorDotRadius,
-  setWorkingIndicatorActive,
-  syncWorkingIndicatorScreens,
-} from "@/features/studio/paywalls/designer/canvas/overlay/working-indicator-animation";
-
-const BLUE_RIBBON_600 = 0x06_73_ff;
-
-/** Room around the screen for the three dot rows that sit outside it. */
-const PADDING = 44;
-
-interface WorkingIndicatorProps {
-  /** Whether the agent is mid-session; drives the entry and exit sweeps. */
-  active: boolean;
-  /** Screen size in paywall coordinates. */
-  height: number;
-  width: number;
-  /** Factor the paywall is displayed at, so dot size tracks the canvas zoom. */
-  scale: number;
-}
-
-/**
- * The designer's "agent is working" indicator, rendered over the landing page's paywall.
- *
- * Shares the exact animation module the real canvas overlay uses, so the marketing
- * illustration and the product stay in step. Pixi is imported on demand to keep it out
- * of the marketing bundle.
- */
-export function WorkingIndicator({ active, height, scale, width }: WorkingIndicatorProps) {
-  const hostRef = useRef<HTMLDivElement>(null);
-  const activeRef = useRef(active);
-  const startRef = useRef<(() => void) | null>(null);
-
-  activeRef.current = active;
-
-  useEffect(() => {
-    const host = hostRef.current;
-    if (!host) {
-      return;
-    }
-
-    let disposed = false;
-    let dispose: (() => void) | null = null;
-
-    const initialize = async () => {
-      const { Application, Graphics } = await import("pixi.js");
-      if (disposed) {
-        return;
-      }
-
-      const app = new Application();
-      await app.init({
-        antialias: true,
-        autoDensity: true,
-        backgroundAlpha: 0,
-        height: height * scale + PADDING * 2,
-        resolution: window.devicePixelRatio || 1,
-        width: width * scale + PADDING * 2,
-      });
-
-      if (disposed) {
-        app.destroy(true, { children: true });
-        return;
-      }
-
-      app.canvas.style.display = "block";
-      host.append(app.canvas);
-
-      const graphics = new Graphics();
-      graphics.eventMode = "none";
-      app.stage.addChild(graphics);
-
-      const animation = createWorkingIndicatorAnimation({ scale, x: PADDING, y: PADDING });
-      syncWorkingIndicatorScreens(animation, [{ height, id: "paywall", width, x: 0, y: 0 }]);
-
-      const tick = (ticker: { deltaMS: number }) => {
-        const now = performance.now();
-        setWorkingIndicatorActive(animation, activeRef.current, now);
-        advanceWorkingIndicator(animation, now, ticker.deltaMS);
-
-        graphics.clear();
-        forEachWorkingIndicatorDot(animation, (dot, viewport) => {
-          if (dot.alpha <= 0.001) {
-            return;
-          }
-
-          const radius = getWorkingIndicatorDotRadius(dot, viewport.scale);
-          graphics.circle(dot.x, dot.y, radius);
-          graphics.fill({ alpha: dot.alpha * 0.24, color: 0xff_ff_ff });
-          if (dot.proximity > 0.001) {
-            graphics.circle(dot.x, dot.y, radius);
-            graphics.fill({ alpha: dot.alpha * dot.proximity * 0.96, color: BLUE_RIBBON_600 });
-          }
-        });
-
-        if (animation.phase === "idle" && !activeRef.current) {
-          app.stop();
-          app.render();
-        }
-      };
-
-      app.ticker.add(tick);
-      startRef.current = () => app.start();
-      if (activeRef.current) {
-        app.start();
-      } else {
-        app.stop();
-        app.render();
-      }
-
-      dispose = () => {
-        startRef.current = null;
-        app.ticker.remove(tick);
-        app.destroy(true, { children: true });
-      };
-    };
-
-    void initialize();
-
-    return () => {
-      disposed = true;
-      dispose?.();
-    };
-  }, [height, scale, width]);
-
-  useEffect(() => {
-    if (active) {
-      startRef.current?.();
-    }
-  }, [active]);
-
-  return (
-    <div
-      aria-hidden="true"
-      className="pointer-events-none absolute"
-      ref={hostRef}
-      style={{ left: -PADDING, top: -PADDING }}
-    />
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/agent-compatibility.tsx b/apps/www/src/features/www/landing/sections/agent-compatibility.tsx
deleted file mode 100644
index 6906d5e68..000000000
--- a/apps/www/src/features/www/landing/sections/agent-compatibility.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-import { TooltipContent, TooltipProvider, TooltipRoot, TooltipTrigger } from "@voidhash/ui";
-
-import antigravityIcon from "../assets/agent-icons/antigravity.png";
-import claudeCodeIcon from "../assets/agent-icons/claude-code.png";
-import codexIcon from "../assets/agent-icons/codex.png";
-import cursorIcon from "../assets/agent-icons/cursor.png";
-import openCodeIcon from "../assets/agent-icons/opencode.png";
-
-const agents = [
-  { name: "Claude Code", src: claudeCodeIcon },
-  { name: "Codex", src: codexIcon },
-  { name: "Cursor", src: cursorIcon },
-  { name: "Antigravity", src: antigravityIcon },
-  { name: "OpenCode", src: openCodeIcon },
-] as const;
-
-/** Renders the AI agent compatibility band below the paywall designer. */
-export function LandingAgentCompatibility() {
-  return (
-    <div className="flex min-h-20 items-center gap-3 border-zinc-800 border-t px-6 py-3 md:h-35.25 md:gap-4 md:px-12 md:py-0 xl:px-32">
-      <TooltipProvider>
-        <ul aria-label="Supported AI agent examples" className="flex shrink-0 items-start">
-          {agents.map((agent, index) => (
-            <li
-              className={index === 0 ? undefined : "-ml-[17px] md:-ml-[27px]"}
-              key={agent.name}
-            >
-              <TooltipRoot>
-                <TooltipTrigger asChild>
-                  <span className="block size-10 shrink-0 -rotate-[10deg] md:size-16" tabIndex={0}>
-                    <img
-                      alt={agent.name}
-                      className="size-full max-w-none object-contain"
-                      height={64}
-                      src={agent.src}
-                      width={64}
-                    />
-                  </span>
-                </TooltipTrigger>
-                <TooltipContent
-                  className="border-zinc-800 bg-zinc-900 text-zinc-50"
-                  side="top"
-                  sideOffset={8}
-                >
-                  {agent.name}
-                </TooltipContent>
-              </TooltipRoot>
-            </li>
-          ))}
-        </ul>
-      </TooltipProvider>
-      <p className="min-w-0 max-w-[421px] flex-1 font-sans text-xs/4 text-zinc-400 md:w-[421px] md:flex-none md:text-base/5">
-        Works with any AI agent or model. You can even use your Claude Code or Codex subscription.
-      </p>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/analytics.tsx b/apps/www/src/features/www/landing/sections/analytics.tsx
deleted file mode 100644
index 0de7f7e95..000000000
--- a/apps/www/src/features/www/landing/sections/analytics.tsx
+++ /dev/null
@@ -1,531 +0,0 @@
-import { ChartWipe, CountUp, Illustration } from "../motion";
-import { LandingSection, ScaledMock, SectionHeader } from "../shared";
-
-/** Renders the analytics product section. */
-export function LandingAnalytics() {
-  return (
-    <LandingSection id="analytics">
-      <div className="flex flex-col items-start justify-center gap-12 px-6 py-16 md:gap-23 md:px-12 md:py-24 xl:p-32">
-        <SectionHeader
-          description="See how people move from download to trial to paying customer. Find what is working, where people drop off and where your next opportunity is."
-          eyebrow="Analytics"
-          title="Understand what drives your revenue."
-        />
-        <div className="flex flex-col items-start gap-10 self-stretch xl:flex-row xl:gap-14">
-          <Illustration className="flex flex-col w-full max-w-98 shrink-0 rounded-xl overflow-clip bg-origin-border border border-solid border-[#FFFFFF12]" style={{ backgroundImage: 'radial-gradient(ellipse 156.12% 100% at 100% -0.8599999999999941% in oklab, var(--color-zinc-900) 0%, var(--color-zinc-950) 100%)' }}>
-            <div className="flex items-center justify-between self-stretch pt-5.5 pb-4.75 px-5.5 border-b border-b-solid border-b-[#FFFFFF0F]">
-              <div className="tracking-[-0.02em] font-sans font-medium text-[#FFFFFFED] text-base/tight">
-                Metrics
-              </div>
-            </div>
-            <div className="flex flex-col self-stretch pt-2.5 pb-4">
-              <div className="flex items-center self-stretch py-2.75 px-5.5 gap-3">
-                <svg aria-hidden="true" width="18" height="18" viewBox="0 0 18 18" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <circle cx="9" cy="9" r="8.25" fill="rgb(6 115 255 / 18%)" stroke="rgb(6 115 255 / 55%)" />
-                  <path d="M5.2 11.2 L8 8.2 L10 10 L12.9 6.6" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                </svg>
-                <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFED] text-[15px]/5">
-                  Revenue
-                </div>
-                <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF80] text-xs/tight">
-                  <CountUp value="$248,190" />
-                </div>
-              </div>
-              <div className="flex flex-col self-stretch pl-8">
-                <div className="flex flex-col self-stretch pl-3.5 border-l border-l-solid border-l-[#FFFFFF17]">
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <path d="M12 7a5 5 0 1 1-1.6-3.7" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.3" strokeLinecap="round" />
-                      <path d="M12.2 1.6v2.6h-2.6" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                    </svg>
-                    <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFE0] text-[15px]/5">
-                      Subscriptions
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.05} value="$214,730" />
-                    </div>
-                  </div>
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <rect x="1.4" y="3.4" width="11.2" height="8" rx="1.6" fill="none" stroke="var(--color-amber-500)" strokeWidth="1.3" />
-                      <path d="M1.4 6.4h11.2" fill="none" stroke="var(--color-amber-500)" strokeWidth="1.3" />
-                    </svg>
-                    <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFE0] text-[15px]/5">
-                      One-time purchases
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.1} value="$35,590" />
-                    </div>
-                  </div>
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <path d="M2 7a5 5 0 1 0 1.6-3.7" fill="none" stroke="var(--color-radical-red-400)" strokeWidth="1.3" strokeLinecap="round" />
-                      <path d="M1.8 1.6v2.6h2.6" fill="none" stroke="var(--color-radical-red-400)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                    </svg>
-                    <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFE0] text-[15px]/5">
-                      Refunds
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.15} value="−$2,130" />
-                    </div>
-                  </div>
-                </div>
-              </div>
-            </div>
-            <div className="self-stretch h-px shrink-0 bg-[#FFFFFF0F]" />
-            <div className="flex flex-col self-stretch pt-2.5 pb-4">
-              <div className="flex items-center self-stretch py-2.75 px-5.5 gap-3">
-                <svg aria-hidden="true" width="18" height="18" viewBox="0 0 18 18" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <circle cx="9" cy="9" r="8.25" fill="rgb(139 92 246 / 18%)" stroke="rgb(139 92 246 / 50%)" />
-                  <circle cx="9" cy="7.1" r="2" fill="none" stroke="var(--color-electric-violet-300)" strokeWidth="1.3" />
-                  <path d="M5.3 12.9c0-1.7 1.7-2.7 3.7-2.7s3.7 1 3.7 2.7" fill="none" stroke="var(--color-electric-violet-300)" strokeWidth="1.3" strokeLinecap="round" />
-                </svg>
-                <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFED] text-[15px]/5">
-                  Subscribers
-                </div>
-                <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF80] text-xs/tight">
-                  <CountUp delay={0.15} value="41,208" />
-                </div>
-              </div>
-              <div className="flex flex-col self-stretch pl-8">
-                <div className="flex flex-col self-stretch pl-3.5 border-l border-l-solid border-l-[#FFFFFF17]">
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <path d="M7 1.8v7.4" fill="none" stroke="var(--color-pistachio-600)" strokeWidth="1.3" strokeLinecap="round" />
-                      <path d="M4.3 6.6 7 9.3l2.7-2.7" fill="none" stroke="var(--color-pistachio-600)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                      <path d="M2 11.9h10" fill="none" stroke="var(--color-pistachio-600)" strokeWidth="1.3" strokeLinecap="round" />
-                    </svg>
-                    <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFE0] text-[15px]/5">
-                      Installs
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.2} value="412,806" />
-                    </div>
-                  </div>
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <path d="M7 1.6 8.5 5l3.6.4-2.7 2.5.8 3.5L7 9.7l-3.2 1.7.8-3.5L1.9 5.4 5.5 5 7 1.6Z" fill="none" stroke="var(--color-amber-500)" strokeWidth="1.2" strokeLinejoin="round" />
-                    </svg>
-                    <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFE0] text-[15px]/5">
-                      Trial → paid
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.25} value="38.2%" />
-                    </div>
-                  </div>
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <path d="M2.2 4.6 7 9.4l4.8-4.8" fill="none" stroke="var(--color-radical-red-400)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                      <path d="M11.8 8.2V4.6H8.2" fill="none" stroke="var(--color-radical-red-400)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                    </svg>
-                    <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFE0] text-[15px]/5">
-                      Churn
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.3} value="4.6%" />
-                    </div>
-                  </div>
-                </div>
-              </div>
-            </div>
-            <div className="self-stretch h-px shrink-0 bg-[#FFFFFF0F]" />
-            <div className="flex flex-col self-stretch pt-2.5 pb-4">
-              <div className="flex items-center self-stretch py-2.75 px-5.5 gap-3">
-                <svg aria-hidden="true" width="18" height="18" viewBox="0 0 18 18" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <circle cx="9" cy="9" r="8.25" fill="rgb(232 86 203 / 16%)" stroke="rgb(232 86 203 / 45%)" />
-                  <path d="M4.6 9.4h2.1l1.4-3.2 1.8 6 1.3-2.8h2.2" fill="none" stroke="var(--color-fuchsia-pink-300)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                </svg>
-                <div className="grow tracking-[-0.015em] w-max font-sans text-[#FFFFFFED] text-[15px]/5">
-                  Events
-                </div>
-                <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF80] text-xs/tight">
-                  <CountUp delay={0.35} value="6,342,428" />
-                </div>
-              </div>
-              <div className="flex flex-col self-stretch pl-8">
-                <div className="flex flex-col self-stretch pl-3.5 border-l border-l-solid border-l-[#FFFFFF17]">
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <rect x="3.6" y="1.6" width="6.8" height="10.8" rx="1.6" fill="none" stroke="var(--color-electric-violet-300)" strokeWidth="1.3" />
-                      <path d="M6.2 10.6h1.6" fill="none" stroke="var(--color-electric-violet-300)" strokeWidth="1.3" strokeLinecap="round" />
-                    </svg>
-                    <div className="grow tracking-[0.005em] w-max font-mono text-[#FFFFFFCC] text-[13px]/5">
-                      app_open
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.4} value="6,204,880" />
-                    </div>
-                  </div>
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <path d="M1.2 7S3.3 3.2 7 3.2 12.8 7 12.8 7 10.7 10.8 7 10.8 1.2 7 1.2 7Z" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.3" strokeLinejoin="round" />
-                      <circle cx="7" cy="7" r="1.6" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.3" />
-                    </svg>
-                    <div className="grow tracking-[0.005em] w-max font-mono text-[#FFFFFFCC] text-[13px]/5">
-                      paywall_view
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.45} value="96,340" />
-                    </div>
-                  </div>
-                  <div className="flex items-center self-stretch pr-5.5 gap-2.5 py-2.25">
-                    <svg aria-hidden="true" width="14" height="14" viewBox="0 0 14 14" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                      <path d="M2 3.2h1.9l1.5 6.6h5.2l1.4-4.7H4.4" fill="none" stroke="var(--color-pistachio-600)" strokeWidth="1.3" strokeLinecap="round" strokeLinejoin="round" />
-                      <circle cx="6.2" cy="11.6" r="0.9" fill="var(--color-pistachio-600)" />
-                      <circle cx="10.2" cy="11.6" r="0.9" fill="var(--color-pistachio-600)" />
-                    </svg>
-                    <div className="grow tracking-[0.005em] w-max font-mono text-[#FFFFFFCC] text-[13px]/5">
-                      purchase
-                    </div>
-                    <div className="shrink-0 w-22.5 text-right tracking-[0.01em] font-mono flex justify-end flex-wrap text-[#FFFFFF73] text-xs/tight">
-                      <CountUp delay={0.5} value="41,208" />
-                    </div>
-                  </div>
-                </div>
-              </div>
-            </div>
-          </Illustration>
-          <ScaledMock className="min-w-0 flex-1" designWidth={952}>
-          <Illustration className="flex flex-col self-stretch relative">
-            <svg aria-hidden="true" width="952" height="664" viewBox="0 0 952 664" xmlns="http://www.w3.org/2000/svg" style={{ position: 'absolute', left: '0px', top: '0px' }}>
-              <defs><linearGradient id="_cbl8kr0" x1="0" y1="0" x2="0" y2="1"><stop offset="0%" stopColor="#FFFFFF" stopOpacity="0.008"/><stop offset="16%" stopColor="#FFFFFF" stopOpacity="0.038"/><stop offset="88%" stopColor="#FFFFFF" stopOpacity="0.03"/><stop offset="100%" stopColor="#FFFFFF" stopOpacity="0"/></linearGradient><linearGradient id="_cbl8kr1" x1="0" y1="0" x2="0" y2="1"><stop offset="0%" stopColor="#FFFFFF" stopOpacity="0.02"/><stop offset="16%" stopColor="#FFFFFF" stopOpacity="0.085"/><stop offset="88%" stopColor="#FFFFFF" stopOpacity="0.07"/><stop offset="100%" stopColor="#FFFFFF" stopOpacity="0"/></linearGradient><linearGradient id="_cbl8kr2" x1="0" y1="0" x2="0" y2="1"><stop offset="0%" stopColor="#FFFFFF" stopOpacity="0"/><stop offset="18%" stopColor="#FFFFFF" stopOpacity="0.115"/><stop offset="88%" stopColor="#FFFFFF" stopOpacity="0.085"/><stop offset="100%" stopColor="#FFFFFF" stopOpacity="0"/></linearGradient></defs>
-              <rect x="816" y="0" width="136" height="664" fill="rgb(255 255 255 / 1.4%)" />
-              <path d="M68 0V664 M204 0V664 M340 0V664 M476 0V664 M612 0V664 M748 0V664 M884 0V664" fill="none" stroke="url(#_cbl8kr0)" strokeDasharray="2 6" />
-              <path d="M136 0V664 M272 0V664 M408 0V664 M544 0V664 M680 0V664" fill="none" stroke="url(#_cbl8kr1)" strokeDasharray="2 6" />
-              <path d="M816 0V664" fill="none" stroke="url(#_cbl8kr2)" />
-            </svg>
-            <div className="flex self-stretch pb-6 relative">
-              <div className="flex flex-col w-34 shrink-0 gap-2.25">
-                <div className="w-max font-sans font-medium text-[#FFFFFF80] text-xs/4">
-                  Feb
-                </div>
-                <div className="flex">
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF1F] text-[11px]/3.25">
-                    2
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF1F] text-[11px]/3.25">
-                    9
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF1F] text-[11px]/3.25">
-                    16
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF1F] text-[11px]/3.25">
-                    23
-                  </div>
-                </div>
-              </div>
-              <div className="flex flex-col w-34 shrink-0 gap-2.25">
-                <div className="w-max font-sans font-medium text-[#FFFFFF80] text-xs/4">
-                  Mar
-                </div>
-                <div className="flex">
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    2
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    9
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    16
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    23
-                  </div>
-                </div>
-              </div>
-              <div className="flex flex-col w-34 shrink-0 gap-2.25">
-                <div className="w-max font-sans font-medium text-[#FFFFFF80] text-xs/4">
-                  Apr
-                </div>
-                <div className="flex">
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    6
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    13
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    20
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    27
-                  </div>
-                </div>
-              </div>
-              <div className="flex flex-col w-34 shrink-0 gap-2.25">
-                <div className="w-max font-sans font-medium text-[#FFFFFF80] text-xs/4">
-                  May
-                </div>
-                <div className="flex">
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    4
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    11
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    18
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    25
-                  </div>
-                </div>
-              </div>
-              <div className="flex flex-col w-34 shrink-0 gap-2.25">
-                <div className="w-max font-sans font-medium text-[#FFFFFF80] text-xs/4">
-                  Jun
-                </div>
-                <div className="flex">
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    1
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    8
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    15
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    22
-                  </div>
-                </div>
-              </div>
-              <div className="flex flex-col w-34 shrink-0 gap-2.25">
-                <div className="w-max font-sans font-medium text-[#FFFFFF80] text-xs/4">
-                  Jul
-                </div>
-                <div className="flex">
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    6
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    13
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    20
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF3D] text-[11px]/3.25">
-                    27
-                  </div>
-                </div>
-              </div>
-              <div className="flex flex-col w-34 shrink-0 gap-2.25">
-                <div className="w-max font-sans font-medium text-[#FFFFFF80] text-xs/4">
-                  Aug
-                </div>
-                <div className="flex">
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF21] text-[11px]/3.25">
-                    3
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF21] text-[11px]/3.25">
-                    10
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF21] text-[11px]/3.25">
-                    17
-                  </div>
-                  <div className="w-8.5 shrink-0 tracking-[0.04em] font-mono text-[#FFFFFF21] text-[11px]/3.25">
-                    24
-                  </div>
-                </div>
-              </div>
-            </div>
-            <div className="flex items-end justify-between self-stretch pb-6.5 relative">
-              <div className="flex flex-col gap-3">
-                <div className="tracking-[-0.01em] w-max font-sans font-medium text-[#FFFFFFB2] text-[13px]/4">
-                  Monthly recurring revenue
-                </div>
-                <div className="flex items-end gap-3.5">
-                  <div className="tracking-[-0.04em] w-max shrink-0 font-sans font-semibold text-zinc-300 text-[46px]/11.5">
-                    <CountUp value="$48,190" />
-                  </div>
-                  <div className="pb-1.25">
-                    <div className="tracking-[-0.01em] w-max font-sans font-medium [color:var(--color-pistachio-600)] text-[13px]/4">
-                      <CountUp delay={0.15} value="+12.4%" />
-                    </div>
-                  </div>
-                </div>
-              </div>
-            </div>
-            <ChartWipe className="relative shrink-0">
-            <svg aria-hidden="true" width="952" height="220" viewBox="0 0 952 220" xmlns="http://www.w3.org/2000/svg" style={{ display: 'block' }}>
-              <defs><linearGradient id="_7gznpr0" x1="0" y1="0" x2="0" y2="1"><stop offset="0%" stopColor="var(--blue-ribbon-600)" stopOpacity="0.2"/><stop offset="72%" stopColor="var(--blue-ribbon-600)" stopOpacity="0.02"/><stop offset="100%" stopColor="var(--blue-ribbon-600)" stopOpacity="0"/></linearGradient><linearGradient id="_7gznpr1" x1="0" y1="0" x2="1" y2="0"><stop offset="0%" stopColor="var(--blue-ribbon-600)" stopOpacity="0"/><stop offset="14%" stopColor="var(--blue-ribbon-600)"/><stop offset="100%" stopColor="var(--blue-ribbon-600)"/></linearGradient><linearGradient id="_7gznpr2" x1="0" y1="0" x2="1" y2="0"><stop offset="0%" stopColor="#FFFFFF" stopOpacity="0"/><stop offset="16%" stopColor="#FFFFFF" stopOpacity="0.22"/><stop offset="100%" stopColor="#FFFFFF" stopOpacity="0.22"/></linearGradient></defs>
-              <path d="M0 188 L68 180 L136 184 L204 166 L272 158 L340 164 L408 142 L476 130 L544 136 L612 112 L680 96 L748 100 L816 66 L816 220 L0 220 Z" fill="url(#_7gznpr0)" />
-              <path d="M0 206 L68 202 L136 205 L204 196 L272 192 L340 195 L408 186 L476 180 L544 183 L612 174 L680 168 L748 170 L816 158" fill="none" stroke="url(#_7gznpr2)" strokeWidth="1.3" strokeLinecap="round" strokeDasharray="3 4" />
-              <path d="M0 188 L68 180 L136 184 L204 166 L272 158 L340 164 L408 142 L476 130 L544 136 L612 112 L680 96 L748 100 L816 66" fill="none" stroke="url(#_7gznpr1)" strokeWidth="1.75" strokeLinecap="round" strokeLinejoin="round" />
-              <path d="M816 66 L884 52 L952 36" fill="none" stroke="#0673FF6B" strokeWidth="1.5" strokeLinecap="round" strokeDasharray="4 5" />
-              <path d="M816 59.5 L822.5 66 L816 72.5 L809.5 66 Z" fill="var(--zinc-950)" stroke="var(--blue-ribbon-600)" strokeWidth="1.3" />
-            </svg>
-            </ChartWipe>
-            <div className="flex items-center justify-between self-stretch pt-4 relative">
-              <div className="flex items-center gap-5.5">
-                <div className="flex items-center gap-2">
-                  <div className="w-1.75 h-1.75 shrink-0 rounded-[999px] [background-color:var(--color-blue-ribbon-500)]" />
-                  <div className="w-max shrink-0 font-sans text-[#FFFFFF8A] text-xs/4">
-                    Subscription revenue
-                  </div>
-                </div>
-                <div className="flex items-center gap-2">
-                  <svg aria-hidden="true" width="14" height="7" viewBox="0 0 14 7" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                    <path d="M0 3.5h14" fill="none" stroke="rgb(255 255 255 / 26%)" strokeWidth="1.4" strokeDasharray="3 3" />
-                  </svg>
-                  <div className="w-max shrink-0 font-sans text-[#FFFFFF8A] text-xs/4">
-                    Previous period
-                  </div>
-                </div>
-              </div>
-              <div className="flex items-center gap-2">
-                <svg aria-hidden="true" width="14" height="7" viewBox="0 0 14 7" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <path d="M0 3.5h14" fill="none" stroke="rgb(6 115 255 / 50%)" strokeWidth="1.4" strokeDasharray="3 3" />
-                </svg>
-                <div className="w-max shrink-0 font-sans text-[#0673FFCC] text-xs/4">
-                  Projected
-                </div>
-              </div>
-            </div>
-            <div className="flex flex-col self-stretch pt-9.5 gap-5 relative">
-              <div className="flex flex-col self-stretch gap-1.75">
-                <div className="tracking-[-0.01em] w-max font-sans font-medium text-[#FFFFFFB2] text-[13px]/4">
-                  Retention by cohort
-                </div>
-              </div>
-              <div className="flex flex-col self-stretch gap-1.5">
-                <div className="flex self-stretch h-7 shrink-0">
-                  <div className="w-34 shrink-0 flex items-center justify-end pr-3">
-                    <div className="w-max shrink-0 font-sans text-[#FFFFFF8A] text-xs/4">
-                      Mar · 3,180
-                    </div>
-                  </div>
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF33] border border-solid border-[#0673FF4D]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFD1] text-[11px]/3.25">
-                      <CountUp delay={0.3} value="100" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF29] border border-solid border-[#0673FF47]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFB3] text-[11px]/3.25">
-                      <CountUp delay={0.335} value="82" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF24] border border-solid border-[#0673FF42]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFA8] text-[11px]/3.25">
-                      <CountUp delay={0.37} value="71" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF1F] border border-solid border-[#0673FF3D]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFA1] text-[11px]/3.25">
-                      <CountUp delay={0.405} value="64" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF1A] border border-solid border-[#0673FF38]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFF99] text-[11px]/3.25">
-                      <CountUp delay={0.44} value="59" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 h-7 rounded-[5px] bg-[#0673FF08] border border-dashed border-[#0673FF52]" />
-                </div>
-                <div className="flex self-stretch h-7 shrink-0">
-                  <div className="w-68 shrink-0 flex items-center justify-end pr-3">
-                    <div className="w-max shrink-0 font-sans text-[#FFFFFF8A] text-xs/4">
-                      Apr · 3,940
-                    </div>
-                  </div>
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF33] border border-solid border-[#0673FF4D]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFD1] text-[11px]/3.25">
-                      <CountUp delay={0.475} value="100" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF2A] border border-solid border-[#0673FF47]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFB3] text-[11px]/3.25">
-                      <CountUp delay={0.51} value="84" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF25] border border-solid border-[#0673FF42]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFA8] text-[11px]/3.25">
-                      <CountUp delay={0.545} value="74" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF21] border border-solid border-[#0673FF3D]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFA1] text-[11px]/3.25">
-                      <CountUp delay={0.58} value="68" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 h-7 rounded-[5px] bg-[#0673FF08] border border-dashed border-[#0673FF52]" />
-                </div>
-                <div className="flex self-stretch h-7 shrink-0">
-                  <div className="w-102 shrink-0 flex items-center justify-end pr-3">
-                    <div className="w-max shrink-0 font-sans text-[#FFFFFF8A] text-xs/4">
-                      May · 4,610
-                    </div>
-                  </div>
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF33] border border-solid border-[#0673FF4D]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFD1] text-[11px]/3.25">
-                      <CountUp delay={0.615} value="100" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF2B] border border-solid border-[#0673FF47]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFB3] text-[11px]/3.25">
-                      <CountUp delay={0.65} value="86" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF26] border border-solid border-[#0673FF42]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFA8] text-[11px]/3.25">
-                      <CountUp delay={0.685} value="77" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 h-7 rounded-[5px] bg-[#0673FF08] border border-dashed border-[#0673FF52]" />
-                </div>
-                <div className="flex self-stretch h-7 shrink-0">
-                  <div className="w-136 shrink-0 flex items-center justify-end pr-3">
-                    <div className="w-max shrink-0 font-sans text-[#FFFFFF8A] text-xs/4">
-                      Jun · 5,120
-                    </div>
-                  </div>
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF33] border border-solid border-[#0673FF4D]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFD1] text-[11px]/3.25">
-                      <CountUp delay={0.72} value="100" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF2B] border border-solid border-[#0673FF47]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFB3] text-[11px]/3.25">
-                      <CountUp delay={0.755} value="88" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 h-7 rounded-[5px] bg-[#0673FF08] border border-dashed border-[#0673FF52]" />
-                </div>
-                <div className="flex self-stretch h-7 shrink-0">
-                  <div className="w-170 shrink-0 flex items-center justify-end pr-3">
-                    <div className="w-max shrink-0 font-sans text-[#FFFFFF8A] text-xs/4">
-                      Jul · 5,860
-                    </div>
-                  </div>
-                  <div className="w-33 shrink-0 flex items-center justify-center h-7 rounded-[5px] bg-[#0673FF33] border border-solid border-[#0673FF4D]">
-                    <div className="tracking-[0.02em] font-mono text-[#FFFFFFD1] text-[11px]/3.25">
-                      <CountUp delay={0.79} value="100" />
-                    </div>
-                  </div>
-                  <div className="w-1 shrink-0" />
-                  <div className="w-33 shrink-0 h-7 rounded-[5px] bg-[#0673FF08] border border-dashed border-[#0673FF52]" />
-                </div>
-              </div>
-            </div>
-            <div className="absolute inset-0" style={{ backgroundImage: 'radial-gradient(ellipse 78.55% 116.835% at 22.040000000000003% 0% in oklab, oklab(17.1% 0 0 / 0%) 30.12%, oklab(14.1% 0.001 -0.004) 100%)' }} />
-          </Illustration>
-          </ScaledMock>
-        </div>
-      </div>
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/asteroids.tsx b/apps/www/src/features/www/landing/sections/asteroids.tsx
deleted file mode 100644
index f97c47f36..000000000
--- a/apps/www/src/features/www/landing/sections/asteroids.tsx
+++ /dev/null
@@ -1,161 +0,0 @@
-"use client";
-
-import { cn, Logo } from "@voidhash/ui";
-import { motion, useMotionValue, useMotionValueEvent, useTransform } from "motion/react";
-import { lazy, Suspense, useEffect, useRef, useState } from "react";
-
-import { ASTEROIDS_STAGE_CLASS } from "../asteroids/frame";
-
-/**
- * The game must cost nothing until someone actually plays it: the engine, the CRT shader and the
- * chrome live in their own chunk, and nothing mounts — no canvas, no loop — until the play button
- * is pressed. The chunk itself is only prefetched once the finale scrolls near.
- */
-const AsteroidsGame = lazy(async () => ({
-  default: (await import("../asteroids/game")).AsteroidsGame,
-}));
-
-/** How far ahead of the viewport the chunk starts downloading. */
-const PREFETCH_MARGIN = "600px";
-
-/** Scroll progress past which the play button is interactive and armed for the keyboard. */
-const REVEAL_PROGRESS = 0.6;
-
-/**
- * The section is one viewport taller than the sticky stage inside it, so the last stretch of the
- * page scrubs the logo-to-play transition instead of flipping it: the giant wordmark dissolves as
- * the extra viewport scrolls by, and the unexplained play button condenses out of the same scroll.
- * Once pressed, the stage swaps to the live game.
- */
-export function LandingAsteroids() {
-  const sectionRef = useRef<HTMLElement>(null);
-  const [stage, setStage] = useState<"scroll" | "game">("scroll");
-  const [revealed, setRevealed] = useState(false);
-
-  // Progress through the runway, computed by hand: how far the extra viewport of section has been
-  // scrolled past the point where the sticky stage pins.
-  const scrollProgress = useMotionValue(0);
-  const logoOpacity = useTransform(scrollProgress, [0, 0.5], [1, 0]);
-  const logoScale = useTransform(scrollProgress, [0, 0.5], [1, 0.96]);
-  const logoLift = useTransform(scrollProgress, [0, 0.5], [0, -48]);
-  const buttonOpacity = useTransform(scrollProgress, [0.45, 0.85], [0, 1]);
-
-  useEffect(() => {
-    const section = sectionRef.current;
-    if (!section || stage !== "scroll") {
-      return;
-    }
-
-    // Geometry is cached outside the scroll handler: reading offsets on every scroll event can
-    // force a reflow mid-scroll, janking the very scrub the handler drives.
-    let runway = 0;
-    let sectionTop = 0;
-
-    const update = () => {
-      const raw = runway > 0 ? (window.scrollY - sectionTop) / runway : 1;
-      scrollProgress.set(Math.min(1, Math.max(0, raw)));
-    };
-
-    const measure = () => {
-      runway = section.offsetHeight - window.innerHeight;
-      sectionTop = section.offsetTop;
-      update();
-    };
-
-    measure();
-    // The section sits at the very bottom of the page, so anything above it resizing (images
-    // loading, fonts swapping) moves its offset.
-    const resizeObserver = new ResizeObserver(measure);
-    resizeObserver.observe(document.body);
-    window.addEventListener("scroll", update, { passive: true });
-    window.addEventListener("resize", measure);
-
-    return () => {
-      resizeObserver.disconnect();
-      window.removeEventListener("scroll", update);
-      window.removeEventListener("resize", measure);
-    };
-  }, [scrollProgress, stage]);
-
-  // Interactivity needs a boolean, not a motion value: the button must ignore clicks and focus
-  // while it is still invisible mid-scrub.
-  useMotionValueEvent(scrollProgress, "change", (progress) => {
-    setRevealed(progress >= REVEAL_PROGRESS);
-  });
-
-  // Warm the chunk once the finale approaches, so pressing play starts the game instantly.
-  useEffect(() => {
-    const section = sectionRef.current;
-    if (!section) {
-      return;
-    }
-
-    const observer = new IntersectionObserver(
-      ([entry]) => {
-        if (entry.isIntersecting) {
-          import("../asteroids/game");
-          observer.disconnect();
-        }
-      },
-      { rootMargin: PREFETCH_MARGIN },
-    );
-    observer.observe(section);
-
-    return () => observer.disconnect();
-  }, []);
-
-  // Once the button has condensed in, the keys that scrolled here also press it.
-  useEffect(() => {
-    if (stage !== "scroll" || !revealed) {
-      return;
-    }
-
-    const onKeyDown = (event: KeyboardEvent) => {
-      if (event.code === "Space" || event.code === "Enter") {
-        event.preventDefault();
-        setStage("game");
-      }
-    };
-
-    window.addEventListener("keydown", onKeyDown);
-    return () => window.removeEventListener("keydown", onKeyDown);
-  }, [revealed, stage]);
-
-  return (
-    <section className="relative h-[200svh] w-full self-stretch bg-zinc-950" ref={sectionRef}>
-      <div className="sticky top-0 h-svh w-full overflow-hidden">
-        {stage === "game" ? (
-          <Suspense fallback={<div className={ASTEROIDS_STAGE_CLASS} />}>
-            <AsteroidsGame autoStart />
-          </Suspense>
-        ) : (
-          <>
-            <motion.div
-              className="absolute inset-x-0 top-0 flex justify-center px-6 pt-16 md:px-12 md:pt-20 xl:px-32"
-              style={{ opacity: logoOpacity, scale: logoScale, y: logoLift }}
-            >
-              {/* The Logo default carries `dark:text-white`, so the dark override must be explicit. */}
-              <Logo className="h-auto w-full max-w-[1656px] text-zinc-800 dark:text-zinc-800" />
-            </motion.div>
-            <motion.div
-              className={cn(
-                "absolute inset-0 flex items-center justify-center",
-                !revealed && "pointer-events-none",
-              )}
-              style={{ opacity: buttonOpacity }}
-            >
-              <button
-                className="border border-zinc-500 px-10 py-3.5 font-mono text-sm text-white tracking-[0.25em] transition-colors hover:border-white hover:bg-white hover:text-black"
-                onClick={() => setStage("game")}
-                tabIndex={revealed ? 0 : -1}
-                type="button"
-              >
-                PLAY
-              </button>
-            </motion.div>
-          </>
-        )}
-      </div>
-    </section>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/crm.tsx b/apps/www/src/features/www/landing/sections/crm.tsx
deleted file mode 100644
index 44df4ed63..000000000
--- a/apps/www/src/features/www/landing/sections/crm.tsx
+++ /dev/null
@@ -1,337 +0,0 @@
-import { LandingSection, ScaledMock, SectionHeader } from "../shared";
-
-/** Renders the CRM product section. */
-export function LandingCrm() {
-  return (
-    <LandingSection id="crm">
-      <div className="flex flex-col items-start justify-center gap-12 px-6 py-16 md:gap-23 md:px-12 md:py-24 xl:p-32">
-        <SectionHeader
-          description="See each customer's journey in one place, from their first visit to purchases, renewals and refunds, even when they switch devices."
-          eyebrow="CRM"
-          title="Know the people behind your growth."
-        />
-        <ScaledMock compactDesignWidth={1010} designWidth={1400}>
-          {/* Below xl the detail card stops floating over the table and stacks above it, so the
-              two panels become an ordinary flex column instead of the artboard's overlap. */}
-          <div className="w-full xl:w-350 xl:h-125 mt-6 shrink-0 relative flex flex-col gap-10 xl:block">
-          <div className="xl:left-97.5 xl:top-0 w-full xl:w-252.5 flex flex-col items-start rounded-lg overflow-clip relative xl:absolute">
-            <div className="self-stretch flex items-center py-3.5 px-6 gap-4 border-b border-b-solid [border-bottom-color:var(--color-zinc-900)]">
-              <div className="w-75 shrink-0 font-sans text-zinc-400 text-xs/4">
-                Person
-              </div>
-              <div className="w-40 shrink-0 font-sans text-zinc-400 text-xs/4">
-                Product
-              </div>
-              <div className="w-30 shrink-0 font-sans text-zinc-400 text-xs/4">
-                Status
-              </div>
-              <div className="w-25 shrink-0 text-right font-sans flex justify-end flex-wrap text-zinc-400 text-xs/4">
-                LTV
-              </div>
-              <div className="grow basis-[0%] text-right font-sans flex justify-end flex-wrap text-zinc-400 text-xs/4">
-                Last seen
-              </div>
-            </div>
-            <div className="self-stretch flex items-center py-3.75 px-6 gap-4 border-b border-b-solid [border-bottom-color:var(--color-zinc-900)]">
-              <div className="w-75 shrink-0 flex items-center gap-3">
-                <div className="w-7.5 h-7.5 shrink-0 rounded-[999px]" style={{ backgroundImage: 'linear-gradient(in oklab 135deg, oklab(85.7% 0.018 0.147) 0%, oklab(88% -0.200 0.140) 100%)' }} />
-                <div className="flex flex-col gap-0.5">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Mara Keller
-                  </div>
-                  <div className="tracking-[-0.01em] font-sans text-zinc-500 text-xs/4">
-                    mara.keller@hey.com
-                  </div>
-                </div>
-              </div>
-              <div className="w-40 shrink-0 font-sans text-[#FFFFFFB8] text-[13px]/4">
-                Pro Annual
-              </div>
-              <div className="w-30 shrink-0 flex">
-                <div className="flex items-center py-1 px-2.5 rounded-[999px] gap-1.5 bg-[#14532D33] border border-solid border-[#16653D]">
-                  <div className="font-sans font-medium [color:var(--color-pistachio-600)] text-xs/4">
-                    Active
-                  </div>
-                </div>
-              </div>
-              <div className="w-25 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-[13px]/4">
-                $149.97
-              </div>
-              <div className="grow basis-[0%] text-right font-sans flex justify-end flex-wrap text-zinc-400 text-[13px]/4">
-                2 min ago
-              </div>
-            </div>
-            <div className="self-stretch flex items-center py-3.75 px-6 gap-4 border-b border-b-solid [border-bottom-color:var(--color-zinc-900)]">
-              <div className="w-75 shrink-0 flex items-center gap-3">
-                <div className="w-7.5 h-7.5 shrink-0 rounded-[999px]" style={{ backgroundImage: 'linear-gradient(in oklab 135deg, oklab(87.3% -0.210 0.125) 0%, oklab(46.2% -0.031 -0.305) 100%)' }} />
-                <div className="flex flex-col gap-0.5">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Jonas Ortega
-                  </div>
-                  <div className="tracking-[-0.01em] font-sans text-zinc-500 text-xs/4">
-                    j.ortega@fastmail.com
-                  </div>
-                </div>
-              </div>
-              <div className="w-40 shrink-0 font-sans text-[#FFFFFFB8] text-[13px]/4">
-                Pro Monthly
-              </div>
-              <div className="w-30 shrink-0 flex">
-                <div className="flex items-center py-1 px-2.5 rounded-[999px] gap-1.5 bg-[#1E3A8A40] border border-solid border-blue-ribbon-800">
-                  <div className="font-sans font-medium text-blue-ribbon-400 text-xs/4">
-                    In trial
-                  </div>
-                </div>
-              </div>
-              <div className="w-25 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-[13px]/4">
-                $0.00
-              </div>
-              <div className="grow basis-[0%] text-right font-sans flex justify-end flex-wrap text-zinc-400 text-[13px]/4">
-                18 min ago
-              </div>
-            </div>
-            <div className="self-stretch flex items-center py-3.75 px-6 gap-4 relative bg-[#FFFFFF0A] border-b border-b-solid [border-bottom-color:var(--color-zinc-900)]">
-              <div className="w-75 shrink-0 flex items-center gap-3">
-                <div className="w-7.5 h-7.5 shrink-0 rounded-[999px]" style={{ backgroundImage: 'linear-gradient(in oklab 135deg, oklab(68.1% -0.134 0.027) 0%, oklab(36.1% 0.011 -0.231) 100%)' }} />
-                <div className="flex flex-col gap-0.5">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Amara Lindqvist
-                  </div>
-                  <div className="tracking-[-0.01em] font-sans text-zinc-500 text-xs/4">
-                    amara@lindqvist.se
-                  </div>
-                </div>
-              </div>
-              <div className="w-40 shrink-0 font-sans text-[#FFFFFFB8] text-[13px]/4">
-                Pro Annual
-              </div>
-              <div className="w-30 shrink-0 flex">
-                <div className="flex items-center py-1 px-2.5 rounded-[999px] gap-1.5 bg-[#14532D33] border border-solid border-[#16653D]">
-                  <div className="font-sans font-medium [color:var(--color-pistachio-600)] text-xs/4">
-                    Active
-                  </div>
-                </div>
-              </div>
-              <div className="w-25 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-[13px]/4">
-                $299.94
-              </div>
-              <div className="grow basis-[0%] text-right font-sans flex justify-end flex-wrap text-zinc-400 text-[13px]/4">
-                1 hr ago
-              </div>
-              <div className="absolute left-0 top-0 w-0.5 h-16.75" style={{ backgroundImage: 'linear-gradient(in oklab 180deg, oklab(68.1% -0.134 0.027) 0%, oklab(36.1% 0.011 -0.231) 100%)' }} />
-            </div>
-            <div className="self-stretch flex items-center py-3.75 px-6 gap-4 border-b border-b-solid [border-bottom-color:var(--color-zinc-900)]">
-              <div className="w-75 shrink-0 flex items-center gap-3">
-                <div className="w-7.5 h-7.5 shrink-0 rounded-[999px]" style={{ backgroundImage: 'linear-gradient(in oklab 135deg, oklab(48.1% -0.041 -0.151) 0%, oklab(51.9% 0.198 -0.141) 100%)' }} />
-                <div className="flex flex-col gap-0.5">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Diego Tran
-                  </div>
-                  <div className="tracking-[-0.01em] font-sans text-zinc-500 text-xs/4">
-                    dtran@proton.me
-                  </div>
-                </div>
-              </div>
-              <div className="w-40 shrink-0 font-sans text-[#FFFFFFB8] text-[13px]/4">
-                Pro Monthly
-              </div>
-              <div className="w-30 shrink-0 flex">
-                <div className="flex items-center py-1 px-2.5 rounded-[999px] gap-1.5 bg-[#78350F40] border border-solid border-[#A16207]">
-                  <div className="font-sans font-medium text-[#FBBF24] text-xs/4">
-                    Grace period
-                  </div>
-                </div>
-              </div>
-              <div className="w-25 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-[13px]/4">
-                $59.88
-              </div>
-              <div className="grow basis-[0%] text-right font-sans flex justify-end flex-wrap text-zinc-400 text-[13px]/4">
-                4 hrs ago
-              </div>
-            </div>
-            <div className="self-stretch flex items-center py-3.75 px-6 gap-4 border-b border-b-solid [border-bottom-color:var(--color-zinc-900)]">
-              <div className="w-75 shrink-0 flex items-center gap-3">
-                <div className="w-7.5 h-7.5 shrink-0 rounded-[999px]" style={{ backgroundImage: 'linear-gradient(in oklab 135deg, oklab(63.1% 0.235 0.099) 0%, oklab(92.5% -0.134 0.190) 100%)' }} />
-                <div className="flex flex-col gap-0.5">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Sofia Baumann
-                  </div>
-                  <div className="tracking-[-0.01em] font-sans text-zinc-500 text-xs/4">
-                    sofia.b@icloud.com
-                  </div>
-                </div>
-              </div>
-              <div className="w-40 shrink-0 font-sans text-[#FFFFFFB8] text-[13px]/4">
-                Lifetime
-              </div>
-              <div className="w-30 shrink-0 flex">
-                <div className="flex items-center py-1 px-2.5 rounded-[999px] gap-1.5 bg-[#14532D33] border border-solid border-[#16653D]">
-                  <div className="font-sans font-medium [color:var(--color-pistachio-600)] text-xs/4">
-                    Active
-                  </div>
-                </div>
-              </div>
-              <div className="w-25 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-[13px]/4">
-                $199.00
-              </div>
-              <div className="grow basis-[0%] text-right font-sans flex justify-end flex-wrap text-zinc-400 text-[13px]/4">
-                Yesterday
-              </div>
-            </div>
-            <div className="self-stretch flex items-center py-3.75 px-6 gap-4">
-              <div className="w-75 shrink-0 flex items-center gap-3">
-                <div className="w-7.5 h-7.5 shrink-0 rounded-[999px]" style={{ backgroundImage: 'linear-gradient(in oklab 135deg, oklab(54.9% -0.036 -0.247) 0%, oklab(69% 0.276 -0.140) 100%)' }} />
-                <div className="flex flex-col gap-0.5">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Ravi Nandakumar
-                  </div>
-                  <div className="tracking-[-0.01em] font-sans text-zinc-500 text-xs/4">
-                    ravi.n@gmail.com
-                  </div>
-                </div>
-              </div>
-              <div className="w-40 shrink-0 font-sans text-[#FFFFFFB8] text-[13px]/4">
-                Pro Annual
-              </div>
-              <div className="w-30 shrink-0 flex">
-                <div className="flex items-center py-1 px-2.5 rounded-[999px] gap-1.5 border border-solid border-zinc-700">
-                  <div className="font-sans font-medium text-zinc-400 text-xs/4">
-                    Churned
-                  </div>
-                </div>
-              </div>
-              <div className="w-25 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-[13px]/4">
-                $49.99
-              </div>
-              <div className="grow basis-[0%] text-right font-sans flex justify-end flex-wrap text-zinc-400 text-[13px]/4">
-                6 days ago
-              </div>
-            </div>
-            {/* Blends the table under the floating detail card — its focal point sits where the
-                card overlaps, so it only makes sense while the two are stacked in z, not in flow. */}
-            <div className="hidden xl:block absolute top-px -bottom-2 inset-x-px" style={{ backgroundImage: 'radial-gradient(ellipse 67.23% 100% at 21.92% 0% in oklab, oklab(17.1% 0 0 / 0%) 17.44%, oklab(16.1% .0004 -0.001 / 33.8%) 45.31%, oklab(14.1% 0.001 -0.004) 100%)' }} />
-            {/* Mobile keeps just the bottom fade, so the row list still reads as continuing. */}
-            <div className="xl:hidden absolute top-px -bottom-2 inset-x-px" style={{ backgroundImage: 'linear-gradient(to bottom, oklab(17.1% 0 0 / 0%) 55%, oklab(14.1% 0.001 -0.004) 100%)' }} />
-          </div>
-          <div className="relative xl:absolute -order-1 xl:order-none xl:left-0 xl:-top-6 w-full xl:w-126 flex flex-col items-start rounded-2xl overflow-clip [box-shadow:#000000B8_0px_28px_90px] bg-origin-border border border-solid [border-color:var(--color-zinc-800)]" style={{ backgroundImage: 'radial-gradient(ellipse 87.36% 97.41499999999999% at 100% 0% in oklab, var(--color-zinc-900) 0%, var(--color-zinc-950) 100%)' }}>
-            <div className="self-stretch flex items-center pt-6 pb-4 overflow-clip gap-4.5 px-7">
-              <div className="shrink-0 rounded-[999px] size-14" style={{ backgroundImage: 'linear-gradient(in oklab 135deg, oklab(68.1% -0.134 0.027) 0%, oklab(36.1% 0.011 -0.231) 100%)' }} />
-              <div className="flex flex-col grow basis-[0%] gap-1">
-                <div className="flex items-center gap-2.5">
-                  <div className="tracking-[-0.03em] font-sans font-semibold text-white text-xl/relaxed">
-                    Amara Lindqvist
-                  </div>
-                </div>
-                <div className="flex items-center gap-2">
-                  <div className="font-sans text-zinc-400 text-[13px]/4.25">
-                    Stockholm, Sweden
-                  </div>
-                  <div className="w-0.75 h-0.75 shrink-0 rounded-[999px] bg-zinc-700" />
-                  <div className="font-sans text-zinc-400 text-[13px]/4.25">
-                    iPhone 16 Pro · iOS 18.4
-                  </div>
-                </div>
-              </div>
-            </div>
-            <div className="self-stretch flex">
-              <div className="flex flex-col w-40.25 shrink-0 py-4 px-7">
-                <div className="font-sans text-zinc-400 text-[13px]/4">
-                  Lifetime value
-                </div>
-                <div className="flex items-baseline gap-2">
-                  <div className="tracking-[-0.035em] font-sans font-semibold text-white text-xl/8">
-                    $299.94
-                  </div>
-                </div>
-              </div>
-              <div className="flex flex-col grow basis-[0%] py-4 px-6">
-                <div className="font-sans text-zinc-400 text-[13px]/4">
-                  Subscribed
-                </div>
-                <div className="tracking-[-0.02em] font-sans font-medium text-white text-xl/8">
-                  3 yrs
-                </div>
-              </div>
-              <div className="flex flex-col grow basis-[0%] items-end py-4 px-6">
-                <div className="self-stretch text-right font-sans flex justify-end flex-wrap text-zinc-400 text-[13px]/4">
-                  Renews
-                </div>
-                <div className="tracking-[-0.02em] self-stretch text-right font-sans font-medium flex justify-end flex-wrap text-white text-xl/8">
-                  Mar 4
-                </div>
-              </div>
-            </div>
-            <div className="self-stretch flex flex-col pb-6 gap-4.5 pt-4 relative px-7">
-              <div className="absolute left-8 top-16 w-px h-41.25" style={{ backgroundImage: 'linear-gradient(in oklab 180deg, oklab(37% 0.003 -0.011) 0%, oklab(27.4% 0.002 -0.005) 70%, oklab(27.4% 0.002 -0.005 / 0%) 100%)' }} />
-              <div className="flex items-center gap-3 justify-between relative">
-                <div className="shrink-0 [letter-spacing:var(--tracking-normal)] font-sans font-medium [color:var(--color-white)] text-base/3.5">
-                  Activity
-                </div>
-                <div className="shrink-0 font-sans text-zinc-400 text-xs/3.5">
-                  Since Feb 2023
-                </div>
-              </div>
-              <div className="flex items-start gap-4 relative">
-                <div className="w-2.25 h-2.25 mt-1.25 shrink-0 rounded-[999px] [background-color:var(--color-pistachio-600)]" />
-                <div className="flex flex-col grow basis-[0%] gap-0.75">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Renewed Pro Annual
-                  </div>
-                  <div className="font-sans text-zinc-400 text-xs/4">
-                    App Store · Mar 4, 2026
-                  </div>
-                </div>
-                <div className="shrink-0 mt-px font-sans font-medium [color:var(--color-pistachio-600)] text-sm/4.5">
-                  +$99.99
-                </div>
-              </div>
-              <div className="flex items-start gap-4 relative">
-                <div className="w-2.25 h-2.25 mt-1.25 shrink-0 rounded-[999px] [background-color:var(--color-blue-ribbon-500)]" />
-                <div className="flex flex-col grow basis-[0%] gap-0.75">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Saw paywall · Onboarding, Variant C
-                  </div>
-                  <div className="font-sans text-zinc-400 text-xs/4">
-                    iOS app · Mar 2, 2026
-                  </div>
-                </div>
-                <div className="shrink-0 mt-px font-sans font-medium text-blue-ribbon-400 text-[13px]/4.5">
-                  Converted
-                </div>
-              </div>
-              <div className="flex items-start gap-4 relative">
-                <div className="w-2.25 h-2.25 mt-1.25 shrink-0 rounded-[999px] bg-electric-violet-400" />
-                <div className="flex flex-col grow basis-[0%] gap-0.75">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Switched Monthly → Annual
-                  </div>
-                  <div className="font-sans text-zinc-400 text-xs/4">
-                    App Store · Nov 18, 2025
-                  </div>
-                </div>
-                <div className="shrink-0 mt-px font-sans font-medium [color:var(--color-pistachio-600)] text-sm/4.5">
-                  +$39.99
-                </div>
-              </div>
-              <div className="flex items-start gap-4 relative">
-                <div className="w-2.25 h-2.25 mt-1.25 shrink-0 rounded-[999px] bg-zinc-600" />
-                <div className="flex flex-col grow basis-[0%] gap-0.75">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                    Started 7-day free trial
-                  </div>
-                  <div className="font-sans text-zinc-400 text-xs/4">
-                    App Store · Feb 26, 2023
-                  </div>
-                </div>
-                <div className="shrink-0 mt-px font-sans text-zinc-400 text-[13px]/4.5">
-                  First touch
-                </div>
-              </div>
-            </div>
-          </div>
-          </div>
-        </ScaledMock>
-      </div>
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/developers.tsx b/apps/www/src/features/www/landing/sections/developers.tsx
deleted file mode 100644
index a0192af7c..000000000
--- a/apps/www/src/features/www/landing/sections/developers.tsx
+++ /dev/null
@@ -1,168 +0,0 @@
-"use client";
-
-import { Button } from "@voidhash/ui";
-import { CheckIcon, CopyIcon } from "lucide-react";
-import { useState } from "react";
-
-import { LandingSection, SectionHeader } from "../shared";
-
-const INSTALL_COMMAND = "npx voidhash-cli init";
-
-function CopyCommandButton() {
-  const [copied, setCopied] = useState(false);
-
-  return (
-    <Button
-      aria-label="Copy install command"
-      onClick={() => {
-        navigator.clipboard.writeText(INSTALL_COMMAND);
-        setCopied(true);
-        setTimeout(() => setCopied(false), 1500);
-      }}
-      size="icon-sm"
-      variant="outline"
-    >
-      {copied ? <CheckIcon className="text-blue-ribbon-400" /> : <CopyIcon />}
-    </Button>
-  );
-}
-
-/** Renders the developer platform section. */
-export function LandingDevelopers() {
-  return (
-    <LandingSection id="developers">
-      <div className="flex flex-col items-start justify-center gap-12 px-6 py-16 md:gap-23 md:px-12 md:py-24 xl:p-32">
-        <SectionHeader
-          description="Connect your app in minutes, then build it yourself or ask your AI coding agent to create, preview and publish it for you."
-          eyebrow="Developers"
-          title="Your first paywall is one command away."
-        />
-        <div className="w-full max-w-[1400px] flex flex-col items-start gap-5">
-          <div className="self-stretch min-w-0 flex gap-12">
-            <div className="flex flex-col rounded-[16px] overflow-clip flex-1 min-w-0 h-fit grow basis-[0%] self-stretch [box-shadow:#00000059_0px_2px_24px] bg-zinc-950 border border-solid border-zinc-800">
-              <div className="self-stretch flex items-center py-2.5 px-3.5 gap-1.5 overflow-x-auto border-b border-b-solid border-b-zinc-900">
-                <div className="flex items-center py-2 px-3.25 rounded-md gap-2.25 bg-zinc-900">
-                  <svg aria-hidden="true" width="15" height="15" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                    <circle cx="12" cy="12" r="2.1" fill="var(--color-blue-ribbon-400)" />
-                    <ellipse cx="12" cy="12" rx="10" ry="3.9" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.4" />
-                    <ellipse cx="12" cy="12" rx="10" ry="3.9" transform="rotate(60 12 12)" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.4" />
-                    <ellipse cx="12" cy="12" rx="10" ry="3.9" transform="rotate(120 12 12)" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="1.4" />
-                  </svg>
-                  <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans font-medium text-zinc-50">
-                    React Native
-                  </div>
-                </div>
-                <div className="flex items-center py-2 px-3.25 gap-2.25">
-                  <svg aria-hidden="true" width="15" height="15" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                    <path d="M17.05 12.54c-.03-2.91 2.38-4.31 2.49-4.38-1.36-1.99-3.47-2.26-4.22-2.29-1.8-.18-3.51 1.06-4.42 1.06-.91 0-2.32-1.03-3.81-1-1.96.03-3.77 1.14-4.78 2.89-2.04 3.54-.52 8.78 1.46 11.65.97 1.4 2.12 2.98 3.63 2.92 1.46-.06 2.01-.94 3.77-.94 1.76 0 2.26.94 3.8.91 1.57-.03 2.56-1.43 3.52-2.84 1.11-1.63 1.57-3.21 1.6-3.29-.04-.02-3.07-1.18-3.04-4.69Z" fill="var(--zinc-500)" />
-                    <path d="M14.13 4.06c.8-.98 1.35-2.33 1.2-3.68-1.16.05-2.57.78-3.4 1.75-.74.86-1.4 2.24-1.22 3.56 1.3.1 2.62-.66 3.42-1.63Z" fill="var(--zinc-500)" />
-                  </svg>
-                  <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-400">
-                    Swift
-                  </div>
-                  <div className="text-[13px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-500">
-                    Soon
-                  </div>
-                </div>
-                <div className="flex items-center py-2 px-3.25 gap-2.25">
-                  <svg aria-hidden="true" width="13" height="13" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                    <path d="M24 24H0V0h24L12 12l12 12Z" fill="var(--zinc-500)" />
-                  </svg>
-                  <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-400">
-                    Kotlin
-                  </div>
-                  <div className="text-[13px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-500">
-                    Soon
-                  </div>
-                </div>
-                <div className="grow basis-[0%] h-px" />
-                <CopyCommandButton />
-              </div>
-              <div className="self-stretch flex flex-col py-8 md:py-11.5">
-                <div className="self-stretch flex items-center px-5 md:px-7 gap-3.5">
-                  <div className="w-max inline-block shrink-0 font-mono text-zinc-600 text-base/6 md:text-xl/7.5">
-                    $
-                  </div>
-                  <div className="flex flex-wrap items-center gap-x-2">
-                    <div className="w-max inline-block shrink-0 font-mono text-zinc-400 text-base/6 md:text-xl/7.5">
-                      npx
-                    </div>
-                    <div className="w-max inline-block shrink-0 font-mono font-medium text-zinc-50 text-base/6 md:text-xl/7.5">
-                      voidhash-cli
-                    </div>
-                    <div className="w-max inline-block shrink-0 font-mono font-medium text-blue-ribbon-400 text-base/6 md:text-xl/7.5">
-                      init
-                    </div>
-                  </div>
-                </div>
-              </div>
-              <div className="self-stretch flex flex-wrap items-center py-4 px-5 md:px-7 gap-x-7 gap-y-2 border-t border-t-solid border-t-zinc-900">
-                <a className="flex items-center gap-2.25 transition-opacity hover:opacity-80" href="/docs">
-                  <svg aria-hidden="true" width="15" height="15" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                    <path d="M4 4.5A1.5 1.5 0 0 1 5.5 3H10a2 2 0 0 1 2 2v15a2 2 0 0 0-2-2H5.5A1.5 1.5 0 0 1 4 16.5v-12Z" fill="none" stroke="var(--zinc-400)" strokeWidth="1.7" strokeLinejoin="round" />
-                    <path d="M20 4.5A1.5 1.5 0 0 0 18.5 3H14a2 2 0 0 0-2 2v15a2 2 0 0 1 2-2h4.5a1.5 1.5 0 0 0 1.5-1.5v-12Z" fill="none" stroke="var(--zinc-400)" strokeWidth="1.7" strokeLinejoin="round" />
-                  </svg>
-                  <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-300">
-                    Read the docs
-                  </div>
-                </a>
-                <div className="grow basis-[0%] h-px" />
-                <div className="text-[13px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-mono text-zinc-500">
-                  Expo SDK 52+ · New Architecture ready
-                </div>
-              </div>
-            </div>
-          </div>
-          <div className="self-stretch flex flex-wrap items-center gap-y-3 pt-5 px-0.5">
-            <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-400">
-              Wired automatically, zero config
-            </div>
-            <div className="grow basis-[0%] h-px" />
-            <div className="flex flex-wrap items-center gap-x-7.5 gap-y-3">
-              <div className="flex items-center gap-2">
-                <svg aria-hidden="true" width="14" height="14" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <path d="M4.5 12.5 9.5 17.5 19.5 6.5" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round" />
-                </svg>
-                <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-300">
-                  Paywalls
-                </div>
-              </div>
-              <div className="flex items-center gap-2">
-                <svg aria-hidden="true" width="14" height="14" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <path d="M4.5 12.5 9.5 17.5 19.5 6.5" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round" />
-                </svg>
-                <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-300">
-                  Purchases
-                </div>
-              </div>
-              <div className="flex items-center gap-2">
-                <svg aria-hidden="true" width="14" height="14" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <path d="M4.5 12.5 9.5 17.5 19.5 6.5" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round" />
-                </svg>
-                <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-300">
-                  Entitlements
-                </div>
-              </div>
-              <div className="flex items-center gap-2">
-                <svg aria-hidden="true" width="14" height="14" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <path d="M4.5 12.5 9.5 17.5 19.5 6.5" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round" />
-                </svg>
-                <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-300">
-                  Experiments
-                </div>
-              </div>
-              <div className="flex items-center gap-2">
-                <svg aria-hidden="true" width="14" height="14" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-                  <path d="M4.5 12.5 9.5 17.5 19.5 6.5" fill="none" stroke="var(--color-blue-ribbon-400)" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round" />
-                </svg>
-                <div className="text-[15px] tracking-[-0.01em] leading-[120%] w-max shrink-0 font-sans text-zinc-300">
-                  Analytics
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-      </div>
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/divider.tsx b/apps/www/src/features/www/landing/sections/divider.tsx
deleted file mode 100644
index 61d75750e..000000000
--- a/apps/www/src/features/www/landing/sections/divider.tsx
+++ /dev/null
@@ -1,8 +0,0 @@
-/** Renders the hairline band that separates two landing page sections. */
-export function LandingDivider() {
-  return (
-    <div className="flex flex-col items-center gap-2.5 self-stretch border-zinc-800 border-b py-2.5">
-      <div className="flex h-3 shrink-0 items-center self-stretch border-zinc-800 border-t border-b" />
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/experimentation.tsx b/apps/www/src/features/www/landing/sections/experimentation.tsx
deleted file mode 100644
index e25d21cd0..000000000
--- a/apps/www/src/features/www/landing/sections/experimentation.tsx
+++ /dev/null
@@ -1,221 +0,0 @@
-"use client";
-
-import { Button, cn, Switch } from "@voidhash/ui";
-import { useState } from "react";
-
-import { CountUp, GrowBar, Illustration } from "../motion";
-import { LandingSection, ScaledMock, SectionHeader } from "../shared";
-
-const FEATURE_FLAGS = [
-  {
-    name: "new_onboarding_flow",
-    enabledDetail: "iOS · 25% rollout",
-    disabledDetail: "iOS · off",
-    defaultEnabled: true,
-  },
-  {
-    name: "annual_price_test",
-    enabledDetail: "Backing flag · experiment · 100%",
-    disabledDetail: "Backing flag · experiment paused",
-    defaultEnabled: true,
-  },
-  {
-    name: "winback_offer_v2",
-    enabledDetail: "Churned subscribers · 50% rollout",
-    disabledDetail: "Churned subscribers · off",
-    defaultEnabled: true,
-  },
-  {
-    name: "family_sharing",
-    enabledDetail: "Internal testers only · on",
-    disabledDetail: "Internal testers only · off",
-    defaultEnabled: false,
-  },
-  {
-    name: "paywall_v4_layout",
-    enabledDetail: "All platforms · live",
-    disabledDetail: "All platforms · draft",
-    defaultEnabled: false,
-  },
-];
-
-function FlagRow({
-  flag,
-  withBorder,
-}: {
-  flag: (typeof FEATURE_FLAGS)[number];
-  withBorder: boolean;
-}) {
-  const [enabled, setEnabled] = useState(flag.defaultEnabled);
-
-  return (
-    <div
-      className={cn(
-        "self-stretch flex items-center py-4.5 px-6 gap-4",
-        withBorder && "border-b border-b-solid border-b-zinc-900",
-      )}
-    >
-      <div className="grow basis-[0%] flex flex-col gap-1">
-        <div
-          className={cn(
-            "font-mono font-medium text-[13px]/4 transition-colors duration-300",
-            enabled ? "text-white" : "text-zinc-400",
-          )}
-        >
-          {flag.name}
-        </div>
-        <div className="tracking-[-0.01em] font-sans text-zinc-400 text-xs/4">
-          {enabled ? flag.enabledDetail : flag.disabledDetail}
-        </div>
-      </div>
-      <Switch checked={enabled} onCheckedChange={setEnabled} />
-    </div>
-  );
-}
-
-/** Renders the experimentation product section. */
-export function LandingExperimentation() {
-  return (
-    <LandingSection id="experimentation">
-      <div className="flex flex-col items-start justify-center gap-12 px-6 py-16 md:gap-23 md:px-12 md:py-24 xl:p-32">
-        <SectionHeader
-          description="Try different paywalls, prices and product experiences with real customers. Compare the results, choose the winner and launch it with confidence."
-          eyebrow="Experimentation"
-          title="Learn what works before you roll it out."
-        />
-        <div className="flex flex-col items-start gap-6 self-stretch xl:flex-row">
-          <ScaledMock className="min-w-0 flex-1" designWidth={944}>
-            <Illustration className="w-236 flex flex-col items-start rounded-lg overflow-clip relative shrink-0">
-              <div className="self-stretch flex items-center justify-between py-5 px-6">
-                <div className="flex flex-col gap-2">
-                  <div className="tracking-[-0.02em] font-sans font-medium text-white text-[15px]/4.5">
-                    Onboarding paywall: annual price
-                  </div>
-                  <div className="font-sans text-zinc-400 text-xs/4">
-                    Running · 14 days · 48,204 exposures
-                  </div>
-                </div>
-              </div>
-              <div className="self-stretch flex flex-col py-6.5 px-6 gap-5.5 grow items-start">
-                <div className="flex items-center gap-5 self-stretch">
-                  <div className="w-50 shrink-0 font-sans text-zinc-400 text-xs/4">
-                    Variant
-                  </div>
-                  <div className="grow basis-[0%] font-sans text-zinc-400 text-xs/4">
-                    Trial start rate
-                  </div>
-                  <div className="w-24 shrink-0 text-right font-sans flex justify-end flex-wrap text-zinc-400 text-xs/4">
-                    ARPU
-                  </div>
-                  <div className="w-21 shrink-0 text-right font-sans flex justify-end flex-wrap text-zinc-400 text-xs/4">
-                    Lift
-                  </div>
-                </div>
-                <div className="flex items-center gap-5 self-stretch">
-                  <div className="w-50 shrink-0 flex flex-col gap-0.75">
-                    <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                      Control
-                    </div>
-                    <div className="tracking-[-0.01em] font-sans text-zinc-400 text-[13px]/4">
-                      $49.99 / year · 33%
-                    </div>
-                  </div>
-                  <div className="grow basis-[0%] flex items-center gap-3">
-                    <GrowBar className="h-6.5 w-56 shrink-0 rounded-lg [background-color:var(--color-zinc-800)]" />
-                    <div className="font-sans font-medium text-[#FFFFFFB8] text-sm/4.5">
-                      <CountUp value="21.4%" />
-                    </div>
-                  </div>
-                  <div className="w-24 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-sm/4.5">
-                    <CountUp value="$1.62" />
-                  </div>
-                  <div className="w-21 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-zinc-500 text-sm/4.5">
-                    0%
-                  </div>
-                </div>
-                <div className="flex items-center gap-5 self-stretch">
-                  <div className="w-50 shrink-0 flex flex-col gap-0.75">
-                    <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                      Variant B
-                    </div>
-                    <div className="tracking-[-0.01em] font-sans text-zinc-400 text-[13px]/4">
-                      $59.99 / year · 33%
-                    </div>
-                  </div>
-                  <div className="grow basis-[0%] flex items-center gap-3">
-                    <GrowBar className="h-6.5 w-51.75 shrink-0 rounded-lg [background-color:var(--color-zinc-800)]" delay={0.08} />
-                    <div className="font-sans font-medium text-[#FFFFFFB8] text-sm/4.5">
-                      <CountUp delay={0.08} value="19.8%" />
-                    </div>
-                  </div>
-                  <div className="w-24 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-sm/4.5">
-                    <CountUp delay={0.08} value="$1.71" />
-                  </div>
-                  <div className="w-21 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap [color:var(--color-pistachio-600)] text-sm/4.5">
-                    <CountUp delay={0.08} value="+5.6%" />
-                  </div>
-                </div>
-                <div className="flex items-center gap-5 self-stretch">
-                  <div className="w-50 shrink-0 flex flex-col gap-0.75">
-                    <div className="tracking-[-0.02em] font-sans font-medium text-white text-sm/4.5">
-                      Variant C
-                    </div>
-                    <div className="tracking-[-0.01em] font-sans text-zinc-400 text-[13px]/4">
-                      $39.99 / year + 7d trial · 34%
-                    </div>
-                  </div>
-                  <div className="grow basis-[0%] flex items-center gap-3">
-                    <GrowBar className="h-6.5 w-73 shrink-0 rounded-lg [box-shadow:var(--color-blue-ribbon-300)_0px_0px_6px_inset] [background-color:var(--color-blue-ribbon-600)]" delay={0.16} />
-                    <div className="font-sans font-medium text-white text-sm/4.5">
-                      <CountUp delay={0.16} value="27.9%" />
-                    </div>
-                  </div>
-                  <div className="w-24 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap text-white text-sm/4.5">
-                    <CountUp delay={0.16} value="$2.04" />
-                  </div>
-                  <div className="w-21 shrink-0 text-right font-sans font-medium flex justify-end flex-wrap [color:var(--color-pistachio-600)] text-sm/4.5">
-                    <CountUp delay={0.16} value="+25.9%" />
-                  </div>
-                </div>
-              </div>
-              <div className="flex items-center justify-between py-6.5 px-6 rounded-lg overflow-clip gap-12 w-236 [background-color:var(--color-zinc-950)]">
-                <div className="w-179 flex flex-col gap-2.25 shrink-0">
-                  <div className="self-stretch h-6.5 flex rounded-lg shrink-0 [background-color:var(--color-zinc-800)]">
-                    <GrowBar className="w-55.75 rounded-lg shrink-0 [box-shadow:var(--color-blue-ribbon-300)_0px_0px_6px_inset] [background-color:var(--color-blue-ribbon-600)]" delay={0.24} />
-                  </div>
-                  <div className="self-stretch flex items-center justify-between">
-                    <div className="font-sans text-zinc-400 text-xs/4">
-                      Rollout <CountUp delay={0.24} value="34%" />
-                    </div>
-                    <div className="font-sans text-zinc-400 text-xs/4">
-                      Target 100%
-                    </div>
-                  </div>
-                </div>
-                <Button className="relative shrink-0">Ship Variant C</Button>
-              </div>
-              <div className="absolute top-0 -bottom-2.25 inset-x-0 pointer-events-none" style={{ backgroundImage: 'radial-gradient(ellipse 114.14500000000001% 169.79% at 37.84% 1.6199999999999992% in oklab, oklab(17.1% 0 0 / 0%) 17.64%, oklab(14.1% 0.001 -0.004) 100%)' }} />
-            </Illustration>
-          </ScaledMock>
-          <div className="w-full max-w-107.25 flex flex-col items-start rounded-lg overflow-clip shrink-0 bg-origin-border border border-solid [border-color:var(--color-zinc-800)]" style={{ backgroundImage: 'radial-gradient(ellipse 100.22999999999999% 100% at 0% 0% in oklab, var(--color-zinc-900) 0%, var(--color-zinc-950) 100%)' }}>
-              <div className="self-stretch flex items-center justify-between py-5 px-6 border-b border-b-solid [border-bottom-color:var(--color-zinc-800)]">
-                <div className="tracking-[-0.02em] font-sans font-medium text-white text-[15px]/4.5">
-                  Feature flags
-                </div>
-                <div className="font-sans text-zinc-400 text-xs/4">
-                  Production
-                </div>
-              </div>
-              {FEATURE_FLAGS.map((flag, index) => (
-                <FlagRow
-                  flag={flag}
-                  key={flag.name}
-                  withBorder={index < FEATURE_FLAGS.length - 1}
-                />
-              ))}
-            </div>
-        </div>
-      </div>
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/footer.tsx b/apps/www/src/features/www/landing/sections/footer.tsx
deleted file mode 100644
index 9842d065f..000000000
--- a/apps/www/src/features/www/landing/sections/footer.tsx
+++ /dev/null
@@ -1,134 +0,0 @@
-import { Logo } from "@voidhash/ui";
-
-import { MARKETING_COMPANY_LINKS } from "@/features/www/landing/marketing-nav-config";
-
-const GITHUB_REPO = "https://github.com/voidhashcom/voidhash";
-
-const LINK_COLUMNS: {
-  title: string;
-  links: { label: string; href?: string }[];
-}[] = [
-  {
-    title: "PRODUCT",
-    links: [
-      { label: "Paywalls", href: "/#paywalls" },
-      { label: "Analytics", href: "/#analytics" },
-      { label: "Experiments", href: "/#experimentation" },
-      { label: "Feature flags", href: "/#experimentation" },
-      { label: "CRM", href: "/#crm" },
-    ],
-  },
-  {
-    title: "DEVELOPERS",
-    links: [
-      { label: "Documentation", href: "/docs" },
-      { label: "React Native SDK", href: "/docs/react-native" },
-      { label: "MCP server", href: "/docs/mcp" },
-      { label: "CLI", href: "/docs/cli" },
-      { label: "API reference", href: "/docs/api" },
-    ],
-  },
-  {
-    title: "OPEN SOURCE",
-    links: [
-      { label: "GitHub", href: GITHUB_REPO },
-      { label: "Self-hosting", href: GITHUB_REPO },
-      { label: "Licensing", href: `${GITHUB_REPO}/blob/main/LICENSE.md` },
-      { label: "Contributing", href: `${GITHUB_REPO}/blob/main/CONTRIBUTING.md` },
-      { label: "Changelog", href: `${GITHUB_REPO}/releases` },
-    ],
-  },
-  {
-    title: "COMPANY",
-    links: [
-      ...MARKETING_COMPANY_LINKS.map((link) => ({ label: link.label, href: link.href })),
-      { label: "Blog" },
-      { label: "Security" },
-      { label: "Privacy" },
-      { label: "Contact" },
-    ],
-  },
-];
-
-const BOTTOM_LINKS: { label: string; href?: string }[] = [
-  { label: "Status" },
-  { label: "Terms" },
-  { label: "X", href: "https://x.com/voidhashcom" },
-  { label: "Discord", href: "https://discord.gg/voidhash" },
-  { label: "GitHub", href: GITHUB_REPO },
-];
-
-function FooterLink({
-  label,
-  href,
-  className,
-}: {
-  label: string;
-  href?: string;
-  className: string;
-}) {
-  if (!href) {
-    return <div className={className}>{label}</div>;
-  }
-  const external = href.startsWith("http");
-  return (
-    <a
-      className={`${className} transition-colors hover:text-white`}
-      href={href}
-      rel={external ? "noreferrer" : undefined}
-      target={external ? "_blank" : undefined}
-    >
-      {label}
-    </a>
-  );
-}
-
-/** Renders the landing page footer. */
-export function LandingFooter() {
-  return (
-    <footer className="flex min-w-0 flex-col items-center self-stretch">
-      <div className="flex w-full max-w-[1656px] flex-col gap-14 px-6 pt-16 pb-16 md:px-12 md:pt-24 lg:flex-row lg:items-start lg:justify-between lg:gap-20 xl:px-32">
-        <div className="flex w-full max-w-85 shrink-0 flex-col gap-5.5">
-          <a aria-label="Voidhash home" href="/">
-            <Logo className="h-[17px] w-auto text-white" />
-          </a>
-          <div className="font-sans text-zinc-400 text-sm/normal tracking-[-0.01em]">
-            The open-source growth platform for mobile apps.
-          </div>
-        </div>
-        <div className="grid grow grid-cols-2 gap-x-8 gap-y-12 sm:grid-cols-4 lg:flex lg:items-start lg:justify-end lg:gap-20">
-          {LINK_COLUMNS.map((column) => (
-            <div className="flex flex-col gap-3.5 lg:w-42.5 lg:shrink-0" key={column.title}>
-              <div className="font-mono text-zinc-500 text-[11px]/3.5 tracking-[0.06em]">
-                {column.title}
-              </div>
-              {column.links.map((link) => (
-                <FooterLink
-                  className="w-max font-sans text-zinc-200 text-sm/4.5 tracking-[-0.01em]"
-                  href={link.href}
-                  key={link.label}
-                  label={link.label}
-                />
-              ))}
-            </div>
-          ))}
-        </div>
-      </div>
-      <div className="flex w-full max-w-[1656px] flex-col gap-4 px-6 pt-6.5 pb-10 sm:flex-row sm:items-center sm:justify-between sm:gap-10 md:px-12 xl:px-32">
-        <div className="font-sans text-zinc-500 text-[13px]/4 tracking-[-0.01em]">
-          © 2026 Voidhash s.r.o.
-        </div>
-        <div className="flex flex-wrap items-center gap-7">
-          {BOTTOM_LINKS.map((link) => (
-            <FooterLink
-              className="font-sans text-zinc-500 text-[13px]/4 tracking-[-0.01em]"
-              href={link.href}
-              key={link.label}
-              label={link.label}
-            />
-          ))}
-        </div>
-      </div>
-    </footer>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/get-started.tsx b/apps/www/src/features/www/landing/sections/get-started.tsx
deleted file mode 100644
index 94a3fadd4..000000000
--- a/apps/www/src/features/www/landing/sections/get-started.tsx
+++ /dev/null
@@ -1,117 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { ArrowUpRightIcon, ChevronRightIcon } from "lucide-react";
-import type { ReactNode } from "react";
-
-import { HeroShader } from "@/features/www/hero/hero-shader";
-import { signUpCtaLabel } from "@/lib/waitlist";
-
-import { LandingSection } from "../shared";
-
-const COMMUNITY_CARDS: {
-  title: string;
-  description: string;
-  action: string;
-  href: string;
-  icon: ReactNode;
-}[] = [
-  {
-    title: "GitHub",
-    description: "The full platform, SDKs and paywall examples in one repo.",
-    action: "Star the repo",
-    href: "https://github.com/voidhashcom/voidhash",
-    icon: (
-      <svg aria-hidden="true" width="26" height="26" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-        <path d="M12 2C6.48 2 2 6.58 2 12.24c0 4.53 2.87 8.37 6.84 9.72.5.1.68-.22.68-.49v-1.7c-2.78.62-3.37-1.37-3.37-1.37-.46-1.18-1.11-1.5-1.11-1.5-.91-.64.07-.63.07-.63 1 .07 1.53 1.06 1.53 1.06.89 1.57 2.34 1.12 2.91.85.09-.66.35-1.11.63-1.37-2.22-.26-4.56-1.14-4.56-5.05 0-1.12.39-2.03 1.03-2.75-.1-.26-.45-1.3.1-2.71 0 0 .84-.28 2.75 1.05a9.3 9.3 0 0 1 5 0c1.91-1.33 2.75-1.05 2.75-1.05.55 1.41.2 2.45.1 2.71.64.72 1.03 1.63 1.03 2.75 0 3.92-2.34 4.79-4.57 5.04.36.32.68.94.68 1.9v2.82c0 .27.18.6.69.49A10.06 10.06 0 0 0 22 12.24C22 6.58 17.52 2 12 2Z" fill="var(--zinc-400)" />
-      </svg>
-    ),
-  },
-  {
-    title: "Discord",
-    description: "Ask questions, share paywalls and get support straight from the team.",
-    action: "Join the server",
-    href: "https://discord.gg/voidhash",
-    icon: (
-      <svg aria-hidden="true" width="26" height="26" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-        <path d="M20.317 4.37a19.79 19.79 0 0 0-4.885-1.515.074.074 0 0 0-.79.037c-.21.375-.444.865-.608 1.25a18.27 18.27 0 0 0-5.487 0 12.64 12.64 0 0 0-.617-1.25.077.077 0 0 0-.079-.037A19.74 19.74 0 0 0 3.677 4.37a.07.07 0 0 0-.32.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .31.057 19.9 19.9 0 0 0 5.993 3.03.078.078 0 0 0 .084-.028c.462-.63.874-1.295 1.226-1.994a.076.076 0 0 0-.041-.106 13.1 13.1 0 0 1-1.872-.892.077.077 0 0 1-.008-.128c.126-.94.252-.192.372-.291a.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .78.009c.12.099.246.198.373.292a.077.077 0 0 1-.6.127 12.3 12.3 0 0 1-1.873.891.077.077 0 0 0-.41.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .84.028 19.84 19.84 0 0 0 6.002-3.03.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.028ZM8.02 15.331c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.096 2.157 2.42 0 1.333-.956 2.418-2.157 2.418Zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419 0-1.333.955-2.419 2.157-2.419 1.21 0 2.176 1.096 2.157 2.42 0 1.333-.946 2.418-2.157 2.418Z" fill="var(--zinc-400)" />
-      </svg>
-    ),
-  },
-  {
-    title: "Docs",
-    description: "Guides, API reference and a hello-world integration for every SDK.",
-    action: "Browse docs",
-    href: "/docs",
-    icon: (
-      <svg aria-hidden="true" width="26" height="26" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg" style={{ flexShrink: '0' }}>
-        <path d="M4 4.5A1.5 1.5 0 0 1 5.5 3H10a2 2 0 0 1 2 2v15a2 2 0 0 0-2-2H5.5A1.5 1.5 0 0 1 4 16.5v-12Z" fill="none" stroke="var(--zinc-400)" strokeWidth="1.6" strokeLinejoin="round" />
-        <path d="M20 4.5A1.5 1.5 0 0 0 18.5 3H14a2 2 0 0 0-2 2v15a2 2 0 0 1 2-2h4.5a1.5 1.5 0 0 0 1.5-1.5v-12Z" fill="none" stroke="var(--zinc-400)" strokeWidth="1.6" strokeLinejoin="round" />
-      </svg>
-    ),
-  },
-];
-
-/** Renders the closing call to action, backed by the lenticular gradient shader. */
-export function LandingGetStarted() {
-  return (
-    <LandingSection>
-      <div className="relative flex flex-col items-center justify-center overflow-clip px-6 py-24 md:py-36 xl:py-44">
-        <div className="absolute inset-0">
-          <HeroShader />
-        </div>
-        <div className="relative flex flex-col items-center gap-8 md:gap-11">
-          <div className="flex flex-col items-center gap-6">
-            <h2 className="text-balance text-center font-medium font-sans text-[36px] text-white leading-[110%] tracking-[-0.03em] md:text-[48px] xl:text-[56px]">
-              Start selling in an afternoon
-            </h2>
-            <p className="max-w-[500px] text-center font-sans text-zinc-400 text-base/6.5 tracking-[-0.03em] md:text-xl/8">
-              Connect your app, publish your first paywall and start turning your product into a
-              business.
-            </p>
-          </div>
-          <div className="flex flex-col items-center gap-3 pt-1 sm:flex-row">
-            <Button asChild size="lg">
-              <a href="/auth/sign-up">
-                {signUpCtaLabel("Get started for free")}
-                <ChevronRightIcon data-icon="inline-end" />
-              </a>
-            </Button>
-            <Button asChild size="lg" variant="ghost">
-              <a href="/docs">
-                View docs
-                <ChevronRightIcon data-icon="inline-end" />
-              </a>
-            </Button>
-          </div>
-        </div>
-      </div>
-      <div className="grid grid-cols-1 divide-y divide-zinc-800 border-zinc-800 border-t md:grid-cols-3 md:divide-x md:divide-y-0">
-        {COMMUNITY_CARDS.map((card) => (
-          <div
-            className="flex flex-col items-center gap-5 px-8 py-12 md:px-14 md:py-18"
-            key={card.title}
-          >
-            {card.icon}
-            <div className="flex flex-col items-center gap-2.5">
-              <div className="font-medium font-sans text-zinc-50 text-xl leading-[120%] tracking-[-0.02em]">
-                {card.title}
-              </div>
-              <p className="max-w-[340px] text-center font-sans text-zinc-400 text-base/6.5 tracking-[-0.01em]">
-                {card.description}
-              </p>
-            </div>
-            <Button asChild variant="outline">
-              <a
-                href={card.href}
-                rel={card.href.startsWith("http") ? "noreferrer" : undefined}
-                target={card.href.startsWith("http") ? "_blank" : undefined}
-              >
-                {card.action}
-                <ArrowUpRightIcon data-icon="inline-end" />
-              </a>
-            </Button>
-          </div>
-        ))}
-      </div>
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/hero.tsx b/apps/www/src/features/www/landing/sections/hero.tsx
deleted file mode 100644
index d98712fa0..000000000
--- a/apps/www/src/features/www/landing/sections/hero.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import { Button } from "@voidhash/ui";
-import { ChevronRightIcon } from "lucide-react";
-
-import { HeroShader } from "@/features/www/hero/hero-shader";
-import { signUpCtaLabel } from "@/lib/waitlist";
-
-import { LandingSection } from "../shared";
-
-/** Renders the landing page hero, backed by the lenticular gradient shader. */
-export function LandingHero() {
-  return (
-    <LandingSection>
-      <div className="relative flex flex-col items-center overflow-clip px-6 py-24 md:py-40 xl:py-56">
-        <div className="absolute inset-0">
-          <HeroShader />
-        </div>
-        <div className="relative flex w-full max-w-[826px] flex-col items-center gap-8 md:gap-11.5">
-          <div className="flex items-center justify-center rounded-[23px] bg-zinc-900 px-4 py-1.75 [outline:1px_solid_var(--zinc-800)] -outline-offset-1">
-            <div className="font-sans font-semibold text-zinc-400 text-sm/normal tracking-[-0.03em]">
-              Currently available in Alpha preview
-            </div>
-          </div>
-          <div className="flex flex-col items-center gap-10 md:gap-12">
-            <div className="flex flex-col items-center gap-6">
-              <h1 className="text-balance text-center font-medium font-sans text-[40px] text-white leading-[110%] tracking-[-0.03em] md:text-[56px] xl:text-[64px]">
-                The AI-native growth platform for mobile apps
-              </h1>
-              <p className="max-w-[628px] text-center font-sans text-zinc-400 text-base/6.5 tracking-[-0.03em] md:text-xl/8">
-                Build paywalls, manage customers, analyze data, A/B test and much more – all in a
-                single integrated platform.
-              </p>
-            </div>
-            <div className="flex flex-col items-center gap-3 sm:flex-row">
-              <Button asChild size="lg">
-                <a href="/auth/sign-up">
-                  {signUpCtaLabel("Get Started")}
-                  <ChevronRightIcon data-icon="inline-end" />
-                </a>
-              </Button>
-              <Button asChild size="lg" variant="ghost">
-                <a href="/docs">
-                  Documentation
-                  <ChevronRightIcon data-icon="inline-end" />
-                </a>
-              </Button>
-            </div>
-          </div>
-        </div>
-      </div>
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/navbar.tsx b/apps/www/src/features/www/landing/sections/navbar.tsx
deleted file mode 100644
index cdf1a92cf..000000000
--- a/apps/www/src/features/www/landing/sections/navbar.tsx
+++ /dev/null
@@ -1,216 +0,0 @@
-"use client";
-
-import {
-  Button,
-  Logo,
-  NavigationMenu,
-  NavigationMenuContent,
-  NavigationMenuItem,
-  NavigationMenuLink,
-  NavigationMenuList,
-  NavigationMenuTrigger,
-  Sheet,
-  SheetClose,
-  SheetContent,
-  SheetTitle,
-  SheetTrigger,
-  navigationMenuTriggerStyle,
-} from "@voidhash/ui";
-import {
-  BookOpenIcon,
-  BracesIcon,
-  ChartColumnIcon,
-  FlaskConicalIcon,
-  LayoutTemplateIcon,
-  type LucideIcon,
-  MenuIcon,
-  UsersIcon,
-} from "lucide-react";
-
-import { MARKETING_COMPANY_LINKS } from "@/features/www/landing/marketing-nav-config";
-import { signUpCtaLabel } from "@/lib/waitlist";
-
-type NavLink = {
-  label: string;
-  href: string;
-  description?: string;
-  icon: LucideIcon;
-};
-
-/**
- * Product links point at landing page sections, so they stay root-relative: from a standalone
- * marketing page a bare `#paywalls` fragment resolves against a page that has no such section
- * and goes nowhere.
- */
-const PRODUCT_LINKS: NavLink[] = [
-  {
-    label: "Paywalls",
-    href: "/#paywalls",
-    description: "No-code designer with AI, shipped without a release.",
-    icon: LayoutTemplateIcon,
-  },
-  {
-    label: "Analytics",
-    href: "/#analytics",
-    description: "See what drives conversion and revenue.",
-    icon: ChartColumnIcon,
-  },
-  {
-    label: "Experimentation",
-    href: "/#experimentation",
-    description: "Try ideas, compare results and launch what works.",
-    icon: FlaskConicalIcon,
-  },
-  {
-    label: "CRM",
-    href: "/#crm",
-    description: "See the full journey behind every customer.",
-    icon: UsersIcon,
-  },
-];
-
-const DEVELOPER_LINKS: NavLink[] = [
-  { label: "Documentation", href: "/docs", icon: BookOpenIcon },
-  { label: "API reference", href: "/docs/api", icon: BracesIcon },
-];
-
-/** Shared look for the top-level triggers and links. */
-const NAV_ITEM_CLASS =
-  "h-auto rounded-lg px-3 py-2 font-normal font-sans text-zinc-400 text-sm/4.5 tracking-[-0.03em] transition-colors hover:bg-white/5 hover:text-white focus:bg-white/5 focus:text-white data-pressed:bg-white/10 data-popup-open:bg-white/5 data-popup-open:text-white data-popup-open:hover:bg-white/5";
-
-/** Shared look for the links inside a menu panel. */
-const PANEL_ITEM_CLASS =
-  "items-start gap-3 p-3 transition-colors hover:bg-zinc-900 focus:bg-zinc-900";
-
-function ProductItem({ link }: { link: NavLink }) {
-  const Icon = link.icon;
-  return (
-    <li>
-      <NavigationMenuLink className={PANEL_ITEM_CLASS} render={<a href={link.href} />}>
-        <Icon className="mt-0.5 size-4 shrink-0 text-zinc-500" />
-        <div className="flex flex-col gap-1">
-          <div className="font-medium font-sans text-white text-sm/4.5 tracking-[-0.02em]">
-            {link.label}
-          </div>
-          <div className="font-sans text-zinc-400 text-xs/4 tracking-[-0.01em]">
-            {link.description}
-          </div>
-        </div>
-      </NavigationMenuLink>
-    </li>
-  );
-}
-
-function DeveloperItem({ link }: { link: NavLink }) {
-  const Icon = link.icon;
-  return (
-    <li>
-      <NavigationMenuLink
-        className={`${PANEL_ITEM_CLASS} items-center gap-2.5 p-2.5`}
-        render={<a href={link.href} />}
-      >
-        <Icon className="size-4 shrink-0 text-zinc-500" />
-        <div className="font-sans text-zinc-200 text-sm/4.5 tracking-[-0.02em]">{link.label}</div>
-      </NavigationMenuLink>
-    </li>
-  );
-}
-
-/** Renders the landing page navigation bar. */
-export function LandingNavbar() {
-  return (
-    <div className="sticky top-0 z-50 flex min-w-0 flex-col items-center self-stretch border-zinc-800 border-b bg-zinc-950/85 backdrop-blur-md">
-      <div className="flex w-full max-w-[1656px] items-center justify-between gap-4 border-zinc-800 p-4 md:p-6 xl:border-x">
-        <a aria-label="Voidhash home" href="/">
-          <Logo className="h-[17px] w-auto text-white" />
-        </a>
-        <NavigationMenu className="hidden lg:flex" popupClassName="dark">
-          <NavigationMenuList className="-mx-3 gap-1">
-            <NavigationMenuItem>
-              <NavigationMenuTrigger className={NAV_ITEM_CLASS}>Product</NavigationMenuTrigger>
-              <NavigationMenuContent>
-                <ul className="grid w-[540px] grid-cols-2 gap-1">
-                  {PRODUCT_LINKS.map((link) => (
-                    <ProductItem key={link.href} link={link} />
-                  ))}
-                </ul>
-              </NavigationMenuContent>
-            </NavigationMenuItem>
-            <NavigationMenuItem>
-              <NavigationMenuTrigger className={NAV_ITEM_CLASS}>Developers</NavigationMenuTrigger>
-              <NavigationMenuContent>
-                <ul className="grid w-[240px] gap-1">
-                  {DEVELOPER_LINKS.map((link) => (
-                    <DeveloperItem key={link.href} link={link} />
-                  ))}
-                </ul>
-              </NavigationMenuContent>
-            </NavigationMenuItem>
-            {MARKETING_COMPANY_LINKS.map((link) => (
-              <NavigationMenuItem key={link.href}>
-                <NavigationMenuLink
-                  className={`${navigationMenuTriggerStyle()} ${NAV_ITEM_CLASS}`}
-                  render={<a href={link.href} />}
-                >
-                  {link.label}
-                </NavigationMenuLink>
-              </NavigationMenuItem>
-            ))}
-          </NavigationMenuList>
-        </NavigationMenu>
-        <div className="hidden items-center gap-4 lg:flex">
-          <Button asChild variant="outline">
-            <a href="/auth/login">Log in</a>
-          </Button>
-          <Button asChild>
-            <a href="/auth/sign-up">{signUpCtaLabel("Sign up")}</a>
-          </Button>
-        </div>
-        <Sheet>
-          <SheetTrigger asChild className="lg:hidden">
-            <Button aria-label="Open menu" size="icon" variant="ghost">
-              <MenuIcon />
-            </Button>
-          </SheetTrigger>
-          <SheetContent className="dark flex flex-col border-zinc-800 bg-zinc-950" side="right">
-            <SheetTitle className="sr-only">Menu</SheetTitle>
-            <nav className="flex flex-1 flex-col gap-8 overflow-y-auto px-6 pt-12">
-              {[
-                { title: "Product", links: PRODUCT_LINKS },
-                { title: "Developers", links: DEVELOPER_LINKS },
-                { title: "Company", links: MARKETING_COMPANY_LINKS },
-              ]
-                .filter((group) => group.links.length > 0)
-                .map((group) => (
-                  <div className="flex flex-col gap-4" key={group.title}>
-                    <div className="font-sans text-zinc-500 text-xs/4 tracking-[-0.01em]">
-                      {group.title}
-                    </div>
-                    {group.links.map((link) => (
-                      <SheetClose asChild key={link.href}>
-                        <a
-                          className="flex items-center gap-3 font-sans text-zinc-200 text-base tracking-[-0.02em] transition-colors hover:text-white"
-                          href={link.href}
-                        >
-                          <link.icon className="size-4 shrink-0 text-zinc-500" />
-                          {link.label}
-                        </a>
-                      </SheetClose>
-                    ))}
-                  </div>
-                ))}
-            </nav>
-            <div className="mt-auto flex flex-col gap-3 px-6 pb-8">
-              <Button asChild size="lg" variant="outline">
-                <a href="/auth/login">Log in</a>
-              </Button>
-              <Button asChild size="lg">
-                <a href="/auth/sign-up">{signUpCtaLabel("Sign up")}</a>
-              </Button>
-            </div>
-          </SheetContent>
-        </Sheet>
-      </div>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/paywalls.tsx b/apps/www/src/features/www/landing/sections/paywalls.tsx
deleted file mode 100644
index 70100be80..000000000
--- a/apps/www/src/features/www/landing/sections/paywalls.tsx
+++ /dev/null
@@ -1,576 +0,0 @@
-import {
-  PaywallBuildCanvas,
-  PaywallBuildProvider,
-  PaywallBuildTerminal,
-} from "../paywall-build/paywall-build";
-import { LandingSection, ScaledMock, SectionHeader } from "../shared";
-import { LandingAgentCompatibility } from "./agent-compatibility";
-
-/** Renders the paywalls product section. */
-export function LandingPaywalls() {
-  return (
-    <LandingSection id="paywalls">
-      <div className="flex flex-col items-start justify-center gap-12 px-6 pt-16 pb-10 md:gap-23 md:px-12 md:pt-24 md:pb-14 xl:px-32 xl:pt-32 xl:pb-16">
-        <SectionHeader
-          description="Maximize your revenue by quickly testing your paywall designs and pricing with a familiar no-code paywall builder."
-          eyebrow="Paywalls"
-          title="Ship paywalls in minutes with our no-code designer and full AI integration."
-        />
-        <PaywallBuildProvider className="flex flex-col gap-6 self-stretch">
-        <PaywallBuildTerminal />
-        <ScaledMock compactDesignWidth={520} designWidth={1368}>
-          <div className="h-211 xl:h-195.5 w-130 xl:w-342 relative shrink-0">
-          <div className="flex absolute w-130 xl:w-342 left-0 top-0 flex-col items-start rounded-lg overflow-clip [background-color:var(--color-zinc-950)] border border-solid [border-color:var(--zinc-800)]">
-            <div className="flex items-start gap-6.5 self-stretch p-3 border-b border-b-solid border-b-zinc-800/50">
-              <div className="flex w-3.25 items-start gap-2.5 shrink-0">
-                <div className="h-3.25 rounded-full self-stretch w-3.25 shrink-0 bg-zinc-700" />
-                <div className="h-3.25 rounded-full self-stretch w-3.25 shrink-0 bg-zinc-700" />
-                <div className="h-3.25 rounded-full self-stretch w-3.25 shrink-0 bg-zinc-700" />
-              </div>
-            </div>
-            <div className="h-201.5 xl:h-186 w-130 xl:w-342 relative shrink-0 border border-solid border-zinc-800/50">
-              <div className="w-130 xl:w-342 h-201.5 xl:h-186 top-[50%] left-[50%] absolute bg-zinc-900" style={{ translate: '-50% -50%' }} />
-              <div className="items-center h-13.5 flex top-0 justify-between absolute px-3 bg-zinc-900 border-b border-b-solid border-b-zinc-800 -inset-x-px">
-                <div className="items-center flex justify-center absolute gap-2 inset-0">
-                  <div className="text-sm leading-[142.857%] font-sans text-zinc-50">
-                    Example
-                  </div>
-                </div>
-                <div className="items-center flex gap-2 relative">
-                  <div className="items-center flex py-3 px-2 rounded-lg">
-                    <svg aria-hidden="true" viewBox="0 0 120 61" xmlns="http://www.w3.org/2000/svg" fontSize="16px" width="120" height="61" style={{ height: '16px', width: '31.4688px', overflow: 'clip', flexShrink: '0' }}>
-                      <path d="M60 30.5L90 0L120 0L120 30.5L90 30.5V61H60L60 30.5ZM0 30.5L30 30.5L30 0L60 0V30.5L30 61H0V30.5Z" fontSize="16px" fill="#FFFFFF" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                    </svg>
-                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '16px', width: '16px', marginLeft: '8px', overflow: 'clip', flexShrink: '0' }}>
-                      <path d="m6 9 6 6 6-6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                    </svg>
-                  </div>
-                  <div className="items-center hidden xl:flex w-fit rounded-lg relative [box-shadow:#0000000D_0px_1px_2px] bg-[#27272A4D] border border-solid border-zinc-800">
-                    <div className="h-full w-[91.5px] top-0 left-0 absolute rounded-[9px] bg-zinc-800" />
-                    <div className="items-center h-7 flex shrink-0 justify-center min-w-0 px-3 rounded-[9px] gap-1.5 relative">
-                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '16px', flexShrink: '0', width: '16px', overflow: 'clip' }}>
-                        <path d="m14.622 17.897-10.68-2.913" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="M18.376 2.622a1 1 0 1 1 3.002 3.002L17.36 9.643a.5.5 0 0 0 0 .707l.944.944a2.41 2.41 0 0 1 0 3.408l-.944.944a.5.5 0 0 1-.707 0L8.354 7.348a.5.5 0 0 1 0-.707l.944-.944a2.41 2.41 0 0 1 3.408 0l.944.944a.5.5 0 0 0 .707 0z" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="M9 8c-1.804 2.71-3.97 3.46-6.583 3.948a.507.507 0 0 0-.302.819l7.32 8.883a1 1 0 0 0 1.185.204C12.735 20.405 16 16.792 16 15" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                      </svg>
-                      <div className="inline-block text-sm leading-[142.857%] text-center w-max shrink-0 font-sans font-medium text-zinc-50">
-                        Design
-                      </div>
-                    </div>
-                    <div className="items-center h-7 flex shrink-0 justify-center min-w-0 px-3 rounded-[9px] gap-1.5 relative">
-                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '16px', flexShrink: '0', width: '16px', overflow: 'clip' }}>
-                        <path d="M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <circle cx="12" cy="12" r="3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                      </svg>
-                      <div className="inline-block text-sm leading-[142.857%] text-center w-max shrink-0 font-sans font-medium text-zinc-400">
-                        Preview
-                      </div>
-                    </div>
-                    <div className="items-center h-7 flex shrink-0 justify-center min-w-0 px-3 rounded-[9px] gap-1.5 relative">
-                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '16px', flexShrink: '0', width: '16px', overflow: 'clip' }}>
-                        <path d="m18 16 4-4-4-4" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="m6 8-4 4 4 4" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="m14.5 4-5 16" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                      </svg>
-                      <div className="inline-block text-sm leading-[142.857%] text-center w-max shrink-0 font-sans font-medium text-zinc-400">
-                        Code
-                      </div>
-                    </div>
-                    <div className="items-center h-7 flex shrink-0 justify-center min-w-0 px-3 rounded-[9px] gap-1.5 relative">
-                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '16px', flexShrink: '0', width: '16px', overflow: 'clip' }}>
-                        <path d="m5 8 6 6" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="m4 14 6-6 2-3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="M2 5h12" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="M7 2h1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="m22 22-5-10-5 10" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                        <path d="M14 18h6" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                      </svg>
-                      <div className="inline-block text-sm leading-[142.857%] text-center w-max shrink-0 font-sans font-medium text-zinc-400">
-                        Translate
-                      </div>
-                    </div>
-                  </div>
-                </div>
-                <div className="items-center flex gap-2 relative">
-                  <div className="items-center h-7 flex shrink-0 justify-center px-2.5 rounded-md gap-1 bg-zinc-800 border border-solid border-[#00000000]">
-                    <div className="flex text-[12.8px] leading-[150%] text-center w-max shrink-0 font-sans font-medium text-zinc-50">
-                      Share
-                    </div>
-                  </div>
-                  <div className="items-center h-7 flex shrink-0 justify-center px-2.5 rounded-md gap-1 bg-blue-ribbon-600 border border-solid border-[#00000000]">
-                    <div className="flex text-[12.8px] leading-[150%] text-center w-max shrink-0 font-sans font-medium text-white">
-                      Publish
-                    </div>
-                  </div>
-                </div>
-              </div>
-              <div className="-bottom-0.5 hidden xl:flex flex-col w-69 top-13.5 -right-px absolute bg-zinc-900 border-l border-l-solid border-l-zinc-800">
-                <div className="flex basis-[0%] flex-col grow overflow-clip relative">
-                  <div className="absolute inset-0">
-                    <div className="h-full">
-                      <div className="overflow-clip size-full">
-                        <div className="table min-w-full">
-                          <div className="">
-                            <div className="border-b border-b-solid border-b-zinc-800">
-                              <div className="items-center h-7 flex justify-between px-4 my-2">
-                                <div className="text-sm leading-[142.857%] font-sans font-medium text-zinc-50">
-                                  Variables
-                                </div>
-                                <div className="items-center flex justify-end gap-2">
-                                  <div className="items-center flex shrink-0 justify-center rounded-md border border-solid border-[#00000000] size-7">
-                                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', flexShrink: '0', width: '14px', opacity: '0.7', overflow: 'clip' }}>
-                                      <path d="m6 9 6 6 6-6" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                    </svg>
-                                  </div>
-                                </div>
-                              </div>
-                            </div>
-                            <div className="border-b border-b-solid border-b-zinc-800">
-                              <div className="items-center h-7 flex justify-between px-4 my-2">
-                                <div className="text-sm leading-[142.857%] font-sans font-medium text-zinc-50">
-                                  States
-                                </div>
-                                <div className="items-center flex justify-end gap-2">
-                                  <div className="items-center flex shrink-0 justify-center rounded-md bg-zinc-800 border border-solid border-[#00000000] size-7">
-                                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', flexShrink: '0', width: '14px', opacity: '0.7', overflow: 'clip' }}>
-                                      <path d="M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      <circle cx="12" cy="12" r="3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                    </svg>
-                                  </div>
-                                </div>
-                              </div>
-                            </div>
-                            <div className="border-b border-b-solid border-b-zinc-800">
-                              <div className="items-center h-7 flex justify-between px-4 my-2">
-                                <div className="text-sm leading-[142.857%] font-sans font-medium text-zinc-50">
-                                  Layout
-                                </div>
-                              </div>
-                              <div className="pb-4 px-4">
-                                <div className="mb-4">
-                                  <div className="pt-2">
-                                    <div className="flex gap-2">
-                                      <div className="flex flex-col gap-2">
-                                        <div className="">
-                                          <div className="items-center flex w-fit rounded-lg relative [box-shadow:#0000000D_0px_1px_2px] bg-[#27272A4D] border border-solid border-zinc-800">
-                                            <div className="h-full w-9.5 top-0 left-0 absolute rounded-[9px] bg-zinc-800" />
-                                            <div className="items-center h-7 flex basis-[0%] grow justify-center min-w-0 px-3 rounded-[9px] gap-2 relative">
-                                              <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', flexShrink: '0', width: '14px', overflow: 'clip' }}>
-                                                <path d="M12 5v14" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                <path d="m19 12-7 7-7-7" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                              </svg>
-                                            </div>
-                                            <div className="items-center h-7 flex basis-[0%] grow justify-center min-w-0 px-3 rounded-[9px] gap-2 relative">
-                                              <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', flexShrink: '0', width: '14px', overflow: 'clip' }}>
-                                                <path d="M5 12h14" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                <path d="m12 5 7 7-7 7" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                              </svg>
-                                            </div>
-                                          </div>
-                                        </div>
-                                        <div className="">
-                                          <div className="items-center h-7 flex w-full rounded-sm bg-[#27272A99]">
-                                            <div className="h-7 flex basis-[0%] grow w-full min-w-0 items-center pr-1 pl-1.5 overflow-clip [box-shadow:#FAFAFA_0px_0px_0px]">
-                                              <div className="h-fit w-full overflow-clip">
-                                                <div className="text-sm leading-[142.857%] font-sans text-zinc-50 line-clamp-1">
-                                                  0
-                                                </div>
-                                              </div>
-                                            </div>
-                                            <div className="items-center flex justify-center order-first pr-0.5 pl-2 gap-2 py-1">
-                                              <div className="items-center flex justify-center shrink-0 size-3.5">
-                                                <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                                  <rect width="13" height="7" x="8" y="3" rx="1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '7px', boxSizing: 'border-box', width: '13px', transformOrigin: '0px 0px' }} />
-                                                  <path d="m2 9 3 3-3 3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                  <rect width="13" height="7" x="8" y="14" rx="1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '7px', boxSizing: 'border-box', width: '13px', transformOrigin: '0px 0px' }} />
-                                                </svg>
-                                              </div>
-                                            </div>
-                                          </div>
-                                        </div>
-                                      </div>
-                                      <div className="">
-                                        <div className="flex rounded-sm bg-[#27272A99]">
-                                          <div className="flex basis-[0%] flex-col grow">
-                                            <div className="items-center flex basis-[0%] grow w-21 justify-center py-1 bg-[#27272ACC]">
-                                              <div className="flex basis-[0%] flex-col grow justify-around">
-                                                <div className="h-0.5 w-2 rounded-md shrink-0 bg-white" />
-                                                <div className="h-0.5 w-2 rounded-md shrink-0 bg-white" />
-                                                <div className="h-0.5 w-2 rounded-md shrink-0 bg-white" />
-                                              </div>
-                                            </div>
-                                            <div className="items-center flex basis-[0%] grow w-21 justify-center py-1 relative">
-                                              <div className="top-[50%] left-[50%] absolute" style={{ translate: '-50% -50%' }}>
-                                                <div className="-bottom-0.5 top-0 -right-0.5 left-0 rounded-full absolute bg-zinc-400 size-0.5" style={{ translate: '-50% -50%' }} />
-                                              </div>
-                                            </div>
-                                            <div className="items-center flex basis-[0%] grow w-21 justify-center py-1 relative">
-                                              <div className="top-[50%] left-[50%] absolute" style={{ translate: '-50% -50%' }}>
-                                                <div className="-bottom-0.5 top-0 -right-0.5 left-0 rounded-full absolute bg-zinc-400 size-0.5" style={{ translate: '-50% -50%' }} />
-                                              </div>
-                                            </div>
-                                          </div>
-                                        </div>
-                                        <div className="items-center inline-flex justify-center rounded-md bg-zinc-800 border border-solid border-[#00000000] size-7">
-                                          <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', flexShrink: '0', width: '14px', opacity: '0.7', overflow: 'clip' }}>
-                                            <path d="M14 17H5" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                            <path d="M19 7h-9" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                            <circle cx="17" cy="17" r="3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                            <circle cx="7" cy="7" r="3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                          </svg>
-                                        </div>
-                                      </div>
-                                    </div>
-                                  </div>
-                                </div>
-                                <div className="mb-4">
-                                  <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-400">
-                                    Dimensions
-                                  </div>
-                                  <div className="pt-2">
-                                    <div className="flex gap-2">
-                                      <div className="">
-                                        <div className="items-center h-7 flex w-full opacity-[0.5] rounded-sm bg-[#27272ACC]">
-                                          <div className="h-7 flex basis-[0%] grow w-full min-w-0 opacity-[0.5] items-center pr-1 pl-1.5 overflow-clip [box-shadow:#FAFAFA_0px_0px_0px]">
-                                            <div className="h-fit w-full overflow-clip">
-                                              <div className="text-sm leading-[142.857%] font-sans text-zinc-50 line-clamp-1">
-                                                375
-                                              </div>
-                                            </div>
-                                          </div>
-                                          <div className="items-center flex justify-center order-first pr-0.5 pl-2 gap-2 py-1">
-                                            <div className="items-center flex justify-center opacity-[0.5] shrink-0 size-3.5">
-                                              <div className="text-xs leading-[133.333%] font-sans font-bold text-zinc-400">
-                                                W
-                                              </div>
-                                            </div>
-                                          </div>
-                                        </div>
-                                      </div>
-                                      <div className="">
-                                        <div className="items-center h-7 flex w-full opacity-[0.5] rounded-sm bg-[#27272ACC]">
-                                          <div className="h-7 flex basis-[0%] grow w-full min-w-0 opacity-[0.5] items-center pr-1 pl-1.5 overflow-clip [box-shadow:#FAFAFA_0px_0px_0px]">
-                                            <div className="h-fit w-full overflow-clip">
-                                              <div className="text-sm leading-[142.857%] font-sans text-zinc-50 line-clamp-1">
-                                                812
-                                              </div>
-                                            </div>
-                                          </div>
-                                          <div className="items-center flex justify-center order-first pr-0.5 pl-2 gap-2 py-1">
-                                            <div className="items-center flex justify-center opacity-[0.5] shrink-0 size-3.5">
-                                              <div className="text-xs leading-[133.333%] font-sans font-bold text-zinc-400">
-                                                H
-                                              </div>
-                                            </div>
-                                          </div>
-                                        </div>
-                                      </div>
-                                    </div>
-                                  </div>
-                                </div>
-                                <div className="">
-                                  <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-400">
-                                    Padding
-                                  </div>
-                                  <div className="pt-2">
-                                    <div className="flex gap-2">
-                                      <div className="flex flex-col gap-2">
-                                        <div className="flex gap-2">
-                                          <div className="">
-                                            <div className="items-center h-7 flex w-full rounded-sm bg-[#27272A99]">
-                                              <div className="h-7 flex basis-[0%] grow w-full min-w-0 items-center pr-1 pl-1.5 overflow-clip [box-shadow:#FAFAFA_0px_0px_0px]">
-                                                <div className="h-fit w-full overflow-clip">
-                                                  <div className="text-sm leading-[142.857%] font-sans text-zinc-50 line-clamp-1">
-                                                    0
-                                                  </div>
-                                                </div>
-                                              </div>
-                                              <div className="items-center flex justify-center order-first pr-0.5 pl-2 gap-2 py-1">
-                                                <div className="items-center flex justify-center shrink-0 size-3.5">
-                                                  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                                    <path d="M15 10V9" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M15 15v-1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M15 21v-2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M15 5V3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M9 10V9" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M9 15v-1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M9 21v-2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M9 5V3" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <rect x="3" y="3" width="18" height="18" rx="2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '18px', boxSizing: 'border-box', width: '18px', transformOrigin: '0px 0px' }} />
-                                                  </svg>
-                                                </div>
-                                              </div>
-                                            </div>
-                                          </div>
-                                          <div className="">
-                                            <div className="items-center h-7 flex w-full rounded-sm bg-[#27272A99]">
-                                              <div className="h-7 flex basis-[0%] grow w-full min-w-0 items-center pr-1 pl-1.5 overflow-clip [box-shadow:#FAFAFA_0px_0px_0px]">
-                                                <div className="h-fit w-full overflow-clip">
-                                                  <div className="text-sm leading-[142.857%] font-sans text-zinc-50 line-clamp-1">
-                                                    0
-                                                  </div>
-                                                </div>
-                                              </div>
-                                              <div className="items-center flex justify-center order-first pr-0.5 pl-2 gap-2 py-1">
-                                                <div className="items-center flex justify-center shrink-0 size-3.5">
-                                                  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                                    <path d="M14 15h1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M14 9h1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M19 15h2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M19 9h2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M3 15h2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M3 9h2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M9 15h1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <path d="M9 9h1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                                    <rect x="3" y="3" width="18" height="18" rx="2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '18px', boxSizing: 'border-box', width: '18px', transformOrigin: '0px 0px' }} />
-                                                  </svg>
-                                                </div>
-                                              </div>
-                                            </div>
-                                          </div>
-                                        </div>
-                                      </div>
-                                      <div className="items-center flex shrink-0 justify-center rounded-md bg-zinc-800 border border-solid border-[#00000000] size-7">
-                                        <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', flexShrink: '0', width: '14px', opacity: '0.7', overflow: 'clip' }}>
-                                          <path d="M3 7V5a2 2 0 0 1 2-2h2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                          <path d="M17 3h2a2 2 0 0 1 2 2v2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                          <path d="M21 17v2a2 2 0 0 1-2 2h-2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                          <path d="M7 21H5a2 2 0 0 1-2-2v-2" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                          <rect width="10" height="8" x="7" y="8" rx="1" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '8px', boxSizing: 'border-box', width: '10px', transformOrigin: '0px 0px' }} />
-                                        </svg>
-                                      </div>
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                            </div>
-                            <div className="border-b border-b-solid border-b-zinc-800">
-                              <div className="items-center h-7 flex justify-between px-4 my-2">
-                                <div className="text-sm leading-[142.857%] font-sans font-medium text-zinc-50">
-                                  Fill
-                                </div>
-                              </div>
-                              <div className="pb-4 px-4">
-                                <div className="">
-                                  <div className="items-center flex gap-2">
-                                    <div className="items-center h-7 flex basis-[0%] grow px-1.5 rounded-sm gap-2 bg-[#27272A99]">
-                                      <div className="shrink-0 rounded-[3px] overflow-clip relative size-5">
-                                        <div className="absolute inset-0" style={{ backgroundImage: 'linear-gradient(in oklab 45deg, oklab(60% 0 0) 25%, oklab(0% 0 0 / 0%) 25%), linear-gradient(in oklab 315deg, oklab(60% 0 0) 25%, oklab(0% 0 0 / 0%) 25%), linear-gradient(in oklab 45deg, oklab(0% 0 0 / 0%) 75%, oklab(60% 0 0) 75%), linear-gradient(in oklab 315deg, oklab(0% 0 0 / 0%) 75%, oklab(60% 0 0) 75%)' }} />
-                                        <div className="absolute bg-white inset-0" />
-                                        <div className="rounded-[3px] absolute [box-shadow:#FFFFFF33_0px_0px_0px_1px_inset] inset-0" />
-                                      </div>
-                                      <div className="text-xs leading-[133.333%] text-center font-sans flex [-webkit-box-orient:vertical] [-webkit-line-clamp:1] overflow-hidden justify-center flex-wrap text-zinc-50">
-                                        #FFFFFF
-                                      </div>
-                                    </div>
-                                    <div className="items-center flex shrink-0 justify-center rounded-md bg-zinc-800 border border-solid border-[#00000000] size-7">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="14px" fontWeight="500" style={{ height: '14px', flexShrink: '0', width: '14px', opacity: '0.7', overflow: 'clip' }}>
-                                        <path d="M5 12h14" fontSize="14px" fontWeight="500" fill="none" stroke="var(--zinc-50)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                            </div>
-                          </div>
-                        </div>
-                      </div>
-                    </div>
-                  </div>
-                </div>
-                <div className="w-2 -left-1 absolute inset-y-0">
-                  <div className="h-full w-px mx-auto" />
-                </div>
-              </div>
-              <div className="-bottom-0.75 hidden xl:flex flex-col w-60.75 top-13.5 left-0 absolute bg-zinc-900 border-r border-r-solid border-r-zinc-800">
-                <div className="flex basis-[0%] flex-col grow overflow-clip relative">
-                  <div className="absolute inset-0">
-                    <div className="h-full">
-                      <div className="overflow-clip size-full">
-                        <div className="table min-w-full">
-                          <div className="p-2">
-                            <div className="">
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 gap-1 rounded-t-sm">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="items-center flex justify-center shrink-0 size-3">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '12px', width: '12px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="m6 9 6 6 6-6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <rect width="14" height="20" x="5" y="2" rx="2" ry="2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '20px', boxSizing: 'border-box', width: '14px', transformOrigin: '0px 0px' }} />
-                                        <path d="M12 18h.01" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      Screen
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 pl-4 gap-1 rounded-t-sm">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="items-center flex justify-center shrink-0 size-3">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '12px', width: '12px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="m6 9 6 6 6-6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <rect width="18" height="18" x="3" y="3" rx="2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '18px', boxSizing: 'border-box', width: '18px', transformOrigin: '0px 0px' }} />
-                                        <path d="M3 12h18" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      Column
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 pl-8 gap-1 rounded-t-sm">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="shrink-0 size-3" />
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="M12 4v16" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M4 7V5a1 1 0 0 1 1-1h14a1 1 0 0 1 1 1v2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M9 20h6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      Text
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 pl-4 gap-1 rounded-t-sm">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="items-center flex justify-center shrink-0 size-3">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '12px', width: '12px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="m6 9 6 6 6-6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="M3 2h18" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <rect width="18" height="12" x="3" y="6" rx="2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '12px', boxSizing: 'border-box', width: '18px', transformOrigin: '0px 0px' }} />
-                                        <path d="M3 22h18" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      ScrollView
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 pl-8 gap-1 rounded-t-sm">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="shrink-0 size-3" />
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="M12 4v16" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M4 7V5a1 1 0 0 1 1-1h14a1 1 0 0 1 1 1v2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M9 20h6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      Text
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 pl-8 gap-1 rounded-t-sm">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="shrink-0 size-3" />
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="M12 4v16" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M4 7V5a1 1 0 0 1 1-1h14a1 1 0 0 1 1 1v2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M9 20h6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      Text
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 pl-8 gap-1 rounded-t-sm">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="shrink-0 size-3" />
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="M10 22V7a1 1 0 0 0-1-1H4a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-5a1 1 0 0 0-1-1H2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <rect x="14" y="2" width="8" height="8" rx="1" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ height: '8px', boxSizing: 'border-box', width: '8px', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      Sample Badge
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                              <div className="">
-                                <div className="items-center h-7 flex pr-1 pl-4 rounded-sm gap-1">
-                                  <div className="items-center flex shrink-0 p-0.5 rounded-sm">
-                                    <div className="shrink-0 size-3" />
-                                  </div>
-                                  <div className="items-center flex basis-[0%] grow overflow-clip gap-1.5">
-                                    <div className="items-center flex shrink-0 justify-center size-3.5">
-                                      <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-hidden="true" fontSize="16px" style={{ height: '14px', width: '14px', overflow: 'clip', flexShrink: '0' }}>
-                                        <path d="M12 4v16" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M4 7V5a1 1 0 0 1 1-1h14a1 1 0 0 1 1 1v2" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                        <path d="M9 20h6" fontSize="16px" fill="none" stroke="var(--zinc-400)" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" style={{ boxSizing: 'border-box', transformOrigin: '0px 0px' }} />
-                                      </svg>
-                                    </div>
-                                    <div className="text-xs leading-[133.333%] font-sans font-medium text-zinc-50 line-clamp-1">
-                                      Text
-                                    </div>
-                                  </div>
-                                </div>
-                              </div>
-                            </div>
-                          </div>
-                        </div>
-                      </div>
-                    </div>
-                  </div>
-                </div>
-                <div className="w-2 -right-1 absolute inset-y-0">
-                  <div className="h-full w-px mx-auto" />
-                </div>
-              </div>
-              <div className="w-130 xl:w-342 h-201.5 xl:h-186 top-0 left-0 absolute" style={{ backgroundImage: 'radial-gradient(ellipse 50.4% 92.66499999999999% at 50% -5.790000000000006% in oklab, oklab(18.2% 0 0 / 0%) 0.14%, oklab(14.1% 0.001 -0.004) 100%)' }} />
-            </div>
-          </div>
-          <PaywallBuildCanvas />
-          </div>
-        </ScaledMock>
-        </PaywallBuildProvider>
-      </div>
-      <LandingAgentCompatibility />
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/sections/problem.tsx b/apps/www/src/features/www/landing/sections/problem.tsx
deleted file mode 100644
index d3fcad4cd..000000000
--- a/apps/www/src/features/www/landing/sections/problem.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import { ScrollBrightenText } from "../motion";
-import { LandingSection } from "../shared";
-
-const PROBLEM_COPY =
-  "Building apps is easier than ever. Growing them has never been harder. Voidhash helps you test what works, understand your customers and turn more users into paying customers.";
-
-/** Renders the landing page positioning statement. */
-export function LandingProblem() {
-  return (
-    <LandingSection>
-      <div className="flex items-center px-6 py-24 md:px-12 md:py-32 xl:px-32 xl:py-48">
-        <ScrollBrightenText
-          className="max-w-[899px] font-medium font-sans text-[28px] leading-[130%] tracking-[-0.03em] md:text-[34px] xl:text-[40px]"
-          text={PROBLEM_COPY}
-        />
-      </div>
-    </LandingSection>
-  );
-}
diff --git a/apps/www/src/features/www/landing/shared.tsx b/apps/www/src/features/www/landing/shared.tsx
deleted file mode 100644
index 0648f4112..000000000
--- a/apps/www/src/features/www/landing/shared.tsx
+++ /dev/null
@@ -1,151 +0,0 @@
-"use client";
-
-import { cn } from "@voidhash/ui";
-import { type ReactNode, useEffect, useRef, useState } from "react";
-
-/** Full-bleed landing section: bottom hairline plus a centered, side-bordered content column. */
-export function LandingSection({
-  id,
-  className,
-  innerClassName,
-  children,
-}: {
-  id?: string;
-  className?: string;
-  innerClassName?: string;
-  children: ReactNode;
-}) {
-  return (
-    <section
-      className={cn(
-        "flex min-w-0 scroll-mt-24 flex-col items-center self-stretch border-zinc-800 border-b",
-        className,
-      )}
-      id={id}
-    >
-      <div className={cn("w-full max-w-[1656px] border-zinc-800 xl:border-x", innerClassName)}>
-        {children}
-      </div>
-    </section>
-  );
-}
-
-/**
- * Eyebrow + headline + optional supporting copy header shared by the product sections.
- *
- * The eyebrow and headline are top-aligned so their gap stays identical in every section — the
- * description hangs off the same top edge instead of bottom-aligning to the headline, which used
- * to push the headline down by however many lines the description happened to wrap to.
- */
-export function SectionHeader({
-  eyebrow,
-  title,
-  description,
-}: {
-  eyebrow: string;
-  title: string;
-  description?: string;
-}) {
-  return (
-    <div className="flex flex-col items-start gap-4 self-stretch">
-      <div className="font-medium font-sans text-zinc-400 text-base leading-[120%] tracking-[-0.01em]">
-        {eyebrow}
-      </div>
-      <div className="flex flex-col gap-6 self-stretch lg:flex-row lg:items-start lg:justify-between lg:gap-12">
-        <h2 className="max-w-[627px] font-sans font-semibold text-[28px] text-white leading-[120%] tracking-[-0.03em] md:text-[36px]">
-          {title}
-        </h2>
-        {description ? (
-          <p className="max-w-[465px] font-sans text-[#FFFFFFB8] text-base/6.5 tracking-[-0.03em] md:text-xl/8">
-            {description}
-          </p>
-        ) : null}
-      </div>
-    </div>
-  );
-}
-
-/**
- * Scales a fixed-width design fragment down to fit its container.
- *
- * The product mockups are pixel-faithful exports from the 1810px artboard, so instead of
- * re-flowing their internals we shrink each one with `transform: scale`. `zoom` would keep
- * layout height in sync for free, but iOS Safari shrinks only the boxes and re-renders the
- * text near its original size, leaving the copy overlapping — a transform scales the rendered
- * pixels wholesale, text included. The wrapper's height is synced to the scaled frame instead.
- *
- * @param designWidth Intrinsic width of the exported fragment, in artboard pixels.
- * @param compactDesignWidth Narrower intrinsic width used below `xl`, for mockups whose markup
- *   drops its outer columns there. Scaling to the trimmed width rather than the full artboard is
- *   what actually buys the phone-sized viewport its resolution back.
- */
-export function ScaledMock({
-  designWidth,
-  compactDesignWidth,
-  className,
-  children,
-}: {
-  designWidth: number;
-  compactDesignWidth?: number;
-  className?: string;
-  children: ReactNode;
-}) {
-  const frameRef = useRef<HTMLDivElement>(null);
-  const sizerRef = useRef<HTMLDivElement>(null);
-  const viewportRef = useRef<HTMLDivElement>(null);
-  const [compact, setCompact] = useState(false);
-
-  useEffect(() => {
-    if (compactDesignWidth === undefined) {
-      return;
-    }
-
-    // Matches Tailwind's `xl` breakpoint, which is where the mockups drop their outer columns.
-    const query = window.matchMedia("(width < 80rem)");
-    const sync = () => setCompact(query.matches);
-
-    sync();
-    query.addEventListener("change", sync);
-    return () => query.removeEventListener("change", sync);
-  }, [compactDesignWidth]);
-
-  const width = compact && compactDesignWidth !== undefined ? compactDesignWidth : designWidth;
-
-  useEffect(() => {
-    const frame = frameRef.current;
-    const sizer = sizerRef.current;
-    const viewport = viewportRef.current;
-    if (!frame || !sizer || !viewport) {
-      return;
-    }
-
-    const applyScale = () => {
-      const scale = Math.min(1, viewport.clientWidth / width);
-      frame.style.transform = `scale(${scale})`;
-      sizer.style.height = `${frame.offsetHeight * scale}px`;
-    };
-
-    applyScale();
-
-    // The frame is observed too: offsetHeight ignores the transform, so a content-height
-    // change (fonts loading, animated blocks) must re-sync the sizer height.
-    const observer = new ResizeObserver(applyScale);
-    observer.observe(viewport);
-    observer.observe(frame);
-    return () => observer.disconnect();
-  }, [width]);
-
-  return (
-    <div className={cn("w-full min-w-0", className)} ref={viewportRef}>
-      {/* The scaled height lives on this inner div: callers pass flex classes for the outer
-          wrapper, and a flex-basis would override an inline height set directly on it. */}
-      <div ref={sizerRef}>
-        {/* flow-root keeps child margins inside the frame's box, so they get measured and
-            scaled with the rest of the mockup instead of collapsing out past the transform. */}
-        <div className="flow-root origin-top-left" ref={frameRef} style={{ width }}>
-          {children}
-        </div>
-      </div>
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/logo.tsx b/apps/www/src/features/www/logo.tsx
deleted file mode 100644
index 385c804d2..000000000
--- a/apps/www/src/features/www/logo.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-import type { SVGProps } from "react";
-
-import { cn } from "@/lib/utils";
-
-export const Logo = ({
-  className,
-  variant = "default",
-  color = "mono",
-}: SVGProps<SVGSVGElement> & {
-  variant?: "default" | "short" | "symbol";
-  color?: "dual-tone" | "mono";
-}) => {
-  const symbolColor = color === "dual-tone" ? "#005EFF" : "currentColor";
-  if (variant === "short") {
-    return (
-      <svg
-        className={cn("h-4 text-black dark:text-white", className)}
-        fill="none"
-        viewBox="0 0 321 108"
-        xmlns="http://www.w3.org/2000/svg"
-      >
-        <title>Voidhash</title>
-        <path
-          d="M12.419 22.23L30.689 73.473L48.785 22.23H58.877L36.518 84H24.773L2.414 22.23H12.419ZM79.7183 85.044C75.3103 85.044 71.4533 84.058 68.1473 82.086C64.8413 80.114 62.2603 77.33 60.4043 73.734C58.6063 70.08 57.7073 65.817 57.7073 60.945C57.7073 56.073 58.6063 51.839 60.4043 48.243C62.2603 44.589 64.8413 41.776 68.1473 39.804C71.4533 37.832 75.3103 36.846 79.7183 36.846C84.0683 36.846 87.8963 37.832 91.2023 39.804C94.5083 41.776 97.0603 44.589 98.8583 48.243C100.714 51.839 101.642 56.073 101.642 60.945C101.642 65.817 100.714 70.08 98.8583 73.734C97.0603 77.33 94.5083 80.114 91.2023 82.086C87.8963 84.058 84.0683 85.044 79.7183 85.044ZM79.7183 77.04C83.6043 77.04 86.6203 75.619 88.7663 72.777C90.9703 69.935 92.0723 65.991 92.0723 60.945C92.0723 55.899 90.9703 51.955 88.7663 49.113C86.6203 46.271 83.6043 44.85 79.7183 44.85C75.8323 44.85 72.7873 46.271 70.5833 49.113C68.3793 51.897 67.2773 55.841 67.2773 60.945C67.2773 66.049 68.3793 70.022 70.5833 72.864C72.7873 75.648 75.8323 77.04 79.7183 77.04ZM117.058 37.89V84H107.836V37.89H117.058ZM117.319 22.317V31.104H107.662V22.317H117.319ZM158.286 22.23H167.508V84H158.895L158.634 77.388C157.3 79.766 155.357 81.651 152.805 83.043C150.253 84.377 147.411 85.044 144.279 85.044C140.335 85.044 136.884 84.058 133.926 82.086C130.968 80.114 128.706 77.33 127.14 73.734C125.574 70.08 124.791 65.817 124.791 60.945C124.791 56.073 125.574 51.839 127.14 48.243C128.706 44.589 130.968 41.776 133.926 39.804C136.884 37.832 140.335 36.846 144.279 36.846C147.295 36.846 150.05 37.484 152.544 38.76C155.038 40.036 156.952 41.805 158.286 44.067V22.23ZM157.416 69.471C158.46 67.035 158.982 64.193 158.982 60.945C158.982 57.639 158.46 54.739 157.416 52.245C156.43 49.751 155.009 47.837 153.153 46.503C151.297 45.169 149.122 44.502 146.628 44.502C142.858 44.502 139.871 46.01 137.667 49.026C135.463 51.984 134.361 55.957 134.361 60.945C134.361 65.875 135.463 69.819 137.667 72.777C139.929 75.677 142.916 77.127 146.628 77.127C149.122 77.127 151.297 76.46 153.153 75.126C155.009 73.792 156.43 71.907 157.416 69.471Z"
-          fill="currentColor"
-        />
-        <path
-          d="M316.143 23.5C318.549 23.5 320.5 25.4508 320.5 27.8571V49.6429C320.5 52.0492 318.549 54 316.143 54H290V80.1429C290 82.5492 288.049 84.5 285.643 84.5H263.857C261.451 84.5 259.5 82.5492 259.5 80.1429V54L290 23.5H316.143Z"
-          fill={symbolColor}
-        />
-        <path
-          d="M229 84.5L259.5 54V27.8571C259.5 25.4508 257.549 23.5 255.143 23.5H233.357C230.951 23.5 229 25.4508 229 27.8571V54H202.857C200.451 54 198.5 55.9508 198.5 58.3571V80.1429C198.5 82.5492 200.451 84.5 202.857 84.5H229Z"
-          fill={symbolColor}
-        />
-      </svg>
-    );
-  }
-
-  if (variant === "symbol") {
-    return (
-      <svg
-        className={cn("h-4 text-black dark:text-white", className)}
-        fill="none"
-        viewBox="0 0 112 56"
-        xmlns="http://www.w3.org/2000/svg"
-      >
-        <title>Voidhash</title>
-        <path
-          d="M112 4C112 1.79086 110.209 0 108 0H84V28H108C110.209 28 112 26.2091 112 24V4Z"
-          fill={symbolColor}
-        />
-        <path
-          d="M84 28H56V52C56 54.2091 57.7909 56 60 56H80C82.2091 56 84 54.2091 84 52V28Z"
-          fill={symbolColor}
-        />
-        <path d="M84 0L56 28H84V0Z" fill={symbolColor} />
-        <path
-          d="M0 52C0 54.2091 1.79086 56 4 56H28V28H4C1.79086 28 0 29.7909 0 32V52Z"
-          fill={symbolColor}
-        />
-        <path
-          d="M28 28H56V4C56 1.79086 54.2091 0 52 0H32C29.7909 0 28 1.79086 28 4V28Z"
-          fill={symbolColor}
-        />
-        <path d="M28 56L56 28H28V56Z" fill={symbolColor} />
-      </svg>
-    );
-  }
-
-  return (
-    <svg
-      className={cn("h-6 text-black dark:text-white", className)}
-      fill="none"
-      viewBox="0 0 505 108"
-      xmlns="http://www.w3.org/2000/svg"
-    >
-      <title>Voidhash</title>
-      <path
-        d="M11.919 22.23L30.189 73.473L48.285 22.23H58.377L36.018 84H24.273L1.914 22.23H11.919ZM79.2183 85.044C74.8103 85.044 70.9533 84.058 67.6473 82.086C64.3413 80.114 61.7603 77.33 59.9043 73.734C58.1063 70.08 57.2073 65.817 57.2073 60.945C57.2073 56.073 58.1063 51.839 59.9043 48.243C61.7603 44.589 64.3413 41.776 67.6473 39.804C70.9533 37.832 74.8103 36.846 79.2183 36.846C83.5683 36.846 87.3963 37.832 90.7023 39.804C94.0083 41.776 96.5603 44.589 98.3583 48.243C100.214 51.839 101.142 56.073 101.142 60.945C101.142 65.817 100.214 70.08 98.3583 73.734C96.5603 77.33 94.0083 80.114 90.7023 82.086C87.3963 84.058 83.5683 85.044 79.2183 85.044ZM79.2183 77.04C83.1043 77.04 86.1203 75.619 88.2663 72.777C90.4703 69.935 91.5723 65.991 91.5723 60.945C91.5723 55.899 90.4703 51.955 88.2663 49.113C86.1203 46.271 83.1043 44.85 79.2183 44.85C75.3323 44.85 72.2873 46.271 70.0833 49.113C67.8793 51.897 66.7773 55.841 66.7773 60.945C66.7773 66.049 67.8793 70.022 70.0833 72.864C72.2873 75.648 75.3323 77.04 79.2183 77.04ZM116.558 37.89V84H107.336V37.89H116.558ZM116.819 22.317V31.104H107.162V22.317H116.819ZM157.786 22.23H167.008V84H158.395L158.134 77.388C156.8 79.766 154.857 81.651 152.305 83.043C149.753 84.377 146.911 85.044 143.779 85.044C139.835 85.044 136.384 84.058 133.426 82.086C130.468 80.114 128.206 77.33 126.64 73.734C125.074 70.08 124.291 65.817 124.291 60.945C124.291 56.073 125.074 51.839 126.64 48.243C128.206 44.589 130.468 41.776 133.426 39.804C136.384 37.832 139.835 36.846 143.779 36.846C146.795 36.846 149.55 37.484 152.044 38.76C154.538 40.036 156.452 41.805 157.786 44.067V22.23ZM156.916 69.471C157.96 67.035 158.482 64.193 158.482 60.945C158.482 57.639 157.96 54.739 156.916 52.245C155.93 49.751 154.509 47.837 152.653 46.503C150.797 45.169 148.622 44.502 146.128 44.502C142.358 44.502 139.371 46.01 137.167 49.026C134.963 51.984 133.861 55.957 133.861 60.945C133.861 65.875 134.963 69.819 137.167 72.777C139.429 75.677 142.416 77.127 146.128 77.127C148.622 77.127 150.797 76.46 152.653 75.126C154.509 73.792 155.93 71.907 156.916 69.471ZM184.15 22.23V48.243L182.845 47.808C183.715 44.038 185.484 41.283 188.152 39.543C190.82 37.745 194.01 36.846 197.722 36.846C202.478 36.846 206.248 38.441 209.032 41.631C211.874 44.763 213.295 48.997 213.295 54.333V84H204.073V57.639C204.073 53.405 203.348 50.244 201.898 48.156C200.448 46.068 198.186 45.024 195.112 45.024C191.748 45.024 189.08 46.126 187.108 48.33C185.136 50.476 184.15 53.579 184.15 57.639V84H174.928V22.23H184.15ZM220.871 51.723C221.799 47.083 223.974 43.458 227.396 40.848C230.876 38.18 235.284 36.846 240.62 36.846C246.884 36.846 251.669 38.528 254.975 41.892C258.339 45.256 260.021 50.099 260.021 56.421V73.56C260.021 74.72 260.253 75.561 260.717 76.083C261.239 76.547 261.964 76.779 262.892 76.779H264.719V84H261.848L260.804 84.087C258.31 84.029 256.193 83.507 254.453 82.521C252.713 81.477 251.756 79.592 251.582 76.866C250.422 79.244 248.566 81.216 246.014 82.782C243.462 84.29 240.359 85.044 236.705 85.044C231.949 85.044 227.976 83.855 224.786 81.477C221.654 79.099 220.088 75.909 220.088 71.907C220.088 68.949 220.784 66.571 222.176 64.773C223.568 62.975 225.482 61.583 227.918 60.597C230.354 59.611 233.573 58.741 237.575 57.987L250.799 55.377C250.741 51.665 249.871 48.91 248.189 47.112C246.507 45.256 243.984 44.328 240.62 44.328C237.952 44.328 235.748 45.024 234.008 46.416C232.268 47.75 231.079 49.722 230.441 52.332L220.871 51.723ZM229.658 71.733C229.658 73.531 230.412 75.01 231.92 76.17C233.486 77.33 235.748 77.91 238.706 77.91C241.026 77.852 243.114 77.272 244.97 76.17C246.826 75.068 248.276 73.415 249.32 71.211C250.422 68.949 250.973 66.223 250.973 63.033V62.424L241.142 64.164C240.678 64.222 240.214 64.309 239.75 64.425C237.372 64.831 235.516 65.266 234.182 65.73C232.848 66.136 231.746 66.832 230.876 67.818C230.064 68.746 229.658 70.051 229.658 71.733ZM297.609 52.419C297.145 50.041 295.927 48.127 293.955 46.677C291.983 45.227 289.75 44.502 287.256 44.502C284.82 44.502 282.79 45.111 281.166 46.329C279.542 47.489 278.73 49.055 278.73 51.027C278.788 52.883 279.745 54.333 281.601 55.377C283.515 56.363 285.98 57.175 288.996 57.813C293.172 58.567 296.594 59.495 299.262 60.597C301.93 61.641 304.018 63.091 305.526 64.947C307.034 66.745 307.788 69.094 307.788 71.994C307.788 74.836 306.918 77.243 305.178 79.215C303.496 81.187 301.205 82.666 298.305 83.652C295.463 84.58 292.331 85.044 288.909 85.044C285.023 85.044 281.543 84.406 278.469 83.13C275.395 81.854 272.93 80.056 271.074 77.736C269.276 75.358 268.261 72.603 268.029 69.471L277.512 68.862C277.86 70.602 278.498 72.11 279.426 73.386C280.412 74.662 281.688 75.648 283.254 76.344C284.878 77.04 286.734 77.388 288.822 77.388C291.316 77.388 293.491 76.924 295.347 75.996C297.261 75.01 298.218 73.531 298.218 71.559C298.218 70.225 297.812 69.152 297 68.34C296.188 67.528 295.173 66.919 293.955 66.513C292.795 66.107 291.229 65.701 289.257 65.295C288.677 65.121 288.039 64.976 287.343 64.86C283.399 63.99 280.18 63.091 277.686 62.163C275.192 61.177 273.133 59.814 271.509 58.074C269.943 56.334 269.16 54.072 269.16 51.288C269.16 48.33 269.914 45.778 271.422 43.632C272.988 41.428 275.163 39.746 277.947 38.586C280.789 37.426 284.124 36.846 287.952 36.846C292.998 36.846 297.261 38.209 300.741 40.935C304.221 43.661 306.338 47.315 307.092 51.897L297.609 52.419ZM323.217 22.23V48.243L321.912 47.808C322.782 44.038 324.551 41.283 327.219 39.543C329.887 37.745 333.077 36.846 336.789 36.846C341.545 36.846 345.315 38.441 348.099 41.631C350.941 44.763 352.362 48.997 352.362 54.333V84H343.14V57.639C343.14 53.405 342.415 50.244 340.965 48.156C339.515 46.068 337.253 45.024 334.179 45.024C330.815 45.024 328.147 46.126 326.175 48.33C324.203 50.476 323.217 53.579 323.217 57.639V84H313.995V22.23H323.217Z"
-        fill="currentColor"
-      />
-      <path
-        d="M500.643 23.5C503.049 23.5 505 25.4508 505 27.8571V49.6429C505 52.0492 503.049 54 500.643 54H474.5V80.1429C474.5 82.5492 472.549 84.5 470.143 84.5H448.357C445.951 84.5 444 82.5492 444 80.1429V54L474.5 23.5H500.643Z"
-        fill={symbolColor}
-      />
-      <path
-        d="M413.5 84.5L444 54V27.8571C444 25.4508 442.049 23.5 439.643 23.5H417.857C415.451 23.5 413.5 25.4508 413.5 27.8571V54H387.357C384.951 54 383 55.9508 383 58.3571V80.1429C383 82.5492 384.951 84.5 387.357 84.5H413.5Z"
-        fill={symbolColor}
-      />
-    </svg>
-  );
-};
diff --git a/apps/www/src/features/www/marketing-home-slot.tsx b/apps/www/src/features/www/marketing-home-slot.tsx
new file mode 100644
index 000000000..6187ed01e
--- /dev/null
+++ b/apps/www/src/features/www/marketing-home-slot.tsx
@@ -0,0 +1,20 @@
+import { redirect } from "@tanstack/react-router";
+
+import { STUDIO_PATH } from "@/lib/paths";
+
+/**
+ * What the community build serves at `/`. A self-hosted deployment is an
+ * application rather than a marketing site, so the root simply hands off to the
+ * studio (which in turn redirects to sign-in when there is no session).
+ *
+ * Hosts that ship a marketing site replace this module — see
+ * `apps/www/vite.config.ts` in voidhash-mono, which aliases it to the hosted
+ * landing page.
+ */
+export const marketingHomeLoader = async (): Promise<void> => {
+  throw redirect({ to: STUDIO_PATH });
+};
+
+export function MarketingHome() {
+  return null;
+}
diff --git a/apps/www/src/features/www/navbar/navigation.tsx b/apps/www/src/features/www/navbar/navigation.tsx
deleted file mode 100644
index 109d598d3..000000000
--- a/apps/www/src/features/www/navbar/navigation.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-"use client";
-
-import { useEffect, useState } from "react";
-
-import { cn } from "@/lib/utils";
-
-// import { Button } from '../button';
-import { Logo } from "../logo";
-
-export function Navigation() {
-  const [isScrolled, setIsScrolled] = useState(false);
-
-  useEffect(() => {
-    const handleScroll = () => {
-      setIsScrolled(window.scrollY > 10);
-    };
-
-    window.addEventListener("scroll", handleScroll);
-    return () => window.removeEventListener("scroll", handleScroll);
-  }, []);
-
-  return (
-    <div>
-      <nav
-        className={cn(
-          "fixed top-0 right-0 left-0 z-50 flex h-16 w-full items-center justify-start bg-background backdrop-blur-sm",
-          isScrolled && "border-border border-b",
-        )}
-      >
-        <div className="mx-auto flex w-full max-w-7xl items-center px-4 py-4">
-          <a href="/">
-            <Logo className="h-6" />
-          </a>
-          <div className="flex-1" />
-          {/* <div className="flex items-center gap-2">
-            <Button size="sm" variant="outline">
-              Sign in
-            </Button>
-            <Button size="sm">
-              <span>Get Started</span>
-              <ChevronRight className="size-4 opacity-50" />
-            </Button>
-          </div> */}
-        </div>
-      </nav>
-      <div className="h-16" />
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/refraction-stripes.tsx b/apps/www/src/features/www/refraction-stripes.tsx
deleted file mode 100644
index 9f9bbed7f..000000000
--- a/apps/www/src/features/www/refraction-stripes.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-"use client";
-
-import { useRef } from "react";
-
-import { useContainerDimensions } from "@/hooks/use-container-dimensions";
-
-const IDEAL_STRIPE_WIDTH = 40;
-
-function Stripe({ width, x }: { width: number; x: number }) {
-  return (
-    <div
-      className="absolute top-0 left-0 h-full w-full border-background/50 border-r bg-gradient-to-r from-background/0 to-background/30"
-      style={{
-        left: x,
-        width: width - 1,
-      }}
-    />
-  );
-}
-export function RefractionStripes() {
-  const containerRef = useRef<HTMLDivElement>(null);
-  const { width: containerWidth } = useContainerDimensions(containerRef);
-  const stripeCount = Math.floor(containerWidth / IDEAL_STRIPE_WIDTH);
-  const stripeWidth = containerWidth / Math.max(1, stripeCount);
-
-  return (
-    <div className="absolute z-20 h-full w-full" ref={containerRef}>
-      {Array.from({ length: stripeCount }).map((_, index) => (
-        <Stripe
-          // biome-ignore lint/suspicious/noArrayIndexKey: it is ok
-          key={index}
-          width={stripeWidth}
-          x={index * stripeWidth}
-        />
-      ))}
-    </div>
-  );
-}
diff --git a/apps/www/src/features/www/section/section-container.tsx b/apps/www/src/features/www/section/section-container.tsx
deleted file mode 100644
index e85a8a198..000000000
--- a/apps/www/src/features/www/section/section-container.tsx
+++ /dev/null
@@ -1,15 +0,0 @@
-import { cn } from "@/lib/utils";
-
-export function SectionContainer({
-  children,
-  className,
-}: {
-  children: React.ReactNode;
-  className?: string;
-}) {
-  return (
-    <div className={cn("mx-auto max-w-7xl px-4", className)}>
-      <div className="w-full border border-border/60">{children}</div>
-    </div>
-  );
-}
diff --git a/apps/www/src/routeTree.gen.ts b/apps/www/src/routeTree.gen.ts
index c8c6f0dc8..fbb51364c 100644
--- a/apps/www/src/routeTree.gen.ts
+++ b/apps/www/src/routeTree.gen.ts
@@ -11,15 +11,12 @@
 import { Route as rootRouteImport } from './routes/__root'
 import { Route as StudioRouteRouteImport } from './routes/studio/route'
 import { Route as DocsRouteRouteImport } from './routes/docs/route'
-import { Route as DesignRouteRouteImport } from './routes/design/route'
 import { Route as AuthRouteRouteImport } from './routes/auth/route'
 import { Route as MarketingRouteRouteImport } from './routes/_marketing/route'
 import { Route as DocsIndexRouteImport } from './routes/docs/index'
-import { Route as DesignIndexRouteImport } from './routes/design/index'
 import { Route as AuthIndexRouteImport } from './routes/auth/index'
 import { Route as MarketingIndexRouteImport } from './routes/_marketing/index'
 import { Route as DocsSplatRouteImport } from './routes/docs/$'
-import { Route as DesignSplatRouteImport } from './routes/design/$'
 import { Route as AuthVerifyEmailRouteImport } from './routes/auth/verify-email'
 import { Route as AuthSignUpRouteImport } from './routes/auth/sign-up'
 import { Route as AuthResetPasswordRouteImport } from './routes/auth/reset-password'
@@ -32,18 +29,11 @@ import { Route as AuthDevicesIndexRouteImport } from './routes/auth/devices/inde
 import { Route as StudioAuthenticatedWaitlistRouteImport } from './routes/studio/_authenticated/waitlist'
 import { Route as DocsApiSearchRouteImport } from './routes/docs/api/search'
 import { Route as DocsApiProxyRouteImport } from './routes/docs/api/proxy'
-import { Route as DesignApiSearchRouteImport } from './routes/design/api/search'
-import { Route as ApiAuthCallbackRouteImport } from './routes/api/auth/callback'
+import { Route as ApiAuthSignOutRouteImport } from './routes/api/auth/sign-out'
+import { Route as ApiAuthSignInRouteImport } from './routes/api/auth/sign-in'
+import { Route as ApiAuthSessionRouteImport } from './routes/api/auth/session'
 import { Route as StudioAuthenticatedDashboardRouteRouteImport } from './routes/studio/_authenticated/_dashboard/route'
 import { Route as StudioAuthenticatedCreateOrganizationIndexRouteImport } from './routes/studio/_authenticated/create-organization/index'
-import { Route as ApiAuthPasswordSignUpRouteImport } from './routes/api/auth/password/sign-up'
-import { Route as ApiAuthPasswordSignInRouteImport } from './routes/api/auth/password/sign-in'
-import { Route as ApiAuthPasswordResetPasswordRouteImport } from './routes/api/auth/password/reset-password'
-import { Route as ApiAuthPasswordForgotPasswordRouteImport } from './routes/api/auth/password/forgot-password'
-import { Route as ApiAuthOauthCallbackRouteImport } from './routes/api/auth/oauth/callback'
-import { Route as ApiAuthOauthProviderRouteImport } from './routes/api/auth/oauth/$provider'
-import { Route as ApiAuthEmailVerifyRouteImport } from './routes/api/auth/email/verify'
-import { Route as ApiAuthEmailResendRouteImport } from './routes/api/auth/email/resend'
 import { Route as StudioAuthenticatedDashboardOrganizationOrganizationSlugRouteRouteImport } from './routes/studio/_authenticated/_dashboard/_organization/$organizationSlug/route'
 import { Route as StudioAuthenticatedDashboardOrganizationOrganizationSlugIndexRouteImport } from './routes/studio/_authenticated/_dashboard/_organization/$organizationSlug/index'
 import { Route as StudioAuthenticatedDashboardProjectOrganizationSlugProjectSlugRouteRouteImport } from './routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/route'
@@ -93,11 +83,6 @@ const DocsRouteRoute = DocsRouteRouteImport.update({
   path: '/docs',
   getParentRoute: () => rootRouteImport,
 } as any)
-const DesignRouteRoute = DesignRouteRouteImport.update({
-  id: '/design',
-  path: '/design',
-  getParentRoute: () => rootRouteImport,
-} as any)
 const AuthRouteRoute = AuthRouteRouteImport.update({
   id: '/auth',
   path: '/auth',
@@ -112,11 +97,6 @@ const DocsIndexRoute = DocsIndexRouteImport.update({
   path: '/',
   getParentRoute: () => DocsRouteRoute,
 } as any)
-const DesignIndexRoute = DesignIndexRouteImport.update({
-  id: '/',
-  path: '/',
-  getParentRoute: () => DesignRouteRoute,
-} as any)
 const AuthIndexRoute = AuthIndexRouteImport.update({
   id: '/',
   path: '/',
@@ -132,11 +112,6 @@ const DocsSplatRoute = DocsSplatRouteImport.update({
   path: '/$',
   getParentRoute: () => DocsRouteRoute,
 } as any)
-const DesignSplatRoute = DesignSplatRouteImport.update({
-  id: '/$',
-  path: '/$',
-  getParentRoute: () => DesignRouteRoute,
-} as any)
 const AuthVerifyEmailRoute = AuthVerifyEmailRouteImport.update({
   id: '/verify-email',
   path: '/verify-email',
@@ -199,14 +174,19 @@ const DocsApiProxyRoute = DocsApiProxyRouteImport.update({
   path: '/api/proxy',
   getParentRoute: () => DocsRouteRoute,
 } as any)
-const DesignApiSearchRoute = DesignApiSearchRouteImport.update({
-  id: '/api/search',
-  path: '/api/search',
-  getParentRoute: () => DesignRouteRoute,
+const ApiAuthSignOutRoute = ApiAuthSignOutRouteImport.update({
+  id: '/api/auth/sign-out',
+  path: '/api/auth/sign-out',
+  getParentRoute: () => rootRouteImport,
 } as any)
-const ApiAuthCallbackRoute = ApiAuthCallbackRouteImport.update({
-  id: '/api/auth/callback',
-  path: '/api/auth/callback',
+const ApiAuthSignInRoute = ApiAuthSignInRouteImport.update({
+  id: '/api/auth/sign-in',
+  path: '/api/auth/sign-in',
+  getParentRoute: () => rootRouteImport,
+} as any)
+const ApiAuthSessionRoute = ApiAuthSessionRouteImport.update({
+  id: '/api/auth/session',
+  path: '/api/auth/session',
   getParentRoute: () => rootRouteImport,
 } as any)
 const StudioAuthenticatedDashboardRouteRoute =
@@ -220,48 +200,6 @@ const StudioAuthenticatedCreateOrganizationIndexRoute =
     path: '/create-organization/',
     getParentRoute: () => StudioAuthenticatedRouteRoute,
   } as any)
-const ApiAuthPasswordSignUpRoute = ApiAuthPasswordSignUpRouteImport.update({
-  id: '/api/auth/password/sign-up',
-  path: '/api/auth/password/sign-up',
-  getParentRoute: () => rootRouteImport,
-} as any)
-const ApiAuthPasswordSignInRoute = ApiAuthPasswordSignInRouteImport.update({
-  id: '/api/auth/password/sign-in',
-  path: '/api/auth/password/sign-in',
-  getParentRoute: () => rootRouteImport,
-} as any)
-const ApiAuthPasswordResetPasswordRoute =
-  ApiAuthPasswordResetPasswordRouteImport.update({
-    id: '/api/auth/password/reset-password',
-    path: '/api/auth/password/reset-password',
-    getParentRoute: () => rootRouteImport,
-  } as any)
-const ApiAuthPasswordForgotPasswordRoute =
-  ApiAuthPasswordForgotPasswordRouteImport.update({
-    id: '/api/auth/password/forgot-password',
-    path: '/api/auth/password/forgot-password',
-    getParentRoute: () => rootRouteImport,
-  } as any)
-const ApiAuthOauthCallbackRoute = ApiAuthOauthCallbackRouteImport.update({
-  id: '/api/auth/oauth/callback',
-  path: '/api/auth/oauth/callback',
-  getParentRoute: () => rootRouteImport,
-} as any)
-const ApiAuthOauthProviderRoute = ApiAuthOauthProviderRouteImport.update({
-  id: '/api/auth/oauth/$provider',
-  path: '/api/auth/oauth/$provider',
-  getParentRoute: () => rootRouteImport,
-} as any)
-const ApiAuthEmailVerifyRoute = ApiAuthEmailVerifyRouteImport.update({
-  id: '/api/auth/email/verify',
-  path: '/api/auth/email/verify',
-  getParentRoute: () => rootRouteImport,
-} as any)
-const ApiAuthEmailResendRoute = ApiAuthEmailResendRouteImport.update({
-  id: '/api/auth/email/resend',
-  path: '/api/auth/email/resend',
-  getParentRoute: () => rootRouteImport,
-} as any)
 const StudioAuthenticatedDashboardOrganizationOrganizationSlugRouteRoute =
   StudioAuthenticatedDashboardOrganizationOrganizationSlugRouteRouteImport.update(
     {
@@ -605,7 +543,6 @@ const StudioAuthenticatedDashboardProjectOrganizationSlugProjectSlugSettingsWebh
 export interface FileRoutesByFullPath {
   '/': typeof MarketingIndexRoute
   '/auth': typeof AuthRouteRouteWithChildren
-  '/design': typeof DesignRouteRouteWithChildren
   '/docs': typeof DocsRouteRouteWithChildren
   '/studio': typeof StudioRouteRouteWithChildren
   '/auth/forgot-password': typeof AuthForgotPasswordRoute
@@ -614,26 +551,17 @@ export interface FileRoutesByFullPath {
   '/auth/reset-password': typeof AuthResetPasswordRoute
   '/auth/sign-up': typeof AuthSignUpRoute
   '/auth/verify-email': typeof AuthVerifyEmailRoute
-  '/design/$': typeof DesignSplatRoute
   '/docs/$': typeof DocsSplatRoute
   '/auth/': typeof AuthIndexRoute
-  '/design/': typeof DesignIndexRoute
   '/docs/': typeof DocsIndexRoute
-  '/api/auth/callback': typeof ApiAuthCallbackRoute
-  '/design/api/search': typeof DesignApiSearchRoute
+  '/api/auth/session': typeof ApiAuthSessionRoute
+  '/api/auth/sign-in': typeof ApiAuthSignInRoute
+  '/api/auth/sign-out': typeof ApiAuthSignOutRoute
   '/docs/api/proxy': typeof DocsApiProxyRoute
   '/docs/api/search': typeof DocsApiSearchRoute
   '/studio/waitlist': typeof StudioAuthenticatedWaitlistRoute
   '/auth/devices/': typeof AuthDevicesIndexRoute
   '/studio/': typeof StudioAuthenticatedIndexRoute
-  '/api/auth/email/resend': typeof ApiAuthEmailResendRoute
-  '/api/auth/email/verify': typeof ApiAuthEmailVerifyRoute
-  '/api/auth/oauth/$provider': typeof ApiAuthOauthProviderRoute
-  '/api/auth/oauth/callback': typeof ApiAuthOauthCallbackRoute
-  '/api/auth/password/forgot-password': typeof ApiAuthPasswordForgotPasswordRoute
-  '/api/auth/password/reset-password': typeof ApiAuthPasswordResetPasswordRoute
-  '/api/auth/password/sign-in': typeof ApiAuthPasswordSignInRoute
-  '/api/auth/password/sign-up': typeof ApiAuthPasswordSignUpRoute
   '/studio/create-organization/': typeof StudioAuthenticatedCreateOrganizationIndexRoute
   '/studio/$organizationSlug': typeof StudioAuthenticatedDashboardOrganizationOrganizationSlugRouteRouteWithChildren
   '/studio/$organizationSlug/$projectSlug': typeof StudioAuthenticatedDashboardProjectOrganizationSlugProjectSlugRouteRouteWithChildren
@@ -682,26 +610,17 @@ export interface FileRoutesByTo {
   '/auth/reset-password': typeof AuthResetPasswordRoute
   '/auth/sign-up': typeof AuthSignUpRoute
   '/auth/verify-email': typeof AuthVerifyEmailRoute
-  '/design/$': typeof DesignSplatRoute
   '/docs/$': typeof DocsSplatRoute
   '/': typeof MarketingIndexRoute
   '/auth': typeof AuthIndexRoute
-  '/design': typeof DesignIndexRoute
   '/docs': typeof DocsIndexRoute
-  '/api/auth/callback': typeof ApiAuthCallbackRoute
-  '/design/api/search': typeof DesignApiSearchRoute
+  '/api/auth/session': typeof ApiAuthSessionRoute
+  '/api/auth/sign-in': typeof ApiAuthSignInRoute
+  '/api/auth/sign-out': typeof ApiAuthSignOutRoute
   '/docs/api/proxy': typeof DocsApiProxyRoute
   '/docs/api/search': typeof DocsApiSearchRoute
   '/studio/waitlist': typeof StudioAuthenticatedWaitlistRoute
   '/auth/devices': typeof AuthDevicesIndexRoute
-  '/api/auth/email/resend': typeof ApiAuthEmailResendRoute
-  '/api/auth/email/verify': typeof ApiAuthEmailVerifyRoute
-  '/api/auth/oauth/$provider': typeof ApiAuthOauthProviderRoute
-  '/api/auth/oauth/callback': typeof ApiAuthOauthCallbackRoute
-  '/api/auth/password/forgot-password': typeof ApiAuthPasswordForgotPasswordRoute
-  '/api/auth/password/reset-password': typeof ApiAuthPasswordResetPasswordRoute
-  '/api/auth/password/sign-in': typeof ApiAuthPasswordSignInRoute
-  '/api/auth/password/sign-up': typeof ApiAuthPasswordSignUpRoute
   '/studio/create-organization': typeof StudioAuthenticatedCreateOrganizationIndexRoute
   '/studio/$organizationSlug': typeof StudioAuthenticatedDashboardOrganizationOrganizationSlugIndexRoute
   '/studio/$organizationSlug/$projectSlug/overview': typeof StudioAuthenticatedDashboardProjectOrganizationSlugProjectSlugOverviewRoute
@@ -744,7 +663,6 @@ export interface FileRoutesById {
   __root__: typeof rootRouteImport
   '/_marketing': typeof MarketingRouteRouteWithChildren
   '/auth': typeof AuthRouteRouteWithChildren
-  '/design': typeof DesignRouteRouteWithChildren
   '/docs': typeof DocsRouteRouteWithChildren
   '/studio': typeof StudioRouteRouteWithChildren
   '/studio/_authenticated': typeof StudioAuthenticatedRouteRouteWithChildren
@@ -754,28 +672,19 @@ export interface FileRoutesById {
   '/auth/reset-password': typeof AuthResetPasswordRoute
   '/auth/sign-up': typeof AuthSignUpRoute
   '/auth/verify-email': typeof AuthVerifyEmailRoute
-  '/design/$': typeof DesignSplatRoute
   '/docs/$': typeof DocsSplatRoute
   '/_marketing/': typeof MarketingIndexRoute
   '/auth/': typeof AuthIndexRoute
-  '/design/': typeof DesignIndexRoute
   '/docs/': typeof DocsIndexRoute
   '/studio/_authenticated/_dashboard': typeof StudioAuthenticatedDashboardRouteRouteWithChildren
-  '/api/auth/callback': typeof ApiAuthCallbackRoute
-  '/design/api/search': typeof DesignApiSearchRoute
+  '/api/auth/session': typeof ApiAuthSessionRoute
+  '/api/auth/sign-in': typeof ApiAuthSignInRoute
+  '/api/auth/sign-out': typeof ApiAuthSignOutRoute
   '/docs/api/proxy': typeof DocsApiProxyRoute
   '/docs/api/search': typeof DocsApiSearchRoute
   '/studio/_authenticated/waitlist': typeof StudioAuthenticatedWaitlistRoute
   '/auth/devices/': typeof AuthDevicesIndexRoute
   '/studio/_authenticated/': typeof StudioAuthenticatedIndexRoute
-  '/api/auth/email/resend': typeof ApiAuthEmailResendRoute
-  '/api/auth/email/verify': typeof ApiAuthEmailVerifyRoute
-  '/api/auth/oauth/$provider': typeof ApiAuthOauthProviderRoute
-  '/api/auth/oauth/callback': typeof ApiAuthOauthCallbackRoute
-  '/api/auth/password/forgot-password': typeof ApiAuthPasswordForgotPasswordRoute
-  '/api/auth/password/reset-password': typeof ApiAuthPasswordResetPasswordRoute
-  '/api/auth/password/sign-in': typeof ApiAuthPasswordSignInRoute
-  '/api/auth/password/sign-up': typeof ApiAuthPasswordSignUpRoute
   '/studio/_authenticated/create-organization/': typeof StudioAuthenticatedCreateOrganizationIndexRoute
   '/studio/_authenticated/_dashboard/_organization/$organizationSlug': typeof StudioAuthenticatedDashboardOrganizationOrganizationSlugRouteRouteWithChildren
   '/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug': typeof StudioAuthenticatedDashboardProjectOrganizationSlugProjectSlugRouteRouteWithChildren
@@ -821,7 +730,6 @@ export interface FileRouteTypes {
   fullPaths:
     | '/'
     | '/auth'
-    | '/design'
     | '/docs'
     | '/studio'
     | '/auth/forgot-password'
@@ -830,26 +738,17 @@ export interface FileRouteTypes {
     | '/auth/reset-password'
     | '/auth/sign-up'
     | '/auth/verify-email'
-    | '/design/$'
     | '/docs/$'
     | '/auth/'
-    | '/design/'
     | '/docs/'
-    | '/api/auth/callback'
-    | '/design/api/search'
+    | '/api/auth/session'
+    | '/api/auth/sign-in'
+    | '/api/auth/sign-out'
     | '/docs/api/proxy'
     | '/docs/api/search'
     | '/studio/waitlist'
     | '/auth/devices/'
     | '/studio/'
-    | '/api/auth/email/resend'
-    | '/api/auth/email/verify'
-    | '/api/auth/oauth/$provider'
-    | '/api/auth/oauth/callback'
-    | '/api/auth/password/forgot-password'
-    | '/api/auth/password/reset-password'
-    | '/api/auth/password/sign-in'
-    | '/api/auth/password/sign-up'
     | '/studio/create-organization/'
     | '/studio/$organizationSlug'
     | '/studio/$organizationSlug/$projectSlug'
@@ -898,26 +797,17 @@ export interface FileRouteTypes {
     | '/auth/reset-password'
     | '/auth/sign-up'
     | '/auth/verify-email'
-    | '/design/$'
     | '/docs/$'
     | '/'
     | '/auth'
-    | '/design'
     | '/docs'
-    | '/api/auth/callback'
-    | '/design/api/search'
+    | '/api/auth/session'
+    | '/api/auth/sign-in'
+    | '/api/auth/sign-out'
     | '/docs/api/proxy'
     | '/docs/api/search'
     | '/studio/waitlist'
     | '/auth/devices'
-    | '/api/auth/email/resend'
-    | '/api/auth/email/verify'
-    | '/api/auth/oauth/$provider'
-    | '/api/auth/oauth/callback'
-    | '/api/auth/password/forgot-password'
-    | '/api/auth/password/reset-password'
-    | '/api/auth/password/sign-in'
-    | '/api/auth/password/sign-up'
     | '/studio/create-organization'
     | '/studio/$organizationSlug'
     | '/studio/$organizationSlug/$projectSlug/overview'
@@ -959,7 +849,6 @@ export interface FileRouteTypes {
     | '__root__'
     | '/_marketing'
     | '/auth'
-    | '/design'
     | '/docs'
     | '/studio'
     | '/studio/_authenticated'
@@ -969,28 +858,19 @@ export interface FileRouteTypes {
     | '/auth/reset-password'
     | '/auth/sign-up'
     | '/auth/verify-email'
-    | '/design/$'
     | '/docs/$'
     | '/_marketing/'
     | '/auth/'
-    | '/design/'
     | '/docs/'
     | '/studio/_authenticated/_dashboard'
-    | '/api/auth/callback'
-    | '/design/api/search'
+    | '/api/auth/session'
+    | '/api/auth/sign-in'
+    | '/api/auth/sign-out'
     | '/docs/api/proxy'
     | '/docs/api/search'
     | '/studio/_authenticated/waitlist'
     | '/auth/devices/'
     | '/studio/_authenticated/'
-    | '/api/auth/email/resend'
-    | '/api/auth/email/verify'
-    | '/api/auth/oauth/$provider'
-    | '/api/auth/oauth/callback'
-    | '/api/auth/password/forgot-password'
-    | '/api/auth/password/reset-password'
-    | '/api/auth/password/sign-in'
-    | '/api/auth/password/sign-up'
     | '/studio/_authenticated/create-organization/'
     | '/studio/_authenticated/_dashboard/_organization/$organizationSlug'
     | '/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug'
@@ -1035,18 +915,11 @@ export interface FileRouteTypes {
 export interface RootRouteChildren {
   MarketingRouteRoute: typeof MarketingRouteRouteWithChildren
   AuthRouteRoute: typeof AuthRouteRouteWithChildren
-  DesignRouteRoute: typeof DesignRouteRouteWithChildren
   DocsRouteRoute: typeof DocsRouteRouteWithChildren
   StudioRouteRoute: typeof StudioRouteRouteWithChildren
-  ApiAuthCallbackRoute: typeof ApiAuthCallbackRoute
-  ApiAuthEmailResendRoute: typeof ApiAuthEmailResendRoute
-  ApiAuthEmailVerifyRoute: typeof ApiAuthEmailVerifyRoute
-  ApiAuthOauthProviderRoute: typeof ApiAuthOauthProviderRoute
-  ApiAuthOauthCallbackRoute: typeof ApiAuthOauthCallbackRoute
-  ApiAuthPasswordForgotPasswordRoute: typeof ApiAuthPasswordForgotPasswordRoute
-  ApiAuthPasswordResetPasswordRoute: typeof ApiAuthPasswordResetPasswordRoute
-  ApiAuthPasswordSignInRoute: typeof ApiAuthPasswordSignInRoute
-  ApiAuthPasswordSignUpRoute: typeof ApiAuthPasswordSignUpRoute
+  ApiAuthSessionRoute: typeof ApiAuthSessionRoute
+  ApiAuthSignInRoute: typeof ApiAuthSignInRoute
+  ApiAuthSignOutRoute: typeof ApiAuthSignOutRoute
 }
 
 declare module '@tanstack/react-router' {
@@ -1065,13 +938,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof DocsRouteRouteImport
       parentRoute: typeof rootRouteImport
     }
-    '/design': {
-      id: '/design'
-      path: '/design'
-      fullPath: '/design'
-      preLoaderRoute: typeof DesignRouteRouteImport
-      parentRoute: typeof rootRouteImport
-    }
     '/auth': {
       id: '/auth'
       path: '/auth'
@@ -1093,13 +959,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof DocsIndexRouteImport
       parentRoute: typeof DocsRouteRoute
     }
-    '/design/': {
-      id: '/design/'
-      path: '/'
-      fullPath: '/design/'
-      preLoaderRoute: typeof DesignIndexRouteImport
-      parentRoute: typeof DesignRouteRoute
-    }
     '/auth/': {
       id: '/auth/'
       path: '/'
@@ -1121,13 +980,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof DocsSplatRouteImport
       parentRoute: typeof DocsRouteRoute
     }
-    '/design/$': {
-      id: '/design/$'
-      path: '/$'
-      fullPath: '/design/$'
-      preLoaderRoute: typeof DesignSplatRouteImport
-      parentRoute: typeof DesignRouteRoute
-    }
     '/auth/verify-email': {
       id: '/auth/verify-email'
       path: '/verify-email'
@@ -1212,18 +1064,25 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof DocsApiProxyRouteImport
       parentRoute: typeof DocsRouteRoute
     }
-    '/design/api/search': {
-      id: '/design/api/search'
-      path: '/api/search'
-      fullPath: '/design/api/search'
-      preLoaderRoute: typeof DesignApiSearchRouteImport
-      parentRoute: typeof DesignRouteRoute
+    '/api/auth/sign-out': {
+      id: '/api/auth/sign-out'
+      path: '/api/auth/sign-out'
+      fullPath: '/api/auth/sign-out'
+      preLoaderRoute: typeof ApiAuthSignOutRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+    '/api/auth/sign-in': {
+      id: '/api/auth/sign-in'
+      path: '/api/auth/sign-in'
+      fullPath: '/api/auth/sign-in'
+      preLoaderRoute: typeof ApiAuthSignInRouteImport
+      parentRoute: typeof rootRouteImport
     }
-    '/api/auth/callback': {
-      id: '/api/auth/callback'
-      path: '/api/auth/callback'
-      fullPath: '/api/auth/callback'
-      preLoaderRoute: typeof ApiAuthCallbackRouteImport
+    '/api/auth/session': {
+      id: '/api/auth/session'
+      path: '/api/auth/session'
+      fullPath: '/api/auth/session'
+      preLoaderRoute: typeof ApiAuthSessionRouteImport
       parentRoute: typeof rootRouteImport
     }
     '/studio/_authenticated/_dashboard': {
@@ -1240,62 +1099,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof StudioAuthenticatedCreateOrganizationIndexRouteImport
       parentRoute: typeof StudioAuthenticatedRouteRoute
     }
-    '/api/auth/password/sign-up': {
-      id: '/api/auth/password/sign-up'
-      path: '/api/auth/password/sign-up'
-      fullPath: '/api/auth/password/sign-up'
-      preLoaderRoute: typeof ApiAuthPasswordSignUpRouteImport
-      parentRoute: typeof rootRouteImport
-    }
-    '/api/auth/password/sign-in': {
-      id: '/api/auth/password/sign-in'
-      path: '/api/auth/password/sign-in'
-      fullPath: '/api/auth/password/sign-in'
-      preLoaderRoute: typeof ApiAuthPasswordSignInRouteImport
-      parentRoute: typeof rootRouteImport
-    }
-    '/api/auth/password/reset-password': {
-      id: '/api/auth/password/reset-password'
-      path: '/api/auth/password/reset-password'
-      fullPath: '/api/auth/password/reset-password'
-      preLoaderRoute: typeof ApiAuthPasswordResetPasswordRouteImport
-      parentRoute: typeof rootRouteImport
-    }
-    '/api/auth/password/forgot-password': {
-      id: '/api/auth/password/forgot-password'
-      path: '/api/auth/password/forgot-password'
-      fullPath: '/api/auth/password/forgot-password'
-      preLoaderRoute: typeof ApiAuthPasswordForgotPasswordRouteImport
-      parentRoute: typeof rootRouteImport
-    }
-    '/api/auth/oauth/callback': {
-      id: '/api/auth/oauth/callback'
-      path: '/api/auth/oauth/callback'
-      fullPath: '/api/auth/oauth/callback'
-      preLoaderRoute: typeof ApiAuthOauthCallbackRouteImport
-      parentRoute: typeof rootRouteImport
-    }
-    '/api/auth/oauth/$provider': {
-      id: '/api/auth/oauth/$provider'
-      path: '/api/auth/oauth/$provider'
-      fullPath: '/api/auth/oauth/$provider'
-      preLoaderRoute: typeof ApiAuthOauthProviderRouteImport
-      parentRoute: typeof rootRouteImport
-    }
-    '/api/auth/email/verify': {
-      id: '/api/auth/email/verify'
-      path: '/api/auth/email/verify'
-      fullPath: '/api/auth/email/verify'
-      preLoaderRoute: typeof ApiAuthEmailVerifyRouteImport
-      parentRoute: typeof rootRouteImport
-    }
-    '/api/auth/email/resend': {
-      id: '/api/auth/email/resend'
-      path: '/api/auth/email/resend'
-      fullPath: '/api/auth/email/resend'
-      preLoaderRoute: typeof ApiAuthEmailResendRouteImport
-      parentRoute: typeof rootRouteImport
-    }
     '/studio/_authenticated/_dashboard/_organization/$organizationSlug': {
       id: '/studio/_authenticated/_dashboard/_organization/$organizationSlug'
       path: '/$organizationSlug'
@@ -1603,22 +1406,6 @@ const AuthRouteRouteWithChildren = AuthRouteRoute._addFileChildren(
   AuthRouteRouteChildren,
 )
 
-interface DesignRouteRouteChildren {
-  DesignSplatRoute: typeof DesignSplatRoute
-  DesignIndexRoute: typeof DesignIndexRoute
-  DesignApiSearchRoute: typeof DesignApiSearchRoute
-}
-
-const DesignRouteRouteChildren: DesignRouteRouteChildren = {
-  DesignSplatRoute: DesignSplatRoute,
-  DesignIndexRoute: DesignIndexRoute,
-  DesignApiSearchRoute: DesignApiSearchRoute,
-}
-
-const DesignRouteRouteWithChildren = DesignRouteRoute._addFileChildren(
-  DesignRouteRouteChildren,
-)
-
 interface DocsRouteRouteChildren {
   DocsSplatRoute: typeof DocsSplatRoute
   DocsIndexRoute: typeof DocsIndexRoute
@@ -1824,18 +1611,11 @@ const StudioRouteRouteWithChildren = StudioRouteRoute._addFileChildren(
 const rootRouteChildren: RootRouteChildren = {
   MarketingRouteRoute: MarketingRouteRouteWithChildren,
   AuthRouteRoute: AuthRouteRouteWithChildren,
-  DesignRouteRoute: DesignRouteRouteWithChildren,
   DocsRouteRoute: DocsRouteRouteWithChildren,
   StudioRouteRoute: StudioRouteRouteWithChildren,
-  ApiAuthCallbackRoute: ApiAuthCallbackRoute,
-  ApiAuthEmailResendRoute: ApiAuthEmailResendRoute,
-  ApiAuthEmailVerifyRoute: ApiAuthEmailVerifyRoute,
-  ApiAuthOauthProviderRoute: ApiAuthOauthProviderRoute,
-  ApiAuthOauthCallbackRoute: ApiAuthOauthCallbackRoute,
-  ApiAuthPasswordForgotPasswordRoute: ApiAuthPasswordForgotPasswordRoute,
-  ApiAuthPasswordResetPasswordRoute: ApiAuthPasswordResetPasswordRoute,
-  ApiAuthPasswordSignInRoute: ApiAuthPasswordSignInRoute,
-  ApiAuthPasswordSignUpRoute: ApiAuthPasswordSignUpRoute,
+  ApiAuthSessionRoute: ApiAuthSessionRoute,
+  ApiAuthSignInRoute: ApiAuthSignInRoute,
+  ApiAuthSignOutRoute: ApiAuthSignOutRoute,
 }
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)
diff --git a/apps/www/src/routes/__root.tsx b/apps/www/src/routes/__root.tsx
index 58cd11a2d..b83574cd2 100644
--- a/apps/www/src/routes/__root.tsx
+++ b/apps/www/src/routes/__root.tsx
@@ -1,13 +1,14 @@
-/** biome-ignore-all lint/style/noHeadElement: Head element is required for TanStack Router */
+/** Head element is required for TanStack Router */
 import type { QueryClient } from "@tanstack/react-query";
 import { HeadContent, Outlet, Scripts, createRootRouteWithContext } from "@tanstack/react-router";
-import {
-  AuthKitProvider,
-  useAccessToken,
-} from "@workos/authkit-tanstack-react-start/client";
 import { ThemeProviderTanstack, Toaster } from "@voidhash/ui";
 import { useEffect } from "react";
 
+import {
+  AuthProvider,
+  resetBrowserAccessToken,
+  useBrowserAccessTokenProvider,
+} from "@/features/auth/adapter/ui-adapter";
 import { setBrowserAccessTokenProvider } from "@/lib/effect-query";
 import appCss from "@/styles/globals.css?url";
 
@@ -54,7 +55,7 @@ function RootComponent() {
         <HeadContent />
       </head>
       <body className="text-pretty antialiased bg-sidebar">
-        <AuthKitProvider>
+        <AuthProvider>
           <ThemeProviderTanstack
             attribute="class"
             defaultTheme="dark"
@@ -62,28 +63,35 @@ function RootComponent() {
             // enableSystem
             suppressHydrationWarning
           >
-            <WorkOsAccessTokenBridge />
+            <AccessTokenBridge />
             <Outlet />
             <Toaster />
           </ThemeProviderTanstack>
-        </AuthKitProvider>
+        </AuthProvider>
         <Scripts />
       </body>
     </html>
   );
 }
 
-function WorkOsAccessTokenBridge() {
-  const { getAccessToken } = useAccessToken();
+/**
+ * Supplies the browser RPC client's bearer credential from whichever identity
+ * provider the deployment runs, without the root route needing to know which
+ * one that is (a root loader would make every navigation depend on it, and the
+ * answer is a deployment constant).
+ */
+function AccessTokenBridge() {
+  const getAccessToken = useBrowserAccessTokenProvider();
 
   if (!import.meta.env.SSR) {
-    setBrowserAccessTokenProvider(async () => (await getAccessToken()) ?? undefined);
+    setBrowserAccessTokenProvider(getAccessToken);
   }
 
   useEffect(
     () => () => {
       if (!import.meta.env.SSR) {
         setBrowserAccessTokenProvider(undefined);
+        resetBrowserAccessToken();
       }
     },
     [],
diff --git a/apps/www/src/routes/_marketing/index.tsx b/apps/www/src/routes/_marketing/index.tsx
index 83bea3033..563d23b2f 100644
--- a/apps/www/src/routes/_marketing/index.tsx
+++ b/apps/www/src/routes/_marketing/index.tsx
@@ -1,19 +1,8 @@
-import { createFileRoute, redirect } from "@tanstack/react-router";
-import { getAuth } from "@workos/authkit-tanstack-react-start";
+import { createFileRoute } from "@tanstack/react-router";
 
-import { LandingPage } from "@/features/www/landing/landing-page";
-import { STUDIO_PATH } from "@/lib/paths";
+import { MarketingHome, marketingHomeLoader } from "@/features/www/marketing-home-slot";
 
 export const Route = createFileRoute("/_marketing/")({
   component: MarketingHome,
-  loader: async () => {
-    const auth = await getAuth();
-    if (auth.user) {
-      throw redirect({ to: STUDIO_PATH });
-    }
-  },
+  loader: marketingHomeLoader,
 });
-
-function MarketingHome() {
-  return <LandingPage />;
-}
diff --git a/apps/www/src/routes/api/auth/callback.tsx b/apps/www/src/routes/api/auth/callback.tsx
deleted file mode 100644
index 5d655ec31..000000000
--- a/apps/www/src/routes/api/auth/callback.tsx
+++ /dev/null
@@ -1,10 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { handleCallbackRoute } from "@workos/authkit-tanstack-react-start";
-
-export const Route = createFileRoute("/api/auth/callback")({
-  server: {
-    handlers: {
-      GET: handleCallbackRoute(),
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/email/resend.tsx b/apps/www/src/routes/api/auth/email/resend.tsx
deleted file mode 100644
index bc61a39e6..000000000
--- a/apps/www/src/routes/api/auth/email/resend.tsx
+++ /dev/null
@@ -1,47 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  authErrorResponse,
-  createWorkosClient,
-  findUserIdByEmail,
-  getJsonBody,
-  jsonResponse,
-} from "@/features/auth/lib/workos-user-management.server";
-
-type ResendVerificationBody = {
-  email?: string;
-  userId?: string;
-};
-
-export const Route = createFileRoute("/api/auth/email/resend")({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const body = await getJsonBody<ResendVerificationBody>(request);
-        const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-        const providedUserId = typeof body.userId === "string" ? body.userId.trim() : "";
-
-        try {
-          const workos = createWorkosClient();
-          const userId = providedUserId || (await findUserIdByEmail(workos, email));
-          if (!userId) {
-            return authErrorResponse("We could not find an account for that email.");
-          }
-
-          await workos.userManagement.sendVerificationEmail({ userId });
-          return jsonResponse({ ok: true });
-        } catch (error) {
-          const status =
-            typeof error === "object" && error !== null && "status" in error
-              ? (error as { status?: unknown }).status
-              : undefined;
-          if (status === 429) {
-            return authErrorResponse("Please wait a moment before requesting another code.", 429);
-          }
-          console.error("[auth] WorkOS resend verification email failed", error);
-          return authErrorResponse("We could not send a new code. Please try again.");
-        }
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/email/verify.tsx b/apps/www/src/routes/api/auth/email/verify.tsx
deleted file mode 100644
index 4419d15ed..000000000
--- a/apps/www/src/routes/api/auth/email/verify.tsx
+++ /dev/null
@@ -1,94 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  authenticateWithOrganizationSelectionChallenge,
-  authErrorResponse,
-  createWorkosClient,
-  findUserIdByEmail,
-  getJsonBody,
-  getSafeReturnPathname,
-  getWorkosAuthConfig,
-  jsonResponse,
-  responseWithSession,
-} from "@/features/auth/lib/workos-user-management.server";
-
-type VerifyEmailBody = {
-  code: string;
-  email?: string;
-  pendingAuthenticationToken?: string;
-  returnPathname?: string;
-};
-
-export const Route = createFileRoute("/api/auth/email/verify")({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const body = await getJsonBody<VerifyEmailBody>(request);
-        const code = typeof body.code === "string" ? body.code.trim() : "";
-        const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-        const pendingAuthenticationToken =
-          typeof body.pendingAuthenticationToken === "string"
-            ? body.pendingAuthenticationToken
-            : "";
-        const returnPathname = getSafeReturnPathname(request, body.returnPathname, "/studio");
-
-        if (!code) {
-          return authErrorResponse("Enter the verification code from your email.");
-        }
-
-        try {
-          const { clientId, cookiePassword } = getWorkosAuthConfig();
-          const workos = createWorkosClient();
-
-          // Preferred path: the pending authentication token from the failed
-          // sign-in/sign-up lets us verify the code AND seal a session in one
-          // call, so the user lands logged in.
-          if (pendingAuthenticationToken) {
-            try {
-              const authResponse = await workos.userManagement.authenticateWithEmailVerification({
-                clientId,
-                code,
-                pendingAuthenticationToken,
-                session: {
-                  cookiePassword,
-                  sealSession: true,
-                },
-              });
-
-              return responseWithSession(authResponse, { redirectTo: returnPathname });
-            } catch (authError) {
-              const organizationSelectionAuthResponse =
-                await authenticateWithOrganizationSelectionChallenge(workos, authError, {
-                  clientId,
-                  cookiePassword,
-                });
-
-              if (organizationSelectionAuthResponse) {
-                return responseWithSession(organizationSelectionAuthResponse, {
-                  redirectTo: returnPathname,
-                });
-              }
-
-              throw authError;
-            }
-          }
-
-          // Fallback (no pending token — e.g. the verify page was reopened cold):
-          // verify the email by user id, then send the user to sign in.
-          const userId = await findUserIdByEmail(workos, email);
-          if (!userId) {
-            return authErrorResponse("We could not find an account for that email.");
-          }
-
-          await workos.userManagement.verifyEmail({ code, userId });
-          return jsonResponse({ verified: true });
-        } catch (error) {
-          console.error("[auth] WorkOS email verification failed", error);
-          return authErrorResponse(
-            "That code is invalid or has expired. Request a new code or sign in again.",
-          );
-        }
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/oauth/$provider.tsx b/apps/www/src/routes/api/auth/oauth/$provider.tsx
deleted file mode 100644
index 31f26d92e..000000000
--- a/apps/www/src/routes/api/auth/oauth/$provider.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  createWorkosClient,
-  getProviderForSlug,
-  getSafeReturnPathnameFromRequest,
-  getWorkosAuthConfig,
-  jsonResponse,
-} from "@/features/auth/lib/workos-user-management.server";
-
-const oauthStateCookieName = "vh-oauth-state";
-
-export const Route = createFileRoute("/api/auth/oauth/$provider")({
-  server: {
-    handlers: {
-      GET: async ({ params, request }) => {
-        const provider = getProviderForSlug(params.provider);
-
-        if (!provider) {
-          return jsonResponse({ error: "Unsupported OAuth provider." }, { status: 404 });
-        }
-
-        const url = new URL(request.url);
-        const state = crypto.randomUUID();
-        const returnPathname = getSafeReturnPathnameFromRequest(request, "/studio");
-        const { clientId } = getWorkosAuthConfig();
-        const workos = createWorkosClient();
-        const location = workos.userManagement.getAuthorizationUrl({
-          clientId,
-          provider,
-          redirectUri: `${url.origin}/api/auth/oauth/callback`,
-          state,
-        });
-
-        const cookieValue = encodeURIComponent(JSON.stringify({ returnPathname, state }));
-        const secure = url.protocol === "https:" ? "; Secure" : "";
-
-        return new Response(null, {
-          headers: {
-            Location: location,
-            "Set-Cookie": `${oauthStateCookieName}=${cookieValue}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600${secure}`,
-          },
-          status: 307,
-        });
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/oauth/callback.tsx b/apps/www/src/routes/api/auth/oauth/callback.tsx
deleted file mode 100644
index aab28adaf..000000000
--- a/apps/www/src/routes/api/auth/oauth/callback.tsx
+++ /dev/null
@@ -1,117 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  authenticateWithOrganizationSelectionChallenge,
-  createWorkosClient,
-  getWorkosAuthConfig,
-  redirectWithSession,
-} from "@/features/auth/lib/workos-user-management.server";
-
-const oauthStateCookieName = "vh-oauth-state";
-
-const getCookieValue = (request: Request, name: string) => {
-  const cookie = request.headers.get("cookie");
-  if (!cookie) {
-    return undefined;
-  }
-
-  return cookie
-    .split(";")
-    .map((part) => part.trim())
-    .find((part) => part.startsWith(`${name}=`))
-    ?.slice(name.length + 1);
-};
-
-const getStoredOAuthState = (request: Request) => {
-  const value = getCookieValue(request, oauthStateCookieName);
-  if (!value) {
-    return undefined;
-  }
-
-  try {
-    return JSON.parse(decodeURIComponent(value)) as {
-      returnPathname?: string;
-      state?: string;
-    };
-  } catch {
-    return undefined;
-  }
-};
-
-const redirectToLogin = (request: Request) => {
-  const secure = new URL(request.url).protocol === "https:" ? "; Secure" : "";
-  return new Response(null, {
-    headers: {
-      Location: "/auth/login?error=oauth_failed",
-      "Set-Cookie": `${oauthStateCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`,
-    },
-    status: 303,
-  });
-};
-
-export const Route = createFileRoute("/api/auth/oauth/callback")({
-  server: {
-    handlers: {
-      GET: async ({ request }) => {
-        const url = new URL(request.url);
-        const code = url.searchParams.get("code");
-        const state = url.searchParams.get("state");
-        const storedState = getStoredOAuthState(request);
-        const returnPathname = storedState?.returnPathname ?? "/studio";
-
-        if (!(code && state && storedState?.state === state)) {
-          return redirectToLogin(request);
-        }
-
-        try {
-          const { clientId, cookiePassword } = getWorkosAuthConfig();
-          const workos = createWorkosClient();
-          const authResponse = await workos.userManagement.authenticateWithCode({
-            clientId,
-            code,
-            session: {
-              cookiePassword,
-              sealSession: true,
-            },
-          });
-
-          const response = await redirectWithSession(authResponse, returnPathname);
-          const secure = url.protocol === "https:" ? "; Secure" : "";
-          response.headers.append(
-            "Set-Cookie",
-            `${oauthStateCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`,
-          );
-          return response;
-        } catch (error) {
-          try {
-            const { clientId, cookiePassword } = getWorkosAuthConfig();
-            const workos = createWorkosClient();
-            const authResponse = await authenticateWithOrganizationSelectionChallenge(
-              workos,
-              error,
-              {
-                clientId,
-                cookiePassword,
-              },
-            );
-
-            if (authResponse) {
-              const response = await redirectWithSession(authResponse, returnPathname);
-              const secure = url.protocol === "https:" ? "; Secure" : "";
-              response.headers.append(
-                "Set-Cookie",
-                `${oauthStateCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0${secure}`,
-              );
-              return response;
-            }
-          } catch (selectionError) {
-            console.error("[auth] WorkOS OAuth organization selection failed", selectionError);
-          }
-
-          console.error("[auth] WorkOS OAuth callback failed", error);
-          return redirectToLogin(request);
-        }
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/password/forgot-password.tsx b/apps/www/src/routes/api/auth/password/forgot-password.tsx
deleted file mode 100644
index 139f7ccde..000000000
--- a/apps/www/src/routes/api/auth/password/forgot-password.tsx
+++ /dev/null
@@ -1,39 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  authErrorResponse,
-  createWorkosClient,
-  getJsonBody,
-  jsonResponse,
-} from "@/features/auth/lib/workos-user-management.server";
-
-type ForgotPasswordBody = {
-  email: string;
-};
-
-export const Route = createFileRoute("/api/auth/password/forgot-password")({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const body = await getJsonBody<ForgotPasswordBody>(request);
-        const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-
-        if (!email) {
-          return authErrorResponse("Enter your email address.");
-        }
-
-        try {
-          const workos = createWorkosClient();
-          await workos.userManagement.createPasswordReset({ email });
-        } catch (error) {
-          console.error("[auth] WorkOS password reset creation failed", error);
-        }
-
-        return jsonResponse({
-          ok: true,
-          message: "If an account exists for that email, a reset link will be sent.",
-        });
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/password/reset-password.tsx b/apps/www/src/routes/api/auth/password/reset-password.tsx
deleted file mode 100644
index 305a24d4d..000000000
--- a/apps/www/src/routes/api/auth/password/reset-password.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  authErrorResponse,
-  createWorkosClient,
-  getJsonBody,
-  jsonResponse,
-} from "@/features/auth/lib/workos-user-management.server";
-
-type ResetPasswordBody = {
-  password: string;
-  token: string;
-};
-
-export const Route = createFileRoute("/api/auth/password/reset-password")({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const body = await getJsonBody<ResetPasswordBody>(request);
-        const token = typeof body.token === "string" ? body.token.trim() : "";
-        const password = typeof body.password === "string" ? body.password : "";
-
-        if (!(token && password)) {
-          return authErrorResponse("Enter a new password from a valid reset link.");
-        }
-
-        try {
-          const workos = createWorkosClient();
-          await workos.userManagement.resetPassword({
-            newPassword: password,
-            token,
-          });
-
-          return jsonResponse({ redirectTo: "/auth/login?reset=success" });
-        } catch (error) {
-          console.error("[auth] WorkOS password reset failed", error);
-          return authErrorResponse("That reset link is invalid or expired.", 400);
-        }
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/password/sign-in.tsx b/apps/www/src/routes/api/auth/password/sign-in.tsx
deleted file mode 100644
index 8826f06b4..000000000
--- a/apps/www/src/routes/api/auth/password/sign-in.tsx
+++ /dev/null
@@ -1,87 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  authenticateWithOrganizationSelectionChallenge,
-  authErrorResponse,
-  createWorkosClient,
-  getEmailVerificationChallenge,
-  getJsonBody,
-  getSafeReturnPathname,
-  getWorkosAuthConfig,
-  jsonResponse,
-  responseWithSession,
-} from "@/features/auth/lib/workos-user-management.server";
-
-type SignInBody = {
-  email: string;
-  password: string;
-  returnPathname?: string;
-};
-
-export const Route = createFileRoute("/api/auth/password/sign-in")({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const body = await getJsonBody<SignInBody>(request);
-        const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-        const password = typeof body.password === "string" ? body.password : "";
-        const returnPathname = getSafeReturnPathname(request, body.returnPathname, "/studio");
-
-        if (!(email && password)) {
-          return authErrorResponse("Enter your email and password.");
-        }
-
-        try {
-          const { clientId, cookiePassword } = getWorkosAuthConfig();
-          const workos = createWorkosClient();
-          const authResponse = await workos.userManagement.authenticateWithPassword({
-            clientId,
-            email,
-            password,
-            session: {
-              cookiePassword,
-              sealSession: true,
-            },
-          });
-
-          return responseWithSession(authResponse, { redirectTo: returnPathname });
-        } catch (error) {
-          // An unverified account can't sign in yet. WorkOS sends a fresh 6-digit
-          // code on this attempt, so we hand the challenge back and let the
-          // verify-email page take over (this also handles users who closed the
-          // page mid sign-up and simply log in again).
-          const challenge = getEmailVerificationChallenge(error);
-          if (challenge) {
-            return jsonResponse({
-              email: challenge.email ?? email,
-              emailVerificationRequired: true,
-              pendingAuthenticationToken: challenge.pendingAuthenticationToken,
-              userId: challenge.userId,
-            });
-          }
-
-          const authResponse = await (async () => {
-            try {
-              const { clientId, cookiePassword } = getWorkosAuthConfig();
-              const workos = createWorkosClient();
-              return await authenticateWithOrganizationSelectionChallenge(workos, error, {
-                clientId,
-                cookiePassword,
-              });
-            } catch (selectionError) {
-              console.error("[auth] WorkOS password organization selection failed", selectionError);
-              return null;
-            }
-          })();
-
-          if (authResponse) {
-            return responseWithSession(authResponse, { redirectTo: returnPathname });
-          }
-
-          console.error("[auth] WorkOS password sign-in failed", error);
-          return authErrorResponse("We could not sign you in with those credentials.", 401);
-        }
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/password/sign-up.tsx b/apps/www/src/routes/api/auth/password/sign-up.tsx
deleted file mode 100644
index a5ce6368a..000000000
--- a/apps/www/src/routes/api/auth/password/sign-up.tsx
+++ /dev/null
@@ -1,99 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-
-import {
-  authenticateWithOrganizationSelectionChallenge,
-  authErrorResponse,
-  createWorkosClient,
-  getEmailVerificationChallenge,
-  getJsonBody,
-  getSafeReturnPathname,
-  getWorkosAuthConfig,
-  jsonResponse,
-  responseWithSession,
-} from "@/features/auth/lib/workos-user-management.server";
-
-type SignUpBody = {
-  email: string;
-  firstName?: string;
-  lastName?: string;
-  password: string;
-  returnPathname?: string;
-};
-
-export const Route = createFileRoute("/api/auth/password/sign-up")({
-  server: {
-    handlers: {
-      POST: async ({ request }) => {
-        const body = await getJsonBody<SignUpBody>(request);
-        const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-        const password = typeof body.password === "string" ? body.password : "";
-        const firstName = typeof body.firstName === "string" ? body.firstName.trim() : "";
-        const lastName = typeof body.lastName === "string" ? body.lastName.trim() : "";
-        const returnPathname = getSafeReturnPathname(request, body.returnPathname, "/studio");
-
-        if (!(email && password)) {
-          return authErrorResponse("Enter your email and password.");
-        }
-
-        try {
-          const { clientId, cookiePassword } = getWorkosAuthConfig();
-          const workos = createWorkosClient();
-
-          await workos.userManagement.createUser({
-            email,
-            firstName: firstName || undefined,
-            lastName: lastName || undefined,
-            password,
-          });
-
-          // The account now exists. Try to start a session immediately; if the
-          // WorkOS environment requires email verification, this step throws and
-          // we surface a "verify your email" state instead of a generic failure.
-          try {
-            const authResponse = await workos.userManagement.authenticateWithPassword({
-              clientId,
-              email,
-              password,
-              session: {
-                cookiePassword,
-                sealSession: true,
-              },
-            });
-
-            return responseWithSession(authResponse, { redirectTo: returnPathname });
-          } catch (authError) {
-            const challenge = getEmailVerificationChallenge(authError);
-            if (challenge) {
-              // Account created and WorkOS sent a 6-digit verification code. We
-              // hand the pending token + user id to the client so the
-              // verify-email page can complete verification and start a session.
-              return jsonResponse({
-                email: challenge.email ?? email,
-                emailVerificationRequired: true,
-                pendingAuthenticationToken: challenge.pendingAuthenticationToken,
-                userId: challenge.userId,
-              });
-            }
-
-            const organizationSelectionAuthResponse =
-              await authenticateWithOrganizationSelectionChallenge(workos, authError, {
-                clientId,
-                cookiePassword,
-              });
-
-            if (organizationSelectionAuthResponse) {
-              return responseWithSession(organizationSelectionAuthResponse, {
-                redirectTo: returnPathname,
-              });
-            }
-
-            throw authError;
-          }
-        } catch (error) {
-          console.error("[auth] WorkOS password sign-up failed", error);
-          return authErrorResponse("We could not create an account with those details.");
-        }
-      },
-    },
-  },
-});
diff --git a/apps/www/src/routes/api/auth/session.tsx b/apps/www/src/routes/api/auth/session.tsx
new file mode 100644
index 000000000..245a01457
--- /dev/null
+++ b/apps/www/src/routes/api/auth/session.tsx
@@ -0,0 +1,24 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import { jsonResponse } from "@/features/auth/lib/http";
+import { readStandaloneSession } from "@/features/auth/lib/standalone-session";
+
+/**
+ * Returns the current session, including its raw token so the browser can
+ * re-seed its bearer-token provider after a reload without making the cookie
+ * readable from script.
+ */
+export const Route = createFileRoute("/api/auth/session")({
+  server: {
+    handlers: {
+      GET: async ({ request }) => {
+        const session = await readStandaloneSession(request);
+        return jsonResponse(
+          session === null
+            ? { accessToken: null, user: null }
+            : { accessToken: session.token, user: session.user },
+        );
+      },
+    },
+  },
+});
diff --git a/apps/www/src/routes/api/auth/sign-in.tsx b/apps/www/src/routes/api/auth/sign-in.tsx
new file mode 100644
index 000000000..c8003befa
--- /dev/null
+++ b/apps/www/src/routes/api/auth/sign-in.tsx
@@ -0,0 +1,85 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import {
+  authErrorResponse,
+  getJsonBody,
+  getSafeReturnPathname,
+  jsonResponse,
+} from "@/features/auth/lib/http";
+import {
+  mintStandaloneSessionToken,
+  standaloneSessionCookie,
+  verifyRootCredentials,
+} from "@/features/auth/lib/standalone-session";
+
+type SignInBody = {
+  username: string;
+  password: string;
+  returnPathname?: string;
+};
+
+/**
+ * Consecutive failures per source address, with a fixed backoff once the
+ * threshold is crossed. In-process state is correct here because the self-host
+ * runtime serves the dashboard from a single Node process; a multi-process
+ * composition would need to move this to shared storage.
+ */
+const FAILURE_THRESHOLD = 5;
+const LOCKOUT_MS = 30_000;
+const attempts = new Map<string, { failures: number; blockedUntil: number }>();
+
+const clientKey = (request: Request): string =>
+  request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+  request.headers.get("cf-connecting-ip") ||
+  "unknown";
+
+const recordFailure = (key: string) => {
+  const entry = attempts.get(key) ?? { blockedUntil: 0, failures: 0 };
+  entry.failures += 1;
+  if (entry.failures >= FAILURE_THRESHOLD) {
+    entry.blockedUntil = Date.now() + LOCKOUT_MS;
+    entry.failures = 0;
+  }
+  attempts.set(key, entry);
+};
+
+/**
+ * Standalone sign-in: verifies the root credentials configured for this
+ * deployment and mints the session token.
+ *
+ * The token is returned in the body as well as the cookie so a split-origin dev
+ * setup (dashboard and API on different ports) can send it as a bearer.
+ */
+export const Route = createFileRoute("/api/auth/sign-in")({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        const key = clientKey(request);
+        const entry = attempts.get(key);
+        if (entry && entry.blockedUntil > Date.now()) {
+          return authErrorResponse("Too many attempts. Try again shortly.", 429);
+        }
+
+        const body = await getJsonBody<SignInBody>(request);
+        const username = typeof body.username === "string" ? body.username : "";
+        const password = typeof body.password === "string" ? body.password : "";
+        const returnPathname = getSafeReturnPathname(request, body.returnPathname, "/studio");
+
+        if (!(await verifyRootCredentials({ password, username }))) {
+          recordFailure(key);
+          // Deliberately does not say which field was wrong.
+          return authErrorResponse("Incorrect username or password.", 401);
+        }
+
+        attempts.delete(key);
+        const token = await mintStandaloneSessionToken();
+
+        return jsonResponse(
+          { accessToken: token, redirectTo: returnPathname },
+          { status: 200 },
+          { "Set-Cookie": standaloneSessionCookie(token, request) },
+        );
+      },
+    },
+  },
+});
diff --git a/apps/www/src/routes/api/auth/sign-out.tsx b/apps/www/src/routes/api/auth/sign-out.tsx
new file mode 100644
index 000000000..b8fbe03be
--- /dev/null
+++ b/apps/www/src/routes/api/auth/sign-out.tsx
@@ -0,0 +1,16 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import { jsonResponse } from "@/features/auth/lib/http";
+import { clearedStandaloneSessionCookie } from "@/features/auth/lib/standalone-session";
+
+/** Clears the standalone session cookie. */
+export const Route = createFileRoute("/api/auth/sign-out")({
+  server: {
+    handlers: {
+      POST: async () =>
+        jsonResponse({ ok: true }, { status: 200 }, {
+          "Set-Cookie": clearedStandaloneSessionCookie(),
+        }),
+    },
+  },
+});
diff --git a/apps/www/src/routes/auth/devices/index.tsx b/apps/www/src/routes/auth/devices/index.tsx
index f9c75f258..946e08d08 100644
--- a/apps/www/src/routes/auth/devices/index.tsx
+++ b/apps/www/src/routes/auth/devices/index.tsx
@@ -3,7 +3,6 @@
 import { useMutation } from "@tanstack/react-query";
 import { createFileRoute, Link, redirect } from "@tanstack/react-router";
 import { zodValidator } from "@tanstack/zod-adapter";
-import { getAuth } from "@workos/authkit-tanstack-react-start";
 import { Button } from "@voidhash/ui";
 import { Loader2 } from "lucide-react";
 import { useState } from "react";
@@ -11,6 +10,7 @@ import { toast } from "sonner";
 import { z } from "zod";
 
 import { AuthHeader, AuthLayout } from "@/features/auth/components/auth-layout";
+import { getSessionUser } from "@/features/auth/lib/session";
 import { createUserApiKeyOptions } from "@/features/auth/lib/tanstack-query";
 import {
   DEVICE_CODE_EXPIRY_MS,
@@ -27,8 +27,8 @@ const devicesSearchSchema = z.object({
 export const Route = createFileRoute("/auth/devices/")({
   component: AuthDevicesPage,
   loader: async ({ location }) => {
-    const auth = await getAuth();
-    if (!auth.user) {
+    const user = await getSessionUser();
+    if (!user) {
       const params = new URLSearchParams(location.searchStr);
       const nextUrl = `/auth/devices?${params.toString()}`;
       throw redirect({ search: { next: nextUrl }, to: "/auth/login" });
@@ -178,7 +178,6 @@ function AuthDevicesPage() {
               <CodeCharacter
                 char={char}
                 key={`${char}-${
-                  // biome-ignore lint/suspicious/noArrayIndexKey: OK in this case
                   i
                 }`}
               />
diff --git a/apps/www/src/routes/auth/forgot-password.tsx b/apps/www/src/routes/auth/forgot-password.tsx
index 0a4a7974c..c6dde0b66 100644
--- a/apps/www/src/routes/auth/forgot-password.tsx
+++ b/apps/www/src/routes/auth/forgot-password.tsx
@@ -1,147 +1,26 @@
-import { Link, createFileRoute } from "@tanstack/react-router";
-import { useMutation } from "@tanstack/react-query";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { zodValidator } from "@tanstack/zod-adapter";
-import {
-  Alert,
-  AlertDescription,
-  AlertTitle,
-  Button,
-  Input,
-  Label,
-} from "@voidhash/ui";
-import { ArrowLeft, Loader2, Mail } from "lucide-react";
-import { type FormEvent, useState } from "react";
 import { z } from "zod";
 
-import { AuthHeader, AuthLayout } from "@/features/auth/components/auth-layout";
-import { requestPasswordReset } from "@/features/auth/lib/auth-api";
-
-const forgotPasswordSearchSchema = z.object({
-  next: z.string().optional(),
-});
+import { authScreens } from "@/features/auth/adapter/ui-adapter";
 
+/**
+ * Self-service screen. Providers that do not offer it — self-host, which has a
+ * single environment-configured user — leave the slot empty, and the route
+ * sends the visitor to sign in instead.
+ */
 export const Route = createFileRoute("/auth/forgot-password")({
-  component: ForgotPasswordPage,
-  validateSearch: zodValidator(forgotPasswordSearchSchema),
+  beforeLoad: () => {
+    if (authScreens.forgotPassword === null) throw redirect({ to: "/auth/login" });
+  },
+  component: ScreenPage,
+  validateSearch: zodValidator(
+    z.object({ email: z.string().optional(), next: z.string().optional(), token: z.string().optional() }),
+  ),
 });
 
-function ForgotPasswordPage() {
-  const searchParams = Route.useSearch();
-  const [email, setEmail] = useState("");
-  const [error, setError] = useState<string>();
-  const [emailSent, setEmailSent] = useState(false);
-  const forgotPasswordMutation = useMutation({
-    mutationFn: requestPasswordReset,
-    onError: (error) => {
-      setError(error.message);
-    },
-    onMutate: () => {
-      setError(undefined);
-    },
-    onSuccess: () => {
-      setEmailSent(true);
-    },
-  });
-
-  const handleSubmit = async (event: FormEvent<HTMLFormElement>) => {
-    event.preventDefault();
-    forgotPasswordMutation.mutate({ email });
-  };
-
-  if (emailSent) {
-    return (
-      <AuthLayout>
-        <AuthHeader
-          description={
-            <>
-              We&apos;ve sent a password reset link to{" "}
-              <span className="font-medium text-foreground">{email}</span>
-            </>
-          }
-          title="Check your email"
-        />
-        <div className="mt-10 flex flex-col gap-6">
-          <Alert>
-            <Mail className="h-4 w-4" />
-            <AlertTitle>Didn&apos;t receive the email?</AlertTitle>
-            <AlertDescription>
-              Check your spam folder or{" "}
-              <button
-                className="underline underline-offset-4"
-                onClick={() => {
-                  setEmailSent(false);
-                  setEmail("");
-                }}
-                type="button"
-              >
-                try another email address
-              </button>
-            </AlertDescription>
-          </Alert>
-        </div>
-        <div className="mt-8 text-center text-sm">
-          <Link
-            className="inline-flex items-center gap-2 text-muted-foreground text-sm hover:text-foreground"
-            search={{ next: searchParams.next }}
-            to="/auth/login"
-          >
-            <ArrowLeft className="h-4 w-4" />
-            Back to login
-          </Link>
-        </div>
-      </AuthLayout>
-    );
-  }
-
-  return (
-    <AuthLayout>
-      <AuthHeader
-        description="Enter the email address you used to create the account and we'll email you instructions to reset your password."
-        title="Forgot password?"
-      />
-      <form className="mt-10 flex flex-col gap-6" onSubmit={handleSubmit}>
-        {error && (
-          <Alert variant="destructive">
-            <AlertTitle>Reset failed</AlertTitle>
-            <AlertDescription>{error}</AlertDescription>
-          </Alert>
-        )}
-
-        <div className="grid gap-6">
-          <div className="grid gap-2">
-            <Label htmlFor="email">Email</Label>
-            <Input
-              autoComplete="email"
-              id="email"
-              onChange={(event) => setEmail(event.target.value)}
-              placeholder="name@example.com"
-              required
-              size="lg"
-              type="email"
-              value={email}
-            />
-          </div>
-          <Button
-            className="w-full cursor-pointer"
-            disabled={forgotPasswordMutation.isPending}
-            size="lg"
-            type="submit"
-          >
-            {forgotPasswordMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-            {forgotPasswordMutation.isPending ? "Sending..." : "Send reset link"}
-          </Button>
-        </div>
-      </form>
-      <div className="mt-8 text-center text-sm">
-        <Link
-          className="inline-flex items-center gap-2 text-muted-foreground text-sm hover:text-foreground"
-          search={{ next: searchParams.next }}
-          to="/auth/login"
-        >
-          <ArrowLeft className="h-4 w-4" />
-          Back to login
-        </Link>
-      </div>
-    </AuthLayout>
-  );
+function ScreenPage() {
+  const { next } = Route.useSearch();
+  const Screen = authScreens.forgotPassword;
+  return Screen === null ? null : <Screen next={next} />;
 }
diff --git a/apps/www/src/routes/auth/index.tsx b/apps/www/src/routes/auth/index.tsx
index 9a0b3760c..78a3e6fa5 100644
--- a/apps/www/src/routes/auth/index.tsx
+++ b/apps/www/src/routes/auth/index.tsx
@@ -1,20 +1,20 @@
 import { Link, createFileRoute, redirect } from "@tanstack/react-router";
-import { getAuth } from "@workos/authkit-tanstack-react-start";
 import { Button } from "@voidhash/ui";
 import { LogOut } from "lucide-react";
 
 import { AuthHeader, AuthLayout } from "@/features/auth/components/auth-layout";
+import { getSessionUser } from "@/features/auth/lib/session";
 import { authMiddleware } from "@/features/auth/middleware/auth";
-import { redirectToSignOut } from "@/features/auth/lib/workos";
+import { redirectToSignOut } from "@/features/auth/lib/sign-out";
 
 export const Route = createFileRoute("/auth/")({
   component: HomePage,
   loader: async () => {
-    const auth = await getAuth();
-    if (!auth.user) {
+    const user = await getSessionUser();
+    if (!user) {
       throw redirect({ to: "/auth/login" });
     }
-    return auth;
+    return { user };
   },
   server: {
     middleware: [authMiddleware],
diff --git a/apps/www/src/routes/auth/login.tsx b/apps/www/src/routes/auth/login.tsx
index a37a45cfb..9a870b028 100644
--- a/apps/www/src/routes/auth/login.tsx
+++ b/apps/www/src/routes/auth/login.tsx
@@ -1,15 +1,8 @@
-import { Link, createFileRoute, useNavigate } from "@tanstack/react-router";
-import { useMutation } from "@tanstack/react-query";
+import { createFileRoute } from "@tanstack/react-router";
 import { zodValidator } from "@tanstack/zod-adapter";
-import { Alert, AlertDescription, AlertTitle, Button, Input, Label, Logo } from "@voidhash/ui";
-import { AlertCircle, CheckCircle, Loader2 } from "lucide-react";
-import { type FormEvent, useState } from "react";
 import { z } from "zod";
 
-import { AuthLenticularBackground } from "@/features/auth/components/auth-lenticular-background";
-import { signInWithPassword } from "@/features/auth/lib/auth-api";
-import { saveEmailVerificationState } from "@/features/auth/lib/email-verification-storage";
-import { signUpCtaLabel } from "@/lib/waitlist";
+import { authScreens } from "@/features/auth/adapter/ui-adapter";
 
 const loginSearchSchema = z.object({
   email: z.string().default(""),
@@ -25,198 +18,7 @@ export const Route = createFileRoute("/auth/login")({
 });
 
 function LoginPage() {
-  const searchParams = Route.useSearch();
-  const navigate = useNavigate();
-  const [error, setError] = useState<string>();
-  const signInMutation = useMutation({
-    mutationFn: signInWithPassword,
-    onError: (error) => {
-      setError(error.message);
-    },
-    onMutate: () => {
-      setError(undefined);
-    },
-    onSuccess: (payload, variables) => {
-      if (payload.emailVerificationRequired) {
-        // The account exists but isn't verified yet. WorkOS just sent a fresh
-        // code; hand off to the verify-email page to complete sign-in.
-        const email = payload.email ?? variables.email;
-        saveEmailVerificationState({
-          email,
-          next: searchParams.next,
-          pendingAuthenticationToken: payload.pendingAuthenticationToken,
-          userId: payload.userId,
-        });
-        navigate({ search: { email, next: searchParams.next }, to: "/auth/verify-email" });
-        return;
-      }
-      window.location.href = payload.redirectTo ?? "/studio";
-    },
-  });
-
-  const handleSubmit = async (event: FormEvent<HTMLFormElement>) => {
-    event.preventDefault();
-
-    const formData = new FormData(event.currentTarget);
-    signInMutation.mutate({
-      email: String(formData.get("email") ?? ""),
-      password: String(formData.get("password") ?? ""),
-      returnPathname: searchParams.next,
-    });
-  };
-
-  const oauthUrl = () => {
-    const params = new URLSearchParams({ returnPathname: searchParams.next ?? "/studio" });
-    return `/api/auth/oauth/github?${params.toString()}`;
-  };
-
-  return (
-    <div className="relative grid min-h-svh overflow-hidden bg-background lg:grid-cols-12">
-      <AuthLenticularBackground className="absolute inset-0" />
-      <div className="relative z-10 col-span-8 flex flex-col gap-4 p-6 md:p-10 bg-linear-to-r from-background to-transparent">
-        <div className="flex justify-center gap-2 md:justify-start">
-          <Link className="flex gap-2 font-medium" to="/">
-            <Logo />
-          </Link>
-        </div>
-        <div className="flex flex-1 items-center justify-center">
-          <div className="w-full max-w-sm">
-            <div className="flex flex-col items-start gap-2 text-left">
-              <h1 className=" text-3xl">Welcome back!</h1>
-            </div>
-            <form className="flex flex-col gap-6 mt-10" onSubmit={handleSubmit}>
-              {(error || searchParams.error === "oauth_failed") && (
-                <div className="mb-6">
-                  <Alert variant="destructive">
-                    <AlertCircle className="h-4 w-4" />
-                    <AlertTitle>Sign-in failed</AlertTitle>
-                    <AlertDescription>
-                      {error ?? "We could not complete the OAuth sign-in."}
-                    </AlertDescription>
-                  </Alert>
-                </div>
-              )}
-
-              {searchParams.error === "insufficient_permissions" && (
-                <div className="mb-6">
-                  <Alert variant="destructive">
-                    <AlertCircle className="h-4 w-4" />
-                    <AlertTitle>Access Denied</AlertTitle>
-                    <AlertDescription>
-                      You don&apos;t have permission to access the requested page.
-                    </AlertDescription>
-                  </Alert>
-                </div>
-              )}
-              {searchParams.signup && (
-                <div className="mb-6">
-                  <Alert>
-                    <CheckCircle className="h-4 w-4" />
-                    <AlertTitle>Your account was successfully created</AlertTitle>
-                    <AlertDescription>You can now login to your account</AlertDescription>
-                  </Alert>
-                </div>
-              )}
-
-              {searchParams.reset === "success" && (
-                <div className="mb-6">
-                  <Alert>
-                    <CheckCircle className="h-4 w-4" />
-                    <AlertTitle>Password updated</AlertTitle>
-                    <AlertDescription>Sign in with your new password.</AlertDescription>
-                  </Alert>
-                </div>
-              )}
-
-              <div className="grid gap-6">
-                <div className="grid gap-2">
-                  <Label htmlFor="email">Email</Label>
-                  <Input
-                    autoComplete="email"
-                    defaultValue={searchParams.email}
-                    id="email"
-                    name="email"
-                    placeholder="name@example.com"
-                    required
-                    size={"lg"}
-                    type="email"
-                  />
-                </div>
-                <div className="grid gap-2">
-                  <div className="flex items-center justify-between">
-                    <Label htmlFor="password">Password</Label>
-                  </div>
-                  <Input
-                    autoComplete="current-password"
-                    id="password"
-                    name="password"
-                    required
-                    size={"lg"}
-                    type="password"
-                  />
-                </div>
-                <Button
-                  className="w-full cursor-pointer"
-                  disabled={signInMutation.isPending}
-                  type="submit"
-                  size={"lg"}
-                >
-                  {signInMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-                  Continue
-                </Button>
-                <div className="relative text-center text-sm after:absolute after:inset-0 after:top-1/2 after:z-0 after:flex after:items-center after:border-accent after:border-t">
-                  <span className="relative z-10 bg-background px-2 text-muted-foreground">OR</span>
-                </div>
-                <div className="flex flex-col gap-4">
-                  <Button
-                    asChild
-                    className="w-full cursor-pointer"
-                    disabled={signInMutation.isPending}
-                    size={"lg"}
-                    type="button"
-                    variant="outline"
-                  >
-                    <a href={oauthUrl()}>
-                      <svg
-                        aria-label="Github"
-                        viewBox="0 0 24 24"
-                        xmlns="http://www.w3.org/2000/svg"
-                      >
-                        <title>Github Icon</title>
-                        <path
-                          d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"
-                          fill="currentColor"
-                        />
-                      </svg>
-                      Continue with Github
-                    </a>
-                  </Button>
-                </div>
-              </div>
-            </form>
-
-            <div className="text-center text-sm mt-8">
-              New to Voidhash?{" "}
-              <Link
-                className="text-muted-foreground text-sm hover:text-foreground underline underline-offset-4"
-                search={{ next: searchParams.next }}
-                to="/auth/sign-up"
-              >
-                {signUpCtaLabel("Sign up")}
-              </Link>
-            </div>
-
-            <div className="text-center mt-6">
-              <Link
-                className="text-muted-foreground text-sm hover:text-foreground underline  underline-offset-4"
-                to="/auth/forgot-password"
-              >
-                Forgot your password?
-              </Link>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  );
+  const { next } = Route.useSearch();
+  const LoginScreen = authScreens.login;
+  return <LoginScreen next={next} />;
 }
diff --git a/apps/www/src/routes/auth/logout.tsx b/apps/www/src/routes/auth/logout.tsx
index 99611c49b..c7f50368d 100644
--- a/apps/www/src/routes/auth/logout.tsx
+++ b/apps/www/src/routes/auth/logout.tsx
@@ -1,20 +1,20 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { signOut } from "@workos/authkit-tanstack-react-start";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { Spinner } from "@voidhash/ui";
 
 import { AuthLenticularBackground } from "@/features/auth/components/auth-lenticular-background";
+import { performSignOut } from "@/features/auth/lib/session";
 import { toSafeReturnPathname } from "@/features/auth/lib/validation";
 
 export const Route = createFileRoute("/auth/logout")({
   component: LogoutPage,
   loader: async ({ location }) => {
-    const returnTo = toSafeReturnPathname(
-      new URLSearchParams(location.searchStr).get("returnTo"),
-    ) ?? "/";
+    const returnTo =
+      toSafeReturnPathname(new URLSearchParams(location.searchStr).get("returnTo")) ?? "/";
 
-    await signOut({
-      data: { returnTo },
-    });
+    // A provider with a hosted sign-out endpoint performs its own redirect and
+    // reports `null`; one that only holds a cookie hands the target back to us.
+    const target = await performSignOut(returnTo);
+    if (target !== null) throw redirect({ href: target });
   },
 });
 
diff --git a/apps/www/src/routes/auth/reset-password.tsx b/apps/www/src/routes/auth/reset-password.tsx
index 83e3620d1..b5966401f 100644
--- a/apps/www/src/routes/auth/reset-password.tsx
+++ b/apps/www/src/routes/auth/reset-password.tsx
@@ -1,191 +1,26 @@
-import { zodResolver } from "@hookform/resolvers/zod";
-import { useMutation } from "@tanstack/react-query";
-import { Link, createFileRoute } from "@tanstack/react-router";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { zodValidator } from "@tanstack/zod-adapter";
-import {
-  Alert,
-  AlertDescription,
-  Button,
-  Form,
-  FormControl,
-  FormField,
-  FormItem,
-  FormLabel,
-  FormMessage,
-  Input,
-} from "@voidhash/ui";
-import { AlertCircle, Loader2 } from "lucide-react";
-import { useState } from "react";
-import { useForm } from "react-hook-form";
 import { z } from "zod";
 
-import { AuthHeader, AuthLayout } from "@/features/auth/components/auth-layout";
-import { resetPassword } from "@/features/auth/lib/auth-api";
-
-const resetPasswordSearchSchema = z.object({
-  next: z.string().optional(),
-  token: z.string().optional(),
-});
+import { authScreens } from "@/features/auth/adapter/ui-adapter";
 
+/**
+ * Self-service screen. Providers that do not offer it — self-host, which has a
+ * single environment-configured user — leave the slot empty, and the route
+ * sends the visitor to sign in instead.
+ */
 export const Route = createFileRoute("/auth/reset-password")({
-  component: ResetPasswordPage,
-  validateSearch: zodValidator(resetPasswordSearchSchema),
+  beforeLoad: () => {
+    if (authScreens.resetPassword === null) throw redirect({ to: "/auth/login" });
+  },
+  component: ScreenPage,
+  validateSearch: zodValidator(
+    z.object({ email: z.string().optional(), next: z.string().optional(), token: z.string().optional() }),
+  ),
 });
 
-const resetPasswordSchema = z
-  .object({
-    confirmPassword: z.string(),
-    password: z
-      .string()
-      .min(8, "Password must be at least 8 characters")
-      .regex(
-        /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/,
-        "Password must contain at least one uppercase letter, one lowercase letter, and one number",
-      ),
-  })
-  .refine((data) => data.password === data.confirmPassword, {
-    message: "Passwords do not match",
-    path: ["confirmPassword"],
-  });
-
-type ResetPasswordForm = z.infer<typeof resetPasswordSchema>;
-
-function ResetPasswordPage() {
-  const searchParams = Route.useSearch();
-  const [success, setSuccess] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const form = useForm<ResetPasswordForm>({
-    defaultValues: {
-      confirmPassword: "",
-      password: "",
-    },
-    resolver: zodResolver(resetPasswordSchema),
-  });
-
-  const { token } = searchParams;
-
-  const resetPasswordMutation = useMutation({
-    mutationFn: resetPassword,
-    onError: (error) => {
-      if (error.message.includes("expired")) {
-        setError("This password reset link has expired. Please request a new one.");
-      } else {
-        setError(error.message);
-      }
-    },
-    onMutate: () => {
-      setError(null);
-    },
-    onSuccess: () => {
-      setSuccess(true);
-    },
-  });
-
-  const onSubmit = (data: ResetPasswordForm) => {
-    if (!token) {
-      setError("Invalid or missing reset token");
-      return;
-    }
-
-    resetPasswordMutation.mutate({
-      password: data.password,
-      token,
-    });
-  };
-
-  if (!token) {
-    return (
-      <AuthLayout>
-        <AuthHeader
-          description="This password reset link is invalid or has expired. Please request a new password reset."
-          title="Invalid link"
-        />
-        <div className="mt-10">
-          <Button asChild className="w-full cursor-pointer" size="lg" variant="outline">
-            <Link search={{ next: searchParams.next }} to="/auth/forgot-password">
-              Request new reset link
-            </Link>
-          </Button>
-        </div>
-      </AuthLayout>
-    );
-  }
-
-  if (success) {
-    return (
-      <AuthLayout>
-        <AuthHeader
-          description="Your password has been reset successfully. You can now sign in with your new password."
-          title="Password reset!"
-        />
-        <div className="mt-10">
-          <Button asChild className="w-full cursor-pointer" size="lg">
-            <Link search={{ next: searchParams.next }} to="/auth/login">
-              Continue to login
-            </Link>
-          </Button>
-        </div>
-      </AuthLayout>
-    );
-  }
-
-  return (
-    <AuthLayout>
-      <AuthHeader
-        description="Enter your new password below. Make sure it's at least 8 characters and includes uppercase, lowercase, and a number."
-        title="Reset your password"
-      />
-      <Form {...form}>
-        <form className="mt-10 flex flex-col gap-6" onSubmit={form.handleSubmit(onSubmit)}>
-          {error && (
-            <Alert variant="destructive">
-              <AlertCircle className="h-4 w-4" />
-              <AlertDescription>{error}</AlertDescription>
-            </Alert>
-          )}
-
-          <div className="grid gap-6">
-            <FormField
-              control={form.control}
-              name="password"
-              render={({ field }) => (
-                <FormItem className="grid gap-2">
-                  <FormLabel>New password</FormLabel>
-                  <FormControl>
-                    <Input autoComplete="new-password" size="lg" type="password" {...field} />
-                  </FormControl>
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-
-            <FormField
-              control={form.control}
-              name="confirmPassword"
-              render={({ field }) => (
-                <FormItem className="grid gap-2">
-                  <FormLabel>Confirm new password</FormLabel>
-                  <FormControl>
-                    <Input autoComplete="new-password" size="lg" type="password" {...field} />
-                  </FormControl>
-                  <FormMessage />
-                </FormItem>
-              )}
-            />
-
-            <Button
-              className="w-full cursor-pointer"
-              disabled={resetPasswordMutation.isPending}
-              size="lg"
-              type="submit"
-            >
-              {resetPasswordMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-              {resetPasswordMutation.isPending ? "Resetting..." : "Reset password"}
-            </Button>
-          </div>
-        </form>
-      </Form>
-    </AuthLayout>
-  );
+function ScreenPage() {
+  const { next } = Route.useSearch();
+  const Screen = authScreens.resetPassword;
+  return Screen === null ? null : <Screen next={next} />;
 }
diff --git a/apps/www/src/routes/auth/sign-up.tsx b/apps/www/src/routes/auth/sign-up.tsx
index eff922362..2e41aea57 100644
--- a/apps/www/src/routes/auth/sign-up.tsx
+++ b/apps/www/src/routes/auth/sign-up.tsx
@@ -1,255 +1,26 @@
-import { zodResolver } from "@hookform/resolvers/zod";
-import { useMutation } from "@tanstack/react-query";
-import { Link, createFileRoute, useNavigate } from "@tanstack/react-router";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { zodValidator } from "@tanstack/zod-adapter";
-import {
-  Alert,
-  AlertDescription,
-  AlertTitle,
-  Button,
-  Form,
-  FormControl,
-  FormField,
-  FormItem,
-  FormLabel,
-  FormMessage,
-  Input,
-  Logo,
-} from "@voidhash/ui";
-import { AlertCircle, Loader2 } from "lucide-react";
-import { useState } from "react";
-import { useForm } from "react-hook-form";
-import { z } from "zod/v3";
+import { z } from "zod";
 
-import { AuthLenticularBackground } from "@/features/auth/components/auth-lenticular-background";
-import { signUpWithPassword } from "@/features/auth/lib/auth-api";
-import { saveEmailVerificationState } from "@/features/auth/lib/email-verification-storage";
-import { provisionCurrentUser } from "@/features/auth/lib/provision-user";
-import { WAITLIST_MODE } from "@/lib/waitlist";
-
-const signUpSearchSchema = z.object({
-  email: z.string().optional(),
-  next: z.string().optional(),
-});
+import { authScreens } from "@/features/auth/adapter/ui-adapter";
 
+/**
+ * Self-service screen. Providers that do not offer it — self-host, which has a
+ * single environment-configured user — leave the slot empty, and the route
+ * sends the visitor to sign in instead.
+ */
 export const Route = createFileRoute("/auth/sign-up")({
-  component: SignUpPage,
-  validateSearch: zodValidator(signUpSearchSchema),
-});
-
-const signUpSchema = z.object({
-  email: z.string().email("Please enter a valid email address"),
-  name: z.string().min(2, "Name must be at least 2 characters"),
-  password: z
-    .string()
-    .min(8, "Password must be at least 8 characters")
-    .regex(
-      /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/,
-      "Password must contain at least one uppercase letter, one lowercase letter, and one number",
-    ),
+  beforeLoad: () => {
+    if (authScreens.signUp === null) throw redirect({ to: "/auth/login" });
+  },
+  component: ScreenPage,
+  validateSearch: zodValidator(
+    z.object({ email: z.string().optional(), next: z.string().optional(), token: z.string().optional() }),
+  ),
 });
 
-type SignUpForm = z.infer<typeof signUpSchema>;
-
-const splitName = (name: string) => {
-  const [firstName = "", ...lastNameParts] = name.trim().split(/\s+/);
-
-  return {
-    firstName,
-    lastName: lastNameParts.join(" "),
-  };
-};
-
-function SignUpPage() {
-  const [error, setError] = useState<string>();
-  const searchParams = Route.useSearch();
-  const navigate = useNavigate();
-
-  const form = useForm<SignUpForm>({
-    defaultValues: {
-      email: searchParams.email ?? "",
-      name: "",
-      password: "",
-    },
-    resolver: zodResolver(signUpSchema),
-  });
-
-  const signUpMutation = useMutation({
-    mutationFn: signUpWithPassword,
-    onError: (error) => {
-      setError(error.message);
-    },
-    onMutate: () => {
-      setError(undefined);
-    },
-    onSuccess: async (payload, variables) => {
-      if (payload.emailVerificationRequired) {
-        const email = payload.email ?? variables.email;
-        saveEmailVerificationState({
-          email,
-          next: searchParams.next,
-          pendingAuthenticationToken: payload.pendingAuthenticationToken,
-          userId: payload.userId,
-        });
-        navigate({ search: { email, next: searchParams.next }, to: "/auth/verify-email" });
-        return;
-      }
-      // Eagerly create the local user record in the backend before landing on
-      // the dashboard, so its first load is a plain read rather than a
-      // write-on-read.
-      await provisionCurrentUser();
-      window.location.href = payload.redirectTo ?? "/studio";
-    },
-  });
-
-  const onSubmit = (data: SignUpForm) => {
-    const { firstName, lastName } = splitName(data.name);
-
-    signUpMutation.mutate({
-      email: data.email,
-      firstName,
-      lastName,
-      password: data.password,
-      returnPathname: searchParams.next,
-    });
-  };
-
-  const oauthUrl = () => {
-    const params = new URLSearchParams({ returnPathname: searchParams.next ?? "/studio" });
-    return `/api/auth/oauth/github?${params.toString()}`;
-  };
-
-  const isSubmitting = signUpMutation.isPending || signUpMutation.isSuccess;
-
-  return (
-    <div className="relative grid min-h-svh overflow-hidden bg-background lg:grid-cols-12">
-      <AuthLenticularBackground className="absolute inset-0" />
-      <div className="relative z-10 col-span-8 flex flex-col gap-4 p-6 md:p-10 bg-linear-to-r from-background to-transparent">
-        <div className="flex justify-center gap-2 md:justify-start">
-          <Link className="flex gap-2 font-medium" to="/">
-            <Logo />
-          </Link>
-        </div>
-        <div className="flex flex-1 items-center justify-center">
-          <div className="w-full max-w-sm">
-            <div className="flex flex-col items-start gap-2 text-left">
-              <h1 className=" text-3xl">
-                {WAITLIST_MODE ? "Join the waitlist" : "Create your account"}
-              </h1>
-              {WAITLIST_MODE && (
-                <p className="text-muted-foreground">
-                  Create your account to claim your spot. We're onboarding new teams in batches and
-                  will email you as soon as it's your turn.
-                </p>
-              )}
-            </div>
-            <Form {...form}>
-              <form className="flex flex-col gap-6 mt-10" onSubmit={form.handleSubmit(onSubmit)}>
-                {error && (
-                  <div className="mb-6">
-                    <Alert variant="destructive">
-                      <AlertCircle className="h-4 w-4" />
-                      <AlertTitle>Sign-up failed</AlertTitle>
-                      <AlertDescription>{error}</AlertDescription>
-                    </Alert>
-                  </div>
-                )}
-
-                <div className="grid gap-6">
-                  <FormField
-                    control={form.control}
-                    name="name"
-                    render={({ field }) => (
-                      <FormItem className="grid gap-2">
-                        <FormLabel>Name</FormLabel>
-                        <FormControl>
-                          <Input placeholder="John Doe" size="lg" {...field} />
-                        </FormControl>
-                        <FormMessage />
-                      </FormItem>
-                    )}
-                  />
-                  <FormField
-                    control={form.control}
-                    name="email"
-                    render={({ field }) => (
-                      <FormItem className="grid gap-2">
-                        <FormLabel>Email</FormLabel>
-                        <FormControl>
-                          <Input placeholder="name@example.com" size="lg" type="email" {...field} />
-                        </FormControl>
-                        <FormMessage />
-                      </FormItem>
-                    )}
-                  />
-                  <FormField
-                    control={form.control}
-                    name="password"
-                    render={({ field }) => (
-                      <FormItem className="grid gap-2">
-                        <FormLabel>Password</FormLabel>
-                        <FormControl>
-                          <Input size="lg" type="password" {...field} />
-                        </FormControl>
-                        <FormMessage />
-                      </FormItem>
-                    )}
-                  />
-                  <Button
-                    className="w-full cursor-pointer"
-                    disabled={isSubmitting}
-                    size="lg"
-                    type="submit"
-                  >
-                    {isSubmitting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-                    Continue
-                  </Button>
-                  <div className="relative text-center text-sm after:absolute after:inset-0 after:top-1/2 after:z-0 after:flex after:items-center after:border-accent after:border-t">
-                    <span className="relative z-10 bg-background px-2 text-muted-foreground">
-                      OR
-                    </span>
-                  </div>
-                  <div className="flex flex-col gap-4">
-                    <Button
-                      asChild
-                      className="w-full cursor-pointer"
-                      disabled={signUpMutation.isPending}
-                      size="lg"
-                      type="button"
-                      variant="outline"
-                    >
-                      <a href={oauthUrl()}>
-                        <svg
-                          aria-label="Github"
-                          viewBox="0 0 24 24"
-                          xmlns="http://www.w3.org/2000/svg"
-                        >
-                          <title>Github Icon</title>
-                          <path
-                            d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"
-                            fill="currentColor"
-                          />
-                        </svg>
-                        Continue with Github
-                      </a>
-                    </Button>
-                  </div>
-                </div>
-              </form>
-            </Form>
-            <div className="text-center text-sm mt-8">
-              Already have an account?{" "}
-              <Link
-                className="text-muted-foreground text-sm hover:text-foreground underline underline-offset-4"
-                search={{ next: searchParams.next }}
-                to="/auth/login"
-              >
-                Sign in
-              </Link>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  );
+function ScreenPage() {
+  const { next } = Route.useSearch();
+  const Screen = authScreens.signUp;
+  return Screen === null ? null : <Screen next={next} />;
 }
diff --git a/apps/www/src/routes/auth/verify-email.tsx b/apps/www/src/routes/auth/verify-email.tsx
index 98b01ce25..417c465d1 100644
--- a/apps/www/src/routes/auth/verify-email.tsx
+++ b/apps/www/src/routes/auth/verify-email.tsx
@@ -1,226 +1,26 @@
-import { useMutation } from "@tanstack/react-query";
-import { Link, createFileRoute, useNavigate } from "@tanstack/react-router";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { zodValidator } from "@tanstack/zod-adapter";
-import {
-  Alert,
-  AlertDescription,
-  AlertTitle,
-  Button,
-  InputOTP,
-  InputOTPGroup,
-  InputOTPSlot,
-} from "@voidhash/ui";
-import { AlertCircle, Loader2, MailCheck } from "lucide-react";
-import { useEffect, useMemo, useState } from "react";
 import { z } from "zod";
 
-import { AuthHeader, AuthLayout } from "@/features/auth/components/auth-layout";
-import { resendVerificationCode, verifyEmailCode } from "@/features/auth/lib/auth-api";
-import {
-  clearEmailVerificationState,
-  loadEmailVerificationState,
-} from "@/features/auth/lib/email-verification-storage";
-import { provisionCurrentUser } from "@/features/auth/lib/provision-user";
-
-const verifyEmailSearchSchema = z.object({
-  email: z.string().optional(),
-  next: z.string().optional(),
-});
+import { authScreens } from "@/features/auth/adapter/ui-adapter";
 
+/**
+ * Self-service screen. Providers that do not offer it — self-host, which has a
+ * single environment-configured user — leave the slot empty, and the route
+ * sends the visitor to sign in instead.
+ */
 export const Route = createFileRoute("/auth/verify-email")({
-  component: VerifyEmailPage,
-  validateSearch: zodValidator(verifyEmailSearchSchema),
+  beforeLoad: () => {
+    if (authScreens.verifyEmail === null) throw redirect({ to: "/auth/login" });
+  },
+  component: ScreenPage,
+  validateSearch: zodValidator(
+    z.object({ email: z.string().optional(), next: z.string().optional(), token: z.string().optional() }),
+  ),
 });
 
-const CODE_LENGTH = 6;
-const RESEND_COOLDOWN_SECONDS = 30;
-const OTP_SLOTS = Array.from({ length: CODE_LENGTH }, (_, index) => index);
-
-function VerifyEmailPage() {
-  const searchParams = Route.useSearch();
-  const navigate = useNavigate();
-
-  // The pending token + user id are written to sessionStorage by the sign-up /
-  // sign-in flow. They survive a refresh but are intentionally lost when the tab
-  // closes — at which point the user signs in again to restart with a fresh code.
-  const stored = useMemo(() => loadEmailVerificationState(), []);
-  const email = stored?.email ?? searchParams.email ?? "";
-  const next = stored?.next ?? searchParams.next;
-  const pendingAuthenticationToken = stored?.pendingAuthenticationToken;
-  const userId = stored?.userId;
-
-  const [code, setCode] = useState("");
-  const [error, setError] = useState<string>();
-  const [info, setInfo] = useState<string>();
-  const [cooldown, setCooldown] = useState(0);
-
-  useEffect(() => {
-    if (cooldown <= 0) {
-      return;
-    }
-    const timer = window.setTimeout(() => setCooldown((value) => value - 1), 1000);
-    return () => window.clearTimeout(timer);
-  }, [cooldown]);
-
-  const verifyMutation = useMutation({
-    mutationFn: verifyEmailCode,
-    onError: (mutationError) => {
-      setError(mutationError.message);
-      setCode("");
-    },
-    onMutate: () => {
-      setError(undefined);
-      setInfo(undefined);
-    },
-    onSuccess: async (payload) => {
-      clearEmailVerificationState();
-      if (payload.redirectTo) {
-        // Verified with a session — eagerly create the local user record in the
-        // backend before landing in the app, so the first dashboard load is a
-        // plain read rather than a write-on-read.
-        await provisionCurrentUser();
-        window.location.href = payload.redirectTo;
-        return;
-      }
-      // Verified without a session (no pending token) — send them to sign in.
-      navigate({ search: { email, next }, to: "/auth/login" });
-    },
-  });
-
-  const resendMutation = useMutation({
-    mutationFn: resendVerificationCode,
-    onError: (mutationError) => {
-      setError(mutationError.message);
-    },
-    onMutate: () => {
-      setError(undefined);
-      setInfo(undefined);
-    },
-    onSuccess: () => {
-      setInfo(`We sent a new code to ${email || "your email"}.`);
-      setCooldown(RESEND_COOLDOWN_SECONDS);
-    },
-  });
-
-  const submitCode = (value: string) => {
-    if (value.length !== CODE_LENGTH || verifyMutation.isPending) {
-      return;
-    }
-    verifyMutation.mutate({
-      code: value,
-      email,
-      pendingAuthenticationToken,
-      returnPathname: next,
-    });
-  };
-
-  // Without an email or a pending token there is nothing to verify against
-  // (e.g. the page was opened directly). Point the user back to sign in.
-  const hasContext = Boolean(email || pendingAuthenticationToken);
-
-  if (!hasContext) {
-    return (
-      <AuthLayout>
-        <AuthHeader
-          description="Sign in with your email and password and we'll send you a fresh verification code."
-          title="Verify your email"
-        />
-        <div className="mt-10">
-          <Button asChild className="w-full cursor-pointer" size="lg">
-            <Link search={{ next }} to="/auth/login">
-              Go to sign in
-            </Link>
-          </Button>
-        </div>
-      </AuthLayout>
-    );
-  }
-
-  return (
-    <AuthLayout>
-      <AuthHeader
-        description={
-          <>
-            Enter the 6-digit code we sent to{" "}
-            <span className="font-medium text-foreground">{email || "your email"}</span>.
-          </>
-        }
-        title="Check your email"
-      />
-      <div className="mt-10 flex flex-col gap-6">
-        {error && (
-          <Alert variant="destructive">
-            <AlertCircle className="h-4 w-4" />
-            <AlertTitle>Verification failed</AlertTitle>
-            <AlertDescription>{error}</AlertDescription>
-          </Alert>
-        )}
-        {info && (
-          <Alert>
-            <MailCheck className="h-4 w-4" />
-            <AlertDescription>{info}</AlertDescription>
-          </Alert>
-        )}
-
-        <form
-          className="flex flex-col gap-6"
-          onSubmit={(event) => {
-            event.preventDefault();
-            submitCode(code);
-          }}
-        >
-          <InputOTP
-            autoFocus
-            disabled={verifyMutation.isPending}
-            maxLength={CODE_LENGTH}
-            onChange={setCode}
-            onComplete={submitCode}
-            value={code}
-          >
-            <InputOTPGroup>
-              {OTP_SLOTS.map((slot) => (
-                <InputOTPSlot index={slot} key={slot} />
-              ))}
-            </InputOTPGroup>
-          </InputOTP>
-
-          <Button
-            className="w-full cursor-pointer"
-            disabled={
-              verifyMutation.isPending ||
-              verifyMutation.isSuccess ||
-              code.length !== CODE_LENGTH
-            }
-            size="lg"
-            type="submit"
-          >
-            {verifyMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-            {verifyMutation.isPending ? "Verifying..." : "Verify email"}
-          </Button>
-        </form>
-
-        <div className="text-muted-foreground text-sm">
-          Didn&apos;t get a code?{" "}
-          <button
-            className="text-foreground underline underline-offset-4 disabled:cursor-not-allowed disabled:opacity-60"
-            disabled={resendMutation.isPending || cooldown > 0}
-            onClick={() => resendMutation.mutate({ email, userId })}
-            type="button"
-          >
-            {cooldown > 0 ? `Resend in ${cooldown}s` : "Resend code"}
-          </button>
-        </div>
-      </div>
-
-      <div className="mt-8 text-center text-sm">
-        <Link
-          className="text-muted-foreground text-sm hover:text-foreground underline underline-offset-4"
-          search={{ next }}
-          to="/auth/login"
-        >
-          Back to sign in
-        </Link>
-      </div>
-    </AuthLayout>
-  );
+function ScreenPage() {
+  const { next } = Route.useSearch();
+  const Screen = authScreens.verifyEmail;
+  return Screen === null ? null : <Screen next={next} />;
 }
diff --git a/apps/www/src/routes/design/$.tsx b/apps/www/src/routes/design/$.tsx
deleted file mode 100644
index a2eda62fa..000000000
--- a/apps/www/src/routes/design/$.tsx
+++ /dev/null
@@ -1,174 +0,0 @@
-import { createServerFn } from "@tanstack/react-start";
-import { createFileRoute, notFound, redirect } from "@tanstack/react-router";
-import browserCollections from "@generated/browser";
-import type * as PageTree from "fumadocs-core/page-tree";
-import {
-  Accordion as DocsAccordion,
-  Accordions as DocsAccordions,
-} from "fumadocs-ui/components/accordion";
-import { Callout } from "fumadocs-ui/components/callout";
-import {
-  File as DocsFile,
-  Files as DocsFiles,
-  Folder as DocsFolder,
-} from "fumadocs-ui/components/files";
-import { Step, Steps } from "fumadocs-ui/components/steps";
-import { Tab as DocsTab, Tabs as DocsTabs } from "fumadocs-ui/components/tabs";
-import { TypeTable } from "fumadocs-ui/components/type-table";
-import defaultMdxComponents from "fumadocs-ui/mdx";
-import { type ComponentProps, Suspense, useMemo } from "react";
-
-import { Preview } from "@/features/design/components/docs/preview";
-import * as Registry from "@/features/design/components/docs/component-registry";
-import { DocsLayout } from "@/features/design/components/layout/docs";
-import {
-  DocsBody,
-  DocsDescription,
-  DocsPage,
-  DocsTitle,
-} from "@/features/design/components/layout/page";
-import { getSource } from "@/features/design/lib/source";
-
-interface RedirectPayload {
-  redirectTo: string;
-}
-
-interface PagePayload {
-  description: string | undefined;
-  pageTree: {};
-  path: string;
-  title: string;
-}
-
-type ServerPayload = PagePayload | RedirectPayload;
-
-export const Route = createFileRoute("/design/$")({
-  component: Page,
-  loader: async ({ params }) => {
-    const slugs = params._splat?.split("/").filter(Boolean) ?? [];
-    if (slugs.length === 0) {
-      throw notFound();
-    }
-
-    const result = (await serverLoader({ data: slugs })) as ServerPayload;
-    if ("redirectTo" in result) {
-      throw redirect({
-        params: {
-          _splat: result.redirectTo,
-        },
-        to: "/design/$",
-      });
-    }
-
-    return result;
-  },
-  notFoundComponent: () => <div>Page not found</div>,
-});
-
-const serverLoader = createServerFn({ method: "GET" })
-  .inputValidator((slugs: string[]) => slugs)
-  .handler(async ({ data: slugs }) => {
-    const source = await getSource();
-    const page = source.getPage(slugs);
-    if (!page) {
-      const fallbackPage = source
-        .getPages()
-        .find(
-          (candidate) =>
-            candidate.slugs.length > slugs.length &&
-            slugs.every((slug, index) => candidate.slugs[index] === slug),
-        );
-
-      if (fallbackPage) {
-        return {
-          redirectTo: fallbackPage.slugs.join("/"),
-        };
-      }
-
-      throw notFound();
-    }
-
-    return {
-      description: page.data.description,
-      pageTree: source.getPageTree() as {},
-      path: page.path,
-      title: page.data.title,
-    };
-  });
-
-const clientLoader = browserCollections.design.createClientLoader({
-  component({ default: MDX, frontmatter }) {
-    return (
-      <DocsPage full={frontmatter.full === true}>
-        <DocsTitle>{frontmatter.title}</DocsTitle>
-        <DocsDescription>{frontmatter.description}</DocsDescription>
-        <DocsBody>
-          <MDX
-            components={{
-              ...defaultMdxComponents,
-              ...Registry,
-              Preview,
-              Step,
-              Steps,
-              DocsFile,
-              DocsFolder,
-              DocsFiles,
-              DocsTab,
-              DocsTabs,
-              TypeTable,
-              DocsAccordion,
-              DocsAccordions,
-              a: DocsMdxLink,
-              Callout: ({
-                children,
-                type,
-                ...props
-              }: {
-                children: React.ReactNode;
-                type?: "info" | "warn" | "error" | "success" | "warning";
-                [key: string]: unknown;
-              }) => (
-                <Callout type={type} {...props}>
-                  {children}
-                </Callout>
-              ),
-              iframe: (props) => <iframe {...props} className="h-[500px] w-full" />,
-            }}
-          />
-        </DocsBody>
-      </DocsPage>
-    );
-  },
-  id: "design",
-});
-
-function PageContent({ path }: { path: string }) {
-  const Content = useMemo(() => clientLoader.getComponent(path), [path]);
-  return <Content />;
-}
-
-function Page() {
-  const data = Route.useLoaderData() as PagePayload;
-
-  return (
-    <DocsLayout tree={data.pageTree as PageTree.Root}>
-      <Suspense>
-        <PageContent path={data.path} />
-      </Suspense>
-    </DocsLayout>
-  );
-}
-
-function DocsMdxLink(props: ComponentProps<"a">) {
-  const href = props.href;
-  if (!href) {
-    return <a {...props} />;
-  }
-
-  const normalizedHref =
-    href.startsWith("/") && !href.startsWith("/design") && !href.startsWith("//")
-      ? `/design${href}`
-      : href;
-
-  return <a {...props} href={normalizedHref} />;
-}
diff --git a/apps/www/src/routes/design/api/search.ts b/apps/www/src/routes/design/api/search.ts
deleted file mode 100644
index 083c95ecd..000000000
--- a/apps/www/src/routes/design/api/search.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { createFromSource } from "fumadocs-core/search/server";
-
-import { getSource } from "@/features/design/lib/source";
-
-let searchApiPromise: Promise<ReturnType<typeof createFromSource>> | undefined;
-
-const getSearchApi = (): Promise<ReturnType<typeof createFromSource>> => {
-  searchApiPromise ??= getSource().then(createFromSource);
-  return searchApiPromise;
-};
-
-export const Route = createFileRoute("/design/api/search")({
-  server: {
-    handlers: {
-      GET: async ({ request }) => (await getSearchApi()).GET(request),
-    },
-  },
-});
diff --git a/apps/www/src/routes/design/index.tsx b/apps/www/src/routes/design/index.tsx
deleted file mode 100644
index c36c3bd44..000000000
--- a/apps/www/src/routes/design/index.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-import { createFileRoute, redirect } from "@tanstack/react-router";
-
-export const Route = createFileRoute("/design/")({
-  beforeLoad: () => {
-    throw redirect({
-      params: {
-        _splat: "components/overview",
-      },
-      to: "/design/$",
-    });
-  },
-  component: () => null,
-});
diff --git a/apps/www/src/routes/design/route.tsx b/apps/www/src/routes/design/route.tsx
deleted file mode 100644
index 30f075a7b..000000000
--- a/apps/www/src/routes/design/route.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { Outlet, createFileRoute } from "@tanstack/react-router";
-import { RootProvider } from "fumadocs-ui/provider/tanstack";
-
-import { DESIGN_PATH } from "@/lib/paths";
-
-export const Route = createFileRoute("/design")({
-  component: DesignLayout,
-  head: () => ({
-    links: [
-      {
-        href: `${DESIGN_PATH}/favicon.ico`,
-        rel: "icon",
-        type: "image/x-icon",
-      },
-      {
-        href: `${DESIGN_PATH}/apple-icon.png`,
-        rel: "apple-touch-icon",
-      },
-    ],
-    meta: [
-      { title: "Voidhash Design System" },
-      {
-        content: "Design system documentation for Voidhash UI components.",
-        name: "description",
-      },
-    ],
-  }),
-});
-
-function DesignLayout() {
-  return (
-    <RootProvider
-      search={{
-        options: {
-          api: `${DESIGN_PATH}/api/search`,
-        },
-      }}
-    >
-      <Outlet />
-    </RootProvider>
-  );
-}
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/activity.events.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/activity.events.tsx
index 24edd5798..e68a323ca 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/activity.events.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/activity.events.tsx
@@ -382,7 +382,6 @@ function PropertyRow({ name, value }: { name: string; value: unknown }) {
         <div className="ml-3 border-border/60 border-l pl-2">
           {isArray
             ? (value as unknown[]).map((entry, index) => (
-                // biome-ignore lint/suspicious/noArrayIndexKey: arrays are static per render
                 <PropertyRow key={index} name={String(index)} value={entry} />
               ))
             : Object.entries(value as Record<string, unknown>).map(([k, v]) => (
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/paywalls.index.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/paywalls.index.tsx
index 1873b020b..79f408c73 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/paywalls.index.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/paywalls.index.tsx
@@ -90,7 +90,6 @@ function PaywallsPageSkeleton() {
       </PageBar>
       <div className="grid w-full grid-cols-2 gap-6 px-4 pt-4 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-5">
         {Array.from({ length: 5 }).map((_, index) => (
-          // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
           <PaywallCardSkeleton key={index} />
         ))}
       </div>
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/api-keys.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/api-keys.tsx
index ebd99d8c0..0dd04f193 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/api-keys.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/api-keys.tsx
@@ -34,7 +34,6 @@ function ProjectApiKeysPageSkeleton() {
     <SettingsPage description="Manage your API keys." title="API Keys">
       <SettingsCard className="grid gap-0 divide-y">
         {Array.from({ length: 3 }).map((_, index) => (
-          // biome-ignore lint/suspicious/noArrayIndexKey: just a skeleton
           <ApiKeyRecordSkeleton key={index} />
         ))}
       </SettingsCard>
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/perks.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/perks.tsx
index e7431a427..1dd220142 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/perks.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/perks.tsx
@@ -39,7 +39,6 @@ function PerksPageSkeleton() {
       <div className="mx-auto w-full max-w-4xl px-4 pt-4">
         <Card className="grid gap-0 divide-y p-0">
           {Array.from({ length: 3 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: just a skeleton
             <PerkRecordSkeleton key={index} />
           ))}
         </Card>
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.$deliveryId.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.$deliveryId.tsx
index 442c09451..d67359843 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.$deliveryId.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.$deliveryId.tsx
@@ -70,7 +70,6 @@ function WebhookDeliveryDetailPageSkeleton() {
               <CardContent>
                 <div className="space-y-4">
                   {Array.from({ length: 3 }).map((_, i) => (
-                    // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
                     <Skeleton key={i} className="h-16 w-full" />
                   ))}
                 </div>
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.index.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.index.tsx
index 6b01ca784..456165f20 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.index.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.$endpointId.index.tsx
@@ -59,7 +59,6 @@ function WebhookEndpointDetailPageSkeleton() {
               </CardHeader>
               <CardContent className="divide-y divide-border border-border border-t px-0">
                 {Array.from({ length: 3 }).map((_, i) => (
-                  // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
                   <WebhookDeliveryRecordSkeleton key={i} />
                 ))}
               </CardContent>
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.index.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.index.tsx
index 3ad9fed1a..9bb7ef6a6 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.index.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/_project/$organizationSlug/$projectSlug/settings/webhooks.index.tsx
@@ -35,7 +35,6 @@ function ProjectWebhooksPageSkeleton() {
     <SettingsPage description="Manage your webhook endpoints." title="Webhooks">
       <SettingsCard className="grid gap-0 divide-y">
         {Array.from({ length: 3 }).map((_, index) => (
-          // biome-ignore lint/suspicious/noArrayIndexKey: just a skeleton
           <WebhookEndpointRecordSkeleton key={index} />
         ))}
       </SettingsCard>
diff --git a/apps/www/src/routes/studio/_authenticated/_dashboard/route.tsx b/apps/www/src/routes/studio/_authenticated/_dashboard/route.tsx
index 14949eaa7..43c3d5dc6 100644
--- a/apps/www/src/routes/studio/_authenticated/_dashboard/route.tsx
+++ b/apps/www/src/routes/studio/_authenticated/_dashboard/route.tsx
@@ -1,7 +1,7 @@
 import { createFileRoute, Outlet } from "@tanstack/react-router";
 import { Logo, SidebarProvider, useIsMobile } from "@voidhash/ui";
 
-import { redirectToSignOut } from "@/features/auth/lib/workos";
+import { redirectToSignOut } from "@/features/auth/lib/sign-out";
 
 export const Route = createFileRoute("/studio/_authenticated/_dashboard")({
   component: RouteComponent,
diff --git a/apps/www/src/routes/studio/_authenticated/create-organization/index.tsx b/apps/www/src/routes/studio/_authenticated/create-organization/index.tsx
index 1fda2f4ee..04a4966d1 100644
--- a/apps/www/src/routes/studio/_authenticated/create-organization/index.tsx
+++ b/apps/www/src/routes/studio/_authenticated/create-organization/index.tsx
@@ -23,7 +23,7 @@ import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod/v3";
 
-import { redirectToSignOut } from "@/features/auth/lib/workos";
+import { redirectToSignOut } from "@/features/auth/lib/sign-out";
 import {
   addCreatedOrganizationToCurrentUserCache,
   createOrganizationOptions,
diff --git a/apps/www/src/routes/studio/_authenticated/route.tsx b/apps/www/src/routes/studio/_authenticated/route.tsx
index 300b89cb6..a7842d8aa 100644
--- a/apps/www/src/routes/studio/_authenticated/route.tsx
+++ b/apps/www/src/routes/studio/_authenticated/route.tsx
@@ -1,10 +1,12 @@
 import { useQuery } from "@tanstack/react-query";
 import type { ErrorComponentProps } from "@tanstack/react-router";
 import { createFileRoute, Outlet, redirect } from "@tanstack/react-router";
-import { getAuth } from "@workos/authkit-tanstack-react-start";
-import type { User as WorkosUser } from "@workos-inc/node";
 import type { User as RpcUser } from "@voidhash/rpc";
 import { Spinner } from "@voidhash/ui";
+import {
+  getSessionUser,
+  type SessionUser,
+} from "@/features/auth/lib/session";
 import { AuthProvider } from "@/features/studio/components/auth-context";
 import { DefaultCatchBoundary } from "@/features/studio/components/default-cache-boundary";
 import { DashboardShellSkeleton } from "@/features/studio/shell/components/skeleton";
@@ -70,19 +72,23 @@ const toDate = (value: unknown) => {
   return new Date();
 };
 
-const getWorkosUserName = (user: WorkosUser) => {
+const getSessionUserName = (user: SessionUser) => {
   const name = [user.firstName, user.lastName].filter(Boolean).join(" ").trim();
   return name.length > 0 ? name : user.email;
 };
 
-const getWorkosFallbackUser = (user: WorkosUser) =>
+/**
+ * Minimal user assembled from the identity provider's session when the
+ * `CurrentUser` RPC cannot reach the database, so the shell still renders.
+ */
+const getSessionFallbackUser = (user: SessionUser) =>
   ({
     createdAt: toDate(user.createdAt),
     email: user.email,
     emailVerified: user.emailVerified,
     id: user.externalId ?? user.id,
     image: user.profilePictureUrl ?? null,
-    name: getWorkosUserName(user),
+    name: getSessionUserName(user),
     organizations: [],
     projects: [],
     role: null,
@@ -92,7 +98,7 @@ const getWorkosFallbackUser = (user: WorkosUser) =>
 export const Route = createFileRoute("/studio/_authenticated")({
   ssr: false,
   loader: async ({ context, location }) => {
-    const auth = await getAuth();
+    const sessionUser = await getSessionUser();
 
     const redirectToLogin = (): never => {
       const nextPath = `${location.pathname}${location.searchStr}${location.hash}`;
@@ -100,7 +106,7 @@ export const Route = createFileRoute("/studio/_authenticated")({
       throw redirect({ href: `/auth/login?${searchParams.toString()}` });
     };
 
-    const authenticatedWorkosUser = auth.user ?? redirectToLogin();
+    const authenticatedUser = sessionUser ?? redirectToLogin();
 
     try {
       // Read through the query cache so an optimistic write (e.g. right after
@@ -116,7 +122,7 @@ export const Route = createFileRoute("/studio/_authenticated")({
       return user;
     } catch (error) {
       if (isDatabaseAuthenticationError(error)) {
-        const user = getWorkosFallbackUser(authenticatedWorkosUser);
+        const user = getSessionFallbackUser(authenticatedUser);
         context.queryClient.setQueryData(queryKeys.user.getUser(), user);
         return user;
       }
diff --git a/apps/www/src/routes/studio/_authenticated/waitlist.tsx b/apps/www/src/routes/studio/_authenticated/waitlist.tsx
index 3f777dc25..355ca4f76 100644
--- a/apps/www/src/routes/studio/_authenticated/waitlist.tsx
+++ b/apps/www/src/routes/studio/_authenticated/waitlist.tsx
@@ -4,7 +4,7 @@ import { Link, Navigate, createFileRoute } from "@tanstack/react-router";
 import { Card, CardContent, Logo } from "@voidhash/ui";
 import { Check } from "lucide-react";
 
-import { redirectToSignOut } from "@/features/auth/lib/workos";
+import { redirectToSignOut } from "@/features/auth/lib/sign-out";
 import { useAuth } from "@/features/studio/components/auth-context";
 import { isOrganizationWaitlisted } from "@/lib/waitlist";
 
diff --git a/apps/www/src/start.ts b/apps/www/src/start.ts
index fb50cc38d..3793ce78e 100644
--- a/apps/www/src/start.ts
+++ b/apps/www/src/start.ts
@@ -1,5 +1,6 @@
 import { createCsrfMiddleware, createStart } from "@tanstack/react-start";
-import { authkitMiddleware } from "@workos/authkit-tanstack-react-start";
+
+import { authRequestMiddleware } from "@/features/auth/adapter/session-adapter";
 
 const localHostnames = new Set(["0.0.0.0", "127.0.0.1", "[::1]", "localhost"]);
 
@@ -38,5 +39,7 @@ const csrfMiddleware = createCsrfMiddleware({
 });
 
 export const startInstance = createStart(() => ({
-  requestMiddleware: [csrfMiddleware, authkitMiddleware()],
+  // Providers that maintain a server-side session (refreshing a sealed cookie,
+  // for example) contribute their middleware through the adapter slot.
+  requestMiddleware: [csrfMiddleware, ...authRequestMiddleware],
 }));
diff --git a/apps/www/src/styles/globals.css b/apps/www/src/styles/globals.css
index 822e680b2..f7f4d8372 100644
--- a/apps/www/src/styles/globals.css
+++ b/apps/www/src/styles/globals.css
@@ -1,4 +1,3 @@
-/** biome-ignore-all lint/nursery/noUnknownAtRule: tailwind */
 @import "@fontsource-variable/geist";
 @import "@fontsource-variable/geist-mono";
 @import "tailwindcss";
diff --git a/apps/www/sst-env.d.ts b/apps/www/sst-env.d.ts
index 64441936d..b6a7e9066 100644
--- a/apps/www/sst-env.d.ts
+++ b/apps/www/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/apps/www/vite.config.ts b/apps/www/vite.config.ts
index d4ba80492..2af31cf46 100644
--- a/apps/www/vite.config.ts
+++ b/apps/www/vite.config.ts
@@ -127,7 +127,6 @@ export default defineConfig(() => ({
       tslib: tslibPath,
     },
     // TanStack's server-function compiler must transform WorkOS-owned createServerFn calls.
-    noExternal: ["@workos/authkit-tanstack-react-start"],
     tsconfigPaths: true,
   },
   server: {
diff --git a/biome.jsonc b/biome.jsonc
deleted file mode 100644
index a6ff4e289..000000000
--- a/biome.jsonc
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "$schema": "https://biomejs.dev/schemas/2.1.2/schema.json",
-  "extends": ["ultracite"],
-  "javascript": {
-    "formatter": {
-      "trailingCommas": "none",
-    },
-  },
-  "linter": {
-    "rules": {
-      "style": {
-        "noNestedTernary": "off",
-        "useFilenamingConvention": "off",
-        "noDoneCallback": "off",
-        "noExportedImports": "off",
-        "useDefaultSwitchClause": "off",
-        "noNamespace": "off",
-      },
-
-      "complexity": {
-        "noExcessiveCognitiveComplexity": "off",
-      },
-
-      "performance": {
-        "noNamespaceImport": "off",
-      },
-      "nursery": {
-        "noNestedComponentDefinitions": "off",
-        "noShadow": "off",
-      },
-    },
-  },
-}
diff --git a/docs/architecture.md b/docs/architecture.md
index 18efd0c45..026a0934a 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -10,7 +10,7 @@ repository.
 ```mermaid
 flowchart TD
   Community["voidhash Community codebase<br/>MIT SDKs + AGPL services"]
-  Platform["@orbian/sdk<br/>provider-neutral contracts"]
+  Platform["@voidhash/platform<br/>provider-neutral contracts"]
   Node["Community self-host<br/>Node + PostgreSQL + MinIO + optional ClickHouse"]
   Cloud["Managed Cloud<br/>Cloudflare + PlanetScale adapters"]
   Private["Private composition<br/>Enterprise + Overwatch + deployment graph"]
@@ -26,19 +26,25 @@ flowchart TD
 
 - `libraries/` contains MIT SDKs embedded in customer applications.
 - `apps/backend`, `apps/www`, and `apps/mimic-db` are the AGPL service entry
-  points.
-- `@orbian/sdk` defines provider-neutral Effect services and application
-  primitives for durable objects, queues, workflows, scheduled jobs, key-value
+  points; `packages/backend` is the backend library they compose.
+- `@voidhash/platform` defines provider-neutral Effect services and application
+  primitives for durable entities, queues, workflows, scheduled jobs, key-value
   storage, object storage, screenshots, and mail.
 - `packages/core`, `packages/db`, `packages/rpc`, and the remaining service
   packages own portable application and domain behavior.
-- `@orbian/node` implements those contracts for a single Node deployment.
-  `selfhost/entry` composes the Community application.
-
-Release lockfiles pin `@orbian/sdk` and `@orbian/node` to immutable Orbian
-commit artifacts. Contributors working in adjacent checkouts can switch to the
-sibling workspace with `pnpm orbian:source workspace`; maintainers prepare a
-standalone release with `pnpm orbian:source <full-commit-sha>`.
+- `@voidhash/platform-selfhost` implements those contracts for a single Node
+  deployment on PostgreSQL. Durable execution — queues, workflows, cron, and
+  durable entities — runs on Effect Cluster and Effect Workflow over that same
+  Postgres; the plain infrastructure adapters (object storage, mail,
+  screenshots) are direct clients. Entity WebSocket sessions are process-local
+  and therefore require the runner that owns the entity's shard, which the
+  single-runner topology guarantees. `apps/backend` composes the Community
+  application.
+
+Runtime backends are selected per primitive, not per provider, so a deployment
+can move one primitive to a managed service without touching the others. Every
+adapter is validated against the shared conformance suite in
+`@voidhash/platform/conformance`.
 
 The publication-boundary check rejects private package scopes, infrastructure
 directories, Enterprise code, operations-plane code, and incomplete package
@@ -51,15 +57,16 @@ and dashboard and runs Mimic entities, queue consumers, workflows, and cron
 fibers. PostgreSQL provides transactional state and durable scheduling; MinIO
 provides S3-compatible objects; the compiler is isolated in a private-network
 sidecar; Chromium renders paywall artifacts. ClickHouse is an optional
-analytics profile. Community v1 uses operator-supplied WorkOS credentials.
+analytics profile. Community authenticates a single root account from the
+environment and needs no external identity service.
 
 See [the self-hosting guide](../selfhost/README.md) for the supported Compose
 path and operational requirements.
 
 ## Managed cloud composition
 
-The private repository can deploy the same Orbian application primitives to
-Cloudflare through `@orbian/alchemy`, and owns deployment state, environments,
+The private repository can deploy the same application primitives to
+Cloudflare through Alchemy, and owns deployment state, environments,
 secrets, and cloud-only integration tests. Product services continue to import
 provider-neutral interfaces; a zero-baseline seam check rejects new Cloudflare
 or Alchemy imports from application code.
diff --git a/docs/launch-announcement-draft.md b/docs/launch-announcement-draft.md
index 64283eaee..dbec5664f 100644
--- a/docs/launch-announcement-draft.md
+++ b/docs/launch-announcement-draft.md
@@ -18,8 +18,9 @@ deployment systems are not part of the Community repository.
 The self-host composition runs the same application services as Voidhash Cloud
 through provider-neutral platform contracts. It uses Node, PostgreSQL, MinIO,
 an isolated component compiler, Chromium, SMTP, and optional ClickHouse.
-Community v1 uses your own WorkOS and provider credentials. Cloud remains the
-zero-operations path; pricing is not being announced with this release.
+Community signs in with a root account you configure in the environment and
+uses your own provider credentials. Cloud remains the zero-operations path;
+pricing is not being announced with this release.
 
 We assembled and tested the complete repository privately before publication,
 including tenant-boundary tests, provider-signature and replay tests, secret
diff --git a/docs/licensing-and-self-hosting-faq.md b/docs/licensing-and-self-hosting-faq.md
index 8eb5fd48c..8c9c4b65f 100644
--- a/docs/licensing-and-self-hosting-faq.md
+++ b/docs/licensing-and-self-hosting-faq.md
@@ -42,14 +42,15 @@ the only security-maintained line. The supported path for evaluation is the
 documented Docker Compose configuration. A production support matrix and
 version table will replace this answer before the first public release.
 
-## Why does Community v1 require WorkOS?
-
-The application already isolates authentication behind a platform port, but
-the first Community composition uses operator-supplied WorkOS credentials so
-the complete product can ship without weakening authentication during the
-open-source migration. Use a WorkOS staging environment for local evaluation
-and your own production environment for any network-accessible deployment. A
-bundled authentication adapter remains a public roadmap item.
+## How does authentication work, and why only one user?
+
+Community ships a built-in authentication provider and needs no external
+identity service. It is single-player: one root account, whose username and
+password come from `VOIDHASH_ROOT_USERNAME` and `VOIDHASH_ROOT_PASSWORD`. There
+is no sign-up and no code path that can create a second user, which is what
+keeps the model easy to reason about while the project is young. Multi-user
+self-host — most likely as a generic OIDC adapter behind the same identity
+port the hosted cloud uses — is a public roadmap item.
 
 ## Is analytics required?
 
diff --git a/docs/security/backend-threat-model.md b/docs/security/backend-threat-model.md
index 6d74be2b4..1d671fc41 100644
--- a/docs/security/backend-threat-model.md
+++ b/docs/security/backend-threat-model.md
@@ -2,7 +2,7 @@
 
 Status: alpha review draft  
 Last updated: 2026-07-12<br>
-Scope: `apps/backend`, `apps/mimic-db`, `apps/www`, `packages/core`, and
+Scope: `packages/backend`, `apps/mimic-db`, `apps/www`, `packages/core`, and
 `selfhost`
 
 This document records the security analysis required before the repository can
@@ -29,13 +29,13 @@ operational objective, but not a guarantee made by the Community Edition.
 
 ## Assets and actors
 
-Protected assets include WorkOS sessions, user and project API keys, payment
+Protected assets include dashboard sessions, user and project API keys, payment
 provider credentials, webhook signing secrets, tenant database rows,
 ClickHouse events, Mimic documents and document tokens, unpublished paywall
 artifacts, object-store credentials, and compiler/container integrity.
 
 Relevant actors are anonymous internet clients, SDK clients holding a
-publishable key, users holding a WorkOS session or user API key, server
+publishable key, users holding a dashboard session or user API key, server
 integrations holding a project secret key, tenant administrators, payment and
 identity providers, self-host operators, and a malicious authenticated tenant
 submitting component source.
@@ -69,7 +69,8 @@ Current controls:
 - `ApiMiddlewares.ts` selects exactly one authentication method and resolves it
   to a typed user, secret-key, or publishable-key session before API handlers
   run.
-- WorkOS session cookies are authenticated by the WorkOS adapter; local access
+- Session cookies are authenticated by the active `IdentityProvider` adapter,
+  which also owns the cookie name the method selector matches on; local access
   is loaded from server-side membership state.
 - Project secret keys establish a session containing only their project.
   Publishable keys establish an SDK identity with no management permissions.
@@ -80,15 +81,46 @@ Current controls:
   errors rather than returning stored credential details.
 
 Evidence includes API-key integration tests for disabled/expired keys and
-forbidden mutation, RPC smoke coverage, MCP protocol/dispatch tests, and WorkOS
-signature tests.
+forbidden mutation, RPC smoke coverage, MCP protocol/dispatch tests, and
+standalone sign-in tests.
 
 Residual work:
 
 - Beta must add explicit cookie fixation, malformed-cookie, revoked-membership,
   and authentication-method-confusion tests.
-- Deployments that change `WORKOS_COOKIE_NAME` must verify that middleware
-  method selection and the WorkOS adapter use the same configured name.
+- The session-cookie name is read from `IdentityProvider.cookieName` by both the
+  method selector and the session resolver, so a provider that issues a
+  differently named cookie needs no change at either site.
+
+### Standalone identity provider
+
+Self-host authenticates a **single root account** whose username and password
+come from `VOIDHASH_ROOT_USERNAME` and `VOIDHASH_ROOT_PASSWORD`. There is no
+sign-up and no code path that can mint a second identity: the provider only
+ever emits the root subject, so single-user is a structural property rather
+than a policy. Sessions are HS256 tokens signed with `VOIDHASH_AUTH_SECRET`,
+used as both the `vh-session` cookie and the API bearer token.
+
+Trust rests on the root password and on transport security, so the controls are:
+
+- Credentials are compared in constant time, after hashing both sides so the
+  comparison cannot leak the configured password's length.
+- Sign-in is throttled per source address: five consecutive failures trigger a
+  fixed lockout, and a failed attempt never reveals which field was wrong.
+- `validateSelfhostSecurityConfig` refuses to start a production deployment
+  whose root password or signing secret is missing or still an evaluation
+  default, before migrations or the application run.
+- Production mode requires HTTPS public, file, and Mimic URLs, so the bearer
+  token and cookie are not exposed in transit.
+- The session endpoint returns the raw token to same-origin scripts so the
+  browser can seed its bearer credential from an `HttpOnly` cookie. This
+  deliberately trades XSS-hardening for a single token pipeline; a successful
+  XSS on the dashboard origin already implies session compromise.
+
+The documented evaluation defaults (`root` / `voidhash` and the shared signing
+secret) are public knowledge and reachable only under
+`SELFHOST_MODE=local-evaluation`, which the self-hosting guide restricts to
+loopback.
 
 ## API keys and credential storage
 
@@ -151,8 +183,10 @@ Current controls:
 - Stripe verifies the signature over the exact raw body and enforces its
   timestamp tolerance. Tests reject wrong signatures, stale timestamps, and
   malformed signature headers.
-- WorkOS verifies its signed raw body and timestamp, records the external event
-  ID under a uniqueness constraint, and treats processed redelivery as a no-op.
+- A composition that mounts an identity-directory webhook through the backend's
+  route extension is responsible for its own signature verification; the shared
+  event table records the external event ID under a uniqueness constraint so
+  processed redelivery is a no-op.
 - Apple verifies signed JWS data and application identity through the App Store
   SDK. Google Play RTDN verifies the Pub/Sub OIDC signature, issuer, lifetime,
   configured audience, verified email claim, and configured push service
@@ -270,7 +304,7 @@ Current controls:
 - Self-host runs the compiler as an unprivileged user with a read-only root
   filesystem, dropped Linux capabilities, `no-new-privileges`, a PID limit, and
   a private internal Docker network shared only with the application. It does
-  not receive database, object-store, WorkOS, or payment credentials.
+  not receive database, object-store, identity, or payment credentials.
 - Cloud invokes a dedicated container through a Durable Object boundary and
   bounds the caller's compile round trip.
 
@@ -283,20 +317,22 @@ Node runtime patched.
 ## Self-host operator boundary
 
 The sample Compose defaults are for loopback evaluation only. They include
-known passwords and placeholder WorkOS credentials. Compose explicitly marks
-the no-env quick start as `local-evaluation`; exposing that composition
+known passwords and the documented default root credentials. Compose explicitly
+marks the no-env quick start as `local-evaluation`; exposing that composition
 unchanged would compromise all stored data.
 
 Before any non-local deployment, the operator must replace every example
-password, configure HTTPS at the reverse proxy, restrict MinIO/Mailpit/
-ClickHouse host ports, configure CORS and public URLs, use real WorkOS and SMTP
-credentials, back up persistent volumes, and apply host/container updates.
+password, set real root credentials and a real session signing secret,
+configure HTTPS at the reverse proxy, restrict MinIO/Mailpit/ClickHouse host
+ports, configure CORS and public URLs, use real SMTP credentials, back up
+persistent volumes, and apply host/container updates.
 
 Production mode validates configuration before migrations or the application
-start. It refuses missing and known example database, object-store, Mimic,
-WorkOS, and enabled ClickHouse credentials, and requires HTTPS for every public,
-file, Mimic, and WorkOS redirect URL. Tests cover explicit mode selection, every
-credential class, optional ClickHouse, and every URL boundary. Independent
+start. It refuses missing and known example root credentials, session signing
+secret, database, object-store, Mimic, and enabled ClickHouse credentials, and
+requires HTTPS for every public, file, and Mimic URL. Tests cover explicit mode
+selection, every credential class, optional ClickHouse, and every URL
+boundary. Independent
 review must still confirm the list remains complete as new infrastructure is
 added.
 
diff --git a/docs/standalone-auth-design.md b/docs/standalone-auth-design.md
new file mode 100644
index 000000000..76c7a1312
--- /dev/null
+++ b/docs/standalone-auth-design.md
@@ -0,0 +1,436 @@
+# Standalone auth: self-host without WorkOS
+
+> **Status: implemented.** Supersedes and replaces `docs/dev-auth-design.md`
+> (the "make WorkOS optional" dev-auth design), which is deleted. The port
+> structure that work introduced is the foundation here; the local provider it
+> added is redesigned from a development-only convenience into the one and only
+> self-host auth mode. Where the implementation diverged from this plan it has
+> been updated in place; see "Deviations from the plan" at the end.
+
+## Direction change
+
+The dev-auth work made WorkOS *optional for development*: an email-assertion
+provider, loopback-only, hard-refused in `SELFHOST_MODE=production`. Real
+self-host deployments still required BYO WorkOS ("Community Edition v1
+intentionally uses BYO WorkOS").
+
+New direction:
+
+- **Self-host is standalone in every mode, including production.** No WorkOS
+  dependency, credential, or code path anywhere in the OSS repo.
+- **Self-host is single-player, for now.** Exactly one user — root — whose
+  username and password come from environment variables. There is no sign-up,
+  no invitation, and no code path that can create a second user.
+- **WorkOS moves entirely to voidhash-mono** and serves only the hosted cloud.
+  The OSS repo keeps the provider-neutral ports (`IdentityProvider`,
+  `AuthTokenVerifier`, the org directory port); mono plugs its WorkOS
+  implementations into them from its own tree, exactly as it already does for
+  Cloudflare platform adapters.
+
+Non-goals (for now):
+
+- Multi-user self-host. The ports deliberately leave room for a community
+  OIDC/generic provider later, but nothing in this design builds toward it.
+- Password management UX: no reset flow, no change-password UI. The password
+  lives in `.env`; rotating it is an operator action.
+- Session revocation lists / refresh tokens. One signed session token with a
+  fixed TTL, like the dev design.
+
+## What survives from the implemented dev auth
+
+Most of it. The dev-auth implementation (uncommitted on this branch) already
+built the right seams:
+
+| Piece | Fate |
+| --- | --- |
+| `IdentityProvider` port + consumers (`AuthSessionResolver`, `ApiMiddlewares`, `mcp.ts`, `AgentNodeWebSocket`) | **Keep unchanged** |
+| `AuthTokenVerifier` port | **Keep**; `provider` field widens (see §4) |
+| HS256 token module (`local-auth-token.ts`) | **Keep**; rename, constant `root` subject |
+| `LocalOrgDirectory` (synthesized `local_org_` / `local_mem_` ids, no migration) | **Keep**; rename `StandaloneOrgDirectory` |
+| Lazy user creation via `resolveLocalUser` | **Keep** |
+| www session seam (`session.ts`, `local-session.ts`, `AccessTokenBridge`) | **Keep shape**; loses the AuthKit fallback branch |
+| `/api/auth/dev/*` mint endpoints, email-assertion sign-in | **Replaced** by credential-checked `/api/auth/*` |
+| `AuthMode.ts` resolution matrix, `VOIDHASH_AUTH_MODE`, dev-signal allowlist | **Deleted** — OSS has exactly one provider |
+| `UnconfiguredWorkosLive` | **Deleted** (dies with `Workos` leaving `InfraServices`) |
+| `Workos.ts`, `WorkosIdentityProvider.ts`, webhook route, `McpAuthKit`, JWKS verifier | **Moved to mono** (§5) |
+
+Naming: "local" implied loopback-only development. The mode is now called
+**standalone**; the uncommitted `Local*` auth files are renamed `Standalone*`
+while the rename is still free.
+
+## 1. The standalone provider
+
+### Environment
+
+```
+VOIDHASH_ROOT_USERNAME   root user login name.
+                         local-evaluation default: "root"; production: required.
+VOIDHASH_ROOT_PASSWORD   root user password.
+                         local-evaluation default: a well-known dev constant;
+                         production: required, placeholder-rejected.
+VOIDHASH_ROOT_EMAIL      optional; default "root@voidhash.local". Display +
+                         SMTP identity for the root user row.
+VOIDHASH_AUTH_SECRET     HS256 session signing secret (renames
+                         VOIDHASH_LOCAL_AUTH_SECRET).
+                         local-evaluation default: the well-known dev constant;
+                         production: required, placeholder-rejected.
+```
+
+This mirrors the existing `MIMIC_ROOT_USERNAME` / `MIMIC_ROOT_PASSWORD`
+precedent. The `local-evaluation` defaults preserve the zero-config compose
+quick start (sign in as `root` with the documented dev password on loopback —
+the same trust model the email-assertion form had). In `production`,
+`validateSelfhostSecurityConfig` rejects missing or example values through the
+existing `isExampleSecret` machinery, replacing the deleted `WORKOS_*` checks.
+
+### Identity
+
+- The JWT subject is the constant `root` — not derived from the email. It lands
+  in `user.workos_user_id` as today (fits `varchar(64)`; column naming debt is
+  §6). A stable subject means changing `VOIDHASH_ROOT_EMAIL` or the username
+  later updates the *same* user row via `resolveLocalUser`'s
+  match-by-provider-id-then-email logic instead of creating a new identity.
+- Identity fields: `email` from env, `emailVerified: true`, `firstName` =
+  username, `image: null`.
+- Single-player is enforced structurally: the standalone provider is the only
+  identity source, and it can only ever emit the root identity, so
+  `resolveLocalUser`'s insert path can only ever create one row. No membership
+  invitation surface exists in OSS (`OrganizationMembershipSyncPort.noop`
+  stays; invite/role flows remain `ee/` in mono).
+- Organizations are untouched: root creates and owns organizations through the
+  normal UI; `StandaloneOrgDirectory` keeps satisfying the `NOT NULL` provider
+  columns with synthesized ids. Single-player means one *user*, not one org.
+
+### Sign-in flow
+
+Endpoints move out of the `dev` namespace (they are no longer a development
+affordance) and gain credential verification:
+
+- `POST /api/auth/sign-in { username, password, returnPathname? }` — verify
+  both against env with a constant-time comparison (SHA-256 both sides, then
+  the existing `constantTimeEquals`); on success mint the HS256 JWT (30-day
+  TTL) and return `{ accessToken, redirectTo }` plus `Set-Cookie`. On failure:
+  401 with no detail about which field was wrong.
+- `GET /api/auth/session` — verified claims + raw token from the cookie, or
+  `null` (unchanged behavior, renamed).
+- `POST /api/auth/sign-out` — clear the cookie.
+
+Brute-force throttling: a small in-process limiter on `sign-in` (e.g. fixed
+backoff after 5 consecutive failures per source IP, reset on success). The
+selfhost entry is a single Node process, so in-memory state is correct today;
+if the cluster composition ever serves www, move the counter to Postgres.
+
+Cookie renames `vh-local-session` → `vh-session`; same attributes (HttpOnly,
+SameSite=Lax, Secure when the request is HTTPS, Max-Age 30 days). The token
+remains both cookie value and bearer token, so the single-verifier design and
+the split-origin dev story are unchanged. www-side minting stays stateless —
+the www server process reads the same `VOIDHASH_ROOT_*` env.
+
+### www UI
+
+- `/auth/login` renders a username + password form (replaces the email form in
+  `local-sign-in-form.tsx`). In `local-evaluation` with default credentials
+  active, the form shows the defaults as a hint — zero-config quick start stays
+  one screen.
+- `/auth/sign-up`, `/auth/verify-email`, `/auth/forgot-password`,
+  `/auth/reset-password` redirect to `/auth/login` (as the local mode does
+  today) — later these routes are supplied by the cloud overlay only (§5).
+- `AccessTokenBridge` simplifies: read `/api/auth/session`; the AuthKit
+  fallback branch moves into the cloud adapter (§5).
+
+## 2. Auth-mode machinery: deleted
+
+With one provider in OSS there is nothing to resolve:
+
+- `VOIDHASH_AUTH_MODE`, `AuthMode.ts` (`resolveAuthMode`, credential sniffing,
+  the `SELFHOST_MODE=local-evaluation` / `NODE_ENV` dev-signal allowlist) and
+  its tests are deleted. The subtle fail-open/fail-closed analysis that
+  motivated the allowlist becomes moot: standalone is *supposed* to run in
+  production, and its production gate is "real credentials configured", not
+  "mode forbidden".
+- `SelfhostAuthConfig` collapses to
+  `{ rootUsername, rootPassword: Redacted, rootEmail, secret: Redacted }`.
+- www routes lose every `resolveAuthMode()` branch; `authkitMiddleware` leaves
+  `start.ts` (cloud installs it via the adapter, §5).
+- `validateSelfhostSecurityConfig` production checks: drop the four `WORKOS_*`
+  placeholder checks and the `WORKOS_REDIRECT_URI` HTTPS check; add
+  `VOIDHASH_ROOT_USERNAME`, `VOIDHASH_ROOT_PASSWORD`, `VOIDHASH_AUTH_SECRET`.
+  Drop the "local auth is not allowed in production" refusal entirely.
+
+## 3. Backend: evict WorkOS from the shared graph
+
+The one structural change: **`Workos` leaves `BackendApp.InfraServices`**
+(`packages/backend/src/BackendApp.ts:177-178`). The dev-auth work kept it there to
+avoid pushing the webhook route's request-time deps onto composition roots;
+with the route itself leaving OSS, the reason evaporates. Consequences:
+
+- `UnconfiguredWorkosLive` is deleted (it existed only to satisfy the union).
+- The `workosWebhooks: boolean` flag on `BackendRuntimeLayers` generalizes to a
+  proper route extension — `routeExtension?: Layer` next to the existing
+  `rpcExtension` — and mono mounts its WorkOS webhook receiver (and MCP OAuth
+  discovery, below) through it. OSS passes nothing.
+- MCP: the standalone composition keeps the already-WorkOS-free project
+  secret-key and user API-key paths. `McpAuthKit` + `routes/mcp-authkit.ts`
+  (RFC 9728 discovery) move to mono and mount via the route extension; the
+  OAuth bearer path simply doesn't exist in OSS (today's "MCP OAuth is not
+  configured" 503 becomes the only OSS behavior).
+- `AuthTokenVerifier`'s `ValidatedJwtSchema.provider` widens from
+  `Schema.Literals(["workos", "local"])` to `Schema.String`. Trust derives from
+  which verifier validated the token, not from the tag; OSS stamps
+  `"standalone"`, mono stamps `"workos"`, and OSS no longer enumerates
+  proprietary providers in a shared schema.
+
+Provider-neutral pieces that only *sound* like WorkOS get renamed, not moved
+(zero coupling in their bodies):
+
+- `WorkosOrgPort` → `OrgDirectoryPort` (+ `WorkosPort*` types, error).
+- `WorkosLocalSyncService` → `IdentityLinkBackfillService` (or similar) — its
+  deps are `LocalUserSessionService`, `OrganizationMembershipSyncPort`,
+  `IdentityProvider` only.
+- `apps/www/src/features/auth/lib/workos.ts` → `sign-out.ts`.
+- Telemetry attributes `voidhash.user.workos_id` /
+  `voidhash.organization.workos_id` → `voidhash.user.external_id` /
+  `voidhash.organization.external_id`.
+
+## 4. What moves to mono, concretely
+
+Pure adapters, ~940 LOC total, four files importing `@workos-inc/node` in the
+whole repo:
+
+| OSS file | Destination |
+| --- | --- |
+| `packages/core/src/services/auth/Workos.ts` (369) | mono `stacks/backend/infrastructure/` (its `Workos.ts` layer factory already wraps this — the service definition simply relocates next to it) |
+| `packages/core/src/services/auth/WorkosIdentityProvider.ts` (48) | mono, same home |
+| `apps/backend/src/routes/webhooks/workos.ts` (314) | mono, mounted via `routeExtension`; the `workos_webhook_event` idempotency table stays in the shared schema for now (§6) |
+| `apps/backend/src/McpAuthKit.ts` + `routes/mcp-authkit.ts` (179) | mono, mounted via `routeExtension` |
+| `selfhost/entry/src/backend/AuthTokenVerifier.ts` (JWKS, 55) | **delete** — mono already has the `JwtAuth` DO + `AuthTokenVerifierLive` adapter |
+| `selfhost/entry/src/backend/Workos.ts` (`WorkosOrgPortLive`, 77) | **delete** — mono already has its own `WorkosOrgPortLive` in `BackendWorker.ts` |
+| `apps/www/src/features/auth/lib/workos-user-management.server.ts` (355) | mono www overlay, minus the generic HTTP helpers (`jsonResponse`, `getJsonBody`, safe-return-path), which split into an OSS `http.server.ts` module first — the standalone auth routes use them too |
+| `apps/www/src/routes/api/auth/{callback,email/*,oauth/*,password/*}.tsx` (~570 across 9 files) | mono www overlay routes |
+
+Dependency deletions in OSS: `@workos-inc/node` from `packages/core` and
+`packages/backend`; `@workos-inc/node` + `@workos/authkit-session` +
+`@workos/authkit-tanstack-react-start` from `apps/www`; the five WorkOS subpath
+exports from `packages/core/package.json`; `WORKOS_AUTHKIT_DOMAIN` from
+`turbo.json`; the `WORKOS_*` block from `.env.example` and
+`docker-compose.yml`.
+
+## 5. The www auth seam (the delicate part)
+
+Mono's cloud dashboard is the OSS www app plus a thin private overlay:
+`voidhash-mono/apps/www/vite.config.ts` merges route trees (OSS routes + mono
+routes) and already aliases four OSS "slot" modules to private
+implementations. **The cloud login UI currently lives in OSS www** — so
+removing WorkOS from OSS requires an explicit seam, and the slot-alias
+mechanism is exactly it:
+
+- OSS www gains one module, e.g. `features/auth/auth-adapter.ts`, the fifth
+  slot. It exports the small surface the app shell needs:
+  `getSessionUser()` (server), `signOutAction`, the login page body component,
+  the browser access-token source consumed by `AccessTokenBridge`, an optional
+  root `Provider` component (OSS default: passthrough), and the optional
+  server middleware list for `start.ts` (OSS default: empty).
+- The OSS default adapter implements standalone auth (verify `vh-session`,
+  username/password form, `/api/auth/*` endpoints).
+- Mono aliases the adapter to its WorkOS/AuthKit implementation. The AuthKit
+  packages become dependencies of mono's `apps/www` overlay only. Mono's
+  overlay also contributes its own `/api/auth/*` WorkOS routes
+  (callback/oauth/password/email) through the existing route-tree merge — no
+  path conflicts, because OSS deletes those routes rather than branching them.
+- Routes that exist in both worlds but render differently (`/auth/login`,
+  `/auth/logout`, and the sign-up/verify/forgot/reset redirects) stay OSS-owned
+  and render through the adapter, so the route tree itself never forks.
+
+Verification item for Phase 3: confirm the mono route-tree merge cleanly
+handles the overlay *adding* auth API routes and that nothing in the OSS tree
+still imports AuthKit at build time (the vite `noExternal` /
+`optimizeDeps.exclude` entries move to the mono config).
+
+## 6. Schema: keep the columns, schedule the rename
+
+Standalone mode continues writing synthesized ids into `user.workos_user_id`
+(`root`), `organization.workos_organization_id` (`local_org_…`), and
+`member.workos_membership_id` (`local_mem_…`). **No migration in this
+design** — the dev-auth decision holds.
+
+The rename (`workos_*_id` → `external_*_id`, `workos_webhook_event` →
+provider-neutral) is real debt but a separate decision: `workosUserId` is
+surfaced in `packages/api-contracts`, `packages/rpc`, the generated OpenAPI
+document, and ~45 test fixtures, so renaming is an API-breaking change that
+needs its own compatibility window. Do not bundle it into this effort.
+
+## 7. Security model
+
+- Production requires real root credentials and a real signing secret
+  (placeholder-rejected), plus the existing HTTPS checks on public URLs.
+  There is no mode in which a network-accessible deployment can run with
+  assertable identity — the property the dev design's allowlist protected is
+  now structural.
+- Anyone with the root password is root; the threat model section on the local
+  provider is rewritten accordingly (`docs/security/backend-threat-model.md`):
+  credential strength is the operator's responsibility, transport security
+  comes from the HTTPS requirement, sign-in is throttled, comparisons are
+  constant-time.
+- `GET /api/auth/session` returning the raw token to same-origin scripts is
+  inherited from the dev design (needed for the browser bearer path and
+  split-origin dev). Acceptable for v1; narrowing it is an open question.
+- The well-known dev defaults for password and signing secret are reachable
+  only in `SELFHOST_MODE=local-evaluation`, which the README already restricts
+  to loopback — the same containment the dev secret had.
+
+## 8. Testing
+
+- Rework `selfhost/entry/tests/LocalAuth.integration.test.ts` into the
+  standalone matrix: correct credentials → cookie + bearer round-trip; wrong
+  password/username → 401; throttle kicks in after N failures; production
+  boot with placeholder credentials refused; org creation; paywall edit token;
+  the existing lazy-user-row assertions with `sub = "root"`.
+- `AuthMode.test.ts` is deleted with its subject. `SecurityConfig.test.ts`
+  swaps WorkOS placeholder cases for root-credential cases.
+- Test-stub convergence stops being optional: `TestWorkosLive`,
+  `TestRealWorkosLive`, and the WorkOS half of `TestRpcAuthLive` cannot stub a
+  service that no longer exists in OSS. OSS test auth converges on the
+  standalone provider (the production code path); the WorkOS webhook smoke in
+  `rpc-smoke.integration.test.ts` moves to mono with the route.
+- The injected harness contract `coreStackOutput.testConnections.workos`
+  becomes mono-optional: the OSS harness drops it; mono keeps supplying WorkOS
+  connections to its own `ee/` and webhook suites.
+- www: login-form component test; session round-trip; removed WorkOS routes
+  are gone from the OSS route tree (typecheck enforces this better than 404
+  tests).
+
+## 9. Config and docs cleanup (rides Phase 1)
+
+- `.env.example`: delete the `WORKOS_*` block; add `VOIDHASH_ROOT_USERNAME`,
+  `VOIDHASH_ROOT_PASSWORD`, `VOIDHASH_ROOT_EMAIL`, `VOIDHASH_AUTH_SECRET`;
+  rewrite the stale trailing note that still claims WorkOS is required to sign
+  in.
+- `selfhost/README.md`: the "Identity providers" section shrinks to the
+  standalone story (production-grade, single-player, env credentials); the
+  quick start text changes from "enter any email address" to the root
+  credentials; the provider-switching section is deleted.
+- Fix two pre-existing self-host bugs found while auditing (they bite the new
+  design's production story directly):
+  1. The production compose `migrate` service only receives the database env
+     anchor, so `SELFHOST_MODE=production` migration runs fail
+     `validateSelfhostSecurityConfig` regardless of the operator's `.env`
+     (missing S3/model-key/public-URL vars).
+  2. `scripts/run-local-integration.mjs` copies `.env.example` (which sets
+     `SELFHOST_MODE=production` with placeholder secrets) to `.env` on first
+     checkout and boots the stack with it — a fresh-checkout
+     `pnpm test:integration` refuses to start. The script should pin
+     `SELFHOST_MODE=local-evaluation` for the stack it manages.
+- Consolidate the duplicated placeholder-secret predicates
+  (`config.ts` `isExampleSecret` vs `AuthMode.ts` `isPlaceholderSecret`) into
+  one exported helper as `AuthMode.ts` is deleted.
+
+## 10. Rollout
+
+Phases 1–2 are OSS-only and independently shippable; Phase 3 must land in both
+repos together.
+
+1. **Provider conversion (OSS).** Rename `local` → `standalone`; root
+   credentials + constant `root` subject; credential check + throttle on the
+   renamed `/api/auth/*` endpoints; cookie rename; login form; production
+   gates flipped (§2, §7); config/docs cleanup (§9). WorkOS mode still exists
+   and still works. Deliverable: a self-host deployment runs standalone auth
+   in `SELFHOST_MODE=production`.
+2. **Backend eviction (OSS + trivial mono bump).** `Workos` out of
+   `InfraServices`; `routeExtension`; move/delete the backend adapters per §4;
+   delete `UnconfiguredWorkosLive` and the selfhost workos branch
+   (`makeSelfhostAuthLayers` collapses); provider-neutral renames (§3). Mono
+   relocates `Workos.ts` + webhook + `McpAuthKit` into its tree and mounts
+   them via `routeExtension` — its `BackendWorker` already provides every
+   WorkOS layer itself.
+3. **www seam (both repos).** Auth adapter slot; OSS deletes the AuthKit
+   surface and WorkOS API routes; mono overlay supplies the WorkOS adapter +
+   routes. Full cloud login regression (password, OAuth, email verification,
+   callback, sign-out, Overwatch admin gate — Overwatch reuses `/auth/login`).
+4. **Cleanup.** Threat-model rewrite, telemetry attribute rename, harness
+   contract change, delete dead fixtures. The schema column rename stays
+   parked (§6).
+
+## 11. Open questions
+
+1. **Signing-secret ergonomics**: require `VOIDHASH_AUTH_SECRET` in production
+   (proposed), or auto-generate one at first boot and persist it in Postgres
+   for a zero-config production path? Auto-generation is strictly nicer but
+   adds a migration and a bootstrap ordering constraint.
+2. **Raw-token exposure** via `GET /api/auth/session`: keep (needed for the
+   browser bearer path today) or move the browser to cookie-authenticated RPC
+   and stop returning the token?
+3. **Cloud login UI shape** (mono-side, Phase 3): keep the ported custom
+   WorkOS UI (password/oauth/email routes, ~925 LOC) or switch the cloud to
+   AuthKit's hosted page and shrink the overlay to middleware + callback +
+   session? Strong lean toward hosted AuthKit — it deletes most of what Phase
+   3 would otherwise move.
+4. **Multi-user self-host later**: when it returns, is it a generic OIDC
+   `IdentityProvider` implementation (community-friendly) or a first-party
+   username/password user table? The ports support either; nothing in this
+   design should prejudge it beyond keeping `resolveLocalUser` intact.
+5. **`VOIDHASH_ROOT_USERNAME` vs email-as-login**: username chosen to match
+   the `MIMIC_ROOT_*` precedent and to avoid implying the login is a routable
+   mailbox. Revisit if it confuses operators.
+
+## Deviations from the plan
+
+1. **The www seam is two slots, not one.** `session-adapter.ts` (server: session
+   read, sign-out, request middleware) and `ui-adapter.tsx` (browser: screens,
+   auth provider, bearer credential) are aliased separately, so `start.ts` does
+   not pull the React screen tree into the server boot path. A third module,
+   `adapter/auth-screens.ts`, holds the contract types: an aliased module cannot
+   export the types its replacement needs to import without the replacement
+   re-entering itself.
+
+2. **Auth screens are a record, not per-route exports.** `authScreens`
+   (`login`, `signUp`, `verifyEmail`, `forgotPassword`, `resetPassword`) keeps
+   the five route files generic — each renders its screen or redirects to
+   `/auth/login` when the slot is `null`. Self-host fills only `login`. The
+   screens own their page chrome through the shared `AuthScreenLayout`, so the
+   hosted screens ported over from the previous route files almost verbatim.
+
+3. **MCP OAuth became a port instead of being dropped.** Deleting the JWT branch
+   would have regressed the hosted cloud, which has working MCP OAuth. Instead
+   `McpOAuth` is a provider-neutral port in the open-source backend with an
+   `McpOAuthUnconfiguredLive` default (discovery reports 503, JWT bearers are
+   refused, key auth still works); the AuthKit implementation moved to mono and
+   is supplied through a new `mcpOAuth` layer input. `routes/mcp-authkit.ts`
+   stayed in the open-source tree as `routes/mcp-oauth.ts` rather than moving.
+
+4. **`routeExtension` had to admit deferred request requirements.** Raw routes
+   registered on `HttpRouter` surface their service needs as
+   `HttpRouter.Request<…>` entries that resolve at request time, so the input is
+   typed `Layer<never, never, HttpRouter | HttpRouter.Request<string, unknown>>`
+   and is merged into the built-in webhook layer, which already gets
+   `HttpRouter.provideRequest`.
+
+5. **The enterprise features bundle takes an `identityDirectory` layer.** With
+   `Workos` out of `InfraServices`, the membership webhook port in `ee/` no
+   longer receives it from the backend's infrastructure graph, so
+   `makeEnterpriseBackendFeatures` gained an explicit input that the composition
+   root supplies.
+
+6. **WorkOS lives in a new mono package.** `@voidhash-mono/workos` holds the
+   service, identity-provider adapter, org directory, webhook route, and AuthKit
+   MCP implementation, because both `stacks/` and `ee/org-management` import it
+   and a leaf package avoids a cycle. The self-host JWKS verifier and the
+   self-host org-directory adapter were deleted rather than moved — mono already
+   had its own of each.
+
+7. **`coreTestConnections.workos` was removed outright**, not made optional. The
+   contract documents that a composition may inject a structural superset, so
+   the hosted harness keeps supplying WorkOS credentials to its own suites
+   without the open-source contract naming them.
+
+8. **The evaluation defaults are `root` / `voidhash`.** A password default was
+   needed to keep the zero-config quick start one screen; production
+   placeholder-rejection is what makes it safe.
+
+## Follow-ups not done here
+
+- The WorkOS webhook smoke (four cases previously in the open-source
+  `rpc-smoke.integration.test.ts`) was removed from the open-source suite with
+  the route, but has not been rebuilt on the hosted side — it needs a mono
+  integration project wired to the shared harness. The route itself moved
+  unchanged.
+- The `workos_*` column rename remains parked (§6).
diff --git a/examples/react-native-example/package.json b/examples/react-native-example/package.json
index bea426d0e..fa14155fa 100644
--- a/examples/react-native-example/package.json
+++ b/examples/react-native-example/package.json
@@ -12,9 +12,9 @@
     "prebuild": "expo prebuild",
     "voidhash:types": "voidhash-cli types generate",
     "voidhash:types-check": "voidhash-cli types check",
-    "lint": "biome check .",
+    "lint": "vp check",
     "typecheck": "tsc --noEmit",
-    "format": "biome format .",
+    "format": "vp check --fix",
     "web": "expo start --web",
     "xcode": "xed ios",
     "android": "expo run:android",
diff --git a/examples/react-native-example/sst-env.d.ts b/examples/react-native-example/sst-env.d.ts
index f2ed71576..b3584169c 100644
--- a/examples/react-native-example/sst-env.d.ts
+++ b/examples/react-native-example/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../../sst-env.d.ts" />
 
diff --git a/libraries/node/build.ts b/libraries/node/build.ts
index 1ab0ae09b..18ea86358 100644
--- a/libraries/node/build.ts
+++ b/libraries/node/build.ts
@@ -29,7 +29,7 @@ const main = async () => {
 };
 
 main().catch((error) => {
-  // biome-ignore lint/suspicious/noConsole: Build script should print the failure.
+  // Build script should print the failure.
   console.error(error);
   process.exit(1);
 });
diff --git a/libraries/node/src/internal/json-compatible-api.ts b/libraries/node/src/internal/json-compatible-api.ts
index cfb759583..441b35e0f 100644
--- a/libraries/node/src/internal/json-compatible-api.ts
+++ b/libraries/node/src/internal/json-compatible-api.ts
@@ -4,50 +4,52 @@ import type { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/htt
 const cloneWithPrototype = <T extends object>(value: T, properties: Record<string, unknown>): T =>
   Object.assign(Object.create(Object.getPrototypeOf(value)), value, properties) as T;
 
-const mapPayloadSchemas = (
-  payload: HttpApiEndpoint.AnyWithProps["payload"],
-): HttpApiEndpoint.AnyWithProps["payload"] =>
+const mapPayloadSchemas = (payload: HttpApiEndpoint.PayloadMap): HttpApiEndpoint.PayloadMap =>
   new Map(
-    Array.from(payload.entries(), ([contentType, value]) => [
-      contentType,
-      {
-        ...value,
-        schemas: value.schemas.map((schema) => Schema.toCodecJson(schema)) as typeof value.schemas,
-      },
-    ]),
+    Array.from(payload.entries(), ([contentType, value]) => {
+      const [first, ...rest] = value.schemas;
+      return [
+        contentType,
+        {
+          ...value,
+          schemas: [
+            Schema.toCodecJson(first),
+            ...rest.map((schema) => Schema.toCodecJson(schema)),
+          ] as const,
+        },
+      ];
+    }),
   );
 
-const mapEndpoint = <TEndpoint extends HttpApiEndpoint.AnyWithProps>(
-  endpoint: TEndpoint,
-): TEndpoint =>
+const mapEndpoint = <TEndpoint extends HttpApiEndpoint.Top>(endpoint: TEndpoint): TEndpoint =>
   cloneWithPrototype(endpoint, {
-    error: new Set(
-      Array.from(endpoint.error, (schema) => Schema.toCodecJson(schema)),
-    ) as TEndpoint["error"],
+    error: new Set(Array.from(endpoint.error, (schema) => Schema.toCodecJson(schema))),
     headers: endpoint.headers ? Schema.toCodecJson(endpoint.headers) : undefined,
     params: endpoint.params ? Schema.toCodecJson(endpoint.params) : undefined,
-    payload: mapPayloadSchemas(endpoint.payload) as TEndpoint["payload"],
+    payload: mapPayloadSchemas(endpoint.payload),
     query: endpoint.query ? Schema.toCodecJson(endpoint.query) : undefined,
-    success: new Set(
-      Array.from(endpoint.success, (schema) => Schema.toCodecJson(schema)),
-    ) as TEndpoint["success"],
+    success: new Set(Array.from(endpoint.success, (schema) => Schema.toCodecJson(schema))),
   });
 
-const mapGroup = <TGroup extends HttpApiGroup.AnyWithProps>(group: TGroup): TGroup =>
+const mapGroup = <TGroup extends HttpApiGroup.Top>(group: TGroup): TGroup =>
   cloneWithPrototype(group, {
     endpoints: Object.fromEntries(
       Object.entries(group.endpoints).map(([endpointName, endpoint]) => [
         endpointName,
-        mapEndpoint(endpoint as HttpApiEndpoint.AnyWithProps),
+        mapEndpoint(endpoint),
       ]),
-    ) as TGroup["endpoints"],
+    ),
   });
 
-export const toJsonCompatibleApi = <TApi extends HttpApi.Any>(api: TApi): TApi =>
+/**
+ * Deep-clones an `HttpApi`, replacing every endpoint schema with its
+ * JSON-compatible codec so the API can be served or consumed over transports
+ * that only carry JSON. Prototypes are preserved, so the clone keeps behaving
+ * like the original `HttpApi`, group, and endpoint instances.
+ */
+export const toJsonCompatibleApi = <TApi extends HttpApi.Top>(api: TApi): TApi =>
   cloneWithPrototype(api, {
     groups: Object.fromEntries(
-      Object.entries(
-        (api as TApi & { groups: Record<string, HttpApiGroup.AnyWithProps> }).groups,
-      ).map(([groupName, group]) => [groupName, mapGroup(group as HttpApiGroup.AnyWithProps)]),
+      Object.entries(api.groups).map(([groupName, group]) => [groupName, mapGroup(group)]),
     ),
   });
diff --git a/libraries/node/sst-env.d.ts b/libraries/node/sst-env.d.ts
index f2ed71576..b3584169c 100644
--- a/libraries/node/sst-env.d.ts
+++ b/libraries/node/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../../sst-env.d.ts" />
 
diff --git a/libraries/paywalls/build.ts b/libraries/paywalls/build.ts
index c60545e59..0a4553131 100644
--- a/libraries/paywalls/build.ts
+++ b/libraries/paywalls/build.ts
@@ -261,7 +261,7 @@ const main = async (): Promise<void> => {
 };
 
 main().catch((error) => {
-  // biome-ignore lint/suspicious/noConsole: Build script should print the failure.
+  // Build script should print the failure.
   console.error(error);
   process.exit(1);
 });
diff --git a/libraries/paywalls/src/authoring/compose-values.ts b/libraries/paywalls/src/authoring/compose-values.ts
index 4640ac7f0..e29f19d1c 100644
--- a/libraries/paywalls/src/authoring/compose-values.ts
+++ b/libraries/paywalls/src/authoring/compose-values.ts
@@ -77,5 +77,5 @@ export const none = (): Action => ACTION_MARKER;
  * the component's action. Inert marker (typed `any` so it slots into any
  * expected value position).
  */
-// biome-ignore lint/suspicious/noExplicitAny: payload slots into any action value position.
+// payload slots into any action value position.
 export const payload = (_field: string): any => undefined;
diff --git a/libraries/paywalls/src/panel/serialize.ts b/libraries/paywalls/src/panel/serialize.ts
index adaf3d0eb..5b3df93f6 100644
--- a/libraries/paywalls/src/panel/serialize.ts
+++ b/libraries/paywalls/src/panel/serialize.ts
@@ -27,7 +27,7 @@ const isDev = process.env.NODE_ENV !== "production";
 
 const warn = (message: string): void => {
   if (isDev) {
-    // biome-ignore lint/suspicious/noConsole: dev-only diagnostic for panel authors.
+    // dev-only diagnostic for panel authors.
     console.warn(`[@voidhash/paywalls/panel] ${message}`);
   }
 };
diff --git a/libraries/paywalls/src/panel/session.tsx b/libraries/paywalls/src/panel/session.tsx
index 9139efefb..c16c51895 100644
--- a/libraries/paywalls/src/panel/session.tsx
+++ b/libraries/paywalls/src/panel/session.tsx
@@ -40,7 +40,7 @@ const isDev = process.env.NODE_ENV !== "production";
 
 const warn = (message: string): void => {
   if (isDev) {
-    // biome-ignore lint/suspicious/noConsole: dev-only diagnostic for panel authors.
+    // dev-only diagnostic for panel authors.
     console.warn(`[@voidhash/paywalls/panel] ${message}`);
   }
 };
diff --git a/libraries/paywalls/src/renderer/error-boundary.tsx b/libraries/paywalls/src/renderer/error-boundary.tsx
index 33df1f869..505844465 100644
--- a/libraries/paywalls/src/renderer/error-boundary.tsx
+++ b/libraries/paywalls/src/renderer/error-boundary.tsx
@@ -30,7 +30,7 @@ export class PaywallErrorBoundary extends Component<
   }
 
   componentDidCatch(error: Error): void {
-    // biome-ignore lint/suspicious/noConsole: deliberate crash signal — the WebView has no other visible failure channel.
+    // deliberate crash signal — the WebView has no other visible failure channel.
     console.error("[voidhash-paywall] paywall render crashed", error);
     const post = this.props.post ?? postOutboundEnvelope;
     post(
diff --git a/libraries/paywalls/src/runtime/bridge.ts b/libraries/paywalls/src/runtime/bridge.ts
index a76cbcfff..e2e8f7b2d 100644
--- a/libraries/paywalls/src/runtime/bridge.ts
+++ b/libraries/paywalls/src/runtime/bridge.ts
@@ -59,7 +59,7 @@ let inboundInstalled = false;
 const dispatchInbound = (raw: unknown): void => {
   const envelope = parseInboundEnvelope(raw);
   if (!envelope) {
-    // biome-ignore lint/suspicious/noConsole: dev-visible signal — a host message that fails to parse would otherwise vanish silently.
+    // dev-visible signal — a host message that fails to parse would otherwise vanish silently.
     console.warn("[voidhash-paywall] ignoring unparseable inbound bridge message", raw);
     return;
   }
@@ -142,7 +142,7 @@ const flushPending = (): void => {
 const giveUpPending = (): void => {
   stopRetrying();
   for (const envelope of pendingOutbound.splice(0)) {
-    // biome-ignore lint/suspicious/noConsole: deliberate standalone-preview fallback.
+    // deliberate standalone-preview fallback.
     console.info("[voidhash-paywall]", envelope);
   }
 };
diff --git a/libraries/paywalls/src/runtime/runtime.tsx b/libraries/paywalls/src/runtime/runtime.tsx
index 5294550f4..52eba4faf 100644
--- a/libraries/paywalls/src/runtime/runtime.tsx
+++ b/libraries/paywalls/src/runtime/runtime.tsx
@@ -196,7 +196,7 @@ export const PaywallRuntimeProvider = ({
       purchase: (productId) => {
         const target = productId ?? selectedProductId;
         if (!target) {
-          // biome-ignore lint/suspicious/noConsole: dev-visible signal — a purchase that silently no-ops is undebuggable from inside a WebView.
+          // dev-visible signal — a purchase that silently no-ops is undebuggable from inside a WebView.
           console.warn(
             "[voidhash-paywall] purchase() called with no selected or available product — did the host send a configure message with products?",
           );
diff --git a/libraries/paywalls/tests/sandbox-bundle.test.ts b/libraries/paywalls/tests/sandbox-bundle.test.ts
index 24314a1db..c96c96ee3 100644
--- a/libraries/paywalls/tests/sandbox-bundle.test.ts
+++ b/libraries/paywalls/tests/sandbox-bundle.test.ts
@@ -67,7 +67,7 @@ describeBuilt("sandbox IIFE (node integration, mirrors the studio sandbox path)"
 
     // Eval the IIFE into a fresh global, exactly like the iframe bootstrap.
     const globalObject = globalThis as Record<string, unknown>;
-    // biome-ignore lint/security/noGlobalEval: exercising the sandbox's eval path
+    // exercising the sandbox's eval path
     (0, eval)(sandboxRuntimeBundle);
     const sandbox = globalObject[SANDBOX_GLOBAL_NAME] as SandboxSurface;
     expect(sandbox).toBeDefined();
@@ -91,7 +91,7 @@ describeBuilt("sandbox IIFE (node integration, mirrors the studio sandbox path)"
       return mod;
     };
     const moduleObj = { exports: {} as Record<string, unknown> };
-    // biome-ignore lint/security/noGlobalEval: executing our own compiled fixture
+    // executing our own compiled fixture
     new Function("require", "module", "exports", compiled.code)(
       requireShim,
       moduleObj,
diff --git a/libraries/react-native/nitrogen/generated/android/kotlin/com/margelo/nitro/voidhash/HybridGoogleBillingSpec.kt b/libraries/react-native/nitrogen/generated/android/kotlin/com/margelo/nitro/voidhash/HybridGoogleBillingSpec.kt
index 835b96795..06e5a6b0f 100644
--- a/libraries/react-native/nitrogen/generated/android/kotlin/com/margelo/nitro/voidhash/HybridGoogleBillingSpec.kt
+++ b/libraries/react-native/nitrogen/generated/android/kotlin/com/margelo/nitro/voidhash/HybridGoogleBillingSpec.kt
@@ -37,7 +37,7 @@ abstract class HybridGoogleBillingSpec: HybridObject() {
   }
 
   // Properties
-
+  
 
   // Methods
   abstract fun initConnection(onPurchase: ((purchase: HybridGoogleBillingPurchaseSpec) -> Unit)?): Promise<Boolean>
@@ -64,11 +64,11 @@ abstract class HybridGoogleBillingSpec: HybridObject() {
   @DoNotStrip
   @Keep
   abstract fun acknowledgePurchase(token: String): Promise<HybridGoogleBillingAcknowledgeResultSpec>
-
+  
   @DoNotStrip
   @Keep
   abstract fun consumeProduct(token: String): Promise<HybridGoogleBillingAcknowledgeResultSpec>
-
+  
   @DoNotStrip
   @Keep
   abstract fun getAvailableItemsByType(type: GoogleBillingProductType): Promise<Array<HybridGoogleBillingPurchaseSpec>>
diff --git a/libraries/react-native/package.json b/libraries/react-native/package.json
index 004b63122..dc667546f 100644
--- a/libraries/react-native/package.json
+++ b/libraries/react-native/package.json
@@ -66,9 +66,9 @@
     "test:storekit-purchase-coordinator": "swift test --package-path .",
     "test:storekit-simulator": "bash ios-storekit-tests/run-tests.sh",
     "clean": "rm -rf android/build node_modules/**/android/build lib",
-    "lint": "biome check .",
-    "lint-ci": "biome check .",
-    "format": "biome format . --write",
+    "lint": "vp check",
+    "lint-ci": "vp check",
+    "format": "vp check --fix",
     "typescript": "tsc -p tsconfig.test.json --noEmit",
     "specs": "pnpm run typescript && nitro-codegen --logLevel=\"debug\""
   },
@@ -91,7 +91,6 @@
     "react-native": "0.81.5",
     "react-native-nitro-modules": "0.26.4",
     "typescript": "5.9.3",
-    "ultracite": "5.0.39",
     "vite-tsconfig-paths": "catalog:",
     "vitest": "catalog:"
   },
diff --git a/libraries/react-native/plugin/src/withVoidhashReactNative.ts b/libraries/react-native/plugin/src/withVoidhashReactNative.ts
index 3d1cf8674..199ee720a 100644
--- a/libraries/react-native/plugin/src/withVoidhashReactNative.ts
+++ b/libraries/react-native/plugin/src/withVoidhashReactNative.ts
@@ -1,7 +1,6 @@
 import type { ConfigPlugin } from "expo/config-plugins";
 import { createRunOncePlugin } from "expo/config-plugins";
 
-// biome-ignore lint/nursery/useJsonImportAttribute: skip
 import pkg from "../../package.json";
 
 const withVoidhashReactNative: ConfigPlugin<void> = (config) => config;
diff --git a/libraries/react-native/src/client.tsx b/libraries/react-native/src/client.tsx
index 5484e6fc7..fcd2e80f3 100644
--- a/libraries/react-native/src/client.tsx
+++ b/libraries/react-native/src/client.tsx
@@ -160,7 +160,7 @@ export class VoidhashClient {
         throw error;
       }
 
-      // biome-ignore lint/suspicious/noConsole: This warning is intentionally surfaced in all environments.
+      // This warning is intentionally surfaced in all environments.
       console.warn(`[voidhash] swallowed error in ${operation}`, error);
     }
   }
@@ -210,7 +210,7 @@ export class VoidhashClient {
         initializedClient.captureAutomaticStartupEvents(),
         "FAILED_TO_CAPTURE_STARTUP_EVENTS",
       ).catch((error) => {
-        // biome-ignore lint/suspicious/noConsole: This warning is intentionally surfaced in all environments.
+        // This warning is intentionally surfaced in all environments.
         console.warn("[voidhash] failed to capture automatic startup analytics", error);
       });
 
@@ -504,12 +504,12 @@ export class VoidhashClient {
 
   private triggerBackgroundFlush(operation: string) {
     void this.flush().catch((error) => {
-      // biome-ignore lint/suspicious/noConsole: This warning is intentionally surfaced in all environments.
+      // This warning is intentionally surfaced in all environments.
       console.warn(`[voidhash] failed to ${operation}`, error);
     });
   }
 
-  // biome-ignore lint/suspicious/noExplicitAny: Effect requires service type parameter
+  // Effect requires service type parameter
   private async runEffect<T>(
     effect: Effect.Effect<T, unknown, any>,
     errorCode: string,
diff --git a/libraries/react-native/src/core/logging/logger.ts b/libraries/react-native/src/core/logging/logger.ts
index 8c060a460..ff02b24a4 100644
--- a/libraries/react-native/src/core/logging/logger.ts
+++ b/libraries/react-native/src/core/logging/logger.ts
@@ -74,27 +74,22 @@ export class ConsoleLogHandler implements LogHandler {
 
     switch (entry.level) {
       case LogLevel.DEBUG: {
-        // biome-ignore lint/suspicious/noConsole: It is a console logger
         console.debug(logMessage);
         break;
       }
       case LogLevel.INFO: {
-        // biome-ignore lint/suspicious/noConsole: It is a console logger
         console.info(logMessage);
         break;
       }
       case LogLevel.WARN: {
-        // biome-ignore lint/suspicious/noConsole: It is a console logger
         console.warn(logMessage);
         break;
       }
       case LogLevel.ERROR: {
-        // biome-ignore lint/suspicious/noConsole: It is a console logger
         console.error(logMessage);
         break;
       }
       default: {
-        // biome-ignore lint/suspicious/noConsole: It is a console logger
         console.log(logMessage);
       }
     }
@@ -158,7 +153,6 @@ export class Logger {
       try {
         handler.handle(entry);
       } catch (error) {
-        // biome-ignore lint/suspicious/noConsole: It is a console logger
         console.error("Logger handler error:", error);
       }
     }
diff --git a/libraries/react-native/src/core/payment-adapters/app-store-adapter.ts b/libraries/react-native/src/core/payment-adapters/app-store-adapter.ts
index 9d166a035..04ad00eb0 100644
--- a/libraries/react-native/src/core/payment-adapters/app-store-adapter.ts
+++ b/libraries/react-native/src/core/payment-adapters/app-store-adapter.ts
@@ -1,4 +1,4 @@
-/** biome-ignore-all lint/style/noNonNullAssertion: we use it for Storekit that is only available on iOS */
+/** we use it for Storekit that is only available on iOS */
 
 import { Effect, Layer } from "effect";
 
diff --git a/libraries/react-native/src/core/payment-adapters/google-play-adapter.ts b/libraries/react-native/src/core/payment-adapters/google-play-adapter.ts
index 10768a2ca..f352fbb94 100644
--- a/libraries/react-native/src/core/payment-adapters/google-play-adapter.ts
+++ b/libraries/react-native/src/core/payment-adapters/google-play-adapter.ts
@@ -1,4 +1,4 @@
-/** biome-ignore-all lint/style/noNonNullAssertion: we use it for GoogleBilling that is only available on Android */
+/** we use it for GoogleBilling that is only available on Android */
 
 import { Effect, Layer } from "effect";
 
diff --git a/libraries/react-native/src/core/platform/react-native-platform-provider.ts b/libraries/react-native/src/core/platform/react-native-platform-provider.ts
index 5cde4fbb4..058d8cb6d 100644
--- a/libraries/react-native/src/core/platform/react-native-platform-provider.ts
+++ b/libraries/react-native/src/core/platform/react-native-platform-provider.ts
@@ -58,7 +58,7 @@ function getAppName(): string | undefined {
 
 function isDebugBuild(): boolean {
   try {
-    // biome-ignore lint/correctness/noUndeclaredVariables: __DEV__ is defined by Expo
+    // __DEV__ is defined by Expo
     return typeof __DEV__ !== "undefined" && __DEV__;
   } catch {
     return false;
diff --git a/libraries/react-native/src/core/schema/registry.ts b/libraries/react-native/src/core/schema/registry.ts
index 30acffee9..139ce76cb 100644
--- a/libraries/react-native/src/core/schema/registry.ts
+++ b/libraries/react-native/src/core/schema/registry.ts
@@ -12,7 +12,7 @@
  * isolated tests), the resolved types degrade gracefully to `string`.
  */
 
-// biome-ignore lint/suspicious/noEmptyInterface: intentional - user code augments this
+// intentional - user code augments this
 export interface VoidhashRegister {}
 
 /**
diff --git a/libraries/react-native/src/core/types.ts b/libraries/react-native/src/core/types.ts
index 5d98fcdf8..9d4c27e07 100644
--- a/libraries/react-native/src/core/types.ts
+++ b/libraries/react-native/src/core/types.ts
@@ -85,7 +85,6 @@ export interface ConfigurationResponse {
       paymentProviderConfigurationProducts: {
         paymentProviderConfigurationProductId: string;
         paymentProviderConfigurationId: string;
-        // biome-ignore lint/suspicious/noExplicitAny: ok
         configuration: Record<string, any>;
       }[];
     }[];
diff --git a/libraries/react-native/src/internal/webview/PaywallWebViewHost.ts b/libraries/react-native/src/internal/webview/PaywallWebViewHost.ts
index 60a688f06..b241cbe7c 100644
--- a/libraries/react-native/src/internal/webview/PaywallWebViewHost.ts
+++ b/libraries/react-native/src/internal/webview/PaywallWebViewHost.ts
@@ -3,7 +3,7 @@ import { getHostComponent, type HybridRef } from "react-native-nitro-modules";
 import type { PaywallWebViewMethods, PaywallWebViewProps } from "../../specs/PaywallWebView.nitro";
 
 // We intentionally use require() to avoid requiring resolveJsonModule in this package tsconfig.
-// biome-ignore lint/suspicious/noExplicitAny: generated JSON view config type is inferred at runtime.
+// generated JSON view config type is inferred at runtime.
 const PaywallWebViewConfig: any = require("../../../nitrogen/generated/shared/json/PaywallWebViewConfig.json");
 
 export const PaywallWebViewHost = getHostComponent<PaywallWebViewProps, PaywallWebViewMethods>(
diff --git a/libraries/react-native/src/metro/index.ts b/libraries/react-native/src/metro/index.ts
index 547dddb6b..8fff45adb 100644
--- a/libraries/react-native/src/metro/index.ts
+++ b/libraries/react-native/src/metro/index.ts
@@ -106,7 +106,6 @@ function startWatcher(options: WithVoidhashOptions) {
     });
 
     activeChildProcess.on("error", (error) => {
-      // biome-ignore lint/suspicious/noConsole: dev-time diagnostic
       console.warn(
         `[voidhash/metro] Failed to spawn '${binary} ${args.join(" ")}': ${error.message}. ` +
           "Ensure voidhash-cli is installed in this project.",
@@ -120,7 +119,6 @@ function startWatcher(options: WithVoidhashOptions) {
 
     ensureTeardownHandlers();
   } catch (error) {
-    // biome-ignore lint/suspicious/noConsole: dev-time diagnostic
     console.warn(
       `[voidhash/metro] Could not start types watcher: ${
         error instanceof Error ? error.message : String(error)
diff --git a/libraries/react-native/src/react/hooks/use-fetch.ts b/libraries/react-native/src/react/hooks/use-fetch.ts
index d21589180..43ed7129b 100644
--- a/libraries/react-native/src/react/hooks/use-fetch.ts
+++ b/libraries/react-native/src/react/hooks/use-fetch.ts
@@ -47,7 +47,6 @@
 
 //   const [state, dispatch] = useReducer(fetchReducer, initialState);
 
-//   // biome-ignore lint/correctness/useExhaustiveDependencies: ok
 //   useEffect(() => {
 //     // Do nothing if the url is not given
 //     if (!url) {
@@ -69,7 +68,6 @@
 //         const response = await fetch(url, options);
 //         if (!response.ok) {
 //           if (response.status >= 400) {
-//             // biome-ignore lint/suspicious/noExplicitAny: ok
 //             const error: any = await response.json();
 //             throw new VoidhashError(
 //               'API_ERROR',
diff --git a/libraries/react-native/src/react/hooks/use-paywall-by-location.ts b/libraries/react-native/src/react/hooks/use-paywall-by-location.ts
index 1a83b5300..584e9e20f 100644
--- a/libraries/react-native/src/react/hooks/use-paywall-by-location.ts
+++ b/libraries/react-native/src/react/hooks/use-paywall-by-location.ts
@@ -145,7 +145,7 @@ async function sendConfigureMessage(options: {
       createPaywallBridgeConfigureMessage(runtimeConfig, requestId),
     );
   } catch (error) {
-    // biome-ignore lint/suspicious/noConsole: This warning is intentionally surfaced in all environments.
+    // This warning is intentionally surfaced in all environments.
     console.warn("[voidhash] failed to send paywall configure message", error);
 
     try {
@@ -161,7 +161,7 @@ async function sendConfigureMessage(options: {
         ),
       );
     } catch (fallbackError) {
-      // biome-ignore lint/suspicious/noConsole: This warning is intentionally surfaced in all environments.
+      // This warning is intentionally surfaced in all environments.
       console.warn("[voidhash] failed to send fallback paywall configure message", fallbackError);
     }
   }
@@ -182,7 +182,7 @@ async function handlePaywallBridgeEvent(options: {
   try {
     bridgeEvent = parsePaywallBridgeEnvelope(rawBridgeEvent);
   } catch (error) {
-    // biome-ignore lint/suspicious/noConsole: This warning is intentionally surfaced in all environments.
+    // This warning is intentionally surfaced in all environments.
     console.warn("[voidhash] ignoring unparseable paywall bridge message", error);
     return;
   }
diff --git a/libraries/react-native/sst-env.d.ts b/libraries/react-native/sst-env.d.ts
index f2ed71576..b3584169c 100644
--- a/libraries/react-native/sst-env.d.ts
+++ b/libraries/react-native/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../../sst-env.d.ts" />
 
diff --git a/libraries/web/build.ts b/libraries/web/build.ts
index eeb40bb59..4d5277d05 100644
--- a/libraries/web/build.ts
+++ b/libraries/web/build.ts
@@ -30,7 +30,7 @@ const main = async () => {
 };
 
 main().catch((error) => {
-  // biome-ignore lint/suspicious/noConsole: Build script should print the failure.
+  // Build script should print the failure.
   console.error(error);
   process.exit(1);
 });
diff --git a/libraries/web/src/client.ts b/libraries/web/src/client.ts
index 902385dc0..367636710 100644
--- a/libraries/web/src/client.ts
+++ b/libraries/web/src/client.ts
@@ -59,7 +59,7 @@ export class VoidhashWebClient {
     this.runtime = CreateEffectRuntime(config, this.eventBus);
   }
 
-  // biome-ignore lint/suspicious/noExplicitAny: Effect requires service type parameter
+  // Effect requires service type parameter
   private async runEffect<T>(
     effect: Effect.Effect<T, unknown, any>,
     errorCode: string,
diff --git a/libraries/web/src/core/feature-flags/feature-flag-service.ts b/libraries/web/src/core/feature-flags/feature-flag-service.ts
index 3c73f243f..0ee51f43d 100644
--- a/libraries/web/src/core/feature-flags/feature-flag-service.ts
+++ b/libraries/web/src/core/feature-flags/feature-flag-service.ts
@@ -22,7 +22,7 @@ const make = Effect.gen(function* effect() {
   const latestFlags = new Map<string, FeatureFlagEntry>();
   const trackedKeySets = new Set<string>();
 
-  // biome-ignore lint/suspicious/noExplicitAny: SDK headers match the schema shape at runtime
+  // SDK headers match the schema shape at runtime
   const buildHeaders = (distinctId: string) =>
     ({
       ...platform.getSdkHeaders({
diff --git a/libraries/web/src/core/identity/identity-manager.ts b/libraries/web/src/core/identity/identity-manager.ts
index 8cfdc0be6..e9142adf7 100644
--- a/libraries/web/src/core/identity/identity-manager.ts
+++ b/libraries/web/src/core/identity/identity-manager.ts
@@ -36,7 +36,7 @@ const make = Effect.gen(function* effect() {
       publishableKey: config.publishableKey,
     });
 
-  // biome-ignore lint/suspicious/noExplicitAny: SDK headers match the schema shape at runtime
+  // SDK headers match the schema shape at runtime
   const buildHeaders = (distinctId: string) =>
     ({
       ...getSdkHeaders(),
diff --git a/libraries/web/src/core/networking/json-compatible-api.ts b/libraries/web/src/core/networking/json-compatible-api.ts
index cfb759583..441b35e0f 100644
--- a/libraries/web/src/core/networking/json-compatible-api.ts
+++ b/libraries/web/src/core/networking/json-compatible-api.ts
@@ -4,50 +4,52 @@ import type { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/htt
 const cloneWithPrototype = <T extends object>(value: T, properties: Record<string, unknown>): T =>
   Object.assign(Object.create(Object.getPrototypeOf(value)), value, properties) as T;
 
-const mapPayloadSchemas = (
-  payload: HttpApiEndpoint.AnyWithProps["payload"],
-): HttpApiEndpoint.AnyWithProps["payload"] =>
+const mapPayloadSchemas = (payload: HttpApiEndpoint.PayloadMap): HttpApiEndpoint.PayloadMap =>
   new Map(
-    Array.from(payload.entries(), ([contentType, value]) => [
-      contentType,
-      {
-        ...value,
-        schemas: value.schemas.map((schema) => Schema.toCodecJson(schema)) as typeof value.schemas,
-      },
-    ]),
+    Array.from(payload.entries(), ([contentType, value]) => {
+      const [first, ...rest] = value.schemas;
+      return [
+        contentType,
+        {
+          ...value,
+          schemas: [
+            Schema.toCodecJson(first),
+            ...rest.map((schema) => Schema.toCodecJson(schema)),
+          ] as const,
+        },
+      ];
+    }),
   );
 
-const mapEndpoint = <TEndpoint extends HttpApiEndpoint.AnyWithProps>(
-  endpoint: TEndpoint,
-): TEndpoint =>
+const mapEndpoint = <TEndpoint extends HttpApiEndpoint.Top>(endpoint: TEndpoint): TEndpoint =>
   cloneWithPrototype(endpoint, {
-    error: new Set(
-      Array.from(endpoint.error, (schema) => Schema.toCodecJson(schema)),
-    ) as TEndpoint["error"],
+    error: new Set(Array.from(endpoint.error, (schema) => Schema.toCodecJson(schema))),
     headers: endpoint.headers ? Schema.toCodecJson(endpoint.headers) : undefined,
     params: endpoint.params ? Schema.toCodecJson(endpoint.params) : undefined,
-    payload: mapPayloadSchemas(endpoint.payload) as TEndpoint["payload"],
+    payload: mapPayloadSchemas(endpoint.payload),
     query: endpoint.query ? Schema.toCodecJson(endpoint.query) : undefined,
-    success: new Set(
-      Array.from(endpoint.success, (schema) => Schema.toCodecJson(schema)),
-    ) as TEndpoint["success"],
+    success: new Set(Array.from(endpoint.success, (schema) => Schema.toCodecJson(schema))),
   });
 
-const mapGroup = <TGroup extends HttpApiGroup.AnyWithProps>(group: TGroup): TGroup =>
+const mapGroup = <TGroup extends HttpApiGroup.Top>(group: TGroup): TGroup =>
   cloneWithPrototype(group, {
     endpoints: Object.fromEntries(
       Object.entries(group.endpoints).map(([endpointName, endpoint]) => [
         endpointName,
-        mapEndpoint(endpoint as HttpApiEndpoint.AnyWithProps),
+        mapEndpoint(endpoint),
       ]),
-    ) as TGroup["endpoints"],
+    ),
   });
 
-export const toJsonCompatibleApi = <TApi extends HttpApi.Any>(api: TApi): TApi =>
+/**
+ * Deep-clones an `HttpApi`, replacing every endpoint schema with its
+ * JSON-compatible codec so the API can be served or consumed over transports
+ * that only carry JSON. Prototypes are preserved, so the clone keeps behaving
+ * like the original `HttpApi`, group, and endpoint instances.
+ */
+export const toJsonCompatibleApi = <TApi extends HttpApi.Top>(api: TApi): TApi =>
   cloneWithPrototype(api, {
     groups: Object.fromEntries(
-      Object.entries(
-        (api as TApi & { groups: Record<string, HttpApiGroup.AnyWithProps> }).groups,
-      ).map(([groupName, group]) => [groupName, mapGroup(group as HttpApiGroup.AnyWithProps)]),
+      Object.entries(api.groups).map(([groupName, group]) => [groupName, mapGroup(group)]),
     ),
   });
diff --git a/libraries/web/sst-env.d.ts b/libraries/web/sst-env.d.ts
index f2ed71576..b3584169c 100644
--- a/libraries/web/sst-env.d.ts
+++ b/libraries/web/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../../sst-env.d.ts" />
 
diff --git a/package.json b/package.json
index 66e4d9781..8c58e8029 100644
--- a/package.json
+++ b/package.json
@@ -38,23 +38,28 @@
     "build": "turbo build",
     "dev": "turbo  dev",
     "clean": "turbo clean && rm -rf node_modules",
-    "format": "biome format . --write",
-    "lint": "biome check .",
-    "lint:fix": "biome check . --apply",
+    "format": "vp check --fix",
+    "lint": "vp check",
     "bump": "bumpp",
     "openapi:generate": "node ./scripts/generate-openapi-clients.mjs",
     "openapi:generate:dev": "pnpm openapi:generate -- localhost:8787",
     "openapi:generate:prod": "pnpm openapi:generate -- api.voidhash.com",
-    "orbian:source": "node ./scripts/set-orbian-source.mjs",
     "db:generate": "node ./scripts/db-generate.mjs",
     "db:migrate": "node ./scripts/db-migrate-local.mjs",
     "sync:plugins": "tsx ./scripts/sync-plugins.ts",
     "sync:plugins:check": "tsx ./scripts/sync-plugins.ts --check",
     "check:publication": "node ./scripts/check-publication-boundary.mjs",
+    "check:platform-seam": "node ./scripts/check-platform-seam.mjs",
     "check:selfhost-runtime": "node ./scripts/check-selfhost-runtime-boundary.mjs",
-    "selfhost:smoke": "tsx selfhost/smoke.mts",
-    "selfhost:release-smoke": "tsx selfhost/release-smoke.mts",
+    "check:test-tiers": "node ./scripts/check-test-tiers.mjs",
+    "stack:up": "SELFHOST_MODE=local-evaluation docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --env-file .env --profile analytics --project-directory selfhost up -d --build",
+    "stack:down": "SELFHOST_MODE=local-evaluation docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml --env-file .env --profile analytics --project-directory selfhost down",
+    "verify": "pnpm verify:quick && pnpm test:integration && pnpm test:e2e",
+    "verify:quick": "pnpm check:publication && pnpm check:platform-seam && pnpm check:selfhost-runtime && pnpm check:test-tiers && pnpm typecheck && pnpm test",
     "test": "turbo test",
+    "test:integration": "node ./scripts/run-local-integration.mjs",
+    "test:e2e": "tsx selfhost/smoke.mts",
+    "test:e2e:release": "tsx selfhost/release-smoke.mts",
     "test:purchase-restore": "pnpm --filter @voidhash/paywalls build && pnpm --filter @voidhash/react-native specs && pnpm --filter @voidhash/react-native typecheck && pnpm --filter @voidhash/react-native test && pnpm --filter @voidhash/react-native test:android-purchase-coordinator && pnpm test:android-native-compile && pnpm --filter @voidhash/generated-clients typecheck && pnpm --filter @voidhash/api-contracts typecheck && pnpm --filter @voidhash/backend typecheck && pnpm --filter @voidhash/backend test",
     "test:android-native-compile": "pnpm --filter @voidhash/react-native-voidhash-example exec expo prebuild --platform android --no-install && examples/react-native-example/android/gradlew -p examples/react-native-example/android :voidhash_react-native:compileDebugKotlin --no-daemon",
     "typecheck": "turbo typecheck",
@@ -74,12 +79,11 @@
     "typescript": "catalog:"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.3.11",
     "@typescript/native-preview": "7.0.0-dev.20260302.1",
     "dotenv-cli": "^8.0.0",
     "tslib": "2.8.1",
     "tsx": "^4.19.3",
-    "ultracite": "5.0.39"
+    "vite-plus": "catalog:"
   },
   "resolutions": {
     "react": "19.1.0",
diff --git a/packages/agent/package.json b/packages/agent/package.json
index 99ac1005f..7e1ad7ac0 100644
--- a/packages/agent/package.json
+++ b/packages/agent/package.json
@@ -31,12 +31,12 @@
   "dependencies": {
     "@earendil-works/pi-agent-core": "0.80.7",
     "@earendil-works/pi-ai": "0.80.7",
-    "@orbian/sdk": "https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526",
+    "@voidhash/platform": "workspace:*",
     "effect": "catalog:",
     "typebox": "1.1.38"
   },
   "devDependencies": {
-    "@orbian/node": "https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526",
+    "@voidhash/platform-selfhost": "workspace:*",
     "@voidhash/tsconfig": "workspace:*",
     "typescript": "catalog:",
     "vite-plus": "catalog:",
diff --git a/packages/agent/src/AgentSessionCore.ts b/packages/agent/src/AgentSessionCore.ts
index 413cd150a..2b28bdc3f 100644
--- a/packages/agent/src/AgentSessionCore.ts
+++ b/packages/agent/src/AgentSessionCore.ts
@@ -5,7 +5,7 @@ import {
   type DurableEntityHostShape,
   type DurableEntitySession,
   makeDurableEntityAddress,
-} from "@orbian/sdk/DurableEntity";
+} from "@voidhash/platform/DurableEntity";
 import { Effect, Semaphore } from "effect";
 
 import {
diff --git a/packages/agent/src/SessionLog.ts b/packages/agent/src/SessionLog.ts
index 7d75f840a..2c04f1b6f 100644
--- a/packages/agent/src/SessionLog.ts
+++ b/packages/agent/src/SessionLog.ts
@@ -3,7 +3,7 @@ import type {
   DurableEntityAddress,
   DurableEntityContext,
   DurableEntityHostShape,
-} from "@orbian/sdk/DurableEntity";
+} from "@voidhash/platform/DurableEntity";
 import { Effect } from "effect";
 
 const LOG_META_KEY = "agent-session/log/meta";
diff --git a/packages/agent/tests/AgentSessionPg.integration.test.ts b/packages/agent/tests/AgentSessionCluster.integration.test.ts
similarity index 62%
rename from packages/agent/tests/AgentSessionPg.integration.test.ts
rename to packages/agent/tests/AgentSessionCluster.integration.test.ts
index 27d3304bd..a8d085358 100644
--- a/packages/agent/tests/AgentSessionPg.integration.test.ts
+++ b/packages/agent/tests/AgentSessionCluster.integration.test.ts
@@ -4,12 +4,13 @@ import {
   type AssistantMessage,
   type Model,
 } from "@earendil-works/pi-ai";
-import { DurableEntityHost } from "@orbian/sdk/DurableEntity";
-import { makeNodeDurableEntitySession } from "@orbian/node/NodeDurableEntitySession";
 import {
-  PgDurableEntityHostLive,
-  type PgDurableEntityConfig,
-} from "@orbian/node/DurableEntity";
+  DurableEntityAlarmControl,
+  DurableEntityHost,
+} from "@voidhash/platform/DurableEntity";
+import { PgClusterDurableEntityLive } from "@voidhash/platform-selfhost/ClusterDurableEntity";
+import { makeNodeDurableEntitySession } from "@voidhash/platform-selfhost/NodeDurableEntitySession";
+import type { PgPlatformConfig } from "@voidhash/platform-selfhost/Postgres";
 import { Effect, ManagedRuntime, Redacted } from "effect";
 import { describe, expect, it } from "vitest";
 
@@ -20,17 +21,17 @@ import {
 } from "../src/AgentSessionCore.ts";
 import { readSessionLogCount } from "../src/SessionLog.ts";
 
-const config: PgDurableEntityConfig = {
-  host: process.env.PLATFORM_NODE_PG_HOST ?? "127.0.0.1",
-  port: Number(process.env.PLATFORM_NODE_PG_PORT ?? "5432"),
-  database: process.env.PLATFORM_NODE_PG_DATABASE ?? "voidhash",
-  username: process.env.PLATFORM_NODE_PG_USERNAME ?? "voidhash",
-  password: Redacted.make(process.env.PLATFORM_NODE_PG_PASSWORD ?? "password"),
+const config: PgPlatformConfig = {
+  host: process.env.PLATFORM_SELFHOST_PG_HOST ?? "127.0.0.1",
+  port: Number(process.env.PLATFORM_SELFHOST_PG_PORT ?? "5432"),
+  database: process.env.PLATFORM_SELFHOST_PG_DATABASE ?? "voidhash",
+  username: process.env.PLATFORM_SELFHOST_PG_USERNAME ?? "voidhash",
+  password: Redacted.make(process.env.PLATFORM_SELFHOST_PG_PASSWORD ?? "password"),
 };
 
 const model: Model<string> = {
-  id: "pg-test-model",
-  name: "Postgres test model",
+  id: "cluster-test-model",
+  name: "Cluster test model",
   api: "test",
   provider: "test-provider",
   baseUrl: "https://example.invalid",
@@ -43,7 +44,7 @@ const model: Model<string> = {
 
 const assistantMessage = (): AssistantMessage => ({
   role: "assistant",
-  content: [{ type: "text", text: "postgres-host-ok" }],
+  content: [{ type: "text", text: "cluster-host-ok" }],
   api: model.api,
   provider: model.provider,
   model: model.id,
@@ -72,13 +73,13 @@ const streamFn: StreamFn = () => {
     stream.push({
       type: "text_delta",
       contentIndex: 0,
-      delta: "postgres-host-ok",
+      delta: "cluster-host-ok",
       partial: message,
     });
     stream.push({
       type: "text_end",
       contentIndex: 0,
-      content: "postgres-host-ok",
+      content: "cluster-host-ok",
       partial: message,
     });
     stream.push({ type: "done", reason: "stop", message });
@@ -91,20 +92,18 @@ const waitFor = async (predicate: () => Promise<boolean> | boolean): Promise<voi
     if (await predicate()) return;
     await new Promise((resolve) => setTimeout(resolve, 10));
   }
-  throw new Error("Timed out waiting for the Postgres agent session");
+  throw new Error("Timed out waiting for the cluster agent session");
 };
 
-const describePg = process.env.PLATFORM_NODE_PG_TEST === "1" ? describe : describe.skip;
-
-describePg("AgentSessionCore on PgDurableEntityHostLive", () => {
+describe("AgentSessionCore on the cluster durable entity host", () => {
   it("persists a turn and rehydrates it after the host runtime restarts", async () => {
-    const sessionId = `agent-pg-${crypto.randomUUID()}`;
+    const sessionId = `agent-cluster-${crypto.randomUUID()}`;
     const owner = {
-      organizationId: "organization-pg",
-      projectId: "project-pg",
-      userId: "user-pg",
+      organizationId: "organization-cluster",
+      projectId: "project-cluster",
+      userId: "user-cluster",
     };
-    const firstRuntime = ManagedRuntime.make(PgDurableEntityHostLive(config));
+    const firstRuntime = ManagedRuntime.make(PgClusterDurableEntityLive(config));
     const firstHost = await firstRuntime.runPromise(DurableEntityHost);
     const frames: string[] = [];
     const firstConnection: AgentSessionConnection = {
@@ -136,7 +135,7 @@ describePg("AgentSessionCore on PgDurableEntityHostLive", () => {
           JSON.stringify({
             v: 1,
             type: "prompt",
-            requestId: "prompt-pg",
+            requestId: "prompt-cluster",
             text: "persist this turn",
           }),
         ),
@@ -147,12 +146,26 @@ describePg("AgentSessionCore on PgDurableEntityHostLive", () => {
             readSessionLogCount(firstHost, agentSessionAddress(sessionId)),
           )) === 2,
       );
+      // Disconnecting the last socket arms the idle alarm, which only ever
+      // fires if the control plane can enumerate it out of storage.
+      await Effect.runPromise(firstCore.disconnect(sessionId, "connection-1"));
+      const firstControl = await firstRuntime.runPromise(DurableEntityAlarmControl);
+      const due = await Effect.runPromise(
+        firstControl.listDueAlarms(Date.now() + 10 * 60_000, 200),
+      );
+      expect(due.some((alarm) => alarm.address.id === sessionId)).toBe(true);
     } finally {
       await firstRuntime.dispose();
     }
 
-    const secondRuntime = ManagedRuntime.make(PgDurableEntityHostLive(config));
+    const secondRuntime = ManagedRuntime.make(PgClusterDurableEntityLive(config));
     const secondHost = await secondRuntime.runPromise(DurableEntityHost);
+    // Persisted state crosses the restart; the sockets that were attached to
+    // the previous process do not.
+    const carriedSessions = await Effect.runPromise(
+      secondHost.run(agentSessionAddress(sessionId), (entity) => entity.sessions.list),
+    );
+    expect(carriedSessions).toEqual([]);
     let restoredMessages: ReadonlyArray<AgentMessage> = [];
     const secondConnection: AgentSessionConnection = {
       sessionId,
@@ -179,11 +192,17 @@ describePg("AgentSessionCore on PgDurableEntityHostLive", () => {
       await Effect.runPromise(
         secondCore.handleMessage(
           secondConnection,
-          JSON.stringify({ v: 1, type: "get_state", requestId: "state-pg" }),
+          JSON.stringify({ v: 1, type: "get_state", requestId: "state-cluster" }),
         ),
       );
       expect(restoredMessages.map((message) => message.role)).toEqual(["user", "assistant"]);
-      expect(frames.some((frame) => frame.includes("postgres-host-ok"))).toBe(true);
+      expect(frames.some((frame) => frame.includes("cluster-host-ok"))).toBe(true);
+      // Connecting cleared the idle alarm the previous process armed.
+      const secondControl = await secondRuntime.runPromise(DurableEntityAlarmControl);
+      const due = await Effect.runPromise(
+        secondControl.listDueAlarms(Date.now() + 10 * 60_000, 200),
+      );
+      expect(due.some((alarm) => alarm.address.id === sessionId)).toBe(false);
     } finally {
       await secondRuntime.dispose();
     }
diff --git a/packages/agent/tests/AgentSessionCore.test.ts b/packages/agent/tests/AgentSessionCore.test.ts
index 995aeaf8f..457971b0f 100644
--- a/packages/agent/tests/AgentSessionCore.test.ts
+++ b/packages/agent/tests/AgentSessionCore.test.ts
@@ -5,8 +5,8 @@ import {
   type Context as PiContext,
   type Model,
 } from "@earendil-works/pi-ai";
-import { makeMemoryDurableEntityHost } from "@orbian/node/MemoryDurableEntity";
-import { makeNodeDurableEntitySession } from "@orbian/node/NodeDurableEntitySession";
+import { makeMemoryDurableEntityHost } from "@voidhash/platform-selfhost/MemoryDurableEntity";
+import { makeNodeDurableEntitySession } from "@voidhash/platform-selfhost/NodeDurableEntitySession";
 import { Effect } from "effect";
 import { describe, expect, it } from "vitest";
 
diff --git a/packages/agent/tests/SessionLog.test.ts b/packages/agent/tests/SessionLog.test.ts
index 5e8e4beb2..cad863c3e 100644
--- a/packages/agent/tests/SessionLog.test.ts
+++ b/packages/agent/tests/SessionLog.test.ts
@@ -1,4 +1,4 @@
-import { makeMemoryDurableEntityHost } from "@orbian/node/MemoryDurableEntity";
+import { makeMemoryDurableEntityHost } from "@voidhash/platform-selfhost/MemoryDurableEntity";
 import { Effect } from "effect";
 import { describe, expect, it } from "vitest";
 
diff --git a/packages/agent/tests/workerd-do-probe.ts b/packages/agent/tests/workerd-do-probe.ts
index 8a9e7ba94..258b7d657 100644
--- a/packages/agent/tests/workerd-do-probe.ts
+++ b/packages/agent/tests/workerd-do-probe.ts
@@ -13,7 +13,7 @@ import {
 import type {
   DurableEntityHostShape,
   DurableEntitySession,
-} from "@orbian/sdk/DurableEntity";
+} from "@voidhash/platform/DurableEntity";
 import { Context, Effect, Semaphore } from "effect";
 
 declare class WebSocketPair {
diff --git a/packages/agent/vitest.integration.mts b/packages/agent/vitest.integration.mts
new file mode 100644
index 000000000..b2228511b
--- /dev/null
+++ b/packages/agent/vitest.integration.mts
@@ -0,0 +1,16 @@
+import { defineConfig } from "vite-plus";
+
+// Integration tier: runs against the provisioned self-host stack via
+// `pnpm test:integration`. Timeouts are generous because these tests wait on
+// real containers rather than fakes.
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["./**/*.integration.test.ts"],
+    exclude: ["./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
+    hookTimeout: 300_000,
+    teardownTimeout: 300_000,
+    testTimeout: 120_000,
+  },
+});
diff --git a/packages/agent/vitest.mts b/packages/agent/vitest.mts
index f7f3ccc15..4d8eb60c4 100644
--- a/packages/agent/vitest.mts
+++ b/packages/agent/vitest.mts
@@ -1,7 +1,12 @@
 import { defineConfig } from "vite-plus";
 
+// Unit tier: every `*.test.ts` except the stack-backed integration files.
+// `scripts/check-test-tiers.mjs` enforces this split across the repository.
 export default defineConfig({
   test: {
-    include: ["tests/**/*.test.ts"],
+    environment: "node",
+    include: ["./**/*.test.ts"],
+    exclude: ["./**/*.integration.test.ts", "./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
   },
 });
diff --git a/packages/backend/LICENSE.md b/packages/backend/LICENSE.md
new file mode 100644
index 000000000..be3f7b28e
--- /dev/null
+++ b/packages/backend/LICENSE.md
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/packages/backend/package.json b/packages/backend/package.json
new file mode 100644
index 000000000..4124c300a
--- /dev/null
+++ b/packages/backend/package.json
@@ -0,0 +1,63 @@
+{
+  "name": "@voidhash/backend",
+  "version": "0.1.0",
+  "private": true,
+  "license": "AGPL-3.0-only",
+  "type": "module",
+  "exports": {
+    "./AuthSessionResolver": "./src/AuthSessionResolver.ts",
+    "./BackendApp": "./src/BackendApp.ts",
+    "./GooglePubSubPushVerifier": "./src/GooglePubSubPushVerifier.ts",
+    "./McpOAuth": "./src/McpOAuth.ts",
+    "./PaywallSnapshotHtmlRenderer": "./src/PaywallSnapshotHtmlRenderer.ts",
+    "./RpcMiddlewares": "./src/RpcMiddlewares.ts",
+    "./Telemetry": "./src/Telemetry.ts",
+    "./ai/AgentSessionIndexAdapter": "./src/ai/AgentSessionIndexAdapter.ts",
+    "./ai/WorkspaceAgentModels": "./src/ai/WorkspaceAgentModels.ts",
+    "./ai/WorkspaceAgentServices": "./src/ai/WorkspaceAgentServices.ts",
+    "./ai/WorkspaceAgentSessionFactory": "./src/ai/WorkspaceAgentSessionFactory.ts",
+    "./routes/event-capture": "./src/routes/event-capture.ts"
+  },
+  "scripts": {
+    "test": "vp test run -c vitest.unit.mts",
+    "typecheck": "tsc --noEmit",
+    "typecheck-go": "tsgo --noEmit",
+    "lint": "vp lint .",
+    "format": "vp fmt .",
+    "test:integration": "vp test run -c vitest.integration.mts"
+  },
+  "dependencies": {
+    "@voidhash/agent": "workspace:*",
+    "@voidhash/ai-shared": "workspace:*",
+    "@voidhash/api-contracts": "workspace:*",
+    "@voidhash/app-store-server-sdk": "workspace:*",
+    "@voidhash/clickhouse-db": "workspace:*",
+    "@voidhash/core": "workspace:*",
+    "@voidhash/db": "workspace:*",
+    "@voidhash/google-play-server-sdk": "workspace:*",
+    "@voidhash/mimic-schema": "workspace:*",
+    "@voidhash/paywall-builtins": "workspace:*",
+    "@voidhash/paywall-renderer-preact": "workspace:*",
+    "@voidhash/paywall-workspace": "workspace:*",
+    "@voidhash/rpc": "workspace:*",
+    "effect": "catalog:",
+    "jose": "catalog:",
+    "just-bash": "3.1.0",
+    "preact": "^10.25.4",
+    "zod": "catalog:"
+  },
+  "devDependencies": {
+    "@effect/platform-bun": "catalog:",
+    "@effect/platform-node": "catalog:",
+    "@types/bun": "latest",
+    "@types/node": "^20",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@voidhash/platform": "workspace:*",
+    "@voidhash/tsconfig": "workspace:*",
+    "alchemy": "catalog:",
+    "typescript": "catalog:",
+    "vite-plus": "catalog:",
+    "vitest": "catalog:"
+  }
+}
diff --git a/apps/backend/src/ApiMiddlewares.ts b/packages/backend/src/ApiMiddlewares.ts
similarity index 88%
rename from apps/backend/src/ApiMiddlewares.ts
rename to packages/backend/src/ApiMiddlewares.ts
index 0e9e57c6d..b0536167c 100644
--- a/apps/backend/src/ApiMiddlewares.ts
+++ b/packages/backend/src/ApiMiddlewares.ts
@@ -10,9 +10,9 @@ import {
   ApiNotAuthenticatedError,
 } from "@voidhash/api-contracts/errors";
 import { ApiKeyService } from "@voidhash/core/services";
+import { IdentityProvider } from "@voidhash/core/services/auth/IdentityProvider";
 import { LocalUserSessionService } from "@voidhash/core/services/auth/LocalUserSessionService";
-import { WorkosLocalSyncService } from "@voidhash/core/services/auth/WorkosLocalSyncService";
-import { Workos } from "@voidhash/core/services/auth/Workos";
+import { IdentityLinkBackfillService } from "@voidhash/core/services/auth/IdentityLinkBackfillService";
 import { AuthSession } from "@voidhash/rpc";
 import { Db, type DbError } from "@voidhash/db";
 import { Effect, Layer, Option, pipe } from "effect";
@@ -27,13 +27,13 @@ type AuthMiddlewareSession = ApiUserSession | ApiSecretKeySession | ApiPublishab
 type SelectedAuthMethod =
   | { method: "api-key"; rawApiKey: string }
   | { method: "secret-key"; rawSecretKey: string }
-  | { method: "workos-session"; headers: Headers }
+  | { method: "user-session"; headers: Headers }
   | { method: "publishable-key"; rawPublishableKey: string; distinctId: string };
 
 const publishableKeyInvalidMessage = "Publishable Key not found, is expired or is invalid.";
 
-const hasWorkosSessionCookieHeader = (headers: Headers): boolean =>
-  headers.get("cookie")?.includes("wos-session=") ?? false;
+const hasSessionCookieHeader = (headers: Headers, cookieName: string): boolean =>
+  headers.get("cookie")?.includes(`${cookieName}=`) ?? false;
 
 const toWebHeaders = (headers: HttpHeaders.Headers): Headers =>
   new Headers(
@@ -44,6 +44,7 @@ const toWebHeaders = (headers: HttpHeaders.Headers): Headers =>
 
 const selectAuthMethod = (
   req: HttpServerRequest.HttpServerRequest,
+  sessionCookieName: string,
 ): Effect.Effect<SelectedAuthMethod, AuthMiddlewareError> =>
   Effect.gen(function* () {
     const rawApiKey = Option.getOrUndefined(HttpHeaders.get(req.headers, "x-api-key"));
@@ -52,8 +53,8 @@ const selectAuthMethod = (
     }
 
     const webHeaders = toWebHeaders(req.headers);
-    if (hasWorkosSessionCookieHeader(webHeaders)) {
-      return { headers: webHeaders, method: "workos-session" } satisfies SelectedAuthMethod;
+    if (hasSessionCookieHeader(webHeaders, sessionCookieName)) {
+      return { headers: webHeaders, method: "user-session" } satisfies SelectedAuthMethod;
     }
 
     const rawSecretKey = Option.getOrUndefined(HttpHeaders.get(req.headers, "x-secret-key"));
@@ -94,17 +95,18 @@ const mapDatabaseError = (e: DbError) =>
 
 /**
  * HTTP API authentication middleware. Resolves an `ApiAuthSession` from one of
- * `x-api-key`, `x-secret-key`, `x-publishable-key` + `x-distinct-id`, or a
- * WorkOS session cookie, matching the legacy parity surface. Failures collapse
- * onto `ApiNotAuthenticatedError` / `ApiAuthenticationError`.
+ * `x-api-key`, `x-secret-key`, `x-publishable-key` + `x-distinct-id`, or the
+ * active {@link IdentityProvider}'s session cookie, matching the legacy parity
+ * surface. Failures collapse onto `ApiNotAuthenticatedError` /
+ * `ApiAuthenticationError`.
  */
 export const AuthMiddlewareLive = Layer.effect(
   AuthMiddleware,
   Effect.gen(function* () {
     const apiKeyService = yield* ApiKeyService;
     const localUserSessions = yield* LocalUserSessionService;
-    const workosLocalSync = yield* WorkosLocalSyncService;
-    const workosAuth = yield* Workos;
+    const workosLocalSync = yield* IdentityLinkBackfillService;
+    const identityProvider = yield* IdentityProvider;
     // Capture the per-request `Db` at middleware-layer build and provide it to
     // the auth resolution below. Core service methods now require `Db` ambiently
     // (native effect-postgres), but the middleware handler's requirement channel
@@ -134,11 +136,11 @@ export const AuthMiddlewareLive = Layer.effect(
         }),
       );
 
-    const authenticateWorkosSession = (headers: Headers) =>
+    const authenticateUserSession = (headers: Headers) =>
       pipe(
         Effect.gen(function* () {
-          const session = yield* workosAuth.authenticateSessionCookie(headers);
-          if (!session) {
+          const identity = yield* identityProvider.authenticateSessionCookie(headers);
+          if (!identity) {
             return yield* Effect.fail(
               new ApiNotAuthenticatedError({ message: "You are not authenticated" }),
             );
@@ -146,31 +148,31 @@ export const AuthMiddlewareLive = Layer.effect(
 
           const localUser = yield* shouldBackfillWorkosLocalState
             ? workosLocalSync
-                .syncAuthenticatedUser(session.user)
+                .syncAuthenticatedUser(identity)
                 .pipe(Effect.map((synced) => synced.localUser))
-            : localUserSessions.resolveLocalUser(session.user);
+            : localUserSessions.resolveLocalUser(identity);
           const access = yield* localUserSessions.loadUserAccess(localUser.id);
           return localUserSessions.toUserSession(
             localUser,
             access,
             headers.get("cookie"),
-            session.user.id,
+            identity.id,
           );
         }),
         Effect.catchTags({
           EffectDrizzleQueryError: (e) => Effect.fail(mapDatabaseError(e)),
-          WorkosAuthError: (e) =>
+          IdentityProviderError: (e) =>
             Effect.fail(
               new ApiAuthenticationError({
                 cause: String(e.message),
-                message: "Failed to authenticate with WorkOS session",
+                message: "Failed to authenticate session",
               }),
             ),
-          WorkosLocalSyncServiceError: (e) =>
+          IdentityLinkBackfillError: (e) =>
             Effect.fail(
               new ApiAuthenticationError({
                 cause: e.cause,
-                message: "Failed to authenticate with WorkOS session",
+                message: "Failed to authenticate session",
               }),
             ),
         }),
@@ -264,8 +266,8 @@ export const AuthMiddlewareLive = Layer.effect(
       switch (selected.method) {
         case "api-key":
           return authenticateApiKey(selected.rawApiKey);
-        case "workos-session":
-          return authenticateWorkosSession(selected.headers);
+        case "user-session":
+          return authenticateUserSession(selected.headers);
         case "secret-key":
           return authenticateSecretKey(selected.rawSecretKey);
         case "publishable-key":
@@ -279,7 +281,7 @@ export const AuthMiddlewareLive = Layer.effect(
     return AuthMiddleware.of((httpEffect) =>
       Effect.gen(function* () {
         const req = yield* HttpServerRequest.HttpServerRequest;
-        const selected = yield* selectAuthMethod(req);
+        const selected = yield* selectAuthMethod(req, identityProvider.cookieName);
         const session = yield* Effect.provideService(authenticateSelectedMethod(selected), Db, db);
         return yield* withIdentity(
           session,
diff --git a/apps/backend/src/AuthSessionResolver.ts b/packages/backend/src/AuthSessionResolver.ts
similarity index 67%
rename from apps/backend/src/AuthSessionResolver.ts
rename to packages/backend/src/AuthSessionResolver.ts
index 4069b924a..7e85dfd3e 100644
--- a/apps/backend/src/AuthSessionResolver.ts
+++ b/packages/backend/src/AuthSessionResolver.ts
@@ -1,11 +1,15 @@
 import { type DbError } from "@voidhash/db";
+import type { LocalUserIdentity } from "@voidhash/core/domain/auth/LocalUserSession";
 import {
   type AuthTokenVerifier,
   extractBearerToken,
   type JwtAuthError,
 } from "@voidhash/core/services/auth/AuthTokenVerifier";
+import {
+  IdentityProvider,
+  type IdentityProviderError,
+} from "@voidhash/core/services/auth/IdentityProvider";
 import { LocalUserSessionService } from "@voidhash/core/services/auth/LocalUserSessionService";
-import { Workos, WorkosAuthError } from "@voidhash/core/services/auth/Workos";
 import {
   RpcAuthenticationError,
   RpcNotAuthenticatedError,
@@ -15,7 +19,7 @@ import type { Db } from "@voidhash/db";
 import * as HttpHeaders from "effect/unstable/http/Headers";
 import { Effect, Option } from "effect";
 
-/** Union of the terminal failures the WorkOS session resolution can raise. */
+/** Union of the terminal failures session resolution can raise. */
 export type RpcAuthFailure = RpcAuthenticationError | RpcNotAuthenticatedError;
 
 const toWebHeaders = (headers: HttpHeaders.Headers): Headers =>
@@ -25,8 +29,14 @@ const toWebHeaders = (headers: HttpHeaders.Headers): Headers =>
     ),
   );
 
-const hasWorkosSessionCookieEffectHeader = (headers: HttpHeaders.Headers): boolean =>
-  Option.exists(HttpHeaders.get(headers, "cookie"), (cookie) => cookie.includes("wos-session="));
+/** True when the request carries the active provider's session cookie. */
+export const hasSessionCookieHeader = (
+  headers: HttpHeaders.Headers,
+  cookieName: string,
+): boolean =>
+  Option.exists(HttpHeaders.get(headers, "cookie"), (cookie) =>
+    cookie.includes(`${cookieName}=`),
+  );
 
 const formatUnknownCause = (cause: unknown): string => {
   if (cause instanceof Error) {
@@ -73,28 +83,28 @@ export const mapAuthenticationDbError = (
  * mirroring the exact logic shared by the RPC auth and admin-auth middlewares:
  *
  * - An `authorization` header → bearer-token path: the request's JWT is
- *   validated through {@link AuthTokenVerifier}, then
- *   the identity is materialised into a local user session.
- * - Otherwise a `wos-session=` cookie → WorkOS session-cookie path.
+ *   validated through {@link AuthTokenVerifier}, then the
+ *   {@link IdentityProvider} materialises it into a full identity.
+ * - Otherwise the provider's session cookie → cookie path.
  * - Neither present → {@link RpcNotAuthenticatedError}.
  *
- * Failures from Db / WorkOS / JWT validation are normalised to
- * {@link RpcAuthenticationError} / {@link RpcNotAuthenticatedError}. This is a
- * behaviour-preserving extraction; the caller supplies `Db` (and the ambient
- * {@link Workos} / {@link LocalUserSessionService}).
+ * Failures from Db / the identity provider / JWT validation are normalised to
+ * {@link RpcAuthenticationError} / {@link RpcNotAuthenticatedError}. The caller
+ * supplies `Db` (and the ambient {@link IdentityProvider} /
+ * {@link LocalUserSessionService}).
  */
-export const resolveWorkosSession = (
+export const resolveUserSession = (
   headers: HttpHeaders.Headers,
   authTokenVerifier: AuthTokenVerifier["Service"],
-): Effect.Effect<UserSession, RpcAuthFailure, Db | Workos | LocalUserSessionService> =>
+): Effect.Effect<UserSession, RpcAuthFailure, Db | IdentityProvider | LocalUserSessionService> =>
   Effect.gen(function* () {
     const localUserSessions = yield* LocalUserSessionService;
-    const workosAuth = yield* Workos;
+    const identityProvider = yield* IdentityProvider;
 
     const mapAuthenticationErrors = <A>(
       effect: Effect.Effect<
         A,
-        DbError | JwtAuthError | RpcNotAuthenticatedError | WorkosAuthError,
+        DbError | IdentityProviderError | JwtAuthError | RpcNotAuthenticatedError,
         Db
       >,
     ): Effect.Effect<A, RpcAuthFailure, Db> =>
@@ -108,32 +118,35 @@ export const resolveWorkosSession = (
             }),
           ),
         ),
-        Effect.catchTag("WorkosAuthError", (e) =>
+        Effect.catchTag("IdentityProviderError", (e) =>
           Effect.fail(
             new RpcAuthenticationError({
-              message: "Failed to authenticate with WorkOS",
+              message: "Failed to authenticate with the identity provider",
               cause: String(e.message),
             }),
           ),
         ),
       );
 
-    const authenticateWorkosIdentity = (
-      workosUserId: string,
+    /**
+     * Mirrors a provider identity into the local user table, links the local id
+     * back onto the provider record the first time, and loads its access.
+     */
+    const toSessionForIdentity = (
+      identity: LocalUserIdentity,
       cookie: string | null,
-    ): Effect.Effect<UserSession, DbError | WorkosAuthError, Db> =>
+    ): Effect.Effect<UserSession, DbError | IdentityProviderError, Db> =>
       Effect.gen(function* () {
-        const workosUser = yield* workosAuth.getUser(workosUserId);
-        const localUser = yield* localUserSessions.resolveLocalUser(workosUser);
+        const localUser = yield* localUserSessions.resolveLocalUser(identity);
 
-        yield* !workosUser.externalId
-          ? workosAuth
-              .setUserExternalId(workosUser.id, localUser.id)
+        yield* !identity.externalId
+          ? identityProvider
+              .linkExternalId(identity.id, localUser.id)
               .pipe(Effect.catch(() => Effect.void))
           : Effect.void;
 
         const access = yield* localUserSessions.loadUserAccess(localUser.id);
-        return localUserSessions.toUserSession(localUser, access, cookie, workosUser.id);
+        return localUserSessions.toUserSession(localUser, access, cookie, identity.id);
       });
 
     const authenticateBearerToken = (
@@ -154,19 +167,20 @@ export const resolveWorkosSession = (
             );
           }
 
-          return yield* authenticateWorkosIdentity(validated.payload.sub, null);
+          const identity = yield* identityProvider.resolveIdentity(validated);
+          return yield* toSessionForIdentity(identity, null);
         }),
       );
 
-    const authenticateWorkosSession = (
+    const authenticateSessionCookie = (
       requestHeaders: HttpHeaders.Headers,
     ): Effect.Effect<UserSession, RpcAuthFailure, Db> =>
       mapAuthenticationErrors(
         Effect.gen(function* () {
           const webHeaders = toWebHeaders(requestHeaders);
-          const session = yield* workosAuth.authenticateSessionCookie(webHeaders);
+          const identity = yield* identityProvider.authenticateSessionCookie(webHeaders);
 
-          if (!session) {
+          if (!identity) {
             return yield* Effect.fail(
               new RpcNotAuthenticatedError({
                 message: "You are not authenticated",
@@ -174,20 +188,7 @@ export const resolveWorkosSession = (
             );
           }
 
-          const localUser = yield* localUserSessions.resolveLocalUser(session.user);
-          yield* !session.user.externalId
-            ? workosAuth
-                .setUserExternalId(session.user.id, localUser.id)
-                .pipe(Effect.catch(() => Effect.void))
-            : Effect.void;
-
-          const access = yield* localUserSessions.loadUserAccess(localUser.id);
-          return localUserSessions.toUserSession(
-            localUser,
-            access,
-            webHeaders.get("cookie"),
-            session.user.id,
-          );
+          return yield* toSessionForIdentity(identity, webHeaders.get("cookie"));
         }),
       );
 
@@ -197,8 +198,8 @@ export const resolveWorkosSession = (
       return yield* authenticateBearerToken(headers);
     }
 
-    if (hasWorkosSessionCookieEffectHeader(headers)) {
-      return yield* authenticateWorkosSession(headers);
+    if (hasSessionCookieHeader(headers, identityProvider.cookieName)) {
+      return yield* authenticateSessionCookie(headers);
     }
 
     return yield* Effect.fail(
diff --git a/apps/backend/src/BackendApp.ts b/packages/backend/src/BackendApp.ts
similarity index 96%
rename from apps/backend/src/BackendApp.ts
rename to packages/backend/src/BackendApp.ts
index 04fbc2701..9cd0e008e 100644
--- a/apps/backend/src/BackendApp.ts
+++ b/packages/backend/src/BackendApp.ts
@@ -4,7 +4,7 @@ import { Db } from "@voidhash/db";
 import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import { PaywallAssetConfig } from "@voidhash/core/services/paywallLocations/PaywallAssetConfig";
-import { Workos } from "@voidhash/core/services/auth/Workos";
+import { IdentityProvider } from "@voidhash/core/services/auth/IdentityProvider";
 import {
   AnalyticsService,
   ApiKeyService,
@@ -81,8 +81,8 @@ import {
   UserService,
   VoidQlService,
   WebhookManagerService,
-  WorkosLocalSyncService,
-  WorkosOrgPort,
+  IdentityLinkBackfillService,
+  OrgDirectoryPort,
 } from "@voidhash/core/services";
 import { AnalyticsWriterService } from "@voidhash/core/services/analyticsIngest/AnalyticsWriterService";
 import { createInitialPaywallDocumentInput, PaywallDesignerDocument } from "@voidhash/mimic-schema";
@@ -107,8 +107,8 @@ import { BackendSnapshotHtmlRendererLive } from "./PaywallSnapshotHtmlRenderer.t
 
 import { AuthMiddlewareLive } from "./ApiMiddlewares.ts";
 import { McpRouteLayer } from "./routes/mcp.ts";
-import { McpAuthKitRouteLayer } from "./routes/mcp-authkit.ts";
-import { McpAuthKit } from "./McpAuthKit.ts";
+import { McpOAuthRouteLayer } from "./routes/mcp-oauth.ts";
+import { McpOAuth, McpOAuthUnconfiguredLive } from "./McpOAuth.ts";
 import { withRequestId } from "./Telemetry.ts";
 import { ApiKeysGroupLive } from "./routes/v1/api-keys.ts";
 import { AuthGroupLive } from "./routes/v1/auth.ts";
@@ -132,7 +132,6 @@ import { GooglePlayRtdnNotificationRouteLayer } from "./routes/webhook-endpoints
 import { StripeWebhookNotificationRouteLayer } from "./routes/webhook-endpoints/stripe.ts";
 import { PaywallServingRouteLayer } from "./routes/paywall-serving.ts";
 import { PublicFileServingRouteLayer } from "./routes/public-file-serving.ts";
-import { WorkosWebhookRouteLayer } from "./routes/webhooks/workos.ts";
 import { AnalyticsRpcsLive } from "./rpcs/analytics-rpcs.ts";
 import { ApiKeyRpcsLive } from "./rpcs/api-key-rpcs.ts";
 import { ExperimentRpcsLive } from "./rpcs/experiment-rpcs.ts";
@@ -172,8 +171,8 @@ import { WebhookRpcsLive } from "./rpcs/webhook-rpcs.ts";
  */
 export type InfraServices =
   | Db
-  | Workos
-  | WorkosOrgPort
+  | IdentityProvider
+  | OrgDirectoryPort
   | PaywallAssetConfig
   | PaywallArtifactStore
   | PublicFileStore
@@ -192,7 +191,28 @@ export interface BackendRuntimeLayers<
   RFeatureServices = never,
   RExtensionRpcs extends Rpc.Any = never,
 > {
-  readonly auth: Layer.Layer<AuthMiddleware, never, Db | LocalUserSessionService | Workos>;
+  readonly auth: Layer.Layer<
+    AuthMiddleware,
+    never,
+    Db | IdentityProvider | LocalUserSessionService
+  >;
+  /**
+   * Raw routes contributed by the composition root, mounted alongside the
+   * built-in webhook receivers and given the same request-scoped access to the
+   * domain and support services. The hosted composition mounts its identity
+   * provider's webhook receiver here; self-host passes nothing.
+   */
+  readonly routeExtension?: Layer.Layer<
+    never,
+    never,
+    HttpRouter.HttpRouter | HttpRouter.Request<string, unknown>
+  >;
+  /**
+   * OAuth authorization server backing MCP bearer tokens. Defaults to
+   * {@link McpOAuthUnconfiguredLive}, leaving project secret keys and user API
+   * keys as the supported MCP credentials.
+   */
+  readonly mcpOAuth?: Layer.Layer<McpOAuth>;
   readonly infrastructure: Layer.Layer<InfraServices, never, RInfrastructure>;
   readonly features: BackendFeatureComposition<RFeatureRpcs, RFeatureServices>;
   readonly routes?: Layer.Layer<never, never, HttpRouter.HttpRouter | RInfrastructure>;
@@ -695,6 +715,7 @@ const buildBackendServiceGraph = <
     | "webhookManager"
     | "analyticsQueryClient"
     | "pushDeliveryDispatch"
+    | "mcpOAuth"
   >,
 ) => {
   const RpcHandlersLayer = Layer.mergeAll(
@@ -728,7 +749,7 @@ const buildBackendServiceGraph = <
   const foundation = buildBackendFoundation(layers.infrastructure);
   const FeatureSupportServicesLayer = layers.features.supportServices(foundation);
 
-  const WorkosLocalSyncServiceLayer = WorkosLocalSyncService.layer.pipe(
+  const IdentityLinkBackfillServiceLayer = IdentityLinkBackfillService.layer.pipe(
     Layer.provide(foundation.FoundationSupportServicesLayer),
     Layer.provide(FeatureSupportServicesLayer),
     Layer.provide(layers.infrastructure),
@@ -737,7 +758,7 @@ const buildBackendServiceGraph = <
   const SupportServicesLayer = Layer.mergeAll(
     foundation.FoundationSupportServicesLayer,
     FeatureSupportServicesLayer,
-    WorkosLocalSyncServiceLayer,
+    IdentityLinkBackfillServiceLayer,
   );
 
   // ExperimentService depends on FeatureFlagService (its backing-flag engine),
@@ -779,7 +800,7 @@ const buildBackendServiceGraph = <
     ExperimentServiceLayer,
     FeatureFlagService.layer,
     InternalFeatureFlagService.layer,
-    McpAuthKit.layer,
+    layers.mcpOAuth ?? McpOAuthUnconfiguredLive,
     // Push notifications: the per-(project, provider) config CRUD consumes the
     // two delivery-provider tags (supplied by BackendPushProvidersLive below)
     // and reads PUSH_REQUIRE_ENCRYPTION so prod fails closed on plaintext secrets.
@@ -881,6 +902,7 @@ export const buildBackendAgentServices = <
     | "webhookManager"
     | "analyticsQueryClient"
     | "pushDeliveryDispatch"
+    | "mcpOAuth"
   >,
 ) => {
   const graph = buildBackendServiceGraph(layers);
@@ -946,9 +968,7 @@ export const NoBackendRpcExtension: BackendRpcExtension<never> = {
  * in-process integration smoke to dispatch RPCs against the real handler graph
  * without an HTTP transport. The only requirements that remain are the
  * {@link InfraServices} (provided by the caller's `infrastructure` layer) and
- * the asynchronous workflow ports the handlers resolve lazily at request time
- * (`WebhookDeliveryWorkflow`, `IdentifyDistinctIdCompletionWorkflow`,
- * `AppStoreReplayParkedNotificationsWorkflow`).
+ * the shared workflow runtime resolved lazily at request time.
  */
 export const buildBackendRpcServices = <
   RInfrastructure = never,
@@ -964,6 +984,7 @@ export const buildBackendRpcServices = <
     | "webhookManager"
     | "analyticsQueryClient"
     | "rpcExtension"
+    | "mcpOAuth"
   >,
 ) => {
   const graph = buildBackendServiceGraph(layers);
@@ -1041,7 +1062,7 @@ export const buildBackendFetch = <
   );
 
   // Provided to every group as the per-request `AuthMiddleware` impl. Itself
-  // depends on `ApiKeyService`, `LocalUserSessionService`, and `Workos` —
+  // depends on `ApiKeyService` and `LocalUserSessionService` —
   // wired here so the api-contracts middleware sees a populated context.
   const HttpAuthMiddlewareLive = AuthMiddlewareLive.pipe(
     Layer.provide(DomainServicesLayer),
@@ -1058,7 +1079,7 @@ export const buildBackendFetch = <
   );
 
   // Webhook routes register raw handlers on the underlying `HttpRouter`. A raw
-  // `router.add` handler's service requirements (DB + WorkOS +
+  // `router.add` handler's service requirements (DB +
   // LocalUserSessionService + OrganizationMembershipWebhookPort for the WorkOS
   // one) surface as a deferred
   // `Request.From<"Requires", …>` that resolves at request time, NOT a normal
@@ -1073,7 +1094,7 @@ export const buildBackendFetch = <
     AppleServerToServerNotificationRouteLayer,
     GooglePlayRtdnNotificationRouteLayer,
     StripeWebhookNotificationRouteLayer,
-    WorkosWebhookRouteLayer,
+    layers.routeExtension ?? Layer.empty,
     layers.features.routes(graph),
   ).pipe(
     HttpRouter.provideRequest(
@@ -1107,7 +1128,7 @@ export const buildBackendFetch = <
     HttpRouter.provideRequest(Layer.mergeAll(DomainServicesLayer, SupportServicesLayer)),
   );
 
-  const McpAuthKitRoutesLayer = McpAuthKitRouteLayer.pipe(
+  const McpOAuthRoutesLayer = McpOAuthRouteLayer.pipe(
     HttpRouter.provideRequest(Layer.mergeAll(DomainServicesLayer, SupportServicesLayer)),
   );
 
@@ -1118,7 +1139,7 @@ export const buildBackendFetch = <
     PaywallServingLayer,
     PublicFileServingLayer,
     McpRoutesLayer,
-    McpAuthKitRoutesLayer,
+    McpOAuthRoutesLayer,
     HealthCheckRoute,
     RuntimeCapabilitiesRoute(layers.features.runtimeCapabilities),
     layers.routes ?? Layer.empty,
diff --git a/apps/backend/src/BackendRpcGroups.test.ts b/packages/backend/src/BackendRpcGroups.test.ts
similarity index 100%
rename from apps/backend/src/BackendRpcGroups.test.ts
rename to packages/backend/src/BackendRpcGroups.test.ts
diff --git a/apps/backend/src/BackendRpcGroups.ts b/packages/backend/src/BackendRpcGroups.ts
similarity index 100%
rename from apps/backend/src/BackendRpcGroups.ts
rename to packages/backend/src/BackendRpcGroups.ts
diff --git a/apps/backend/src/GooglePubSubPushVerifier.test.ts b/packages/backend/src/GooglePubSubPushVerifier.test.ts
similarity index 100%
rename from apps/backend/src/GooglePubSubPushVerifier.test.ts
rename to packages/backend/src/GooglePubSubPushVerifier.test.ts
diff --git a/apps/backend/src/GooglePubSubPushVerifier.ts b/packages/backend/src/GooglePubSubPushVerifier.ts
similarity index 100%
rename from apps/backend/src/GooglePubSubPushVerifier.ts
rename to packages/backend/src/GooglePubSubPushVerifier.ts
diff --git a/packages/backend/src/McpOAuth.ts b/packages/backend/src/McpOAuth.ts
new file mode 100644
index 000000000..f0e6b153d
--- /dev/null
+++ b/packages/backend/src/McpOAuth.ts
@@ -0,0 +1,59 @@
+/**
+ * Provider-neutral OAuth surface for the MCP protected resource.
+ *
+ * MCP accepts three credentials: project secret keys, user API keys, and — when
+ * a deployment runs an OAuth authorization server — a resource-bound access
+ * token. The first two need no external service and are always available. The
+ * third is supplied by the composition root; self-host ships
+ * {@link McpOAuthUnconfiguredLive}, which reports the endpoint as unconfigured
+ * so clients fall back to key auth.
+ */
+import { Context, Data, Effect, Layer } from "effect";
+
+export class McpOAuthError extends Data.TaggedError("McpOAuthError")<{
+  readonly kind: "invalid_token" | "misconfigured" | "upstream";
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
+
+/** Identity claims an MCP access token must carry. */
+export interface McpOAuthClaims {
+  readonly organizationId: string;
+  readonly subject: string;
+}
+
+export interface McpOAuthShape {
+  /** Issuer advertised by OAuth discovery, or `undefined` when unconfigured. */
+  readonly authorizationServer: string | undefined;
+  /** Verifies a resource-bound access token and returns its identity claims. */
+  readonly verifyAccessToken: (
+    token: string,
+    audience: string,
+  ) => Effect.Effect<McpOAuthClaims, McpOAuthError>;
+  /** Proxies the authorization server's metadata document for discovery. */
+  readonly fetchAuthorizationServerMetadata: () => Effect.Effect<unknown, McpOAuthError>;
+}
+
+/** OAuth issuer discovery and resource-audience token verification for MCP. */
+export class McpOAuth extends Context.Service<McpOAuth, McpOAuthShape>()("backend/McpOAuth") {}
+
+const misconfigured = <A>(): Effect.Effect<A, McpOAuthError> =>
+  Effect.fail(
+    new McpOAuthError({
+      kind: "misconfigured",
+      message: "This deployment does not run an MCP OAuth authorization server.",
+    }),
+  );
+
+/**
+ * Default implementation: no authorization server. Discovery reports the
+ * resource as unavailable and JWT bearer tokens are refused, leaving project
+ * secret keys and user API keys as the supported MCP credentials.
+ */
+export const McpOAuthUnconfiguredLive: Layer.Layer<McpOAuth> = Layer.succeed(McpOAuth)(
+  McpOAuth.of({
+    authorizationServer: undefined,
+    fetchAuthorizationServerMetadata: () => misconfigured(),
+    verifyAccessToken: () => misconfigured(),
+  }),
+);
diff --git a/apps/backend/src/PaywallSnapshotHtmlRenderer.test.ts b/packages/backend/src/PaywallSnapshotHtmlRenderer.test.ts
similarity index 100%
rename from apps/backend/src/PaywallSnapshotHtmlRenderer.test.ts
rename to packages/backend/src/PaywallSnapshotHtmlRenderer.test.ts
diff --git a/apps/backend/src/PaywallSnapshotHtmlRenderer.ts b/packages/backend/src/PaywallSnapshotHtmlRenderer.ts
similarity index 100%
rename from apps/backend/src/PaywallSnapshotHtmlRenderer.ts
rename to packages/backend/src/PaywallSnapshotHtmlRenderer.ts
diff --git a/apps/backend/src/RpcMiddlewares.ts b/packages/backend/src/RpcMiddlewares.ts
similarity index 82%
rename from apps/backend/src/RpcMiddlewares.ts
rename to packages/backend/src/RpcMiddlewares.ts
index 9bee24478..7b9a39ffa 100644
--- a/apps/backend/src/RpcMiddlewares.ts
+++ b/packages/backend/src/RpcMiddlewares.ts
@@ -1,7 +1,7 @@
 import { Db } from "@voidhash/db";
 import type { AuthTokenVerifier } from "@voidhash/core/services/auth/AuthTokenVerifier";
+import { IdentityProvider } from "@voidhash/core/services/auth/IdentityProvider";
 import { LocalUserSessionService } from "@voidhash/core/services/auth/LocalUserSessionService";
-import { Workos } from "@voidhash/core/services/auth/Workos";
 import {
   AuthMiddleware,
   AuthSession,
@@ -10,7 +10,7 @@ import * as HttpHeaders from "effect/unstable/http/Headers";
 import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";
 import { Effect, Layer, Option, pipe } from "effect";
 
-import { resolveWorkosSession } from "./AuthSessionResolver.ts";
+import { resolveUserSession } from "./AuthSessionResolver.ts";
 import { withIdentity } from "./Telemetry.ts";
 
 const withHttpRequestHeaders = (headers: HttpHeaders.Headers): Effect.Effect<HttpHeaders.Headers> =>
@@ -23,19 +23,19 @@ const withHttpRequestHeaders = (headers: HttpHeaders.Headers): Effect.Effect<Htt
     ),
   );
 
-/** Builds the shared WorkOS-backed session resolver used by RPC auth adapters. */
+/** Builds the shared session resolver used by RPC auth adapters. */
 export const makeRpcSessionResolver = (authTokenVerifier: AuthTokenVerifier["Service"]) =>
   Effect.gen(function* () {
     const localUserSessions = yield* LocalUserSessionService;
-    const workosAuth = yield* Workos;
+    const identityProvider = yield* IdentityProvider;
     const db = yield* Db;
 
     return (headers: HttpHeaders.Headers) =>
       withHttpRequestHeaders(headers).pipe(
         Effect.flatMap((requestHeaders) =>
-          resolveWorkosSession(requestHeaders, authTokenVerifier).pipe(
+          resolveUserSession(requestHeaders, authTokenVerifier).pipe(
             Effect.provideService(Db)(db),
-            Effect.provideService(Workos)(workosAuth),
+            Effect.provideService(IdentityProvider)(identityProvider),
             Effect.provideService(LocalUserSessionService)(localUserSessions),
           ),
         ),
diff --git a/apps/backend/src/Telemetry.test.ts b/packages/backend/src/Telemetry.test.ts
similarity index 94%
rename from apps/backend/src/Telemetry.test.ts
rename to packages/backend/src/Telemetry.test.ts
index 135911758..b7cc926ab 100644
--- a/apps/backend/src/Telemetry.test.ts
+++ b/packages/backend/src/Telemetry.test.ts
@@ -39,12 +39,12 @@ describe("identityAttributes", () => {
     const attrs = attrMap(userSession);
     expect(attrs.get("voidhash.auth.method")).toBe("user");
     expect(attrs.get("voidhash.user.id")).toBe("user_1");
-    expect(attrs.get("voidhash.user.workos_id")).toBe("wos_user_1");
+    expect(attrs.get("voidhash.user.external_id")).toBe("wos_user_1");
     expect(attrs.get("voidhash.user.role")).toBe("admin");
     // First org is stamped; count signals there are more.
     expect(attrs.get("voidhash.organization.id")).toBe("org_1");
     expect(attrs.get("voidhash.organization.slug")).toBe("acme");
-    expect(attrs.get("voidhash.organization.workos_id")).toBe("wos_org_1");
+    expect(attrs.get("voidhash.organization.external_id")).toBe("wos_org_1");
     expect(attrs.get("voidhash.organization.count")).toBe("2");
     expect(attrs.get("voidhash.project.id")).toBe("proj_1");
     expect(attrs.get("voidhash.project.organization_id")).toBe("org_1");
@@ -78,9 +78,9 @@ describe("identityAttributes", () => {
       organizations: [{ id: "org_3", slug: "solo", workosOrganizationId: null }],
       projects: [],
     });
-    expect(attrs.has("voidhash.user.workos_id")).toBe(false);
+    expect(attrs.has("voidhash.user.external_id")).toBe(false);
     expect(attrs.has("voidhash.user.role")).toBe(false);
-    expect(attrs.has("voidhash.organization.workos_id")).toBe(false);
+    expect(attrs.has("voidhash.organization.external_id")).toBe(false);
     expect(attrs.has("voidhash.project.id")).toBe(false);
     expect(attrs.get("voidhash.project.count")).toBe("0");
   });
diff --git a/apps/backend/src/Telemetry.ts b/packages/backend/src/Telemetry.ts
similarity index 97%
rename from apps/backend/src/Telemetry.ts
rename to packages/backend/src/Telemetry.ts
index 005dfe2b1..d637cbf76 100644
--- a/apps/backend/src/Telemetry.ts
+++ b/packages/backend/src/Telemetry.ts
@@ -100,7 +100,7 @@ export const identityAttributes = (
   if (session.user) {
     attrs.push(["voidhash.user.id", session.user.id]);
     if (session.user.workosUserId)
-      attrs.push(["voidhash.user.workos_id", session.user.workosUserId]);
+      attrs.push(["voidhash.user.external_id", session.user.workosUserId]);
     if (session.user.role) attrs.push(["voidhash.user.role", session.user.role]);
   }
   if (session.person) attrs.push(["voidhash.person.distinct_id", session.person.distinctId]);
@@ -109,7 +109,7 @@ export const identityAttributes = (
   if (org) {
     attrs.push(["voidhash.organization.id", org.id], ["voidhash.organization.slug", org.slug]);
     if (org.workosOrganizationId) {
-      attrs.push(["voidhash.organization.workos_id", org.workosOrganizationId]);
+      attrs.push(["voidhash.organization.external_id", org.workosOrganizationId]);
     }
   }
 
diff --git a/apps/backend/src/ai/AgentSessionIndexAdapter.test.ts b/packages/backend/src/ai/AgentSessionIndexAdapter.test.ts
similarity index 100%
rename from apps/backend/src/ai/AgentSessionIndexAdapter.test.ts
rename to packages/backend/src/ai/AgentSessionIndexAdapter.test.ts
diff --git a/apps/backend/src/ai/AgentSessionIndexAdapter.ts b/packages/backend/src/ai/AgentSessionIndexAdapter.ts
similarity index 100%
rename from apps/backend/src/ai/AgentSessionIndexAdapter.ts
rename to packages/backend/src/ai/AgentSessionIndexAdapter.ts
diff --git a/apps/backend/src/ai/DesignerContext.ts b/packages/backend/src/ai/DesignerContext.ts
similarity index 100%
rename from apps/backend/src/ai/DesignerContext.ts
rename to packages/backend/src/ai/DesignerContext.ts
diff --git a/apps/backend/src/ai/WorkspaceAgentModels.ts b/packages/backend/src/ai/WorkspaceAgentModels.ts
similarity index 100%
rename from apps/backend/src/ai/WorkspaceAgentModels.ts
rename to packages/backend/src/ai/WorkspaceAgentModels.ts
diff --git a/apps/backend/src/ai/WorkspaceAgentServices.ts b/packages/backend/src/ai/WorkspaceAgentServices.ts
similarity index 100%
rename from apps/backend/src/ai/WorkspaceAgentServices.ts
rename to packages/backend/src/ai/WorkspaceAgentServices.ts
diff --git a/apps/backend/src/ai/WorkspaceAgentSessionFactory.test.ts b/packages/backend/src/ai/WorkspaceAgentSessionFactory.test.ts
similarity index 100%
rename from apps/backend/src/ai/WorkspaceAgentSessionFactory.test.ts
rename to packages/backend/src/ai/WorkspaceAgentSessionFactory.test.ts
diff --git a/apps/backend/src/ai/WorkspaceAgentSessionFactory.ts b/packages/backend/src/ai/WorkspaceAgentSessionFactory.ts
similarity index 100%
rename from apps/backend/src/ai/WorkspaceAgentSessionFactory.ts
rename to packages/backend/src/ai/WorkspaceAgentSessionFactory.ts
diff --git a/apps/backend/src/ai/WorkspaceAgentTools.test.ts b/packages/backend/src/ai/WorkspaceAgentTools.test.ts
similarity index 100%
rename from apps/backend/src/ai/WorkspaceAgentTools.test.ts
rename to packages/backend/src/ai/WorkspaceAgentTools.test.ts
diff --git a/apps/backend/src/ai/WorkspaceAgentTools.ts b/packages/backend/src/ai/WorkspaceAgentTools.ts
similarity index 100%
rename from apps/backend/src/ai/WorkspaceAgentTools.ts
rename to packages/backend/src/ai/WorkspaceAgentTools.ts
diff --git a/apps/backend/src/ai/skills/component-authoring.test.ts b/packages/backend/src/ai/skills/component-authoring.test.ts
similarity index 100%
rename from apps/backend/src/ai/skills/component-authoring.test.ts
rename to packages/backend/src/ai/skills/component-authoring.test.ts
diff --git a/apps/backend/src/ai/skills/component-authoring.ts b/packages/backend/src/ai/skills/component-authoring.ts
similarity index 100%
rename from apps/backend/src/ai/skills/component-authoring.ts
rename to packages/backend/src/ai/skills/component-authoring.ts
diff --git a/apps/backend/src/ai/skills/paywall-authoring.test.ts b/packages/backend/src/ai/skills/paywall-authoring.test.ts
similarity index 100%
rename from apps/backend/src/ai/skills/paywall-authoring.test.ts
rename to packages/backend/src/ai/skills/paywall-authoring.test.ts
diff --git a/apps/backend/src/ai/skills/paywall-authoring.ts b/packages/backend/src/ai/skills/paywall-authoring.ts
similarity index 100%
rename from apps/backend/src/ai/skills/paywall-authoring.ts
rename to packages/backend/src/ai/skills/paywall-authoring.ts
diff --git a/apps/backend/src/ai/skills/registry.ts b/packages/backend/src/ai/skills/registry.ts
similarity index 100%
rename from apps/backend/src/ai/skills/registry.ts
rename to packages/backend/src/ai/skills/registry.ts
diff --git a/apps/backend/src/ai/surfaces.test.ts b/packages/backend/src/ai/surfaces.test.ts
similarity index 100%
rename from apps/backend/src/ai/surfaces.test.ts
rename to packages/backend/src/ai/surfaces.test.ts
diff --git a/apps/backend/src/ai/surfaces.ts b/packages/backend/src/ai/surfaces.ts
similarity index 100%
rename from apps/backend/src/ai/surfaces.ts
rename to packages/backend/src/ai/surfaces.ts
diff --git a/apps/backend/src/ai/tools.test.ts b/packages/backend/src/ai/tools.test.ts
similarity index 100%
rename from apps/backend/src/ai/tools.test.ts
rename to packages/backend/src/ai/tools.test.ts
diff --git a/apps/backend/src/ai/vfs/bash-tool.test.ts b/packages/backend/src/ai/vfs/bash-tool.test.ts
similarity index 100%
rename from apps/backend/src/ai/vfs/bash-tool.test.ts
rename to packages/backend/src/ai/vfs/bash-tool.test.ts
diff --git a/apps/backend/src/ai/vfs/bash-tool.ts b/packages/backend/src/ai/vfs/bash-tool.ts
similarity index 100%
rename from apps/backend/src/ai/vfs/bash-tool.ts
rename to packages/backend/src/ai/vfs/bash-tool.ts
diff --git a/apps/backend/src/ai/vfs/readonly-fs.test.ts b/packages/backend/src/ai/vfs/readonly-fs.test.ts
similarity index 100%
rename from apps/backend/src/ai/vfs/readonly-fs.test.ts
rename to packages/backend/src/ai/vfs/readonly-fs.test.ts
diff --git a/apps/backend/src/ai/vfs/readonly-fs.ts b/packages/backend/src/ai/vfs/readonly-fs.ts
similarity index 100%
rename from apps/backend/src/ai/vfs/readonly-fs.ts
rename to packages/backend/src/ai/vfs/readonly-fs.ts
diff --git a/apps/backend/src/ai/vfs/workspace-vfs.ts b/packages/backend/src/ai/vfs/workspace-vfs.ts
similarity index 100%
rename from apps/backend/src/ai/vfs/workspace-vfs.ts
rename to packages/backend/src/ai/vfs/workspace-vfs.ts
diff --git a/apps/backend/src/ai/workspace-tools.ts b/packages/backend/src/ai/workspace-tools.ts
similarity index 100%
rename from apps/backend/src/ai/workspace-tools.ts
rename to packages/backend/src/ai/workspace-tools.ts
diff --git a/apps/backend/src/mcp/dispatch.test.ts b/packages/backend/src/mcp/dispatch.test.ts
similarity index 100%
rename from apps/backend/src/mcp/dispatch.test.ts
rename to packages/backend/src/mcp/dispatch.test.ts
diff --git a/apps/backend/src/mcp/protocol.test.ts b/packages/backend/src/mcp/protocol.test.ts
similarity index 100%
rename from apps/backend/src/mcp/protocol.test.ts
rename to packages/backend/src/mcp/protocol.test.ts
diff --git a/apps/backend/src/mcp/protocol.ts b/packages/backend/src/mcp/protocol.ts
similarity index 100%
rename from apps/backend/src/mcp/protocol.ts
rename to packages/backend/src/mcp/protocol.ts
diff --git a/apps/backend/src/mcp/tool-manifest.test.ts b/packages/backend/src/mcp/tool-manifest.test.ts
similarity index 100%
rename from apps/backend/src/mcp/tool-manifest.test.ts
rename to packages/backend/src/mcp/tool-manifest.test.ts
diff --git a/apps/backend/src/mcp/tool-manifest.ts b/packages/backend/src/mcp/tool-manifest.ts
similarity index 100%
rename from apps/backend/src/mcp/tool-manifest.ts
rename to packages/backend/src/mcp/tool-manifest.ts
diff --git a/apps/backend/src/routes/event-capture.ts b/packages/backend/src/routes/event-capture.ts
similarity index 100%
rename from apps/backend/src/routes/event-capture.ts
rename to packages/backend/src/routes/event-capture.ts
diff --git a/apps/backend/src/routes/mcp-authkit.test.ts b/packages/backend/src/routes/mcp-oauth.test.ts
similarity index 54%
rename from apps/backend/src/routes/mcp-authkit.test.ts
rename to packages/backend/src/routes/mcp-oauth.test.ts
index 808a21544..1b4e6824b 100644
--- a/apps/backend/src/routes/mcp-authkit.test.ts
+++ b/packages/backend/src/routes/mcp-oauth.test.ts
@@ -2,17 +2,27 @@ import { Effect, Layer } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 import { describe, expect, it } from "vite-plus/test";
 
-import { makeMcpAuthKit, McpAuthKit } from "../McpAuthKit.ts";
-import { McpAuthKitRouteLayer } from "./mcp-authkit.ts";
+import { McpOAuth, McpOAuthError, McpOAuthUnconfiguredLive } from "../McpOAuth.ts";
+import { McpOAuthRouteLayer } from "./mcp-oauth.ts";
+
+/** Stand-in for a deployment that does run an authorization server. */
+const configuredLive = (authorizationServer: string) =>
+  Layer.succeed(McpOAuth)(
+    McpOAuth.of({
+      authorizationServer,
+      fetchAuthorizationServerMetadata: () => Effect.succeed({ issuer: authorizationServer }),
+      verifyAccessToken: () =>
+        Effect.fail(new McpOAuthError({ kind: "invalid_token", message: "not exercised" })),
+    }),
+  );
 
 const serve = (path: string, authorizationServer?: string) =>
   Effect.gen(function* () {
-    const authKit = Layer.succeed(
-      McpAuthKit,
-      McpAuthKit.of(makeMcpAuthKit(authorizationServer, undefined)),
-    );
+    const oauth = authorizationServer
+      ? configuredLive(authorizationServer)
+      : McpOAuthUnconfiguredLive;
     const handler = yield* HttpRouter.toHttpEffect(
-      McpAuthKitRouteLayer.pipe(HttpRouter.provideRequest(authKit)),
+      McpOAuthRouteLayer.pipe(HttpRouter.provideRequest(oauth)),
     );
     const response = yield* handler.pipe(
       Effect.provideService(
@@ -23,8 +33,8 @@ const serve = (path: string, authorizationServer?: string) =>
     return HttpServerResponse.toWeb(response);
   }).pipe(Effect.scoped, Effect.runPromise);
 
-describe("MCP AuthKit metadata", () => {
-  it("points the protected resource at the configured AuthKit issuer", async () => {
+describe("MCP OAuth metadata", () => {
+  it("points the protected resource at the configured issuer", async () => {
     const response = await serve(
       "/.well-known/oauth-protected-resource/api/mcp",
       "https://example.authkit.app",
@@ -38,7 +48,7 @@ describe("MCP AuthKit metadata", () => {
     });
   });
 
-  it("fails closed when no AuthKit issuer is configured", async () => {
+  it("fails closed when the deployment runs no authorization server", async () => {
     const response = await serve("/.well-known/oauth-protected-resource");
 
     expect(response.status).toBe(503);
diff --git a/apps/backend/src/routes/mcp-authkit.ts b/packages/backend/src/routes/mcp-oauth.ts
similarity index 78%
rename from apps/backend/src/routes/mcp-authkit.ts
rename to packages/backend/src/routes/mcp-oauth.ts
index 5563f4079..a3c060f2a 100644
--- a/apps/backend/src/routes/mcp-authkit.ts
+++ b/packages/backend/src/routes/mcp-oauth.ts
@@ -1,7 +1,7 @@
 import { Effect, Layer } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 
-import { McpAuthKit } from "../McpAuthKit.ts";
+import { McpOAuth } from "../McpOAuth.ts";
 
 const METADATA_HEADERS = { "cache-control": "public, max-age=300" } as const;
 
@@ -22,11 +22,11 @@ const unavailable = HttpServerResponse.json(
 
 const protectedResourceMetadata = Effect.gen(function* () {
   const request = yield* HttpServerRequest.HttpServerRequest;
-  const authKit = yield* McpAuthKit;
-  if (!authKit.authorizationServer) return yield* unavailable;
+  const mcpOAuth = yield* McpOAuth;
+  if (!mcpOAuth.authorizationServer) return yield* unavailable;
   return yield* HttpServerResponse.json(
     {
-      authorization_servers: [authKit.authorizationServer],
+      authorization_servers: [mcpOAuth.authorizationServer],
       bearer_methods_supported: ["header"],
       resource: `${requestOrigin(request)}/api/mcp`,
     },
@@ -35,14 +35,14 @@ const protectedResourceMetadata = Effect.gen(function* () {
 });
 
 const authorizationServerMetadata = Effect.gen(function* () {
-  const authKit = yield* McpAuthKit;
-  const result = yield* Effect.result(authKit.fetchAuthorizationServerMetadata());
+  const mcpOAuth = yield* McpOAuth;
+  const result = yield* Effect.result(mcpOAuth.fetchAuthorizationServerMetadata());
   return result._tag === "Success"
     ? yield* HttpServerResponse.json(result.success, { headers: METADATA_HEADERS })
     : yield* HttpServerResponse.json({ error: result.failure.message }, { status: 502 });
 });
 
-const registerMcpAuthKitRoutes = Effect.gen(function* () {
+const registerMcpOAuthRoutes = Effect.gen(function* () {
   const router = yield* HttpRouter.HttpRouter;
   yield* router.add("GET", "/.well-known/oauth-protected-resource", protectedResourceMetadata);
   yield* router.add(
@@ -54,4 +54,4 @@ const registerMcpAuthKitRoutes = Effect.gen(function* () {
 });
 
 /** AuthKit-backed OAuth discovery endpoints for the MCP protected resource. */
-export const McpAuthKitRouteLayer = Layer.effectDiscard(registerMcpAuthKitRoutes);
+export const McpOAuthRouteLayer = Layer.effectDiscard(registerMcpOAuthRoutes);
diff --git a/apps/backend/src/routes/mcp.test.ts b/packages/backend/src/routes/mcp.test.ts
similarity index 100%
rename from apps/backend/src/routes/mcp.test.ts
rename to packages/backend/src/routes/mcp.test.ts
diff --git a/apps/backend/src/routes/mcp.ts b/packages/backend/src/routes/mcp.ts
similarity index 96%
rename from apps/backend/src/routes/mcp.ts
rename to packages/backend/src/routes/mcp.ts
index f4e5af0e9..ab46db09b 100644
--- a/apps/backend/src/routes/mcp.ts
+++ b/packages/backend/src/routes/mcp.ts
@@ -20,7 +20,7 @@
  * or invalid bearer → 401 with a `WWW-Authenticate` header.
  *
  */
-import { ApiKeyService, LocalUserSessionService, Workos } from "@voidhash/core/services";
+import { ApiKeyService, IdentityProvider, LocalUserSessionService } from "@voidhash/core/services";
 import {
   AuthSession,
   makeInternalProjectAuthSession,
@@ -39,7 +39,7 @@ import {
 } from "../mcp/protocol.ts";
 import { findMcpTool } from "../mcp/tool-manifest.ts";
 import type { WorkspaceToolScope } from "../ai/workspace-tools.ts";
-import { McpAuthKit } from "../McpAuthKit.ts";
+import { McpOAuth } from "../McpOAuth.ts";
 
 const requestOrigin = (request: HttpServerRequest.HttpServerRequest): string => {
   try {
@@ -153,8 +153,8 @@ const handlePost = Effect.gen(function* () {
   let session: AnyAuthSession;
   let scope: WorkspaceToolScope;
   if (token.split(".").length === 3) {
-    const authKit = yield* McpAuthKit;
-    const validatedToken = yield* Effect.result(authKit.verifyAccessToken(token, resource));
+    const mcpOAuth = yield* McpOAuth;
+    const validatedToken = yield* Effect.result(mcpOAuth.verifyAccessToken(token, resource));
     if (Result.isFailure(validatedToken)) {
       const status = validatedToken.failure.kind === "misconfigured" ? 503 : 401;
       return HttpServerResponse.setHeader(
@@ -172,9 +172,9 @@ const handlePost = Effect.gen(function* () {
 
     const claims = validatedToken.success;
     const localUserSessions = yield* LocalUserSessionService;
-    const workos = yield* Workos;
-    const workosUser = yield* workos.getUser(claims.subject);
-    const localUser = yield* localUserSessions.resolveLocalUser(workosUser);
+    const identityProvider = yield* IdentityProvider;
+    const identity = yield* identityProvider.resolveIdentityById(claims.subject);
+    const localUser = yield* localUserSessions.resolveLocalUser(identity);
     const access = yield* localUserSessions.loadUserAccess(localUser.id);
     const organization = access.organizations.find(
       (candidate) => candidate.workosOrganizationId === claims.organizationId,
@@ -204,7 +204,7 @@ const handlePost = Effect.gen(function* () {
       localUser,
       { organizations: [organization], projects: [selection.project] },
       null,
-      workosUser.id,
+      identity.id,
     );
     session = userSession as unknown as AnyAuthSession;
     scope = { projectId: selection.project.id };
diff --git a/apps/backend/src/routes/paywall-serving.test.ts b/packages/backend/src/routes/paywall-serving.test.ts
similarity index 100%
rename from apps/backend/src/routes/paywall-serving.test.ts
rename to packages/backend/src/routes/paywall-serving.test.ts
diff --git a/apps/backend/src/routes/paywall-serving.ts b/packages/backend/src/routes/paywall-serving.ts
similarity index 100%
rename from apps/backend/src/routes/paywall-serving.ts
rename to packages/backend/src/routes/paywall-serving.ts
diff --git a/apps/backend/src/routes/public-file-serving.test.ts b/packages/backend/src/routes/public-file-serving.test.ts
similarity index 100%
rename from apps/backend/src/routes/public-file-serving.test.ts
rename to packages/backend/src/routes/public-file-serving.test.ts
diff --git a/apps/backend/src/routes/public-file-serving.ts b/packages/backend/src/routes/public-file-serving.ts
similarity index 100%
rename from apps/backend/src/routes/public-file-serving.ts
rename to packages/backend/src/routes/public-file-serving.ts
diff --git a/apps/backend/src/routes/v1/api-keys.ts b/packages/backend/src/routes/v1/api-keys.ts
similarity index 100%
rename from apps/backend/src/routes/v1/api-keys.ts
rename to packages/backend/src/routes/v1/api-keys.ts
diff --git a/apps/backend/src/routes/v1/auth.ts b/packages/backend/src/routes/v1/auth.ts
similarity index 100%
rename from apps/backend/src/routes/v1/auth.ts
rename to packages/backend/src/routes/v1/auth.ts
diff --git a/apps/backend/src/routes/v1/notifications.ts b/packages/backend/src/routes/v1/notifications.ts
similarity index 100%
rename from apps/backend/src/routes/v1/notifications.ts
rename to packages/backend/src/routes/v1/notifications.ts
diff --git a/apps/backend/src/routes/v1/organizations.ts b/packages/backend/src/routes/v1/organizations.ts
similarity index 100%
rename from apps/backend/src/routes/v1/organizations.ts
rename to packages/backend/src/routes/v1/organizations.ts
diff --git a/apps/backend/src/routes/v1/payment-provider-configurations.ts b/packages/backend/src/routes/v1/payment-provider-configurations.ts
similarity index 100%
rename from apps/backend/src/routes/v1/payment-provider-configurations.ts
rename to packages/backend/src/routes/v1/payment-provider-configurations.ts
diff --git a/apps/backend/src/routes/v1/payment-provider-products.ts b/packages/backend/src/routes/v1/payment-provider-products.ts
similarity index 100%
rename from apps/backend/src/routes/v1/payment-provider-products.ts
rename to packages/backend/src/routes/v1/payment-provider-products.ts
diff --git a/apps/backend/src/routes/v1/paywall-deploys.ts b/packages/backend/src/routes/v1/paywall-deploys.ts
similarity index 100%
rename from apps/backend/src/routes/v1/paywall-deploys.ts
rename to packages/backend/src/routes/v1/paywall-deploys.ts
diff --git a/apps/backend/src/routes/v1/paywall-locations.ts b/packages/backend/src/routes/v1/paywall-locations.ts
similarity index 100%
rename from apps/backend/src/routes/v1/paywall-locations.ts
rename to packages/backend/src/routes/v1/paywall-locations.ts
diff --git a/apps/backend/src/routes/v1/perks.ts b/packages/backend/src/routes/v1/perks.ts
similarity index 100%
rename from apps/backend/src/routes/v1/perks.ts
rename to packages/backend/src/routes/v1/perks.ts
diff --git a/apps/backend/src/routes/v1/persons.ts b/packages/backend/src/routes/v1/persons.ts
similarity index 100%
rename from apps/backend/src/routes/v1/persons.ts
rename to packages/backend/src/routes/v1/persons.ts
diff --git a/apps/backend/src/routes/v1/product-perks.ts b/packages/backend/src/routes/v1/product-perks.ts
similarity index 100%
rename from apps/backend/src/routes/v1/product-perks.ts
rename to packages/backend/src/routes/v1/product-perks.ts
diff --git a/apps/backend/src/routes/v1/products.ts b/packages/backend/src/routes/v1/products.ts
similarity index 100%
rename from apps/backend/src/routes/v1/products.ts
rename to packages/backend/src/routes/v1/products.ts
diff --git a/apps/backend/src/routes/v1/projects.ts b/packages/backend/src/routes/v1/projects.ts
similarity index 100%
rename from apps/backend/src/routes/v1/projects.ts
rename to packages/backend/src/routes/v1/projects.ts
diff --git a/apps/backend/src/routes/v1/schema.ts b/packages/backend/src/routes/v1/schema.ts
similarity index 100%
rename from apps/backend/src/routes/v1/schema.ts
rename to packages/backend/src/routes/v1/schema.ts
diff --git a/apps/backend/src/routes/v1/sdk.test.ts b/packages/backend/src/routes/v1/sdk.test.ts
similarity index 100%
rename from apps/backend/src/routes/v1/sdk.test.ts
rename to packages/backend/src/routes/v1/sdk.test.ts
diff --git a/apps/backend/src/routes/v1/sdk.ts b/packages/backend/src/routes/v1/sdk.ts
similarity index 100%
rename from apps/backend/src/routes/v1/sdk.ts
rename to packages/backend/src/routes/v1/sdk.ts
diff --git a/apps/backend/src/routes/v1/users.ts b/packages/backend/src/routes/v1/users.ts
similarity index 100%
rename from apps/backend/src/routes/v1/users.ts
rename to packages/backend/src/routes/v1/users.ts
diff --git a/apps/backend/src/routes/v1/webhooks.ts b/packages/backend/src/routes/v1/webhooks.ts
similarity index 100%
rename from apps/backend/src/routes/v1/webhooks.ts
rename to packages/backend/src/routes/v1/webhooks.ts
diff --git a/apps/backend/src/routes/webhook-endpoints/apple-server-to-server.ts b/packages/backend/src/routes/webhook-endpoints/apple-server-to-server.ts
similarity index 100%
rename from apps/backend/src/routes/webhook-endpoints/apple-server-to-server.ts
rename to packages/backend/src/routes/webhook-endpoints/apple-server-to-server.ts
diff --git a/apps/backend/src/routes/webhook-endpoints/google-play-rtdn.test.ts b/packages/backend/src/routes/webhook-endpoints/google-play-rtdn.test.ts
similarity index 100%
rename from apps/backend/src/routes/webhook-endpoints/google-play-rtdn.test.ts
rename to packages/backend/src/routes/webhook-endpoints/google-play-rtdn.test.ts
diff --git a/apps/backend/src/routes/webhook-endpoints/google-play-rtdn.ts b/packages/backend/src/routes/webhook-endpoints/google-play-rtdn.ts
similarity index 100%
rename from apps/backend/src/routes/webhook-endpoints/google-play-rtdn.ts
rename to packages/backend/src/routes/webhook-endpoints/google-play-rtdn.ts
diff --git a/apps/backend/src/routes/webhook-endpoints/stripe.ts b/packages/backend/src/routes/webhook-endpoints/stripe.ts
similarity index 100%
rename from apps/backend/src/routes/webhook-endpoints/stripe.ts
rename to packages/backend/src/routes/webhook-endpoints/stripe.ts
diff --git a/apps/backend/src/rpc-smoke.integration.test.ts b/packages/backend/src/rpc-smoke.integration.test.ts
similarity index 57%
rename from apps/backend/src/rpc-smoke.integration.test.ts
rename to packages/backend/src/rpc-smoke.integration.test.ts
index 2f65982ab..596f9869e 100644
--- a/apps/backend/src/rpc-smoke.integration.test.ts
+++ b/packages/backend/src/rpc-smoke.integration.test.ts
@@ -1,5 +1,5 @@
 /**
- * Backend RPC + WorkOS-webhook smoke, run IN-PROCESS against the real backend
+ * Backend RPC smoke, run IN-PROCESS against the real backend
  * stack provisioned once by `packages/core/test/_testing/globalSetup.ts` (the
  * same deploy the core service integration tests use). Nothing is deployed or
  * called over the wire here:
@@ -9,15 +9,13 @@
  *    in-memory client↔server with no HTTP/serialization. The `rpcSmokeCases`
  *    manifest, its payloads, and the `runRpcSmokeCase` runner are reused
  *    unchanged; only the transport differs from the old over-the-wire client.
- *  - **WorkOS webhook cases** POST synthetic, correctly-signed requests to the
- *    real `buildBackendFetch` route graph via a synthetic `HttpServerRequest`,
- *    exercising the real SDK signature verification (`TestRealWorkosLive` wraps
- *    real `verifyWebhook` with faked networked user lookups).
+ *  - **Raw route cases** feed synthetic requests to the real
+ *    `buildBackendFetch` route graph via a synthetic `HttpServerRequest`.
  *
- * Infra is real where the deployed stack is real: `Db`/`Clickhouse`/`Workos`
+ * Infra is real where the deployed stack is real: `Db`/`Clickhouse`
  * are built from the gated `testConnections`. Only the genuine external/platform
- * seams are doubled — `WorkosOrgPort` is faked so organization RPCs never
- * mutate real WorkOS; payment providers use local stubs; the webhook manager
+ * seams are doubled — `OrgDirectoryPort` is faked so organization RPCs never
+ * touch a real directory; payment providers use local stubs; the webhook manager
  * stays a thin DB-backed stub (the production
  * `webhook-rpcs.ts` passes `projectId: ""`, which the tolerant stub accepts).
  * The smoke fixture is seeded in-process via `seedSmokeData` (formerly the
@@ -30,9 +28,10 @@ import { RpcClient, RpcTest } from "effect/unstable/rpc";
 import { describe, expect, inject, test } from "vitest";
 
 import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
-import { PaywallArtifactStore, Workos } from "@voidhash/core/services";
+import { PaywallArtifactStore } from "@voidhash/core/services";
+import { StandaloneIdentityProviderLive } from "@voidhash/core/services/auth/StandaloneIdentityProvider";
 import { Db } from "@voidhash/db";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 import {
   BackendComponentCompilerStubLive,
@@ -50,13 +49,11 @@ import {
 } from "./BackendApp.ts";
 import { BackendRpcGroups as RpcGroups } from "./BackendRpcGroups.ts";
 import {
-  TEST_WORKOS_WEBHOOK_SECRET,
   TestClickhouseLive,
   TestProjectSchemaCacheLive,
-  TestRealWorkosLive,
   TestWebhookManagerServiceLive,
-  TestWorkflowPortsLive,
-  TestWorkosOrgPortLive,
+  TestWorkflowRunnerLive,
+  TestOrgDirectoryLive,
 } from "./testing/TestLayers.ts";
 import { TestRpcAuthLive } from "./testing/TestRpcAuth.ts";
 import type { BackendTestConnections } from "./testing/BackendTestConnections.ts";
@@ -76,6 +73,9 @@ import { seedSmokeData } from "./testing/smoke-seed.ts";
  * loudly when absent or null — that means `globalSetup` failed, or it ran on a
  * production/preview stage (where `testConnections` is intentionally withheld).
  */
+/** Signing key for the standalone session tokens this smoke mints. */
+const SMOKE_AUTH_SECRET = "rpc-smoke-standalone-auth-secret";
+
 const requireTestConnections = (): BackendTestConnections => {
   const tc = inject("coreStackOutput")?.testConnections ?? null;
   if (tc === null) {
@@ -109,28 +109,18 @@ const SmokePaywallArtifactStoreLive = Layer.sync(PaywallArtifactStore, () => {
   });
 });
 
-/** Real `Workos` SDK layer built from the deployed stack's credentials. */
-const workosLayer = (tc: BackendTestConnections): Layer.Layer<Workos> =>
-  Workos.layer({
-    apiKey: Effect.succeed(tc.workos.apiKey),
-    clientId: Effect.succeed(tc.workos.clientId),
-    cookieName: Effect.succeed(tc.workos.cookieName),
-    cookiePassword: Effect.succeed(tc.workos.cookiePassword),
-    webhookSecret: Effect.succeed(tc.workos.webhookSecret),
-  });
-
 /**
- * In-process infrastructure for the RPC handler graph: real `Db`/`Clickhouse`/
- * `Workos` from the deployed stack, an in-memory schema cache, a faked
- * `WorkosOrgPort`, and local payment/paywall/identity stubs.
+ * In-process infrastructure for the RPC handler graph: real `Db`/`Clickhouse`
+ * from the deployed stack, an in-memory schema cache, a faked
+ * `OrgDirectoryPort`, and local payment/paywall/identity stubs.
  */
 const makeRpcInfra = (tc: BackendTestConnections) =>
   Layer.mergeAll(
     Db.layer(tc.db),
     ClickhouseWebClient.layer(tc.clickhouse).pipe(Layer.orDie),
-    workosLayer(tc),
+    StandaloneIdentityProviderLive(SMOKE_AUTH_SECRET),
     TestProjectSchemaCacheLive,
-    TestWorkosOrgPortLive,
+    TestOrgDirectoryLive,
     BackendMimicHostStubLive,
     BackendComponentCompilerStubLive,
     BackendSnapshotImageRendererStubLive,
@@ -142,16 +132,16 @@ const makeRpcInfra = (tc: BackendTestConnections) =>
   );
 
 /**
- * In-process infrastructure for the WorkOS webhook route: real `Db`, the
- * real-verify/fake-getUser `Workos` wrapper, and the same stubs otherwise (the
- * webhook path needs no ClickHouse, so a no-op stands in).
+ * In-process infrastructure for the raw route graph: real `Db` plus the same
+ * stubs as the RPC graph (these routes need no ClickHouse, so a no-op stands
+ * in).
  */
-const makeWebhookInfra = (tc: BackendTestConnections) =>
+const makeRouteInfra = (tc: BackendTestConnections) =>
   Layer.mergeAll(
     Db.layer(tc.db),
     TestClickhouseLive,
     TestProjectSchemaCacheLive,
-    TestWorkosOrgPortLive,
+    TestOrgDirectoryLive,
     BackendMimicHostStubLive,
     BackendComponentCompilerStubLive,
     BackendSnapshotImageRendererStubLive,
@@ -160,7 +150,7 @@ const makeWebhookInfra = (tc: BackendTestConnections) =>
     BackendPaywallArtifactStoreStubLive,
     BackendPublicFileStoreStubLive,
     BackendNoopIdentityProjectionPublisherLive,
-    TestRealWorkosLive,
+    StandaloneIdentityProviderLive(SMOKE_AUTH_SECRET),
   );
 
 const smokeHeaders = (context: RpcSmokeContext, role: RpcSmokeRole) => ({
@@ -267,102 +257,16 @@ describe("Backend RPC smoke", () => {
         for (const smokeCase of rpcSmokeCases) {
           yield* runRpcSmokeCase(client as never, smokeCase, context);
         }
-      }).pipe(Effect.provide(rpcServices), Effect.provide(TestWorkflowPortsLive), Effect.scoped),
+      }).pipe(
+        Effect.provide(rpcServices),
+        Effect.provide(TestWorkflowRunnerLive),
+        Effect.provide(SmokePlatformRuntimeStub),
+        Effect.scoped,
+      ),
     );
   }, 600_000);
 });
 
-// --- WorkOS webhook (in-process against the real route graph) ----------------
-
-const toHex = (buffer: ArrayBuffer): string =>
-  Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, "0")).join("");
-
-/**
- * Sign a webhook payload the way the WorkOS SDK verifies it: HMAC-SHA256 over
- * `${timestamp}.${JSON.stringify(payload)}` keyed by the webhook secret, header
- * formatted `t=<ms>, v1=<hex>`. The returned `body` is the exact bytes to POST
- * so the handler's `JSON.parse(rawBody)` round-trips to the signed string.
- */
-const signWorkosWebhook = async (payload: object, secret: string, timestamp: number) => {
-  const body = JSON.stringify(payload);
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"],
-  );
-  const signature = await crypto.subtle.sign(
-    "HMAC",
-    key,
-    new TextEncoder().encode(`${timestamp}.${body}`),
-  );
-  return { body, header: `t=${timestamp}, v1=${toHex(signature)}` };
-};
-
-const makeUserCreatedEvent = () => {
-  const suffix = crypto.randomUUID().replaceAll("-", "");
-  return {
-    created_at: new Date().toISOString(),
-    data: {
-      created_at: new Date().toISOString(),
-      email: `webhook-test-${suffix}@example.com`,
-      email_verified: true,
-      external_id: null,
-      first_name: "Webhook",
-      id: `user_${suffix}`,
-      last_name: "Test",
-      object: "user",
-      profile_picture_url: null,
-      updated_at: new Date().toISOString(),
-    },
-    event: "user.created",
-    id: `event_${suffix}`,
-  };
-};
-
-const makeOrganizationUpdatedEvent = (ids: ReturnType<typeof makeSmokeIds>) => {
-  const suffix = crypto.randomUUID().replaceAll("-", "");
-  return {
-    created_at: new Date().toISOString(),
-    data: {
-      allow_profiles_outside_organization: false,
-      created_at: new Date().toISOString(),
-      domains: [],
-      external_id: ids.organizationId,
-      id: ids.workosOrganizationId,
-      metadata: {},
-      name: "Webhook Renamed Organization",
-      object: "organization",
-      updated_at: new Date().toISOString(),
-    },
-    event: "organization.updated",
-    id: `event_${suffix}`,
-  };
-};
-
-const makeOrganizationMembershipCreatedEvent = (ids: ReturnType<typeof makeSmokeIds>) => {
-  const suffix = crypto.randomUUID().replaceAll("-", "");
-  return {
-    created_at: new Date().toISOString(),
-    data: {
-      created_at: new Date().toISOString(),
-      custom_attributes: {},
-      directory_managed: false,
-      id: `workos_mem_webhook_${suffix.slice(0, 16)}`,
-      object: "organization_membership",
-      organization_id: ids.workosOrganizationId,
-      organization_name: "Webhook Renamed Organization",
-      role: { slug: "admin" },
-      status: "active",
-      updated_at: new Date().toISOString(),
-      user_id: ids.workosNormalUserId,
-    },
-    event: "organization_membership.created",
-    id: `event_${suffix}`,
-  };
-};
-
 /**
  * Sends a request to the real backend route graph in-process: builds
  * `buildBackendFetch`, feeds it a synthetic `HttpServerRequest`, and reads the
@@ -377,13 +281,13 @@ const requestBackend = (tc: BackendTestConnections, path: string, init: RequestI
         auth: TestRpcAuthLive,
         features: NoBackendFeatures,
         rpcExtension: NoBackendRpcExtension,
-        infrastructure: makeWebhookInfra(tc),
-      }).pipe(Effect.provide(TestWorkflowPortsLive));
+        infrastructure: makeRouteInfra(tc),
+      }).pipe(Effect.provide(TestWorkflowRunnerLive));
 
       const request = HttpServerRequest.fromWeb(new Request(`http://backend.local${path}`, init));
       const response = yield* handler.pipe(
         Effect.provideService(HttpServerRequest.HttpServerRequest, request),
-        Effect.provide(TestWorkflowPortsLive),
+        Effect.provide(TestWorkflowRunnerLive),
         // The push send path colors its effects with the runtime-phase marker
         // (queue dispatch); the deployed worker's fetch provides it, so mirror
         // that here with a minimal stub.
@@ -396,7 +300,7 @@ const requestBackend = (tc: BackendTestConnections, path: string, init: RequestI
       // The auth middleware now resolves `Db` ambiently, so its requirement
       // surfaces on the built handler (exactly as in the deployed worker, which
       // provides `Db` at the outer fetch scope). Provide it here to match.
-    }).pipe(Effect.provide(Db.layer(tc.db))),
+    }).pipe(Effect.provide(Db.layer(tc.db)), Effect.provide(SmokePlatformRuntimeStub)),
   );
 
 describe("Backend runtime capabilities", () => {
@@ -410,93 +314,3 @@ describe("Backend runtime capabilities", () => {
     expect(JSON.parse(text)).toEqual({ enterprise: {} });
   });
 });
-
-const seedWebhookFixture = (tc: BackendTestConnections, webhookRunId: string) =>
-  Effect.runPromise(seedSmokeData(webhookRunId).pipe(Effect.provide(Db.layer(tc.db))));
-
-describe("Backend WorkOS webhook smoke", () => {
-  test("processes a correctly-signed user.created event", async () => {
-    const tc = requireTestConnections();
-    const { body, header } = await signWorkosWebhook(
-      makeUserCreatedEvent(),
-      TEST_WORKOS_WEBHOOK_SECRET,
-      Date.now(),
-    );
-
-    const { status, text } = await Effect.runPromise(
-      requestBackend(tc, "/api/webhooks/workos", {
-        body,
-        headers: { "content-type": "application/json", "workos-signature": header },
-        method: "POST",
-      }),
-    );
-
-    // On failure the body explains why (the route returns a 500 with detail).
-    expect(status, `webhook returned ${status}: ${text}`).toBe(200);
-    const json = JSON.parse(text) as { duplicate?: boolean; received?: boolean };
-    expect(json.received).toBe(true);
-    expect(json.duplicate ?? false).toBe(false);
-  }, 120_000);
-
-  test("processes a correctly-signed organization.updated event", async () => {
-    const tc = requireTestConnections();
-    const webhookRunId = `org${crypto.randomUUID().replaceAll("-", "").slice(0, 7)}`;
-    const ids = makeSmokeIds(webhookRunId);
-    await seedWebhookFixture(tc, webhookRunId);
-
-    const { body, header } = await signWorkosWebhook(
-      makeOrganizationUpdatedEvent(ids),
-      TEST_WORKOS_WEBHOOK_SECRET,
-      Date.now(),
-    );
-
-    const { status, text } = await Effect.runPromise(
-      requestBackend(tc, "/api/webhooks/workos", {
-        body,
-        headers: { "content-type": "application/json", "workos-signature": header },
-        method: "POST",
-      }),
-    );
-
-    expect(status, `webhook returned ${status}: ${text}`).toBe(200);
-  }, 120_000);
-
-  test("processes a correctly-signed organization_membership.created event", async () => {
-    const tc = requireTestConnections();
-    const webhookRunId = `mem${crypto.randomUUID().replaceAll("-", "").slice(0, 7)}`;
-    const ids = makeSmokeIds(webhookRunId);
-    await seedWebhookFixture(tc, webhookRunId);
-
-    const { body, header } = await signWorkosWebhook(
-      makeOrganizationMembershipCreatedEvent(ids),
-      TEST_WORKOS_WEBHOOK_SECRET,
-      Date.now(),
-    );
-
-    const { status, text } = await Effect.runPromise(
-      requestBackend(tc, "/api/webhooks/workos", {
-        body,
-        headers: { "content-type": "application/json", "workos-signature": header },
-        method: "POST",
-      }),
-    );
-
-    expect(status, `webhook returned ${status}: ${text}`).toBe(200);
-  }, 120_000);
-
-  test("rejects an invalid signature", async () => {
-    const tc = requireTestConnections();
-    const { status } = await Effect.runPromise(
-      requestBackend(tc, "/api/webhooks/workos", {
-        body: JSON.stringify(makeUserCreatedEvent()),
-        headers: {
-          "content-type": "application/json",
-          "workos-signature": `t=${Date.now()}, v1=${"0".repeat(64)}`,
-        },
-        method: "POST",
-      }),
-    );
-
-    expect(status).not.toBe(200);
-  }, 120_000);
-});
diff --git a/apps/backend/src/rpcs/agent-session-rpcs.test.ts b/packages/backend/src/rpcs/agent-session-rpcs.test.ts
similarity index 100%
rename from apps/backend/src/rpcs/agent-session-rpcs.test.ts
rename to packages/backend/src/rpcs/agent-session-rpcs.test.ts
diff --git a/apps/backend/src/rpcs/agent-session-rpcs.ts b/packages/backend/src/rpcs/agent-session-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/agent-session-rpcs.ts
rename to packages/backend/src/rpcs/agent-session-rpcs.ts
diff --git a/apps/backend/src/rpcs/analytics-rpcs.ts b/packages/backend/src/rpcs/analytics-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/analytics-rpcs.ts
rename to packages/backend/src/rpcs/analytics-rpcs.ts
diff --git a/apps/backend/src/rpcs/api-key-rpcs.ts b/packages/backend/src/rpcs/api-key-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/api-key-rpcs.ts
rename to packages/backend/src/rpcs/api-key-rpcs.ts
diff --git a/apps/backend/src/rpcs/experiment-rpcs.ts b/packages/backend/src/rpcs/experiment-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/experiment-rpcs.ts
rename to packages/backend/src/rpcs/experiment-rpcs.ts
diff --git a/apps/backend/src/rpcs/feature-flag-rpcs.ts b/packages/backend/src/rpcs/feature-flag-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/feature-flag-rpcs.ts
rename to packages/backend/src/rpcs/feature-flag-rpcs.ts
diff --git a/apps/backend/src/rpcs/feedback-rpcs.ts b/packages/backend/src/rpcs/feedback-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/feedback-rpcs.ts
rename to packages/backend/src/rpcs/feedback-rpcs.ts
diff --git a/apps/backend/src/rpcs/organization-rpcs.ts b/packages/backend/src/rpcs/organization-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/organization-rpcs.ts
rename to packages/backend/src/rpcs/organization-rpcs.ts
diff --git a/apps/backend/src/rpcs/payment-provider-configuration-rpcs.ts b/packages/backend/src/rpcs/payment-provider-configuration-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/payment-provider-configuration-rpcs.ts
rename to packages/backend/src/rpcs/payment-provider-configuration-rpcs.ts
diff --git a/apps/backend/src/rpcs/payment-provider-product-rpcs.ts b/packages/backend/src/rpcs/payment-provider-product-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/payment-provider-product-rpcs.ts
rename to packages/backend/src/rpcs/payment-provider-product-rpcs.ts
diff --git a/apps/backend/src/rpcs/paywall-asset-rpcs.ts b/packages/backend/src/rpcs/paywall-asset-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/paywall-asset-rpcs.ts
rename to packages/backend/src/rpcs/paywall-asset-rpcs.ts
diff --git a/apps/backend/src/rpcs/paywall-component-rpcs.ts b/packages/backend/src/rpcs/paywall-component-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/paywall-component-rpcs.ts
rename to packages/backend/src/rpcs/paywall-component-rpcs.ts
diff --git a/apps/backend/src/rpcs/paywall-deploy-rpcs.ts b/packages/backend/src/rpcs/paywall-deploy-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/paywall-deploy-rpcs.ts
rename to packages/backend/src/rpcs/paywall-deploy-rpcs.ts
diff --git a/apps/backend/src/rpcs/paywall-location-rpcs.ts b/packages/backend/src/rpcs/paywall-location-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/paywall-location-rpcs.ts
rename to packages/backend/src/rpcs/paywall-location-rpcs.ts
diff --git a/apps/backend/src/rpcs/paywall-rpcs.ts b/packages/backend/src/rpcs/paywall-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/paywall-rpcs.ts
rename to packages/backend/src/rpcs/paywall-rpcs.ts
diff --git a/apps/backend/src/rpcs/paywall-workspace-rpcs.test.ts b/packages/backend/src/rpcs/paywall-workspace-rpcs.test.ts
similarity index 100%
rename from apps/backend/src/rpcs/paywall-workspace-rpcs.test.ts
rename to packages/backend/src/rpcs/paywall-workspace-rpcs.test.ts
diff --git a/apps/backend/src/rpcs/paywall-workspace-rpcs.ts b/packages/backend/src/rpcs/paywall-workspace-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/paywall-workspace-rpcs.ts
rename to packages/backend/src/rpcs/paywall-workspace-rpcs.ts
diff --git a/apps/backend/src/rpcs/perk-rpcs.ts b/packages/backend/src/rpcs/perk-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/perk-rpcs.ts
rename to packages/backend/src/rpcs/perk-rpcs.ts
diff --git a/apps/backend/src/rpcs/person-rpcs.ts b/packages/backend/src/rpcs/person-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/person-rpcs.ts
rename to packages/backend/src/rpcs/person-rpcs.ts
diff --git a/apps/backend/src/rpcs/product-perk-rpcs.ts b/packages/backend/src/rpcs/product-perk-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/product-perk-rpcs.ts
rename to packages/backend/src/rpcs/product-perk-rpcs.ts
diff --git a/apps/backend/src/rpcs/product-rpcs.ts b/packages/backend/src/rpcs/product-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/product-rpcs.ts
rename to packages/backend/src/rpcs/product-rpcs.ts
diff --git a/apps/backend/src/rpcs/project-rpcs.ts b/packages/backend/src/rpcs/project-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/project-rpcs.ts
rename to packages/backend/src/rpcs/project-rpcs.ts
diff --git a/apps/backend/src/rpcs/push-notification-configuration-rpcs.ts b/packages/backend/src/rpcs/push-notification-configuration-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/push-notification-configuration-rpcs.ts
rename to packages/backend/src/rpcs/push-notification-configuration-rpcs.ts
diff --git a/apps/backend/src/rpcs/push-notification-send-rpcs.ts b/packages/backend/src/rpcs/push-notification-send-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/push-notification-send-rpcs.ts
rename to packages/backend/src/rpcs/push-notification-send-rpcs.ts
diff --git a/apps/backend/src/rpcs/user-rpcs.ts b/packages/backend/src/rpcs/user-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/user-rpcs.ts
rename to packages/backend/src/rpcs/user-rpcs.ts
diff --git a/apps/backend/src/rpcs/voidql-rpcs.ts b/packages/backend/src/rpcs/voidql-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/voidql-rpcs.ts
rename to packages/backend/src/rpcs/voidql-rpcs.ts
diff --git a/apps/backend/src/rpcs/webhook-rpcs.ts b/packages/backend/src/rpcs/webhook-rpcs.ts
similarity index 100%
rename from apps/backend/src/rpcs/webhook-rpcs.ts
rename to packages/backend/src/rpcs/webhook-rpcs.ts
diff --git a/apps/backend/src/security/authorization-matrix.test.ts b/packages/backend/src/security/authorization-matrix.test.ts
similarity index 100%
rename from apps/backend/src/security/authorization-matrix.test.ts
rename to packages/backend/src/security/authorization-matrix.test.ts
diff --git a/apps/backend/src/testing/BackendTestConnections.ts b/packages/backend/src/testing/BackendTestConnections.ts
similarity index 100%
rename from apps/backend/src/testing/BackendTestConnections.ts
rename to packages/backend/src/testing/BackendTestConnections.ts
diff --git a/apps/backend/src/testing/PurchaseSdkHttpHarness.ts b/packages/backend/src/testing/PurchaseSdkHttpHarness.ts
similarity index 100%
rename from apps/backend/src/testing/PurchaseSdkHttpHarness.ts
rename to packages/backend/src/testing/PurchaseSdkHttpHarness.ts
diff --git a/apps/backend/src/testing/TestLayers.ts b/packages/backend/src/testing/TestLayers.ts
similarity index 68%
rename from apps/backend/src/testing/TestLayers.ts
rename to packages/backend/src/testing/TestLayers.ts
index ee398b577..6d8480215 100644
--- a/apps/backend/src/testing/TestLayers.ts
+++ b/packages/backend/src/testing/TestLayers.ts
@@ -4,14 +4,8 @@ import {
   WebhookValidationError,
 } from "@voidhash/core/domain/webhook/Webhook";
 import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
-import { AppStoreReconcileOriginalTransactionWorkflow } from "@voidhash/core/services/paymentProviders/AppStoreReconcileOriginalTransactionWorkflow";
-import { AppStoreReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow";
-import { AppStoreReplayParkedSdkNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/AppStoreReplayParkedSdkNotificationsWorkflow";
-import { GooglePlayReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow";
-import { StripeReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/StripeReplayParkedNotificationsWorkflow";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
-import { WebhookDeliveryWorkflow } from "@voidhash/core/services/webhookDispatch/WebhookDeliveryWorkflow";
-import { Workos, WorkosAuthError } from "@voidhash/core/services/auth/Workos";
+import * as TestWorkflowRunner from "@voidhash/platform/TestWorkflowRunner";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
 import {
   Db,
   eq,
@@ -24,7 +18,7 @@ import {
   ProjectSchemaCache,
   WebhookManagerService,
   WebhookServiceError,
-  WorkosOrgPort,
+  OrgDirectoryPort,
 } from "@voidhash/core/services";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -58,21 +52,8 @@ export const TestClickhouseLive = Layer.succeed(
   clickhouseStub,
 );
 
-// The asynchronous workflow ports the route graph dispatches to
-// (`PersonIdentityService` → identity completion, webhook dispatch → delivery,
-// App Store reconciliation → replay). Every one is a fire-and-forget `dispatch`,
-// so the smoke stubs are no-ops. Unlike the other infrastructure services these
-// surface as request-scoped requirements on the built handler, so they are
-// provided to the worker's `fetch` directly rather than via the infra layer.
-export const TestWorkflowPortsLive = Layer.mergeAll(
-  Layer.succeed(IdentifyDistinctIdCompletionWorkflow, { dispatch: () => Effect.void }),
-  Layer.succeed(WebhookDeliveryWorkflow, { dispatch: () => Effect.void }),
-  Layer.succeed(AppStoreReplayParkedNotificationsWorkflow, { dispatch: () => Effect.void }),
-  Layer.succeed(AppStoreReplayParkedSdkNotificationsWorkflow, { dispatch: () => Effect.void }),
-  Layer.succeed(AppStoreReconcileOriginalTransactionWorkflow, { dispatch: () => Effect.void }),
-  Layer.succeed(GooglePlayReplayParkedNotificationsWorkflow, { dispatch: () => Effect.void }),
-  Layer.succeed(StripeReplayParkedNotificationsWorkflow, { dispatch: () => Effect.void }),
-);
+/** Recording workflow runner used by backend smoke tests. */
+export const TestWorkflowRunnerLive = Layer.succeed(WorkflowRunner, TestWorkflowRunner.make());
 
 // In-memory no-op project schema cache. The smoke path never relies on a cache
 // hit, so every read misses and writes are dropped.
@@ -84,110 +65,7 @@ export const TestProjectSchemaCacheLive = Layer.succeed(ProjectSchemaCache, {
   }),
 });
 
-/**
- * Stub `Workos` service for the integration smoke. The HTTP-level
- * `AuthMiddleware` requires it; the RPC smoke deliberately authenticates via
- * `TestRpcAuthLive` instead, so every WorkOS-shaped method here fails fast
- * with `WorkosAuthError`. If a future smoke exercises an HTTP v1 endpoint
- * that needs a real session it must swap in a richer stub.
- */
-const workosNotConfigured = (operation: string) =>
-  Effect.fail(
-    new WorkosAuthError({
-      cause: "Workos is not configured in the test backend",
-      message: `Workos.${operation} is not available in tests`,
-    }),
-  );
-
-export const TestWorkosLive = Layer.succeed(Workos, {
-  authenticateSessionCookie: () => Effect.succeed(null),
-  clientId: "test-client-id",
-  cookieName: "wos-session",
-  createOrganization: () => workosNotConfigured("createOrganization"),
-  createOrganizationMembership: () => workosNotConfigured("createOrganizationMembership"),
-  deleteOrganization: () => workosNotConfigured("deleteOrganization"),
-  deleteOrganizationMembership: () => workosNotConfigured("deleteOrganizationMembership"),
-  findUserByEmail: () => Effect.succeed(null),
-  getJwksUrl: () => "https://test-workos.invalid/jwks",
-  getOrganization: () => workosNotConfigured("getOrganization"),
-  getOrganizationByExternalId: () => Effect.succeed(null),
-  getUser: () => workosNotConfigured("getUser"),
-  listOrganizationMembershipsForUser: () => Effect.succeed([]),
-  setUserExternalId: () => workosNotConfigured("setUserExternalId"),
-  updateOrganization: () => workosNotConfigured("updateOrganization"),
-  updateOrganizationMembership: () => workosNotConfigured("updateOrganizationMembership"),
-  verifyWebhook: () => workosNotConfigured("verifyWebhook"),
-});
-
-/**
- * Webhook signing secret the WorkOS webhook smoke signs payloads with. Shared so
- * the test signs with the same key {@link TestRealWorkosLive} verifies against.
- */
-export const TEST_WORKOS_WEBHOOK_SECRET = "whsec_integration_test_secret_000000000000000000000000";
-
-// The real Workos service so the `/api/webhooks/workos` route exercises the
-// actual SDK signature verification (SubtleCrypto) rather than the fast-failing
-// stub. apiKey/clientId are unused by `verifyWebhook` (no network), so dummy
-// values are fine; only `webhookSecret` matters. The wrapper below stubs the
-// networked user calls that membership webhooks need.
-const TestRealWorkosBaseLive = Workos.layer({
-  apiKey: Effect.succeed("sk_test_unused"),
-  clientId: Effect.succeed("client_test_unused"),
-  cookieName: Effect.succeed("wos-session"),
-  cookiePassword: Effect.succeed("integration-test-cookie-password-0000000000"),
-  webhookSecret: Effect.succeed(TEST_WORKOS_WEBHOOK_SECRET),
-});
-
-/**
- * Real WorkOS SDK for webhook signature verification, with the networked user
- * lookups (`getUser` / `setUserExternalId`) faked so membership webhooks resolve
- * a synthetic user instead of hitting the WorkOS API.
- */
-export const TestRealWorkosLive = Layer.effect(
-  Workos,
-  Effect.gen(function* () {
-    const real = yield* Workos;
-    const makeUser = (workosUserId: string, externalId: string | null) => {
-      const localUserId = workosUserId.startsWith("user_smk_")
-        ? workosUserId.slice("user_".length)
-        : externalId;
-      const suffix = localUserId?.replace(/^smk_(?:admin|user|invite)_/, "");
-      const email =
-        localUserId?.startsWith("smk_admin_") && suffix
-          ? `smoke-admin-${suffix}@example.test`
-          : localUserId?.startsWith("smk_user_") && suffix
-            ? `smoke-user-${suffix}@example.test`
-            : localUserId?.startsWith("smk_invite_") && suffix
-              ? `smoke-invite-${suffix}@example.test`
-              : `webhook-${workosUserId}@example.test`;
-
-      return {
-        createdAt: new Date().toISOString(),
-        email,
-        emailVerified: true,
-        externalId: localUserId,
-        firstName: "Webhook",
-        id: workosUserId,
-        lastName: "User",
-        lastSignInAt: null,
-        locale: null,
-        metadata: {},
-        object: "user" as const,
-        profilePictureUrl: null,
-        updatedAt: new Date().toISOString(),
-      };
-    };
-
-    return {
-      ...real,
-      getUser: (workosUserId: string) => Effect.succeed(makeUser(workosUserId, null)),
-      setUserExternalId: (workosUserId: string, externalId: string) =>
-        Effect.succeed(makeUser(workosUserId, externalId)),
-    };
-  }),
-).pipe(Layer.provide(TestRealWorkosBaseLive));
-
-export const TestWorkosOrgPortLive = Layer.succeed(WorkosOrgPort, {
+export const TestOrgDirectoryLive = Layer.succeed(OrgDirectoryPort, {
   createMembership: (input) =>
     Effect.succeed({
       id: `workos_mem_${crypto.randomUUID()}`,
@@ -534,8 +412,7 @@ export const TestWebhookManagerServiceLive = Layer.effect(
 export const TestBackendStubInfrastructureLive = Layer.mergeAll(
   TestClickhouseLive,
   TestProjectSchemaCacheLive,
-  TestWorkosLive,
-  TestWorkosOrgPortLive,
+  TestOrgDirectoryLive,
   BackendMimicHostStubLive,
   BackendComponentCompilerStubLive,
   BackendSnapshotImageRendererStubLive,
diff --git a/apps/backend/src/testing/TestRpcAuth.ts b/packages/backend/src/testing/TestRpcAuth.ts
similarity index 100%
rename from apps/backend/src/testing/TestRpcAuth.ts
rename to packages/backend/src/testing/TestRpcAuth.ts
diff --git a/apps/backend/src/testing/provided-context.d.ts b/packages/backend/src/testing/provided-context.d.ts
similarity index 100%
rename from apps/backend/src/testing/provided-context.d.ts
rename to packages/backend/src/testing/provided-context.d.ts
diff --git a/apps/backend/src/testing/rpc-smoke-cases.ts b/packages/backend/src/testing/rpc-smoke-cases.ts
similarity index 100%
rename from apps/backend/src/testing/rpc-smoke-cases.ts
rename to packages/backend/src/testing/rpc-smoke-cases.ts
diff --git a/apps/backend/src/testing/smoke-ids.ts b/packages/backend/src/testing/smoke-ids.ts
similarity index 100%
rename from apps/backend/src/testing/smoke-ids.ts
rename to packages/backend/src/testing/smoke-ids.ts
diff --git a/apps/backend/src/testing/smoke-seed.ts b/packages/backend/src/testing/smoke-seed.ts
similarity index 100%
rename from apps/backend/src/testing/smoke-seed.ts
rename to packages/backend/src/testing/smoke-seed.ts
diff --git a/apps/backend/sst-env.d.ts b/packages/backend/sst-env.d.ts
similarity index 81%
rename from apps/backend/sst-env.d.ts
rename to packages/backend/sst-env.d.ts
index eec65b9bd..cf5e5fbe5 100644
--- a/apps/backend/sst-env.d.ts
+++ b/packages/backend/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/packages/backend/tsconfig.json b/packages/backend/tsconfig.json
new file mode 100644
index 000000000..b9da6a8e5
--- /dev/null
+++ b/packages/backend/tsconfig.json
@@ -0,0 +1,17 @@
+{
+  "extends": "@voidhash/tsconfig/alchemy-base.json",
+  "compilerOptions": {
+    "types": ["bun"],
+    "allowImportingTsExtensions": true,
+    "composite": true,
+    "stripInternal": true,
+    "noEmit": false,
+    "outDir": "./lib",
+    "rootDir": "./src",
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["src"],
+  "exclude": ["**/node_modules/**"]
+}
diff --git a/packages/backend/vitest.integration.mts b/packages/backend/vitest.integration.mts
new file mode 100644
index 000000000..be239ff1a
--- /dev/null
+++ b/packages/backend/vitest.integration.mts
@@ -0,0 +1,25 @@
+import { defineConfig } from "vite-plus";
+
+// Backend RPC + webhook smoke against a provisioned environment. Locally the
+// self-host stack supplies it via the shared core globalSetup; downstream
+// compositions substitute their own globalSetup providing the same
+// `coreStackOutput` contract.
+export default defineConfig({
+  resolve: {
+    tsconfigPaths: true,
+  },
+  test: {
+    environment: "node",
+    include: ["./**/*.integration.test.ts"],
+    exclude: ["./node_modules/**", "./dist/**"],
+    globalSetup: ["../../packages/core/test/_testing/globalSetup.ts"],
+    passWithNoTests: true,
+    reporters: ["verbose"],
+    pool: "threads",
+    isolate: false,
+    fileParallelism: false,
+    hookTimeout: 300_000,
+    teardownTimeout: 300_000,
+    testTimeout: 120_000,
+  },
+});
diff --git a/packages/backend/vitest.unit.mts b/packages/backend/vitest.unit.mts
new file mode 100644
index 000000000..4d8eb60c4
--- /dev/null
+++ b/packages/backend/vitest.unit.mts
@@ -0,0 +1,12 @@
+import { defineConfig } from "vite-plus";
+
+// Unit tier: every `*.test.ts` except the stack-backed integration files.
+// `scripts/check-test-tiers.mjs` enforces this split across the repository.
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["./**/*.test.ts"],
+    exclude: ["./**/*.integration.test.ts", "./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
+  },
+});
diff --git a/packages/clickhouse-db/sst-env.d.ts b/packages/clickhouse-db/sst-env.d.ts
index 661beaa1f..a73ac12f6 100644
--- a/packages/clickhouse-db/sst-env.d.ts
+++ b/packages/clickhouse-db/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../sst-env.d.ts" />
 
diff --git a/packages/core/package.json b/packages/core/package.json
index c524357d0..286ef069e 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -32,6 +32,7 @@
     "./utils/crypto/PaymentConfigSecretCrypto": "./src/utils/crypto/PaymentConfigSecretCrypto.ts",
     "./utils/crypto/SecretBox": "./src/utils/crypto/SecretBox.ts",
     "./utils/crypto/account-token": "./src/utils/crypto/account-token.ts",
+    "./utils/crypto/standalone-auth-token": "./src/utils/crypto/standalone-auth-token.ts",
     "./utils/generate-id": "./src/utils/generate-id.ts",
     "./services/personIdentity/IdentityMutationService": "./src/services/personIdentity/IdentityMutationService.ts",
     "./services/paymentProviders/appStore/payment-provider": "./src/services/paymentProviders/appStore/payment-provider.ts",
@@ -62,9 +63,11 @@
     "./services/apiKeys/ApiKeyService": "./src/services/apiKeys/ApiKeyService.ts",
     "./services/auditLog/AuditLogPort": "./src/services/auditLog/AuditLogPort.ts",
     "./services/auth/AuthTokenVerifier": "./src/services/auth/AuthTokenVerifier.ts",
+    "./services/auth/IdentityProvider": "./src/services/auth/IdentityProvider.ts",
+    "./services/auth/StandaloneAuthConfig": "./src/services/auth/StandaloneAuthConfig.ts",
+    "./services/auth/StandaloneIdentityProvider": "./src/services/auth/StandaloneIdentityProvider.ts",
     "./services/auth/LocalUserSessionService": "./src/services/auth/LocalUserSessionService.ts",
-    "./services/auth/WorkosLocalSyncService": "./src/services/auth/WorkosLocalSyncService.ts",
-    "./services/auth/Workos": "./src/services/auth/Workos.ts",
+    "./services/auth/IdentityLinkBackfillService": "./src/services/auth/IdentityLinkBackfillService.ts",
     "./services/featureFlags/FeatureFlagService": "./src/services/featureFlags/FeatureFlagService.ts",
     "./services/fxRates/FxRateService": "./src/services/fxRates/FxRateService.ts",
     "./services/paywalls/MimicHost": "./src/services/paywalls/MimicHost.ts",
@@ -79,7 +82,6 @@
     "./services/paymentProviders/AppStorePaymentProviderService": "./src/services/paymentProviders/AppStorePaymentProviderService.ts",
     "./services/paymentProviders/GooglePlayPaymentProviderService": "./src/services/paymentProviders/GooglePlayPaymentProviderService.ts",
     "./services/paymentProviders/StripePaymentProviderService": "./src/services/paymentProviders/StripePaymentProviderService.ts",
-    "./services/paymentProviders/StripeReplayParkedNotificationsWorkflow": "./src/services/paymentProviders/StripeReplayParkedNotificationsWorkflow.ts",
     "./services/paymentProviders/stripe/payment-provider": "./src/services/paymentProviders/stripe/payment-provider.ts",
     "./services/paymentProviders/stripe/payment-provider-service": "./src/services/paymentProviders/stripe/payment-provider-service.ts",
     "./services/paymentProviders/stripe/payment-provider-service-queries": "./src/services/paymentProviders/stripe/payment-provider-service-queries.ts",
@@ -116,7 +118,8 @@
     "./services/organizations/OrganizationLifecyclePort": "./src/services/organizations/OrganizationLifecyclePort.ts",
     "./services/organizations/OrganizationMembershipSyncPort": "./src/services/organizations/OrganizationMembershipSyncPort.ts",
     "./services/organizations/OrganizationMembershipWebhookPort": "./src/services/organizations/OrganizationMembershipWebhookPort.ts",
-    "./services/organizations/WorkosOrgPort": "./src/services/organizations/WorkosOrgPort.ts",
+    "./services/organizations/StandaloneOrgDirectory": "./src/services/organizations/StandaloneOrgDirectory.ts",
+    "./services/organizations/OrgDirectoryPort": "./src/services/organizations/OrgDirectoryPort.ts",
     "./services/sdk/SdkService": "./src/services/sdk/SdkService.ts",
     "./services/storage/PublicFileStore": "./src/services/storage/PublicFileStore.ts",
     "./eventBus/CoreEventBus": "./src/eventBus/CoreEventBus.ts",
@@ -132,19 +135,17 @@
     "./services/webhookManager/WebhookManagerService": "./src/services/webhookManager/WebhookManagerService.ts",
     "./services/webhookManager/event-types": "./src/services/webhookManager/event-types.ts",
     "./services/webhookDispatch/WebhookDispatchService": "./src/services/webhookDispatch/WebhookDispatchService.ts",
-    "./services/webhookDispatch/WebhookDeliveryWorkflow": "./src/services/webhookDispatch/WebhookDeliveryWorkflow.ts",
     "./services/webhookDispatch/WebhookDeliveryService": "./src/services/webhookDispatch/WebhookDeliveryService.ts",
-    "./services/personIdentity/IdentifyDistinctIdCompletionWorkflow": "./src/services/personIdentity/IdentifyDistinctIdCompletionWorkflow.ts",
-    "./services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow": "./src/services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow.ts",
-    "./services/paymentProviders/AppStoreReplayParkedSdkNotificationsWorkflow": "./src/services/paymentProviders/AppStoreReplayParkedSdkNotificationsWorkflow.ts",
-    "./services/paymentProviders/AppStoreReconcileOriginalTransactionWorkflow": "./src/services/paymentProviders/AppStoreReconcileOriginalTransactionWorkflow.ts",
-    "./services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow": "./src/services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow.ts"
+    "./workflows/definitions": "./src/workflows/definitions.ts",
+    "./workflows/DeliverWebhook": "./src/workflows/DeliverWebhook.ts",
+    "./workflows/registry": "./src/workflows/registry.ts"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
     "typecheck-go": "tsgo --noEmit",
     "test": "vp test run -c vitest.unit.mts",
-    "test:watch": "vp test -c vitest.unit.mts"
+    "test:watch": "vp test -c vitest.unit.mts",
+    "test:integration": "vp test run -c vitest.integration.mts"
   },
   "dependencies": {
     "@distilled.cloud/stripe": "0.30.3",
@@ -158,9 +159,8 @@
     "@voidhash/lib": "workspace:*",
     "@voidhash/paywall-build": "workspace:*",
     "@voidhash/paywall-workspace": "workspace:*",
-    "@orbian/sdk": "https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526",
+    "@voidhash/platform": "workspace:*",
     "@voidhash/rpc": "workspace:*",
-    "@workos-inc/node": "9.2.0",
     "nanoid": "^5.1.5",
     "uncrypto": "^0.1.3"
   },
diff --git a/packages/core/src/domain/auth/LocalUserSession.ts b/packages/core/src/domain/auth/LocalUserSession.ts
index e3f613a36..35b32dc28 100644
--- a/packages/core/src/domain/auth/LocalUserSession.ts
+++ b/packages/core/src/domain/auth/LocalUserSession.ts
@@ -1,9 +1,22 @@
-import type { User as WorkOSUser } from "@workos-inc/node";
-
-export type LocalUserIdentity = Pick<
-  WorkOSUser,
-  "email" | "emailVerified" | "externalId" | "firstName" | "id" | "lastName" | "profilePictureUrl"
->;
+/**
+ * Provider-neutral identity mirrored into the local `user` table.
+ *
+ * Structurally a subset of the WorkOS `User` object so the WorkOS adapters can
+ * pass SDK values through unchanged, but declared independently so core carries
+ * no `@workos-inc/node` dependency and alternative identity providers (the
+ * local development provider) can satisfy it.
+ */
+export interface LocalUserIdentity {
+  readonly email: string;
+  readonly emailVerified: boolean;
+  /** Local user id previously linked back onto the provider record, when known. */
+  readonly externalId: string | null;
+  readonly firstName: string | null;
+  /** Identity id as issued by the provider — stored as `user.workos_user_id`. */
+  readonly id: string;
+  readonly lastName: string | null;
+  readonly profilePictureUrl: string | null;
+}
 
 export interface LocalUserAccess {
   readonly organizations: ReadonlyArray<{
diff --git a/packages/core/src/services/analyticsIngest/AnalyticsDispatchService.ts b/packages/core/src/services/analyticsIngest/AnalyticsDispatchService.ts
index f14e69b29..2733a3b27 100644
--- a/packages/core/src/services/analyticsIngest/AnalyticsDispatchService.ts
+++ b/packages/core/src/services/analyticsIngest/AnalyticsDispatchService.ts
@@ -12,7 +12,7 @@
  * Tests / non-worker hosts get {@link AnalyticsDispatchService.noop}.
  */
 import { Context, Effect, Layer } from "effect";
-import type { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import type { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 import {
   type CapturedEventV1Type,
diff --git a/packages/core/src/services/analyticsIngest/CaptureIngress.ts b/packages/core/src/services/analyticsIngest/CaptureIngress.ts
index dd07e71f7..2e439f010 100644
--- a/packages/core/src/services/analyticsIngest/CaptureIngress.ts
+++ b/packages/core/src/services/analyticsIngest/CaptureIngress.ts
@@ -1,5 +1,5 @@
 import { Context, Effect, Layer, Schema } from "effect";
-import type { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import type { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 import type {
   CapturedEventV1Type,
diff --git a/packages/core/src/services/analyticsIngest/PolicyCounterStore.ts b/packages/core/src/services/analyticsIngest/PolicyCounterStore.ts
index 807aa6ca8..bb36643b8 100644
--- a/packages/core/src/services/analyticsIngest/PolicyCounterStore.ts
+++ b/packages/core/src/services/analyticsIngest/PolicyCounterStore.ts
@@ -12,7 +12,7 @@
  * port to a provider implementation.
  */
 import { Context, Effect, Layer, Schema } from "effect";
-import type { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import type { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 export class PolicyStoreError extends Schema.TaggedErrorClass<PolicyStoreError>("PolicyStoreError")(
   "PolicyStoreError",
diff --git a/packages/core/src/services/auth/AuthTokenVerifier.ts b/packages/core/src/services/auth/AuthTokenVerifier.ts
index 920601a49..394d6344f 100644
--- a/packages/core/src/services/auth/AuthTokenVerifier.ts
+++ b/packages/core/src/services/auth/AuthTokenVerifier.ts
@@ -11,7 +11,7 @@ export class JwtAuthError extends Data.TaggedError("JwtAuthError")<{
   readonly message: string;
 }> {}
 
-/** Claims required from a verified WorkOS identity token. */
+/** Claims required from a verified identity token. */
 export const JwtAuthPayloadSchema = Schema.Struct({
   sub: Schema.String,
   email: Schema.String,
@@ -19,13 +19,19 @@ export const JwtAuthPayloadSchema = Schema.Struct({
   image: Schema.optional(Schema.String),
 });
 
-/** Claims decoded from a verified WorkOS identity token. */
+/** Claims decoded from a verified identity token. */
 export type JwtAuthPayload = typeof JwtAuthPayloadSchema.Type;
 
-/** Provider-qualified result returned by {@link AuthTokenVerifier}. */
+/**
+ * Provider-qualified result returned by {@link AuthTokenVerifier}.
+ *
+ * `provider` is an open string rather than a closed union: trust derives from
+ * which verifier validated the token, not from the tag, and the shared contract
+ * should not have to enumerate every deployment's providers.
+ */
 export const ValidatedJwtSchema = Schema.Struct({
   payload: JwtAuthPayloadSchema,
-  provider: Schema.Literal("workos"),
+  provider: Schema.String,
 });
 
 /** Verified token plus the identity provider that issued it. */
diff --git a/packages/core/src/services/auth/WorkosLocalSyncService.test.ts b/packages/core/src/services/auth/IdentityLinkBackfillService.test.ts
similarity index 84%
rename from packages/core/src/services/auth/WorkosLocalSyncService.test.ts
rename to packages/core/src/services/auth/IdentityLinkBackfillService.test.ts
index 01e8eadaa..1d194cbae 100644
--- a/packages/core/src/services/auth/WorkosLocalSyncService.test.ts
+++ b/packages/core/src/services/auth/IdentityLinkBackfillService.test.ts
@@ -8,11 +8,11 @@ import {
   OrganizationMembershipSyncPortError,
 } from "../organizations/OrganizationMembershipSyncPort.ts";
 import { LocalUserSessionService } from "./LocalUserSessionService.ts";
-import { Workos } from "./Workos.ts";
+import { IdentityProvider } from "./IdentityProvider.ts";
 import {
-  WorkosLocalSyncService,
-  WorkosLocalSyncServiceError,
-} from "./WorkosLocalSyncService.ts";
+  IdentityLinkBackfillService,
+  IdentityLinkBackfillError,
+} from "./IdentityLinkBackfillService.ts";
 
 const identity = (externalId: string | null = "local_user_1"): LocalUserIdentity => ({
   email: "alice@example.com",
@@ -72,12 +72,12 @@ const makeTestLayer = (options: {
       }),
     ),
     Layer.succeed(
-      Workos,
+      IdentityProvider,
       {
-        setUserExternalId: (workosUserId: string, externalId: string) => {
-          externalIdCalls.push({ externalId, workosUserId });
+        linkExternalId: (providerUserId: string, externalId: string) => {
+          externalIdCalls.push({ externalId, workosUserId: providerUserId });
           return options.setExternalIdFailure
-            ? Effect.fail({ _tag: "WorkosError" } as never)
+            ? Effect.fail({ _tag: "IdentityProviderError" } as never)
             : Effect.void;
         },
       } as never,
@@ -88,18 +88,18 @@ const makeTestLayer = (options: {
     externalIdCalls,
     layer: Layer.mergeAll(
       Dependencies,
-      WorkosLocalSyncService.layer.pipe(Layer.provide(Dependencies)),
+      IdentityLinkBackfillService.layer.pipe(Layer.provide(Dependencies)),
     ),
     membershipCalls,
   };
 };
 
-describe("WorkosLocalSyncService", () => {
+describe("IdentityLinkBackfillService", () => {
   it("resolves the local user and delegates optional membership synchronization", async () => {
     const testLayer = makeTestLayer();
     const result = await Effect.runPromise(
       Effect.gen(function* () {
-        const sync = yield* WorkosLocalSyncService;
+        const sync = yield* IdentityLinkBackfillService;
         return yield* sync.syncAuthenticatedUser(identity());
       }).pipe(Effect.provide(testLayer.layer)),
     );
@@ -119,7 +119,7 @@ describe("WorkosLocalSyncService", () => {
     const testLayer = makeTestLayer();
     await Effect.runPromise(
       Effect.gen(function* () {
-        const sync = yield* WorkosLocalSyncService;
+        const sync = yield* IdentityLinkBackfillService;
         yield* sync.syncAuthenticatedUser(identity(null));
       }).pipe(Effect.provide(testLayer.layer)),
     );
@@ -133,7 +133,7 @@ describe("WorkosLocalSyncService", () => {
     const testLayer = makeTestLayer({ setExternalIdFailure: true });
     const result = await Effect.runPromise(
       Effect.gen(function* () {
-        const sync = yield* WorkosLocalSyncService;
+        const sync = yield* IdentityLinkBackfillService;
         return yield* sync.syncAuthenticatedUser(identity(null));
       }).pipe(Effect.provide(testLayer.layer)),
     );
@@ -146,14 +146,14 @@ describe("WorkosLocalSyncService", () => {
     const testLayer = makeTestLayer({ membershipFailure: true });
     const result = await Effect.runPromise(
       Effect.gen(function* () {
-        const sync = yield* WorkosLocalSyncService;
+        const sync = yield* IdentityLinkBackfillService;
         return yield* Effect.result(sync.syncAuthenticatedUser(identity()));
       }).pipe(Effect.provide(testLayer.layer)),
     );
 
     expect(result._tag).toBe("Failure");
     if (result._tag === "Failure") {
-      expect(result.failure).toBeInstanceOf(WorkosLocalSyncServiceError);
+      expect(result.failure).toBeInstanceOf(IdentityLinkBackfillError);
       expect(result.failure.cause).toBe("membership sync failed");
     }
   });
diff --git a/packages/core/src/services/auth/WorkosLocalSyncService.ts b/packages/core/src/services/auth/IdentityLinkBackfillService.ts
similarity index 60%
rename from packages/core/src/services/auth/WorkosLocalSyncService.ts
rename to packages/core/src/services/auth/IdentityLinkBackfillService.ts
index 28b3aabb7..ca570a430 100644
--- a/packages/core/src/services/auth/WorkosLocalSyncService.ts
+++ b/packages/core/src/services/auth/IdentityLinkBackfillService.ts
@@ -3,24 +3,24 @@ import { Context, Effect, Layer, Schema } from "effect";
 
 import type { LocalUserIdentity } from "../../domain/auth/LocalUserSession.ts";
 import { OrganizationMembershipSyncPort } from "../organizations/OrganizationMembershipSyncPort.ts";
+import { IdentityProvider } from "./IdentityProvider.ts";
 import { LocalUserSessionService } from "./LocalUserSessionService.ts";
-import { Workos } from "./Workos.ts";
 
 /** Stable authentication-facing error for local WorkOS synchronization failures. */
-export class WorkosLocalSyncServiceError extends Schema.TaggedErrorClass<WorkosLocalSyncServiceError>(
-  "WorkosLocalSyncServiceError",
-)("WorkosLocalSyncServiceError", { cause: Schema.String }) {}
+export class IdentityLinkBackfillError extends Schema.TaggedErrorClass<IdentityLinkBackfillError>(
+  "IdentityLinkBackfillError",
+)("IdentityLinkBackfillError", { cause: Schema.String }) {}
 
-export interface WorkosLocalSyncResult {
+export interface IdentityLinkBackfillResult {
   readonly localUser: DbUser;
   readonly syncedMembershipIds: ReadonlyArray<string>;
   readonly syncedOrganizationIds: ReadonlyArray<string>;
 }
 
-export interface WorkosLocalSyncServiceShape {
+export interface IdentityLinkBackfillServiceShape {
   readonly syncAuthenticatedUser: (
     identity: LocalUserIdentity,
-  ) => Effect.Effect<WorkosLocalSyncResult, WorkosLocalSyncServiceError, Db>;
+  ) => Effect.Effect<IdentityLinkBackfillResult, IdentityLinkBackfillError, Db>;
 }
 
 /**
@@ -28,25 +28,25 @@ export interface WorkosLocalSyncServiceShape {
  * delegates optional multi-user organization synchronization through
  * {@link OrganizationMembershipSyncPort}.
  */
-export class WorkosLocalSyncService extends Context.Service<
-  WorkosLocalSyncService,
-  WorkosLocalSyncServiceShape
->()("WorkosLocalSyncService", {
+export class IdentityLinkBackfillService extends Context.Service<
+  IdentityLinkBackfillService,
+  IdentityLinkBackfillServiceShape
+>()("IdentityLinkBackfillService", {
   make: Effect.gen(function* () {
     const localUserSessions = yield* LocalUserSessionService;
     const membershipSync = yield* OrganizationMembershipSyncPort;
-    const workos = yield* Workos;
+    const identityProvider = yield* IdentityProvider;
 
-    const syncAuthenticatedUser = Effect.fn("WorkosLocalSyncService.syncAuthenticatedUser")(
+    const syncAuthenticatedUser = Effect.fn("IdentityLinkBackfillService.syncAuthenticatedUser")(
       function* (identity: LocalUserIdentity) {
-        if (identity.id) yield* Effect.annotateCurrentSpan("voidhash.user.workos_id", identity.id);
+        if (identity.id) yield* Effect.annotateCurrentSpan("voidhash.user.external_id", identity.id);
 
         const localUser = yield* localUserSessions.resolveLocalUser(identity);
         if (localUser.id) yield* Effect.annotateCurrentSpan("voidhash.user.id", localUser.id);
 
         yield* !identity.externalId
-          ? workos
-              .setUserExternalId(identity.id, localUser.id)
+          ? identityProvider
+              .linkExternalId(identity.id, localUser.id)
               .pipe(Effect.catch(() => Effect.void))
           : Effect.void;
 
@@ -55,17 +55,17 @@ export class WorkosLocalSyncService extends Context.Service<
           workosUserId: identity.id,
         });
 
-        return { localUser, ...synced } satisfies WorkosLocalSyncResult;
+        return { localUser, ...synced } satisfies IdentityLinkBackfillResult;
       },
       (effect) =>
         effect.pipe(
           Effect.catchTags({
             EffectDrizzleQueryError: (error) =>
               Effect.fail(
-                new WorkosLocalSyncServiceError({ cause: String(error.cause ?? error.message) }),
+                new IdentityLinkBackfillError({ cause: String(error.cause ?? error.message) }),
               ),
             OrganizationMembershipSyncPortError: (error) =>
-              Effect.fail(new WorkosLocalSyncServiceError({ cause: error.cause })),
+              Effect.fail(new IdentityLinkBackfillError({ cause: error.cause })),
           }),
         ),
     );
@@ -73,5 +73,5 @@ export class WorkosLocalSyncService extends Context.Service<
     return { syncAuthenticatedUser } as const;
   }),
 }) {
-  static layer = Layer.effect(WorkosLocalSyncService)(WorkosLocalSyncService.make);
+  static layer = Layer.effect(IdentityLinkBackfillService)(IdentityLinkBackfillService.make);
 }
diff --git a/packages/core/src/services/auth/IdentityProvider.ts b/packages/core/src/services/auth/IdentityProvider.ts
new file mode 100644
index 000000000..332416f1b
--- /dev/null
+++ b/packages/core/src/services/auth/IdentityProvider.ts
@@ -0,0 +1,70 @@
+import { Context, type Effect, Schema } from "effect";
+
+import type { LocalUserIdentity } from "../../domain/auth/LocalUserSession.ts";
+import type { ValidatedJwt } from "./AuthTokenVerifier.ts";
+
+/**
+ * Catch-all error for {@link IdentityProvider} operations. Adapters wrap any
+ * provider-specific failure into this single tag so the authentication catch
+ * boundaries stay small.
+ */
+export class IdentityProviderError extends Schema.TaggedErrorClass<IdentityProviderError>(
+  "IdentityProviderError",
+)("IdentityProviderError", {
+  cause: Schema.String,
+  message: Schema.String,
+}) {}
+
+export interface IdentityProviderShape {
+  /**
+   * Name of the session cookie this provider issues. Request middlewares use it
+   * to detect a session-cookie request before attempting to authenticate one.
+   */
+  readonly cookieName: string;
+
+  /**
+   * Authenticates the provider's session cookie carried by `headers`. Resolves
+   * to `null` when no valid session is present, which callers treat as
+   * "not authenticated" rather than as a failure.
+   */
+  readonly authenticateSessionCookie: (
+    headers: Headers,
+  ) => Effect.Effect<LocalUserIdentity | null, IdentityProviderError>;
+
+  /**
+   * Resolves a verified bearer token into a full identity. The WorkOS adapter
+   * re-fetches the user so profile changes land immediately; the local adapter
+   * builds the identity from the token claims alone.
+   */
+  readonly resolveIdentity: (
+    validated: ValidatedJwt,
+  ) => Effect.Effect<LocalUserIdentity, IdentityProviderError>;
+
+  /**
+   * Resolves an identity from a provider user id alone, for callers that
+   * authenticated through a different token pipeline and hold only the subject
+   * (the MCP AuthKit OAuth path).
+   */
+  readonly resolveIdentityById: (
+    providerUserId: string,
+  ) => Effect.Effect<LocalUserIdentity, IdentityProviderError>;
+
+  /**
+   * Records the local user id on the provider's identity record so later
+   * lookups can map back without an email match. Providers that have nowhere to
+   * store it may implement this as a no-op.
+   */
+  readonly linkExternalId: (
+    providerUserId: string,
+    localUserId: string,
+  ) => Effect.Effect<void, IdentityProviderError>;
+}
+
+/**
+ * Provider-agnostic port for request authentication. The live adapter (WorkOS
+ * or the local development provider) is wired by the application root, keeping
+ * session resolution provider-neutral and trivially fakeable in tests.
+ */
+export class IdentityProvider extends Context.Service<IdentityProvider, IdentityProviderShape>()(
+  "@voidhash/core/IdentityProvider",
+) {}
diff --git a/packages/core/src/services/auth/StandaloneAuthConfig.ts b/packages/core/src/services/auth/StandaloneAuthConfig.ts
new file mode 100644
index 000000000..97f5d5c56
--- /dev/null
+++ b/packages/core/src/services/auth/StandaloneAuthConfig.ts
@@ -0,0 +1,82 @@
+/**
+ * Root credentials for the standalone identity provider.
+ *
+ * Read identically by the self-host runtime and the TanStack Start server
+ * routes so both sides mint and verify the same session tokens without passing
+ * the decision between processes.
+ *
+ * Self-host is single-player: there is exactly one user, whose credentials come
+ * from the environment. Nothing here can create a second identity.
+ */
+import {
+  STANDALONE_AUTH_DEFAULT_SECRET,
+  normalizeEmail,
+} from "../../utils/crypto/standalone-auth-token.ts";
+
+/** Environment bag accepted by the resolvers — `process.env` in every runtime. */
+export type StandaloneAuthEnv = Record<string, string | undefined>;
+
+/** Root login name used when `VOIDHASH_ROOT_USERNAME` is unset. */
+export const DEFAULT_ROOT_USERNAME = "root";
+
+/**
+ * Root password used when `VOIDHASH_ROOT_PASSWORD` is unset. Reachable only in
+ * `SELFHOST_MODE=local-evaluation`, which the README restricts to loopback;
+ * production refuses to start without a real value.
+ */
+export const DEFAULT_ROOT_PASSWORD = "voidhash";
+
+/** Root email used when `VOIDHASH_ROOT_EMAIL` is unset. */
+export const DEFAULT_ROOT_EMAIL = "root@voidhash.local";
+
+/**
+ * Values `.env.example` ships as placeholders. Shared with the self-host
+ * security validator so both agree on what "not really configured" means.
+ */
+export const isPlaceholderSecret = (value: string | undefined): boolean => {
+  const normalized = value?.trim().toLowerCase();
+  return (
+    !normalized ||
+    normalized === "password" ||
+    normalized.includes("not_configured") ||
+    normalized.includes("change-me") ||
+    normalized.includes("replace-me") ||
+    normalized.startsWith("replace-with-")
+  );
+};
+
+/** Resolved root identity and session signing key. */
+export interface StandaloneAuthConfig {
+  readonly rootUsername: string;
+  readonly rootPassword: string;
+  readonly rootEmail: string;
+  readonly secret: string;
+}
+
+/**
+ * Reads the standalone auth configuration, falling back to the documented
+ * evaluation defaults. Callers that must not accept the defaults check
+ * {@link standaloneAuthConfigIssues} first.
+ */
+export const resolveStandaloneAuthConfig = (
+  env: StandaloneAuthEnv = process.env,
+): StandaloneAuthConfig => ({
+  rootEmail: normalizeEmail(env.VOIDHASH_ROOT_EMAIL?.trim() || DEFAULT_ROOT_EMAIL),
+  rootPassword: env.VOIDHASH_ROOT_PASSWORD?.trim() || DEFAULT_ROOT_PASSWORD,
+  rootUsername: env.VOIDHASH_ROOT_USERNAME?.trim() || DEFAULT_ROOT_USERNAME,
+  secret: env.VOIDHASH_AUTH_SECRET?.trim() || STANDALONE_AUTH_DEFAULT_SECRET,
+});
+
+/**
+ * Names the standalone settings that are missing or still carry an evaluation
+ * default. Empty when the deployment is safe to expose beyond loopback.
+ */
+export const standaloneAuthConfigIssues = (
+  env: StandaloneAuthEnv = process.env,
+): ReadonlyArray<string> => {
+  const issues: Array<string> = [];
+  if (!env.VOIDHASH_ROOT_USERNAME?.trim()) issues.push("VOIDHASH_ROOT_USERNAME");
+  if (isPlaceholderSecret(env.VOIDHASH_ROOT_PASSWORD)) issues.push("VOIDHASH_ROOT_PASSWORD");
+  if (isPlaceholderSecret(env.VOIDHASH_AUTH_SECRET)) issues.push("VOIDHASH_AUTH_SECRET");
+  return issues;
+};
diff --git a/packages/core/src/services/auth/StandaloneIdentityProvider.ts b/packages/core/src/services/auth/StandaloneIdentityProvider.ts
new file mode 100644
index 000000000..0c2f82e4e
--- /dev/null
+++ b/packages/core/src/services/auth/StandaloneIdentityProvider.ts
@@ -0,0 +1,119 @@
+/**
+ * Standalone identity provider — the self-host half of the auth seam.
+ *
+ * Identity comes from root credentials held in the environment and is carried
+ * by a signed session token, so there is no directory to call and nothing to
+ * verify remotely: both the cookie and the bearer path resolve straight out of
+ * the token claims.
+ *
+ * The provider can only ever emit the single root identity, which is what makes
+ * self-host single-player structurally rather than by policy.
+ */
+import { Effect, Layer } from "effect";
+
+import type { LocalUserIdentity } from "../../domain/auth/LocalUserSession.ts";
+import {
+  STANDALONE_AUTH_COOKIE_NAME,
+  readCookieValue,
+  verifyStandaloneAuthToken,
+  type StandaloneAuthTokenClaims,
+} from "../../utils/crypto/standalone-auth-token.ts";
+import { AuthTokenVerifier, JwtAuthError, type ValidatedJwt } from "./AuthTokenVerifier.ts";
+import { IdentityProvider, IdentityProviderError } from "./IdentityProvider.ts";
+
+/** Provider tag stamped on tokens issued by the standalone provider. */
+export const STANDALONE_PROVIDER = "standalone";
+
+const identityFromClaims = (claims: {
+  readonly sub: string;
+  readonly email: string;
+  readonly name?: string | undefined;
+  readonly image?: string | undefined;
+}): LocalUserIdentity => ({
+  email: claims.email,
+  // The operator configured this address out of band; there is no mailbox
+  // round-trip to perform and no second identity that could claim it.
+  emailVerified: true,
+  externalId: null,
+  firstName: claims.name ?? claims.email,
+  id: claims.sub,
+  lastName: null,
+  profilePictureUrl: claims.image ?? null,
+});
+
+/** Maps verified standalone token claims onto the shared identity shape. */
+export const standaloneIdentityFromClaims = (
+  claims: StandaloneAuthTokenClaims,
+): LocalUserIdentity => identityFromClaims(claims);
+
+/**
+ * Verifies standalone HS256 session tokens. The bearer path needs no external
+ * key server, so the same secret validates cookies and API bearer tokens.
+ */
+export const StandaloneAuthTokenVerifierLive = (secret: string): Layer.Layer<AuthTokenVerifier> =>
+  Layer.succeed(AuthTokenVerifier)(
+    AuthTokenVerifier.of({
+      validateToken: (token) =>
+        verifyStandaloneAuthToken(token, secret).pipe(
+          Effect.map(
+            (claims): ValidatedJwt => ({
+              payload: {
+                email: claims.email,
+                sub: claims.sub,
+                ...(claims.image === undefined ? {} : { image: claims.image }),
+                ...(claims.name === undefined ? {} : { name: claims.name }),
+              },
+              provider: STANDALONE_PROVIDER,
+            }),
+          ),
+          Effect.mapError(
+            (error) =>
+              new JwtAuthError({
+                cause: error,
+                detail: error.message,
+                message: "JWT validation failed",
+              }),
+          ),
+        ),
+    }),
+  );
+
+/** Identity provider backed by locally signed root session tokens. */
+export const StandaloneIdentityProviderLive = (secret: string): Layer.Layer<IdentityProvider> =>
+  Layer.succeed(IdentityProvider)(
+    IdentityProvider.of({
+      authenticateSessionCookie: (headers) => {
+        const token = readCookieValue(headers.get("cookie"), STANDALONE_AUTH_COOKIE_NAME);
+        if (!token) return Effect.succeed(null);
+        return verifyStandaloneAuthToken(token, secret).pipe(
+          Effect.map(identityFromClaims),
+          // An expired or tampered cookie is "no session" rather than a hard
+          // failure, so the browser is redirected to sign in again.
+          Effect.catch(() => Effect.succeed(null)),
+        );
+      },
+      cookieName: STANDALONE_AUTH_COOKIE_NAME,
+      // Nothing to link: the root subject is a constant, so the mapping to the
+      // local user row is already stable without writing anything back.
+      linkExternalId: () => Effect.void,
+      resolveIdentity: (validated) =>
+        validated.provider === STANDALONE_PROVIDER
+          ? Effect.succeed(identityFromClaims(validated.payload))
+          : Effect.fail(
+              new IdentityProviderError({
+                cause: validated.provider,
+                message: "Standalone identity provider received a token from another provider",
+              }),
+            ),
+      // Only reached through an OAuth path that requires a remote directory.
+      // Self-host MCP clients authenticate with project secret keys or user API
+      // keys instead.
+      resolveIdentityById: (providerUserId) =>
+        Effect.fail(
+          new IdentityProviderError({
+            cause: providerUserId,
+            message: "Standalone identity provider cannot resolve an identity by id alone",
+          }),
+        ),
+    }),
+  );
diff --git a/packages/core/src/services/auth/Workos.ts b/packages/core/src/services/auth/Workos.ts
deleted file mode 100644
index de2fc9d68..000000000
--- a/packages/core/src/services/auth/Workos.ts
+++ /dev/null
@@ -1,369 +0,0 @@
-import {
-  type Event as WorkosEvent,
-  type Organization as WorkosOrganization,
-  type OrganizationMembership as WorkosOrganizationMembership,
-  WorkOS,
-  type User as WorkOSUser,
-} from "@workos-inc/node";
-import { Context, Data, Effect, Layer } from "effect";
-
-export interface WorkosConfig {
-  readonly apiKey: Effect.Effect<string>;
-  readonly clientId: Effect.Effect<string>;
-  readonly cookieName: Effect.Effect<string>;
-  readonly cookiePassword: Effect.Effect<string>;
-  readonly webhookSecret: Effect.Effect<string>;
-}
-
-export class WorkosAuthError extends Data.TaggedError("WorkosAuthError")<{
-  readonly cause?: unknown;
-  readonly message: string;
-}> {}
-
-type AuthenticatedSession = {
-  readonly accessToken: string;
-  readonly organizationId?: string;
-  readonly permissions?: string[];
-  readonly role?: string;
-  readonly roles?: string[];
-  readonly sessionId: string;
-  readonly user: WorkOSUser;
-};
-
-/**
- * Format a WorkOS SDK rejection into a single human-readable string. The SDK
- * throws `WorkOSResponseError`-shaped objects whose useful fields live under
- * `rawData` (`message`, `code`, `errors`) and on `status` — without this
- * normalization the `Error.message` we surface is empty and the cause is just
- * `[object Object]`.
- */
-const describeWorkosError = (cause: unknown): string => {
-  if (cause instanceof Error && cause.message) {
-    return cause.message;
-  }
-  const data = cause as {
-    readonly status?: number;
-    readonly rawData?: {
-      readonly message?: string;
-      readonly code?: string;
-      readonly errors?: unknown;
-    };
-    readonly message?: string;
-  } | null;
-  if (data) {
-    const parts: string[] = [];
-    if (data.status) parts.push(`HTTP ${data.status}`);
-    if (data.rawData?.code) parts.push(data.rawData.code);
-    if (data.rawData?.message) parts.push(data.rawData.message);
-    else if (data.message) parts.push(data.message);
-    if (data.rawData?.errors) parts.push(JSON.stringify(data.rawData.errors));
-    if (parts.length > 0) return parts.join(" — ");
-  }
-  try {
-    return JSON.stringify(cause);
-  } catch {
-    return String(cause);
-  }
-};
-
-const getCookieValue = (cookieHeader: string | null | undefined, cookieName: string) => {
-  if (!cookieHeader) {
-    return undefined;
-  }
-
-  for (const segment of cookieHeader.split(";")) {
-    const trimmed = segment.trim();
-    if (!trimmed.startsWith(`${cookieName}=`)) {
-      continue;
-    }
-
-    return decodeURIComponent(trimmed.slice(cookieName.length + 1));
-  }
-
-  return undefined;
-};
-
-const makeWorkos = (config: WorkosConfig) =>
-  Effect.gen(function* () {
-    const apiKey = (yield* config.apiKey).trim();
-    const clientId = (yield* config.clientId).trim();
-    const cookiePassword = (yield* config.cookiePassword).trim();
-    const webhookSecret = (yield* config.webhookSecret).trim();
-    const cookieName = (yield* config.cookieName).trim();
-
-    const workos = new WorkOS(apiKey, { clientId });
-    const jwksUrl = workos.userManagement.getJwksUrl(clientId);
-
-    const authenticateSessionCookie = (headers: Headers) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: "Failed to authenticate WorkOS session cookie",
-          }),
-        try: async (): Promise<AuthenticatedSession | null> => {
-          const sessionData = getCookieValue(headers.get("cookie"), cookieName);
-          if (!sessionData) {
-            return null;
-          }
-
-          const session = workos.userManagement.loadSealedSession({
-            cookiePassword,
-            sessionData,
-          });
-
-          const authResponse = await session.authenticate();
-          if (!authResponse.authenticated) {
-            return null;
-          }
-
-          return {
-            accessToken: authResponse.accessToken,
-            organizationId: authResponse.organizationId,
-            permissions: authResponse.permissions,
-            role: authResponse.role,
-            roles: authResponse.roles,
-            sessionId: authResponse.sessionId,
-            user: authResponse.user,
-          };
-        },
-      });
-
-    const getUser = (userId: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to fetch WorkOS user ${userId}`,
-          }),
-        try: () => workos.userManagement.getUser(userId),
-      });
-
-    const setUserExternalId = (workosUserId: string, externalId: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to set WorkOS external id for user ${workosUserId}`,
-          }),
-        try: () =>
-          workos.userManagement.updateUser({
-            externalId,
-            userId: workosUserId,
-          }),
-      });
-
-    const createOrganization = (input: { readonly name: string; readonly externalId: string }) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to create WorkOS organization for external id ${input.externalId}: ${describeWorkosError(cause)}`,
-          }),
-        try: (): Promise<WorkosOrganization> =>
-          workos.organizations.createOrganization({
-            externalId: input.externalId,
-            name: input.name,
-          }),
-      });
-
-    const updateOrganization = (input: {
-      readonly workosOrganizationId: string;
-      readonly name?: string;
-    }) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to update WorkOS organization ${input.workosOrganizationId}: ${describeWorkosError(cause)}`,
-          }),
-        try: (): Promise<WorkosOrganization> =>
-          workos.organizations.updateOrganization({
-            name: input.name,
-            organization: input.workosOrganizationId,
-          }),
-      });
-
-    const deleteOrganization = (workosOrganizationId: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to delete WorkOS organization ${workosOrganizationId}: ${describeWorkosError(cause)}`,
-          }),
-        try: (): Promise<void> => workos.organizations.deleteOrganization(workosOrganizationId),
-      });
-
-    /**
-     * Look up a WorkOS organization by the `external_id` we set on creation
-     * (= local UUID). Returns `null` when WorkOS reports a 404 so callers can
-     * treat absence as a normal control-flow case.
-     */
-    const getOrganizationByExternalId = (externalId: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to get WorkOS organization by external id ${externalId}`,
-          }),
-        try: (): Promise<WorkosOrganization> =>
-          workos.organizations.getOrganizationByExternalId(externalId),
-      }).pipe(
-        Effect.catch((error) => {
-          // The SDK throws `NotFoundException` (status 404) when no org has
-          // the given external id; treat that as a normal "absent" result.
-          // Other transports surface the same condition as a generic error
-          // with `rawData.code === "entity_not_found"`.
-          const cause = error.cause as {
-            name?: string;
-            status?: number;
-            rawData?: { code?: string };
-          } | null;
-          const isNotFound =
-            cause?.name === "NotFoundException" ||
-            cause?.status === 404 ||
-            cause?.rawData?.code === "entity_not_found";
-          if (isNotFound) {
-            return Effect.succeed(null as WorkosOrganization | null);
-          }
-          return Effect.fail(error);
-        }),
-      );
-
-    /** Fetch a WorkOS organization by WorkOS id. */
-    const getOrganization = (workosOrganizationId: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to get WorkOS organization ${workosOrganizationId}: ${describeWorkosError(cause)}`,
-          }),
-        try: (): Promise<WorkosOrganization> =>
-          workos.organizations.getOrganization(workosOrganizationId),
-      });
-
-    const createOrganizationMembership = (input: {
-      readonly workosOrganizationId: string;
-      readonly workosUserId: string;
-      readonly roleSlug?: string;
-    }) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to create WorkOS membership for user ${input.workosUserId} in org ${input.workosOrganizationId}: ${describeWorkosError(cause)}`,
-          }),
-        try: (): Promise<WorkosOrganizationMembership> =>
-          workos.userManagement.createOrganizationMembership({
-            organizationId: input.workosOrganizationId,
-            roleSlug: input.roleSlug,
-            userId: input.workosUserId,
-          }),
-      });
-
-    const updateOrganizationMembership = (
-      workosMembershipId: string,
-      input: { readonly roleSlug: string },
-    ) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to update WorkOS membership ${workosMembershipId}: ${describeWorkosError(cause)}`,
-          }),
-        try: (): Promise<WorkosOrganizationMembership> =>
-          workos.userManagement.updateOrganizationMembership(workosMembershipId, {
-            roleSlug: input.roleSlug,
-          }),
-      });
-
-    const deleteOrganizationMembership = (workosMembershipId: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to delete WorkOS membership ${workosMembershipId}: ${describeWorkosError(cause)}`,
-          }),
-        try: (): Promise<void> =>
-          workos.userManagement.deleteOrganizationMembership(workosMembershipId),
-      });
-
-    /** List active organization memberships for a WorkOS user. */
-    const listOrganizationMembershipsForUser = (workosUserId: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to list WorkOS memberships for user ${workosUserId}: ${describeWorkosError(cause)}`,
-          }),
-        try: async (): Promise<ReadonlyArray<WorkosOrganizationMembership>> => {
-          const result = await workos.userManagement.listOrganizationMemberships({
-            userId: workosUserId,
-          });
-          return result.autoPagination();
-        },
-      });
-
-    /** First WorkOS user whose email matches, or `null` if none. */
-    const findUserByEmail = (email: string) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: `Failed to look up WorkOS user by email ${email}: ${describeWorkosError(cause)}`,
-          }),
-        try: async (): Promise<WorkOSUser | null> => {
-          const result = await workos.userManagement.listUsers({ email });
-          return result.data[0] ?? null;
-        },
-      });
-
-    /**
-     * Verify a webhook signature and parse the event. Throws via WorkosAuthError
-     * on bad signatures, expired timestamps, or malformed payloads.
-     */
-    const verifyWebhook = (input: { readonly rawBody: string; readonly signatureHeader: string }) =>
-      Effect.tryPromise({
-        catch: (cause) =>
-          new WorkosAuthError({
-            cause,
-            message: "Failed to verify WorkOS webhook signature",
-          }),
-        try: (): Promise<WorkosEvent> => {
-          const payload = JSON.parse(input.rawBody) as Record<string, unknown>;
-          return workos.webhooks.constructEvent({
-            payload,
-            secret: webhookSecret,
-            sigHeader: input.signatureHeader,
-          });
-        },
-      });
-
-    return {
-      authenticateSessionCookie,
-      clientId,
-      cookieName,
-      createOrganization,
-      createOrganizationMembership,
-      deleteOrganization,
-      deleteOrganizationMembership,
-      findUserByEmail,
-      getJwksUrl: () => jwksUrl,
-      getOrganization,
-      getOrganizationByExternalId,
-      getUser,
-      listOrganizationMembershipsForUser,
-      setUserExternalId,
-      updateOrganization,
-      updateOrganizationMembership,
-      verifyWebhook,
-    };
-  });
-
-type WorkosService = Effect.Success<ReturnType<typeof makeWorkos>>;
-
-export class Workos extends Context.Service<Workos, WorkosService>()("core/Workos") {
-  /** Create a WorkOS service layer from already-bound runtime configuration. */
-  static layer = (config: WorkosConfig): Layer.Layer<Workos> =>
-    Layer.effect(Workos)(makeWorkos(config));
-}
diff --git a/packages/core/src/services/fxRates/FxRateService.ts b/packages/core/src/services/fxRates/FxRateService.ts
index d3f4f24e4..175be4817 100644
--- a/packages/core/src/services/fxRates/FxRateService.ts
+++ b/packages/core/src/services/fxRates/FxRateService.ts
@@ -332,7 +332,7 @@ export class FxRateService extends Context.Service<FxRateService>()("core/FxRate
    * Live layer. Wires the ExchangeRate-API fetcher from the provided
    * {@link FxRateConfig}. The daily refresh is dispatched by
    * `FxRateSyncWorkflow` on the `0 5 * * *` cron registered in
-   * `apps/backend/src/Service.ts`.
+   * `packages/backend/src/Service.ts`.
    */
   static readonly layer = (config: FxRateConfig): Layer.Layer<FxRateService, never, Db> =>
     Layer.effect(FxRateService)(FxRateService.make).pipe(Layer.provide(liveFetcherLayer(config)));
diff --git a/packages/core/src/services/index.ts b/packages/core/src/services/index.ts
index 8f6b21ab2..365ba05b7 100644
--- a/packages/core/src/services/index.ts
+++ b/packages/core/src/services/index.ts
@@ -14,20 +14,23 @@ export * from "./analyticsIngest/ProcessorOutputs.ts";
 export * from "./apiKeys/ApiKeyService.ts";
 export * from "./auditLog/AuditLogPort.ts";
 export * from "./auth/AuthTokenVerifier.ts";
+export * from "./auth/IdentityProvider.ts";
 export * from "./auth/LocalUserSessionService.ts";
-export * from "./auth/WorkosLocalSyncService.ts";
-export * from "./auth/Workos.ts";
+export * from "./auth/StandaloneAuthConfig.ts";
+export * from "./auth/StandaloneIdentityProvider.ts";
+export * from "./auth/IdentityLinkBackfillService.ts";
 export * from "./experiments/ExperimentService.ts";
 export * from "./featureFlags/FeatureFlagService.ts";
 export * from "./feedback/FeedbackService.ts";
 export * from "./fxRates/FxRateService.ts";
 export * from "./slack/slack-client.ts";
 export * from "./internalFeatureFlags/InternalFeatureFlagService.ts";
+export * from "./organizations/StandaloneOrgDirectory.ts";
 export * from "./organizations/OrganizationService.ts";
 export * from "./organizations/OrganizationLifecyclePort.ts";
 export * from "./organizations/OrganizationMembershipSyncPort.ts";
 export * from "./organizations/OrganizationMembershipWebhookPort.ts";
-export * from "./organizations/WorkosOrgPort.ts";
+export * from "./organizations/OrgDirectoryPort.ts";
 export * from "./paymentProviders/AppStorePaymentProviderService.ts";
 export * from "./paymentProviders/appStore/payment-provider-service.ts";
 export * from "./paymentProviders/appStore/app-store-reconciliation-service.ts";
@@ -70,12 +73,11 @@ export { AppStorePaymentProvider as AppStorePaymentProviderEngine } from "./paym
 // with the config-adapter tag in `PaymentProvider.ts`; alias it so both are
 // importable (same pattern as the App Store engine).
 export { GooglePlayPaymentProvider as GooglePlayPaymentProviderEngine } from "./paymentProviders/googlePlay/payment-provider.ts";
-// Stripe record engine, webhook handler, public service, queries, errors, and
-// the replay workflow port (the config-write slice is exported above). The
-// engine shares the bare name `StripePaymentProvider` with the config-adapter
-// tag in `PaymentProvider.ts`, so alias it as `StripePaymentProviderEngine`.
+// Stripe record engine, webhook handler, public service, queries, and errors
+// (the config-write slice is exported above). The engine shares the bare name
+// `StripePaymentProvider` with the config-adapter tag in `PaymentProvider.ts`,
+// so alias it as `StripePaymentProviderEngine`.
 export * from "./paymentProviders/StripePaymentProviderService.ts";
-export * from "./paymentProviders/StripeReplayParkedNotificationsWorkflow.ts";
 export * from "./paymentProviders/stripe/payment-provider-service.ts";
 export * from "./paymentProviders/stripe/stripe-webhook-handler-service.ts";
 export * from "./paymentProviders/stripe/payment-provider-service-queries.ts";
diff --git a/packages/core/src/services/infrastructure/QueueProducer.ts b/packages/core/src/services/infrastructure/QueueProducer.ts
index 2c9a55510..01ea82c24 100644
--- a/packages/core/src/services/infrastructure/QueueProducer.ts
+++ b/packages/core/src/services/infrastructure/QueueProducer.ts
@@ -1,8 +1,8 @@
 /**
  * Compatibility export for the provider-neutral queue contract now owned by
- * `@orbian/sdk`.
+ * `@voidhash/platform`.
  */
 export {
   QueueProducerError,
   type QueueProducer,
-} from "@orbian/sdk/Queue";
+} from "@voidhash/platform/Queue";
diff --git a/packages/core/src/services/notifications/PushDeliveryDispatch.ts b/packages/core/src/services/notifications/PushDeliveryDispatch.ts
index 3c5f12fec..b62bf9b2c 100644
--- a/packages/core/src/services/notifications/PushDeliveryDispatch.ts
+++ b/packages/core/src/services/notifications/PushDeliveryDispatch.ts
@@ -1,5 +1,5 @@
 import { Context, Effect, Layer, Schema } from "effect";
-import type { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import type { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 /**
  * Catch-all dispatch error. Wraps the underlying queue `send`/encode failure at
diff --git a/packages/core/src/services/organizations/WorkosOrgPort.ts b/packages/core/src/services/organizations/OrgDirectoryPort.ts
similarity index 62%
rename from packages/core/src/services/organizations/WorkosOrgPort.ts
rename to packages/core/src/services/organizations/OrgDirectoryPort.ts
index 1fa5c9004..1faf36b95 100644
--- a/packages/core/src/services/organizations/WorkosOrgPort.ts
+++ b/packages/core/src/services/organizations/OrgDirectoryPort.ts
@@ -1,31 +1,31 @@
 import { Context, type Effect, Schema } from "effect";
 
 /**
- * Catch-all error for {@link WorkosOrgPort} operations. Adapters wrap any
+ * Catch-all error for {@link OrgDirectoryPort} operations. Adapters wrap any
  * `@workos-inc/node` failure into this single tag so the
  * {@link OrganizationService} catch boundary stays small.
  */
-export class WorkosOrgPortError extends Schema.TaggedErrorClass<WorkosOrgPortError>(
-  "WorkosOrgPortError",
-)("WorkosOrgPortError", {
+export class OrgDirectoryPortError extends Schema.TaggedErrorClass<OrgDirectoryPortError>(
+  "OrgDirectoryPortError",
+)("OrgDirectoryPortError", {
   cause: Schema.String,
   message: Schema.String,
 }) {}
 
-export interface WorkosPortOrganization {
+export interface OrgDirectoryOrganization {
   readonly id: string;
   readonly name: string;
   readonly externalId: string | null;
 }
 
-export interface WorkosPortMembership {
+export interface OrgDirectoryMembership {
   readonly id: string;
   readonly organizationId: string;
   readonly userId: string;
   readonly role: string | null;
 }
 
-export interface WorkosPortUser {
+export interface OrgDirectoryUser {
   readonly id: string;
   readonly email: string;
   readonly emailVerified: boolean;
@@ -35,53 +35,53 @@ export interface WorkosPortUser {
   readonly profilePictureUrl: string | null;
 }
 
-export interface WorkosOrgPortShape {
+export interface OrgDirectoryPortShape {
   readonly createOrganization: (input: {
     readonly name: string;
     readonly externalId: string;
-  }) => Effect.Effect<WorkosPortOrganization, WorkosOrgPortError>;
+  }) => Effect.Effect<OrgDirectoryOrganization, OrgDirectoryPortError>;
 
   readonly updateOrganization: (input: {
     readonly workosOrganizationId: string;
     readonly name?: string;
-  }) => Effect.Effect<WorkosPortOrganization, WorkosOrgPortError>;
+  }) => Effect.Effect<OrgDirectoryOrganization, OrgDirectoryPortError>;
 
   readonly deleteOrganization: (
     workosOrganizationId: string,
-  ) => Effect.Effect<void, WorkosOrgPortError>;
+  ) => Effect.Effect<void, OrgDirectoryPortError>;
 
   readonly getOrganizationByExternalId: (
     externalId: string,
-  ) => Effect.Effect<WorkosPortOrganization | null, WorkosOrgPortError>;
+  ) => Effect.Effect<OrgDirectoryOrganization | null, OrgDirectoryPortError>;
 
   /** Fetches a WorkOS organization by its WorkOS id. */
   readonly getOrganization: (
     workosOrganizationId: string,
-  ) => Effect.Effect<WorkosPortOrganization, WorkosOrgPortError>;
+  ) => Effect.Effect<OrgDirectoryOrganization, OrgDirectoryPortError>;
 
   readonly createMembership: (input: {
     readonly workosOrganizationId: string;
     readonly workosUserId: string;
     readonly roleSlug?: string;
-  }) => Effect.Effect<WorkosPortMembership, WorkosOrgPortError>;
+  }) => Effect.Effect<OrgDirectoryMembership, OrgDirectoryPortError>;
 
   /** Lists active WorkOS organization memberships for a WorkOS user. */
   readonly listMembershipsForUser: (
     workosUserId: string,
-  ) => Effect.Effect<ReadonlyArray<WorkosPortMembership>, WorkosOrgPortError>;
+  ) => Effect.Effect<ReadonlyArray<OrgDirectoryMembership>, OrgDirectoryPortError>;
 
   readonly updateMembershipRole: (
     workosMembershipId: string,
     input: { readonly roleSlug: string },
-  ) => Effect.Effect<WorkosPortMembership, WorkosOrgPortError>;
+  ) => Effect.Effect<OrgDirectoryMembership, OrgDirectoryPortError>;
 
   readonly deleteMembership: (
     workosMembershipId: string,
-  ) => Effect.Effect<void, WorkosOrgPortError>;
+  ) => Effect.Effect<void, OrgDirectoryPortError>;
 
   readonly findUserByEmail: (
     email: string,
-  ) => Effect.Effect<WorkosPortUser | null, WorkosOrgPortError>;
+  ) => Effect.Effect<OrgDirectoryUser | null, OrgDirectoryPortError>;
 }
 
 /**
@@ -91,6 +91,6 @@ export interface WorkosOrgPortShape {
  * application root, keeping business logic provider-neutral and trivially
  * fakeable in tests.
  */
-export class WorkosOrgPort extends Context.Service<WorkosOrgPort, WorkosOrgPortShape>()(
-  "WorkosOrgPort",
+export class OrgDirectoryPort extends Context.Service<OrgDirectoryPort, OrgDirectoryPortShape>()(
+  "OrgDirectoryPort",
 ) {}
diff --git a/packages/core/src/services/organizations/OrganizationService.ts b/packages/core/src/services/organizations/OrganizationService.ts
index 46d88eb7f..fe5af5c80 100644
--- a/packages/core/src/services/organizations/OrganizationService.ts
+++ b/packages/core/src/services/organizations/OrganizationService.ts
@@ -17,10 +17,10 @@ import { generateId } from "../../utils/generate-id.ts";
 import { checkOrganizationPermission } from "../../utils/permissions.ts";
 import { PublicFileStore } from "../storage/PublicFileStore.ts";
 import { OrganizationLifecyclePort } from "./OrganizationLifecyclePort.ts";
-import { WorkosOrgPort } from "./WorkosOrgPort.ts";
+import { OrgDirectoryPort } from "./OrgDirectoryPort.ts";
 
 /**
- * Catch-all service error. Wraps `DatabaseError`, `WorkosOrgPortError`, and
+ * Catch-all service error. Wraps `DatabaseError`, `OrgDirectoryPortError`, and
  * other infrastructural failures at the public-method boundary so callers
  * see one stable error tag.
  */
@@ -39,7 +39,7 @@ export class OrganizationServiceError extends Schema.TaggedErrorClass<Organizati
  * policies keyed on the per-query `SQL_organization_id` setting, so adding a
  * tenant is zero ClickHouse DDL.
  *
- * `Db`, `WorkosOrgPort`, `OrganizationLifecyclePort`, and `AuthSession` are
+ * `Db`, `OrgDirectoryPort`, `OrganizationLifecyclePort`, and `AuthSession` are
  * provided by the application root. Community deployments use the no-op
  * lifecycle port; hosted deployments provide their own lifecycle extension
  * without coupling this service to its implementation.
@@ -48,7 +48,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
   "OrganizationService",
   {
     make: Effect.gen(function* () {
-      const workosOrgPort = yield* WorkosOrgPort;
+      const workosOrgPort = yield* OrgDirectoryPort;
       const organizationLifecycle = yield* OrganizationLifecyclePort;
       const publicFileStore = yield* PublicFileStore;
       const db = yield* Db;
@@ -65,7 +65,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
             yield* Effect.annotateCurrentSpan("voidhash.user.id", session.user.id);
           }
           if (session.user?.workosUserId) {
-            yield* Effect.annotateCurrentSpan("voidhash.user.workos_id", session.user.workosUserId);
+            yield* Effect.annotateCurrentSpan("voidhash.user.external_id", session.user.workosUserId);
           }
           if (session.person?.distinctId) {
             yield* Effect.annotateCurrentSpan(
@@ -115,7 +115,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
           yield* Effect.annotateCurrentSpan("voidhash.organization.slug", org.slug);
           if (org.workosOrganizationId) {
             yield* Effect.annotateCurrentSpan(
-              "voidhash.organization.workos_id",
+              "voidhash.organization.external_id",
               org.workosOrganizationId,
             );
           }
@@ -147,7 +147,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
           yield* Effect.annotateCurrentSpan("voidhash.organization.id", org.id);
           if (org.workosOrganizationId) {
             yield* Effect.annotateCurrentSpan(
-              "voidhash.organization.workos_id",
+              "voidhash.organization.external_id",
               org.workosOrganizationId,
             );
           }
@@ -207,7 +207,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
             );
 
           yield* Effect.log(`Created WorkOS org ${workosOrg.id} for ${orgId} (${input.name})`);
-          yield* Effect.annotateCurrentSpan("voidhash.organization.workos_id", workosOrg.id);
+          yield* Effect.annotateCurrentSpan("voidhash.organization.external_id", workosOrg.id);
 
           const workosMembership = yield* workosOrgPort
             .createMembership({
@@ -237,7 +237,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
           const now = new Date();
           const ownerMembershipId = generateId("member");
           yield* Effect.annotateCurrentSpan("voidhash.member.id", ownerMembershipId);
-          yield* Effect.annotateCurrentSpan("voidhash.member.workos_id", workosMembership.id);
+          yield* Effect.annotateCurrentSpan("voidhash.member.external_id", workosMembership.id);
           yield* Effect.annotateCurrentSpan("voidhash.member.role", "owner");
 
           // Local mirror in a single transaction. On failure, compensate by
@@ -301,7 +301,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
                 Effect.fail(new OrganizationServiceError({ cause: String(error.cause) })),
               SqlError: (error) =>
                 Effect.fail(new OrganizationServiceError({ cause: String(error.cause) })),
-              WorkosOrgPortError: (error) =>
+              OrgDirectoryPortError: (error) =>
                 Effect.fail(new OrganizationServiceError({ cause: error.message })),
             }),
           ),
@@ -323,7 +323,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
           yield* Effect.annotateCurrentSpan("voidhash.organization.slug", org.slug);
           if (org.workosOrganizationId) {
             yield* Effect.annotateCurrentSpan(
-              "voidhash.organization.workos_id",
+              "voidhash.organization.external_id",
               org.workosOrganizationId,
             );
           }
@@ -350,7 +350,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
             Effect.catchTags({
               EffectDrizzleQueryError: (error) =>
                 Effect.fail(new OrganizationServiceError({ cause: String(error.cause) })),
-              WorkosOrgPortError: (error) =>
+              OrgDirectoryPortError: (error) =>
                 Effect.fail(new OrganizationServiceError({ cause: error.message })),
             }),
           ),
@@ -486,7 +486,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
           if (org) {
             if (org.workosOrganizationId) {
               yield* Effect.annotateCurrentSpan(
-                "voidhash.organization.workos_id",
+                "voidhash.organization.external_id",
                 org.workosOrganizationId,
               );
             }
@@ -500,7 +500,7 @@ export class OrganizationService extends Context.Service<OrganizationService>()(
             Effect.catchTags({
               EffectDrizzleQueryError: (error) =>
                 Effect.fail(new OrganizationServiceError({ cause: String(error.cause) })),
-              WorkosOrgPortError: (error) =>
+              OrgDirectoryPortError: (error) =>
                 Effect.fail(new OrganizationServiceError({ cause: error.message })),
             }),
           ),
diff --git a/packages/core/src/services/organizations/StandaloneOrgDirectory.ts b/packages/core/src/services/organizations/StandaloneOrgDirectory.ts
new file mode 100644
index 000000000..7b9656b6c
--- /dev/null
+++ b/packages/core/src/services/organizations/StandaloneOrgDirectory.ts
@@ -0,0 +1,205 @@
+/**
+ * Local development implementation of {@link OrgDirectoryPort}.
+ *
+ * There is no external directory in local mode, so organization and membership
+ * writes are accepted as-is and the port synthesizes the provider-side ids that
+ * `organization.workos_organization_id` and `member.workos_membership_id`
+ * require (both are `NOT NULL UNIQUE`). Deriving them from the local ids keeps
+ * the mapping stable and collision-free without a schema change.
+ *
+ * Reads are answered from the local tables, which in this mode are the only
+ * source of truth.
+ */
+import { Db, eq, member, organization, user } from "@voidhash/db";
+import { Effect, Layer } from "effect";
+
+import { generateId } from "../../utils/generate-id.ts";
+import {
+  OrgDirectoryPort,
+  OrgDirectoryPortError,
+  type OrgDirectoryMembership,
+  type OrgDirectoryOrganization,
+  type OrgDirectoryUser,
+} from "./OrgDirectoryPort.ts";
+
+const LOCAL_ORGANIZATION_PREFIX = "local_org_";
+const LOCAL_MEMBERSHIP_PREFIX = "local_mem_";
+
+/** Provider-side organization id synthesized from the local organization id. */
+export const toStandaloneOrganizationId = (externalId: string): string =>
+  `${LOCAL_ORGANIZATION_PREFIX}${externalId}`;
+
+const splitName = (name: string): { firstName: string | null; lastName: string | null } => {
+  const trimmed = name.trim();
+  if (trimmed.length === 0) return { firstName: null, lastName: null };
+  const separator = trimmed.indexOf(" ");
+  if (separator === -1) return { firstName: trimmed, lastName: null };
+  return {
+    firstName: trimmed.slice(0, separator),
+    lastName: trimmed.slice(separator + 1).trim() || null,
+  };
+};
+
+/** {@link OrgDirectoryPort} backed entirely by the local database. */
+export const StandaloneOrgDirectoryLive: Layer.Layer<OrgDirectoryPort, never, Db> = Layer.effect(
+  OrgDirectoryPort,
+  Effect.gen(function* () {
+    // Captured at layer build so the port's methods keep the empty requirement
+    // channel the shape declares.
+    const db = yield* Db;
+
+    const query = <A>(effect: Effect.Effect<A, { readonly message: string }, Db>) =>
+      Effect.provideService(effect, Db, db).pipe(
+        Effect.mapError(
+          (error) =>
+            new OrgDirectoryPortError({
+              cause: String(error.message),
+              message: "Local organization directory query failed",
+            }),
+        ),
+      );
+
+    return {
+      createMembership: (input) =>
+        Effect.succeed({
+          id: `${LOCAL_MEMBERSHIP_PREFIX}${generateId("member")}`,
+          organizationId: input.workosOrganizationId,
+          role: input.roleSlug ?? null,
+          userId: input.workosUserId,
+        } satisfies OrgDirectoryMembership),
+
+      createOrganization: (input) =>
+        Effect.succeed({
+          externalId: input.externalId,
+          id: toStandaloneOrganizationId(input.externalId),
+          name: input.name,
+        } satisfies OrgDirectoryOrganization),
+
+      deleteMembership: () => Effect.void,
+
+      deleteOrganization: () => Effect.void,
+
+      findUserByEmail: (email) =>
+        query(
+          Effect.gen(function* () {
+            const row = yield* db.query.user.findFirst({
+              where: { email: email.trim().toLowerCase() },
+            });
+            // A user who has never signed in has no provider id yet, which is
+            // indistinguishable from "no such user" for this port's callers.
+            if (!row?.workosUserId) return null;
+            const { firstName, lastName } = splitName(row.name);
+            return {
+              email: row.email,
+              emailVerified: row.emailVerified,
+              externalId: row.id,
+              firstName,
+              id: row.workosUserId,
+              lastName,
+              profilePictureUrl: row.customImageUrl ?? row.image ?? null,
+            } satisfies OrgDirectoryUser;
+          }),
+        ),
+
+      getOrganization: (workosOrganizationId) =>
+        query(
+          Effect.gen(function* () {
+            const row = yield* db.query.organization.findFirst({
+              where: { workosOrganizationId },
+            });
+            if (!row) {
+              return yield* Effect.fail({
+                message: `No local organization for ${workosOrganizationId}`,
+              });
+            }
+            return {
+              externalId: row.id,
+              id: row.workosOrganizationId,
+              name: row.name,
+            } satisfies OrgDirectoryOrganization;
+          }),
+        ),
+
+      getOrganizationByExternalId: (externalId) =>
+        query(
+          Effect.gen(function* () {
+            const row = yield* db.query.organization.findFirst({ where: { id: externalId } });
+            return row === undefined
+              ? null
+              : ({
+                  externalId: row.id,
+                  id: row.workosOrganizationId,
+                  name: row.name,
+                } satisfies OrgDirectoryOrganization);
+          }),
+        ),
+
+      listMembershipsForUser: (workosUserId) =>
+        query(
+          Effect.gen(function* () {
+            const rows = yield* db
+              .select({
+                membershipId: member.workosMembershipId,
+                role: member.role,
+                workosOrganizationId: organization.workosOrganizationId,
+              })
+              .from(member)
+              .innerJoin(user, eq(member.userId, user.id))
+              .innerJoin(organization, eq(member.organizationId, organization.id))
+              .where(eq(user.workosUserId, workosUserId));
+
+            return rows.map(
+              (row): OrgDirectoryMembership => ({
+                id: row.membershipId,
+                organizationId: row.workosOrganizationId,
+                role: row.role,
+                userId: workosUserId,
+              }),
+            );
+          }),
+        ),
+
+      updateMembershipRole: (workosMembershipId, input) =>
+        query(
+          Effect.gen(function* () {
+            const rows = yield* db
+              .select({
+                workosOrganizationId: organization.workosOrganizationId,
+                workosUserId: user.workosUserId,
+              })
+              .from(member)
+              .innerJoin(user, eq(member.userId, user.id))
+              .innerJoin(organization, eq(member.organizationId, organization.id))
+              .where(eq(member.workosMembershipId, workosMembershipId));
+
+            const row = rows[0];
+            if (!row?.workosUserId) {
+              return yield* Effect.fail({
+                message: `No local membership for ${workosMembershipId}`,
+              });
+            }
+            return {
+              id: workosMembershipId,
+              organizationId: row.workosOrganizationId,
+              role: input.roleSlug,
+              userId: row.workosUserId,
+            } satisfies OrgDirectoryMembership;
+          }),
+        ),
+
+      updateOrganization: (input) =>
+        query(
+          Effect.gen(function* () {
+            const row = yield* db.query.organization.findFirst({
+              where: { workosOrganizationId: input.workosOrganizationId },
+            });
+            return {
+              externalId: row?.id ?? null,
+              id: input.workosOrganizationId,
+              name: input.name ?? row?.name ?? "",
+            } satisfies OrgDirectoryOrganization;
+          }),
+        ),
+    };
+  }),
+);
diff --git a/packages/core/src/services/organizations/index.ts b/packages/core/src/services/organizations/index.ts
index 12a57caad..2358fd903 100644
--- a/packages/core/src/services/organizations/index.ts
+++ b/packages/core/src/services/organizations/index.ts
@@ -1,2 +1,2 @@
 export * from "./OrganizationService.ts";
-export * from "./WorkosOrgPort.ts";
+export * from "./OrgDirectoryPort.ts";
diff --git a/packages/core/src/services/paymentProviders/AppStoreReconcileOriginalTransactionWorkflow.ts b/packages/core/src/services/paymentProviders/AppStoreReconcileOriginalTransactionWorkflow.ts
deleted file mode 100644
index 81c9190d4..000000000
--- a/packages/core/src/services/paymentProviders/AppStoreReconcileOriginalTransactionWorkflow.ts
+++ /dev/null
@@ -1,32 +0,0 @@
-import { Context, type Effect } from "effect";
-
-import type { ReconciliationReason } from "./appStore/app-store-reconciliation-service.ts";
-
-/**
- * Identifies the App Store `originalTransactionId` series to reconcile against
- * Apple's authoritative transaction history + subscription statuses, and why.
- */
-export interface AppStoreReconcileOriginalTransactionInput {
-  readonly paymentProviderConfigurationId: string;
-  readonly originalTransactionId: string;
-  /** ISO-8601 timestamp of when reconciliation was triggered. */
-  readonly triggeredAt: string;
-  readonly reason: ReconciliationReason;
-}
-
-/**
- * Abstract workflow for the lazy first-seen Apple-history backfill. `dispatch`
- * fires from `processSdkTransaction` the first time a tenant (with the
- * `enableFirstSeenReconciliation` flag on) records a purchase for an
- * `originalTransactionId` we have never seen — it imports any history Apple
- * holds that arrived before the SDK boundary (RevenueCat-migrated subscribers,
- * offline-then-reopen, dropped EXPIRED/REFUND). The concrete adapter (a
- * Cloudflare Workflow) is wired at the application root, keeping the
- * infrastructure dependency out of `packages/core`.
- */
-export class AppStoreReconcileOriginalTransactionWorkflow extends Context.Service<
-  AppStoreReconcileOriginalTransactionWorkflow,
-  {
-    readonly dispatch: (input: AppStoreReconcileOriginalTransactionInput) => Effect.Effect<void>;
-  }
->()("AppStoreReconcileOriginalTransactionWorkflow") {}
diff --git a/packages/core/src/services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow.ts b/packages/core/src/services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow.ts
deleted file mode 100644
index fc60e3bf0..000000000
--- a/packages/core/src/services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Context, type Effect } from "effect";
-
-/** Identifies the new product mapping whose parked App Store notifications to replay. */
-export interface AppStoreReplayParkedNotificationsInput {
-  readonly paymentProviderConfigurationId: string;
-  readonly paymentProviderProductId: string;
-  readonly providerProductKey: string;
-}
-
-/**
- * Abstract workflow for replaying parked App Store notifications. `dispatch`
- * runs fire-and-forget when a new `(configuration, providerProduct)` mapping
- * appears; the concrete adapter (a Cloudflare Workflow) is wired at the
- * application root, keeping the infrastructure dependency out of
- * `packages/core`.
- */
-export class AppStoreReplayParkedNotificationsWorkflow extends Context.Service<
-  AppStoreReplayParkedNotificationsWorkflow,
-  {
-    readonly dispatch: (input: AppStoreReplayParkedNotificationsInput) => Effect.Effect<void>;
-  }
->()("AppStoreReplayParkedNotificationsWorkflow") {}
diff --git a/packages/core/src/services/paymentProviders/AppStoreReplayParkedSdkNotificationsWorkflow.ts b/packages/core/src/services/paymentProviders/AppStoreReplayParkedSdkNotificationsWorkflow.ts
deleted file mode 100644
index 13c5c56c3..000000000
--- a/packages/core/src/services/paymentProviders/AppStoreReplayParkedSdkNotificationsWorkflow.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { Context, type Effect } from "effect";
-
-/**
- * Identifies the `originalTransactionId` series whose notifications, parked
- * pending SDK confirmation, should now be replayed.
- */
-export interface AppStoreReplayParkedSdkNotificationsInput {
-  readonly paymentProviderConfigurationId: string;
-  readonly originalTransactionId: string;
-}
-
-/**
- * Abstract workflow for replaying App Store notifications parked under the
- * per-tenant `trackNewPurchasesFromAppleServerNotifications = false` mode
- * (lifecycle webhooks held back until the SDK confirms the series). `dispatch`
- * runs after `processSdkTransaction` records a purchase; the concrete adapter
- * (a Cloudflare Workflow) is wired at the application root, keeping the
- * infrastructure dependency out of `packages/core`.
- */
-export class AppStoreReplayParkedSdkNotificationsWorkflow extends Context.Service<
-  AppStoreReplayParkedSdkNotificationsWorkflow,
-  {
-    readonly dispatch: (input: AppStoreReplayParkedSdkNotificationsInput) => Effect.Effect<void>;
-  }
->()("AppStoreReplayParkedSdkNotificationsWorkflow") {}
diff --git a/packages/core/src/services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow.ts b/packages/core/src/services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow.ts
deleted file mode 100644
index 39c1c183c..000000000
--- a/packages/core/src/services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Context, type Effect } from "effect";
-
-/** Identifies the new product mapping whose parked Google Play notifications to replay. */
-export interface GooglePlayReplayParkedNotificationsInput {
-  readonly paymentProviderConfigurationId: string;
-  readonly paymentProviderProductId: string;
-  readonly providerProductKey: string;
-}
-
-/**
- * Abstract workflow for replaying parked Google Play notifications. `dispatch`
- * runs fire-and-forget when a new `(configuration, providerProduct)` mapping
- * appears; the concrete adapter (a Cloudflare Workflow) is wired at the
- * application root, keeping the infrastructure dependency out of
- * `packages/core`.
- */
-export class GooglePlayReplayParkedNotificationsWorkflow extends Context.Service<
-  GooglePlayReplayParkedNotificationsWorkflow,
-  {
-    readonly dispatch: (input: GooglePlayReplayParkedNotificationsInput) => Effect.Effect<void>;
-  }
->()("GooglePlayReplayParkedNotificationsWorkflow") {}
diff --git a/packages/core/src/services/paymentProviders/PaymentProviderProductService.ts b/packages/core/src/services/paymentProviders/PaymentProviderProductService.ts
index 155bf1f51..7657f1f44 100644
--- a/packages/core/src/services/paymentProviders/PaymentProviderProductService.ts
+++ b/packages/core/src/services/paymentProviders/PaymentProviderProductService.ts
@@ -5,9 +5,12 @@ import {
   PaymentProviderProductNotFoundError,
   PaymentProviderProductValidationError,
 } from "../../domain/paymentProvider/PaymentProviderProduct.ts";
-import { AppStoreReplayParkedNotificationsWorkflow } from "./AppStoreReplayParkedNotificationsWorkflow.ts";
-import { GooglePlayReplayParkedNotificationsWorkflow } from "./GooglePlayReplayParkedNotificationsWorkflow.ts";
-import { StripeReplayParkedNotificationsWorkflow } from "./StripeReplayParkedNotificationsWorkflow.ts";
+import * as Workflow from "@voidhash/platform/Workflow";
+import {
+  AppStoreReplayParkedNotifications,
+  GooglePlayReplayParkedNotifications,
+  StripeReplayParkedNotifications,
+} from "../../workflows/definitions.ts";
 import {
   AuditLogAction,
   AuditLogEntityType,
@@ -89,8 +92,7 @@ export class PaymentProviderProductService extends Context.Service<PaymentProvid
       /**
        * Background-schedules the App Store parked-notification replay
        * workflow when a new `(configurationId, providerProductKey)` mapping
-       * exists. Fire-and-forget — the workflow body itself is a stub until
-       * the App Store payment-provider migration lands.
+       * exists.
        */
       const scheduleAppStoreParkedReplayIfApplicable = (input: {
         readonly providerId: string;
@@ -101,24 +103,12 @@ export class PaymentProviderProductService extends Context.Service<PaymentProvid
         if (input.providerId !== "apple-app-store") {
           return Effect.void;
         }
-        return AppStoreReplayParkedNotificationsWorkflow.pipe(
-          Effect.flatMap((appStoreReplayParkedNotifications) =>
-            appStoreReplayParkedNotifications.dispatch({
-              paymentProviderConfigurationId: input.paymentProviderConfigurationId,
-              paymentProviderProductId: input.paymentProviderProductId,
-              providerProductKey: input.providerProductKey,
-            }),
-          ),
-          Effect.catchCause((cause) =>
-            Effect.logWarning("Failed to schedule App Store parked notification replay", {
-              cause,
-              paymentProviderConfigurationId: input.paymentProviderConfigurationId,
-              paymentProviderProductId: input.paymentProviderProductId,
-              providerProductKey: input.providerProductKey,
-            }),
-          ),
-          Effect.asVoid,
-        );
+        return Workflow.dispatchAndForget(AppStoreReplayParkedNotifications, {
+          paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+          paymentProviderProductId: input.paymentProviderProductId,
+          providerProductKey: input.providerProductKey,
+          requestedAt: new Date().toISOString(),
+        });
       };
 
       /**
@@ -137,24 +127,12 @@ export class PaymentProviderProductService extends Context.Service<PaymentProvid
         if (input.providerId !== "google-play") {
           return Effect.void;
         }
-        return GooglePlayReplayParkedNotificationsWorkflow.pipe(
-          Effect.flatMap((googlePlayReplayParkedNotifications) =>
-            googlePlayReplayParkedNotifications.dispatch({
-              paymentProviderConfigurationId: input.paymentProviderConfigurationId,
-              paymentProviderProductId: input.paymentProviderProductId,
-              providerProductKey: input.providerProductKey,
-            }),
-          ),
-          Effect.catchCause((cause) =>
-            Effect.logWarning("Failed to schedule Google Play parked notification replay", {
-              cause,
-              paymentProviderConfigurationId: input.paymentProviderConfigurationId,
-              paymentProviderProductId: input.paymentProviderProductId,
-              providerProductKey: input.providerProductKey,
-            }),
-          ),
-          Effect.asVoid,
-        );
+        return Workflow.dispatchAndForget(GooglePlayReplayParkedNotifications, {
+          paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+          paymentProviderProductId: input.paymentProviderProductId,
+          providerProductKey: input.providerProductKey,
+          requestedAt: new Date().toISOString(),
+        });
       };
 
       /**
@@ -171,24 +149,12 @@ export class PaymentProviderProductService extends Context.Service<PaymentProvid
         if (input.providerId !== "stripe") {
           return Effect.void;
         }
-        return StripeReplayParkedNotificationsWorkflow.pipe(
-          Effect.flatMap((stripeReplayParkedNotifications) =>
-            stripeReplayParkedNotifications.dispatch({
-              paymentProviderConfigurationId: input.paymentProviderConfigurationId,
-              paymentProviderProductId: input.paymentProviderProductId,
-              providerProductKey: input.providerProductKey,
-            }),
-          ),
-          Effect.catchCause((cause) =>
-            Effect.logWarning("Failed to schedule Stripe parked notification replay", {
-              cause,
-              paymentProviderConfigurationId: input.paymentProviderConfigurationId,
-              paymentProviderProductId: input.paymentProviderProductId,
-              providerProductKey: input.providerProductKey,
-            }),
-          ),
-          Effect.asVoid,
-        );
+        return Workflow.dispatchAndForget(StripeReplayParkedNotifications, {
+          paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+          paymentProviderProductId: input.paymentProviderProductId,
+          providerProductKey: input.providerProductKey,
+          requestedAt: new Date().toISOString(),
+        });
       };
 
       const getProviderProductsByProjectId = Effect.fn("getProviderProductsByProjectId")(
diff --git a/packages/core/src/services/paymentProviders/StripeReplayParkedNotificationsWorkflow.ts b/packages/core/src/services/paymentProviders/StripeReplayParkedNotificationsWorkflow.ts
deleted file mode 100644
index 918f34998..000000000
--- a/packages/core/src/services/paymentProviders/StripeReplayParkedNotificationsWorkflow.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Context, type Effect } from "effect";
-
-/** Identifies the new product mapping whose parked Stripe events to replay. */
-export interface StripeReplayParkedNotificationsInput {
-  readonly paymentProviderConfigurationId: string;
-  readonly paymentProviderProductId: string;
-  readonly providerProductKey: string;
-}
-
-/**
- * Abstract workflow for replaying parked Stripe webhook events. `dispatch` runs
- * fire-and-forget when a new `(configuration, providerProduct)` mapping appears;
- * the concrete adapter (a Cloudflare Workflow) is wired at the application root,
- * keeping the infrastructure dependency out of `packages/core`. Mirrors
- * {@link AppStoreReplayParkedNotificationsWorkflow}.
- */
-export class StripeReplayParkedNotificationsWorkflow extends Context.Service<
-  StripeReplayParkedNotificationsWorkflow,
-  {
-    readonly dispatch: (input: StripeReplayParkedNotificationsInput) => Effect.Effect<void>;
-  }
->()("StripeReplayParkedNotificationsWorkflow") {}
diff --git a/packages/core/src/services/paymentProviders/appStore/payment-provider-service-queries.ts b/packages/core/src/services/paymentProviders/appStore/payment-provider-service-queries.ts
index 827ed9e7c..0e21819c0 100644
--- a/packages/core/src/services/paymentProviders/appStore/payment-provider-service-queries.ts
+++ b/packages/core/src/services/paymentProviders/appStore/payment-provider-service-queries.ts
@@ -16,17 +16,9 @@ import {
   eq,
   lt,
   PersonOrigin,
-  paymentProviderConfigurationProducts,
-  paymentProviderConfigurations,
   paymentProviderNotificationProcessed,
   personExternalIdentifiers,
-  personIdentities,
-  persons,
-  projects,
-  purchases,
   sql,
-  subscriptions,
-  transactions,
   type Project as DbProject,
   type DbError,
   Db,
@@ -184,10 +176,9 @@ const make = Effect.gen(function* () {
    * Follows `persons.mergedIntoPersonId` to the surviving canonical person,
    * bounded to {@link MAX_MERGE_CHAIN_HOPS} so a (theoretical) cycle can't
    * spin. External-identifier rows are NOT repointed when their person is
-   * merged away (the identify-completion workflow only touches
-   * `person_identity`), so a webhook resolving an `apple-app-store` /
-   * account-token binding must canonicalize the result before returning it,
-   * else post-merge renewals would attribute to an archived person.
+   * merged away, so a webhook resolving an `apple-app-store` / account-token
+   * binding must canonicalize the result before returning it, else post-merge
+   * renewals would attribute to an archived person.
    */
   const resolveCanonicalPersonId = Effect.fn("resolveCanonicalPersonId")(
     (input: { readonly personId: string }): Effect.Effect<string, DbError, Db> =>
diff --git a/packages/core/src/services/paymentProviders/appStore/payment-provider-service.ts b/packages/core/src/services/paymentProviders/appStore/payment-provider-service.ts
index 791edf077..50ec69072 100644
--- a/packages/core/src/services/paymentProviders/appStore/payment-provider-service.ts
+++ b/packages/core/src/services/paymentProviders/appStore/payment-provider-service.ts
@@ -6,19 +6,15 @@
  * decode → forward to {@link AppStorePaymentProvider.recordPurchase}) and
  * delegates webhook ingress to {@link AppStoreWebhookHandlerService}.
  *
- * Ported from `internal/packages/core/.../app-store-payment-provider-service.ts`
- * with two backend-specific changes:
+ * The implementation differs from the original authenticated SDK path in two
+ * ways:
  *   1. The SDK path resolves the project from an explicit `projectId` input
  *      instead of yielding `AuthSession` from context — this keeps the method's
  *      `R` channel `never` as the service shape requires. `SdkService` passes
  *      the project-elevated id.
  *   2. The deferred-replay and lazy first-seen reconciliation workflow triggers
- *      ARE fired here, through abstract ports
- *      ({@link AppStoreReplayParkedSdkNotificationsWorkflow},
- *      {@link AppStoreReconcileOriginalTransactionWorkflow}) that the
- *      application root wires to concrete Cloudflare Workflows. Both are
- *      fire-and-forget (awaited `create` + log-on-failure, never `forkDetach`),
- *      and the synchronous record path does not depend on their completion.
+ *      are dispatched here through the shared workflow runtime. The
+ *      synchronous record path does not depend on their completion.
  */
 import { Effect, Layer, Option, Schema } from "effect";
 
@@ -27,8 +23,11 @@ import {
   AppStorePaymentProviderServiceError,
   type AppStorePaymentProviderServiceShape,
 } from "../AppStorePaymentProviderService.ts";
-import { AppStoreReconcileOriginalTransactionWorkflow } from "../AppStoreReconcileOriginalTransactionWorkflow.ts";
-import { AppStoreReplayParkedSdkNotificationsWorkflow } from "../AppStoreReplayParkedSdkNotificationsWorkflow.ts";
+import * as Workflow from "@voidhash/platform/Workflow";
+import {
+  AppStoreReconcileOriginalTransaction,
+  AppStoreReplayParkedSdkNotifications,
+} from "../../../workflows/definitions.ts";
 import { AppStoreWebhookHandlerService } from "./app-store-webhook-handler-service.ts";
 import { getActiveAppStorePaymentProviderConfiguration } from "./helpers.ts";
 import { AppStorePaymentProvider, globalConfigurationSchema } from "./payment-provider.ts";
@@ -169,20 +168,11 @@ export const AppStorePaymentProviderServiceLive = Layer.effect(AppStorePaymentPr
             paymentProviderConfigurationId: configuration.id,
           });
           if (parked.length > 0) {
-            yield* AppStoreReplayParkedSdkNotificationsWorkflow.pipe(
-              Effect.flatMap((workflow) =>
-                workflow.dispatch({
-                  originalTransactionId,
-                  paymentProviderConfigurationId: configuration.id,
-                }),
-              ),
-              Effect.catchCause((cause) =>
-                Effect.logWarning("Failed to schedule App Store parked SDK-notification replay", {
-                  cause,
-                  originalTransactionId,
-                }),
-              ),
-            );
+            yield* Workflow.dispatchAndForget(AppStoreReplayParkedSdkNotifications, {
+              originalTransactionId,
+              paymentProviderConfigurationId: configuration.id,
+              requestedAt: input.receivedAt.toISOString(),
+            });
           }
         }
 
@@ -190,25 +180,15 @@ export const AppStorePaymentProviderServiceLive = Layer.effect(AppStorePaymentPr
         // it fires at most once per `originalTransactionId` per flag-on tenant;
         // Cloudflare handles Apple 429 backoff at the workflow level, and each
         // replayed event is idempotent. Admin-repair / install-backfill remain
-        // separate manual triggers. Awaited `create` + log-on-failure (mirrors
-        // the parked-replay dispatch above); never `forkDetach`.
+        // separate manual triggers. Dispatch is scheduled through the shared
+        // workflow runtime, mirroring the parked replay above.
         if (shouldReconcileFirstSeen && originalTransactionId) {
-          yield* AppStoreReconcileOriginalTransactionWorkflow.pipe(
-            Effect.flatMap((workflow) =>
-              workflow.dispatch({
-                originalTransactionId,
-                paymentProviderConfigurationId: configuration.id,
-                reason: "first_seen",
-                triggeredAt: input.receivedAt.toISOString(),
-              }),
-            ),
-            Effect.catchCause((cause) =>
-              Effect.logWarning("Failed to schedule App Store first-seen reconciliation", {
-                cause,
-                originalTransactionId,
-              }),
-            ),
-          );
+          yield* Workflow.dispatchAndForget(AppStoreReconcileOriginalTransaction, {
+            originalTransactionId,
+            paymentProviderConfigurationId: configuration.id,
+            reason: "first_seen",
+            triggeredAt: input.receivedAt.toISOString(),
+          });
         }
 
         yield* Effect.annotateCurrentSpan("voidhash.person.id", result.personId);
diff --git a/packages/core/src/services/paymentProviders/appStore/payment-provider.ts b/packages/core/src/services/paymentProviders/appStore/payment-provider.ts
index ce76ddbdc..221fbdad8 100644
--- a/packages/core/src/services/paymentProviders/appStore/payment-provider.ts
+++ b/packages/core/src/services/paymentProviders/appStore/payment-provider.ts
@@ -561,9 +561,9 @@ const make = Effect.gen(function* () {
       // transactionId, or — for token-bearing series — the token itself).
       // Checked before the account-token binding because it reflects
       // cross-owner transfers that the per-user token binding deliberately
-      // doesn't. Canonicalized: the identify-completion workflow never repoints
-      // external identifiers, so a post-merge renewal would otherwise resolve
-      // to the archived source person.
+      // doesn't. Person merges do not repoint provider identifiers, so
+      // canonicalize to avoid resolving a post-merge renewal to the archived
+      // source person.
       const externalIdentifier = yield* queries.findExternalIdentifier({
         identifier: input.personIdentifier,
         projectId: input.projectId,
diff --git a/packages/core/src/services/paymentProviders/googlePlay/payment-provider.ts b/packages/core/src/services/paymentProviders/googlePlay/payment-provider.ts
index d8177051f..0319050bd 100644
--- a/packages/core/src/services/paymentProviders/googlePlay/payment-provider.ts
+++ b/packages/core/src/services/paymentProviders/googlePlay/payment-provider.ts
@@ -424,9 +424,9 @@ const make = Effect.gen(function* () {
     // Existing `google-play` binding (keyed on purchaseToken / orderId, or the
     // account token itself). Checked BEFORE the account-token binding because it
     // reflects cross-owner transfers that the per-user token binding deliberately
-    // does NOT (mirrors the App Store ordering). Canonicalized because the
-    // identify-completion workflow never repoints external identifiers, so a
-    // post-merge event would otherwise resolve to the archived source person.
+    // does NOT (mirrors the App Store ordering). Person merges do not repoint
+    // provider identifiers, so canonicalize the result to avoid resolving a
+    // post-merge event to the archived source person.
     const externalIdentifier = yield* queries.findExternalIdentifier({
       identifier: input.personIdentifier,
       projectId: input.projectId,
diff --git a/packages/core/src/services/personIdentity/IdentifyDistinctIdCompletionWorkflow.ts b/packages/core/src/services/personIdentity/IdentifyDistinctIdCompletionWorkflow.ts
deleted file mode 100644
index 1d07e6694..000000000
--- a/packages/core/src/services/personIdentity/IdentifyDistinctIdCompletionWorkflow.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import { Context, type Effect } from "effect";
-
-import type { PersonOriginValue } from "@voidhash/db";
-
-/**
- * Payload for the asynchronous identity-migration completion job, started after
- * the synchronous `identifyDistinctId` write commits.
- */
-export interface IdentifyDistinctIdCompletionInput {
-  readonly distinctId: string;
-  readonly eventTimestamp: string;
-  readonly jobId: string;
-  readonly origin: PersonOriginValue;
-  readonly previousDistinctId: string;
-  readonly projectId: string;
-  readonly requestedAt: string;
-  readonly targetPersonId: string;
-}
-
-/**
- * Abstract completion-job workflow. `dispatch` schedules the asynchronous
- * identity migration fire-and-forget; the concrete adapter (a Cloudflare
- * Workflow) is wired at the application root, so `packages/core` carries no
- * infrastructure dependency.
- */
-export class IdentifyDistinctIdCompletionWorkflow extends Context.Service<
-  IdentifyDistinctIdCompletionWorkflow,
-  {
-    readonly dispatch: (input: IdentifyDistinctIdCompletionInput) => Effect.Effect<void>;
-  }
->()("IdentifyDistinctIdCompletionWorkflow") {}
diff --git a/packages/core/src/services/personIdentity/IdentityMutationService.ts b/packages/core/src/services/personIdentity/IdentityMutationService.ts
index f612a943c..115d64965 100644
--- a/packages/core/src/services/personIdentity/IdentityMutationService.ts
+++ b/packages/core/src/services/personIdentity/IdentityMutationService.ts
@@ -92,16 +92,16 @@ const toMappingEvent = ({
 
 /**
  * Person-identity write operations, each running on a caller-supplied
- * transaction handle (`tx`) so the surrounding service or workflow controls
- * commit/rollback. Consumed by {@link PersonIdentityService} (synchronous
- * resolve/identify) and the identity completion workflow (durable source-side
- * merge). Pure projection types and trait/version rules live in the
- * `domain/person` model; this service owns only the database mutations.
+ * transaction handle (`tx`) so the surrounding service controls
+ * commit/rollback. Consumed by {@link PersonIdentityService} for synchronous
+ * resolve and identify operations. Pure projection types and trait/version
+ * rules live in the `domain/person` model; this service owns only the database
+ * mutations.
  */
 export class IdentityMutationService extends Context.Service<IdentityMutationService>()(
   "IdentityMutationService",
   {
-    make: Effect.gen(function* () {
+    make: Effect.sync(() => {
       const findPersonById = Effect.fn("findPersonById")(
         (db: DbTransaction, { personId }: { readonly personId: string }) =>
           Effect.gen(function* () {
@@ -532,8 +532,7 @@ export class IdentityMutationService extends Context.Service<IdentityMutationSer
        * Idempotent and repointing: the UNIQUE `(projectId, serviceId, identifier)`
        * key serializes concurrent writers, and `ON CONFLICT ... DO UPDATE
        * person_id` moves an existing binding onto the new canonical person —
-       * which is exactly what an identify-merge needs (the completion workflow
-       * does not repoint external identifiers).
+       * exactly what a synchronous identify merge needs.
        */
       const upsertAccountTokenBinding = Effect.fn("upsertAccountTokenBinding")(
         (
diff --git a/packages/core/src/services/personIdentity/IdentityProjectionPublisher.ts b/packages/core/src/services/personIdentity/IdentityProjectionPublisher.ts
index ac501ec97..349c8edb0 100644
--- a/packages/core/src/services/personIdentity/IdentityProjectionPublisher.ts
+++ b/packages/core/src/services/personIdentity/IdentityProjectionPublisher.ts
@@ -84,9 +84,8 @@ const toProcessorPersonIdentityEvent = ({
 /**
  * Publishes identity projection events produced outside the capture flush
  * batch. The analytics ingest path uses {@link noop} because its processor
- * returns these events to `AnalyticsIngestFlushWorkflow`; the identify
- * completion workflow uses {@link analyticsWriterLayer} for direct ClickHouse
- * writes.
+ * returns these events to its batch writer; the SDK composition uses
+ * {@link analyticsWriterLayer} for direct ClickHouse writes.
  */
 export class IdentityProjectionPublisher extends Context.Service<
   IdentityProjectionPublisher,
@@ -96,7 +95,7 @@ export class IdentityProjectionPublisher extends Context.Service<
     ) => Effect.Effect<void, QueueProducerError, Db>;
   }
 >()("IdentityProjectionPublisher", {
-  make: Effect.gen(function* () {
+  make: Effect.sync(() => {
     return { publishIdentityResult: () => Effect.void };
   }),
 }) {
diff --git a/packages/core/src/services/personIdentity/PersonIdentityService.ts b/packages/core/src/services/personIdentity/PersonIdentityService.ts
index b9f39bc7c..adbdbef19 100644
--- a/packages/core/src/services/personIdentity/PersonIdentityService.ts
+++ b/packages/core/src/services/personIdentity/PersonIdentityService.ts
@@ -81,9 +81,8 @@ export interface PersonIdentityResult {
  *   given distinct id; the result drives every SDK call that needs to attach a
  *   person to an analytics event.
  * - `identifyDistinctId` — promote an anonymous identity to an identified one.
- *   The synchronous transaction reconciles only the target person so the
- *   caller sees a consistent view; the source-side merge work is durable and
- *   handed off to {@link IdentifyDistinctIdCompletionWorkflow}.
+ *   The transaction synchronously reconciles the full source and target state,
+ *   then publishes the resulting projection events.
  */
 export class PersonIdentityService extends Context.Service<PersonIdentityService>()(
   "PersonIdentityService",
diff --git a/packages/core/src/services/users/UserService.ts b/packages/core/src/services/users/UserService.ts
index 6af79f669..3c583d72f 100644
--- a/packages/core/src/services/users/UserService.ts
+++ b/packages/core/src/services/users/UserService.ts
@@ -33,7 +33,7 @@ export class UserService extends Context.Service<UserService>()("UserService", {
       yield* Effect.annotateCurrentSpan("voidhash.auth.method", session.method);
       yield* Effect.annotateCurrentSpan("voidhash.user.id", session.user.id);
       if (session.user.workosUserId)
-        yield* Effect.annotateCurrentSpan("voidhash.user.workos_id", session.user.workosUserId);
+        yield* Effect.annotateCurrentSpan("voidhash.user.external_id", session.user.workosUserId);
       yield* Effect.annotateCurrentSpan(
         "voidhash.organization.count",
         session.organizations.length,
@@ -44,7 +44,7 @@ export class UserService extends Context.Service<UserService>()("UserService", {
         yield* Effect.annotateCurrentSpan("voidhash.organization.id", activeOrganization.id);
         if (activeOrganization.workosOrganizationId)
           yield* Effect.annotateCurrentSpan(
-            "voidhash.organization.workos_id",
+            "voidhash.organization.external_id",
             activeOrganization.workosOrganizationId,
           );
       }
diff --git a/packages/core/src/services/webhookDispatch/WebhookDeliveryService.ts b/packages/core/src/services/webhookDispatch/WebhookDeliveryService.ts
index 39230e42b..ffe8eb3a9 100644
--- a/packages/core/src/services/webhookDispatch/WebhookDeliveryService.ts
+++ b/packages/core/src/services/webhookDispatch/WebhookDeliveryService.ts
@@ -9,9 +9,9 @@ import {
   webhookEndpoints,
 } from "@voidhash/db";
 import { generateId } from "../../utils/generate-id.ts";
-import type { DeliverWebhookInput } from "./WebhookDeliveryWorkflow.ts";
+import type { DeliverWebhookInput } from "../../workflows/definitions.ts";
 
-export type { DeliverWebhookInput } from "./WebhookDeliveryWorkflow.ts";
+export type { DeliverWebhookInput } from "../../workflows/definitions.ts";
 
 /** Outcome of a single HTTP delivery attempt. Never throws — failures are
  * captured as a non-succeeded result so the workflow can decide to retry. */
diff --git a/packages/core/src/services/webhookDispatch/WebhookDeliveryWorkflow.ts b/packages/core/src/services/webhookDispatch/WebhookDeliveryWorkflow.ts
deleted file mode 100644
index dd88b0f49..000000000
--- a/packages/core/src/services/webhookDispatch/WebhookDeliveryWorkflow.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-import { Context, type Effect } from "effect";
-
-/** Durable delivery request for a single webhook attempt. */
-export interface DeliverWebhookInput {
-  readonly deliveryId: string;
-  readonly endpointId: string;
-  readonly attemptNumber: number;
-  readonly eventType: string;
-  readonly payload: unknown;
-  readonly secret: string;
-  readonly url: string;
-}
-
-/**
- * Abstract webhook-delivery workflow. `dispatch` hands a delivery off to the
- * durable retry mechanism fire-and-forget; the concrete adapter (a Cloudflare
- * Workflow) is wired at the application root, so `packages/core` carries no
- * infrastructure dependency. Consumers fork the returned effect — failures are
- * the delivery mechanism's concern, never the caller's.
- */
-export class WebhookDeliveryWorkflow extends Context.Service<
-  WebhookDeliveryWorkflow,
-  {
-    readonly dispatch: (input: DeliverWebhookInput) => Effect.Effect<void>;
-  }
->()("WebhookDeliveryWorkflow") {}
diff --git a/packages/core/src/services/webhookDispatch/WebhookDispatchService.ts b/packages/core/src/services/webhookDispatch/WebhookDispatchService.ts
index df1b529e9..1139080e7 100644
--- a/packages/core/src/services/webhookDispatch/WebhookDispatchService.ts
+++ b/packages/core/src/services/webhookDispatch/WebhookDispatchService.ts
@@ -1,12 +1,8 @@
 import { Context, Effect, Layer } from "effect";
+import * as Workflow from "@voidhash/platform/Workflow";
 
-import {
-  Db,
-  WebhookDeliveryStatus,
-  WebhookEndpointStatus,
-  webhookDeliveries,
-} from "@voidhash/db";
-import { WebhookDeliveryWorkflow } from "./WebhookDeliveryWorkflow.ts";
+import { Db, WebhookDeliveryStatus, WebhookEndpointStatus, webhookDeliveries } from "@voidhash/db";
+import { DeliverWebhook } from "../../workflows/definitions.ts";
 import { generateId } from "../../utils/generate-id.ts";
 import { WebhookServiceError } from "../webhookManager/WebhookManagerService.ts";
 import type { WebhookEventType } from "../webhookManager/event-types.ts";
@@ -20,7 +16,6 @@ export class WebhookDispatchService extends Context.Service<WebhookDispatchServi
   "WebhookDispatchService",
   {
     make: Effect.gen(function* () {
-      const webhookDelivery = yield* WebhookDeliveryWorkflow;
       const db = yield* Db;
 
       const emit = Effect.fn("webhookDispatch.emit")(
@@ -87,17 +82,15 @@ export class WebhookDispatchService extends Context.Service<WebhookDispatchServi
               webhookEndpointId: endpoint.id,
             });
 
-            yield* webhookDelivery
-              .dispatch({
-                attemptNumber: 1,
-                deliveryId,
-                endpointId: endpoint.id,
-                eventType: input.eventType,
-                payload: input.payload,
-                secret: endpoint.secret,
-                url: endpoint.url,
-              })
-              .pipe(Effect.forkDetach);
+            yield* Workflow.dispatchAndForget(DeliverWebhook, {
+              attemptNumber: 1,
+              deliveryId,
+              endpointId: endpoint.id,
+              eventType: input.eventType,
+              payload: input.payload,
+              secret: endpoint.secret,
+              url: endpoint.url,
+            }).pipe(Effect.forkDetach);
           }
 
           yield* Effect.logInfo(
diff --git a/packages/core/src/services/webhookManager/WebhookManagerService.ts b/packages/core/src/services/webhookManager/WebhookManagerService.ts
index ae34a8f8b..0acb1b033 100644
--- a/packages/core/src/services/webhookManager/WebhookManagerService.ts
+++ b/packages/core/src/services/webhookManager/WebhookManagerService.ts
@@ -15,10 +15,10 @@ import {
   type WebhookEndpointStatusValue,
   eq,
   webhookDeliveries,
-  webhookDeliveryAttempts,
   webhookEndpoints,
 } from "@voidhash/db";
-import { WebhookDeliveryWorkflow } from "../webhookDispatch/WebhookDeliveryWorkflow.ts";
+import * as Workflow from "@voidhash/platform/Workflow";
+import { DeliverWebhook } from "../../workflows/definitions.ts";
 import { generateId } from "../../utils/generate-id.ts";
 import { AuditLogPort } from "../auditLog/AuditLogPort.ts";
 import { type WebhookEventType, isValidWebhookEvent } from "./event-types.ts";
@@ -629,18 +629,15 @@ export class WebhookManagerService extends Context.Service<WebhookManagerService
             })
             .where(eq(webhookDeliveries.id, input.deliveryId));
 
-          const webhookDelivery = yield* WebhookDeliveryWorkflow;
-          yield* webhookDelivery
-            .dispatch({
-              attemptNumber: nextAttemptNumber,
-              deliveryId: delivery.id,
-              endpointId: endpoint.id,
-              eventType: delivery.eventType,
-              payload: delivery.payload,
-              secret: endpoint.secret,
-              url: endpoint.url,
-            })
-            .pipe(Effect.forkDetach);
+          yield* Workflow.dispatchAndForget(DeliverWebhook, {
+            attemptNumber: nextAttemptNumber,
+            deliveryId: delivery.id,
+            endpointId: endpoint.id,
+            eventType: delivery.eventType,
+            payload: delivery.payload,
+            secret: endpoint.secret,
+            url: endpoint.url,
+          }).pipe(Effect.forkDetach);
 
           return mapDeliveryToResponse({
             ...delivery,
@@ -703,18 +700,15 @@ export class WebhookManagerService extends Context.Service<WebhookManagerService
             webhookEndpointId: endpoint.id,
           });
 
-          const webhookDelivery = yield* WebhookDeliveryWorkflow;
-          yield* webhookDelivery
-            .dispatch({
-              attemptNumber: 1,
-              deliveryId,
-              endpointId: endpoint.id,
-              eventType,
-              payload,
-              secret: endpoint.secret,
-              url: endpoint.url,
-            })
-            .pipe(Effect.forkDetach);
+          yield* Workflow.dispatchAndForget(DeliverWebhook, {
+            attemptNumber: 1,
+            deliveryId,
+            endpointId: endpoint.id,
+            eventType,
+            payload,
+            secret: endpoint.secret,
+            url: endpoint.url,
+          }).pipe(Effect.forkDetach);
 
           return mapDeliveryToResponse({
             attemptCount: 0,
diff --git a/packages/core/src/testing/effect-vitest.ts b/packages/core/src/testing/effect-vitest.ts
index a6ae0366f..320f77d13 100644
--- a/packages/core/src/testing/effect-vitest.ts
+++ b/packages/core/src/testing/effect-vitest.ts
@@ -13,7 +13,7 @@
 import { makeMethods } from "@effect/vitest";
 import { describe, expect, it as baseIt, test, vi } from "vite-plus/test";
 
-// biome-ignore lint/suspicious/noExplicitAny: TestAPI types differ slightly between
+// TestAPI types differ slightly between
 // @effect/vitest's vendored vitest and vite-plus/test, but the runtime shape (`it`,
 // `it.skip`, `it.only`, `it.each`, etc.) is identical. Casting through any keeps the
 // shim a one-liner.
diff --git a/packages/core/src/utils/crypto/standalone-auth-token.ts b/packages/core/src/utils/crypto/standalone-auth-token.ts
new file mode 100644
index 000000000..c8f64cac5
--- /dev/null
+++ b/packages/core/src/utils/crypto/standalone-auth-token.ts
@@ -0,0 +1,243 @@
+/**
+ * HS256 session tokens for the standalone identity provider.
+ *
+ * The same compact JWT is used as both the browser session cookie value and the
+ * `Authorization: Bearer` token, so the backend's cookie and bearer paths
+ * collapse onto one verifier. Claims deliberately match
+ * `JwtAuthPayloadSchema` (`sub`, `email`, `name`, `image`) so the token flows
+ * through the existing bearer pipeline unchanged.
+ *
+ * WebCrypto only (no Node `crypto`/`Buffer`), matching {@link jwt-sign} — the
+ * module is imported by the Node self-host runtime and the TanStack Start
+ * server routes alike.
+ *
+ * See `docs/standalone-auth-design.md` for the trust model.
+ */
+import { Effect, Schema } from "effect";
+
+/** Raised when a standalone token cannot be signed, parsed, or verified. */
+export class StandaloneAuthTokenError extends Schema.TaggedErrorClass<StandaloneAuthTokenError>(
+  "StandaloneAuthTokenError",
+)("StandaloneAuthTokenError", { message: Schema.String }) {}
+
+/**
+ * Signing key used when `VOIDHASH_AUTH_SECRET` is unset. Reachable only in
+ * `SELFHOST_MODE=local-evaluation` — production refuses to start without a real
+ * secret — and it lets a split-process dev setup (www and backend in separate
+ * processes) agree on a key with zero configuration.
+ */
+export const STANDALONE_AUTH_DEFAULT_SECRET = "voidhash-local-evaluation-auth-secret";
+
+/** Cookie that carries the standalone session token. */
+export const STANDALONE_AUTH_COOKIE_NAME = "vh-session";
+
+/**
+ * Subject claim for the single root identity.
+ *
+ * A constant rather than a value derived from the email or username: it lands in
+ * `user.workos_user_id`, so keeping it stable means changing
+ * `VOIDHASH_ROOT_EMAIL` or `VOIDHASH_ROOT_USERNAME` later updates the existing
+ * user row instead of stranding it behind a new identity.
+ */
+export const STANDALONE_ROOT_SUBJECT = "root";
+
+/** Default session lifetime: long enough that sign-in is a rare event. */
+export const STANDALONE_AUTH_DEFAULT_TTL_SECONDS = 30 * 24 * 60 * 60;
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+const bytesToBase64Url = (bytes: Uint8Array): string => {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i] as number);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+
+const base64UrlToBytes = (value: string): Uint8Array => {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded.padEnd(Math.ceil(padded.length / 4) * 4, "="));
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+};
+
+const stringToBase64Url = (value: string): string => bytesToBase64Url(encoder.encode(value));
+
+const importKey = (secret: string) =>
+  Effect.tryPromise({
+    try: () =>
+      crypto.subtle.importKey(
+        "raw",
+        encoder.encode(secret) as BufferSource,
+        { name: "HMAC", hash: "SHA-256" },
+        false,
+        ["sign"],
+      ),
+    catch: (cause) =>
+      new StandaloneAuthTokenError({
+        message: `failed to import standalone auth key: ${String(cause)}`,
+      }),
+  });
+
+const signingSignature = (signingInput: string, secret: string) =>
+  Effect.gen(function* () {
+    const key = yield* importKey(secret);
+    const signature = yield* Effect.tryPromise({
+      try: () => crypto.subtle.sign("HMAC", key, encoder.encode(signingInput) as BufferSource),
+      catch: (cause) =>
+        new StandaloneAuthTokenError({
+          message: `standalone auth signing failed: ${String(cause)}`,
+        }),
+    });
+    return bytesToBase64Url(new Uint8Array(signature));
+  });
+
+/** Length-independent comparison so verification does not leak the signature. */
+export const constantTimeEquals = (left: string, right: string): boolean => {
+  if (left.length !== right.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < left.length; i++) {
+    mismatch |= left.charCodeAt(i) ^ right.charCodeAt(i);
+  }
+  return mismatch === 0;
+};
+
+const sha256Hex = async (value: string): Promise<string> => {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+  let hex = "";
+  for (const byte of digest) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+};
+
+/**
+ * Compares two secrets without leaking their length or contents through timing.
+ *
+ * Both sides are hashed first so the constant-time comparison always runs over
+ * equal-length inputs — a raw comparison would return early on a length
+ * mismatch and leak the expected password's length.
+ */
+export const secretsMatch = (candidate: string, expected: string): Effect.Effect<boolean> =>
+  Effect.promise(async () =>
+    constantTimeEquals(await sha256Hex(candidate), await sha256Hex(expected)),
+  );
+
+/** Normalizes an email for storage: trimmed, lowercased. */
+export const normalizeEmail = (email: string): string => email.trim().toLowerCase();
+
+export interface StandaloneAuthTokenClaims {
+  readonly sub: string;
+  readonly email: string;
+  readonly name?: string;
+  readonly image?: string;
+  readonly iat: number;
+  readonly exp: number;
+}
+
+export interface SignStandaloneAuthTokenInput {
+  readonly email: string;
+  readonly name?: string | undefined;
+  readonly image?: string | undefined;
+  readonly secret: string;
+  /** Seconds until expiry; defaults to {@link STANDALONE_AUTH_DEFAULT_TTL_SECONDS}. */
+  readonly expiresInSeconds?: number;
+  /** Issue time in seconds since the epoch; defaults to now. */
+  readonly issuedAt?: number;
+}
+
+/** Signs a session token for the root identity. */
+export const signStandaloneAuthToken = (
+  input: SignStandaloneAuthTokenInput,
+): Effect.Effect<string, StandaloneAuthTokenError> =>
+  Effect.gen(function* () {
+    const issuedAt = input.issuedAt ?? Math.floor(Date.now() / 1000);
+    const claims: StandaloneAuthTokenClaims = {
+      email: normalizeEmail(input.email),
+      exp: issuedAt + (input.expiresInSeconds ?? STANDALONE_AUTH_DEFAULT_TTL_SECONDS),
+      iat: issuedAt,
+      sub: STANDALONE_ROOT_SUBJECT,
+      ...(input.image ? { image: input.image } : {}),
+      ...(input.name ? { name: input.name } : {}),
+    };
+    const signingInput = `${stringToBase64Url(
+      JSON.stringify({ alg: "HS256", typ: "JWT" }),
+    )}.${stringToBase64Url(JSON.stringify(claims))}`;
+    const signature = yield* signingSignature(signingInput, input.secret);
+    return `${signingInput}.${signature}`;
+  });
+
+/**
+ * Verifies a standalone session token and returns its claims. Fails on a bad
+ * signature, malformed structure, expiry, or a subject other than the root one —
+ * the provider only ever issues root tokens, so anything else is forged.
+ */
+export const verifyStandaloneAuthToken = (
+  token: string,
+  secret: string,
+): Effect.Effect<StandaloneAuthTokenClaims, StandaloneAuthTokenError> =>
+  Effect.gen(function* () {
+    const segments = token.split(".");
+    if (segments.length !== 3) {
+      return yield* Effect.fail(
+        new StandaloneAuthTokenError({ message: "standalone auth token is malformed" }),
+      );
+    }
+    const [header, payload, signature] = segments as [string, string, string];
+    const expected = yield* signingSignature(`${header}.${payload}`, secret);
+    if (!constantTimeEquals(expected, signature)) {
+      return yield* Effect.fail(
+        new StandaloneAuthTokenError({ message: "standalone auth token signature is invalid" }),
+      );
+    }
+
+    const claims = yield* Effect.try({
+      try: () =>
+        JSON.parse(decoder.decode(base64UrlToBytes(payload))) as StandaloneAuthTokenClaims,
+      catch: (cause) =>
+        new StandaloneAuthTokenError({
+          message: `standalone auth token payload is invalid: ${String(cause)}`,
+        }),
+    });
+
+    if (
+      typeof claims.sub !== "string" ||
+      typeof claims.email !== "string" ||
+      typeof claims.exp !== "number"
+    ) {
+      return yield* Effect.fail(
+        new StandaloneAuthTokenError({ message: "standalone auth token claims are incomplete" }),
+      );
+    }
+    if (claims.sub !== STANDALONE_ROOT_SUBJECT) {
+      return yield* Effect.fail(
+        new StandaloneAuthTokenError({ message: "standalone auth token subject is not the root identity" }),
+      );
+    }
+    if (claims.exp * 1000 <= Date.now()) {
+      return yield* Effect.fail(
+        new StandaloneAuthTokenError({ message: "standalone auth token has expired" }),
+      );
+    }
+
+    return claims;
+  });
+
+/** Reads a named cookie out of a raw `Cookie` header. */
+export const readCookieValue = (
+  cookieHeader: string | null | undefined,
+  cookieName: string,
+): string | undefined => {
+  if (!cookieHeader) return undefined;
+  for (const segment of cookieHeader.split(";")) {
+    const trimmed = segment.trim();
+    if (trimmed.startsWith(`${cookieName}=`)) {
+      return decodeURIComponent(trimmed.slice(cookieName.length + 1));
+    }
+  }
+  return undefined;
+};
diff --git a/packages/core/src/workflows/AppStoreExpireParkedNotifications.ts b/packages/core/src/workflows/AppStoreExpireParkedNotifications.ts
new file mode 100644
index 000000000..3e030116c
--- /dev/null
+++ b/packages/core/src/workflows/AppStoreExpireParkedNotifications.ts
@@ -0,0 +1,36 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Schema } from "effect";
+
+import { APP_STORE_PARKED_SDK_TTL_DAYS } from "../services/paymentProviders/appStore/payment-provider.ts";
+import { AppStorePaymentProviderServiceQueries } from "../services/paymentProviders/appStore/payment-provider-service-queries.ts";
+import { AppStoreExpireParkedNotifications } from "./definitions.ts";
+
+const dayMillis = 24 * 60 * 60 * 1_000;
+
+/** Daily expiry registration for unconfirmed App Store notifications. */
+export const AppStoreExpireParkedNotificationsRegistration = WorkflowRegistration.make(
+  AppStoreExpireParkedNotifications,
+  {
+    dependencies: AppStorePaymentProviderServiceQueries.layer,
+    cron: {
+      schedule: "0 4 * * *",
+      payload: (scheduledTime) => ({ triggeredAt: scheduledTime.toISOString() }),
+    },
+    run: (input, ctx) =>
+      Effect.gen(function* () {
+        const triggeredAt = Date.parse(input.triggeredAt);
+        if (Number.isNaN(triggeredAt)) return { expired: 0 };
+
+        const olderThan = new Date(triggeredAt - APP_STORE_PARKED_SDK_TTL_DAYS * dayMillis);
+        const expired = yield* ctx.step({
+          name: `app-store-expire-parked:${input.triggeredAt}`,
+          success: Schema.Struct({ expired: Schema.Number }),
+          execute: Effect.gen(function* () {
+            const queries = yield* AppStorePaymentProviderServiceQueries;
+            return yield* queries.expireStaleParkedSdkConfirmationRows({ olderThan });
+          }),
+        });
+        return expired;
+      }),
+  },
+);
diff --git a/packages/core/src/workflows/AppStoreReconcileOriginalTransaction.ts b/packages/core/src/workflows/AppStoreReconcileOriginalTransaction.ts
new file mode 100644
index 000000000..f9232be40
--- /dev/null
+++ b/packages/core/src/workflows/AppStoreReconcileOriginalTransaction.ts
@@ -0,0 +1,41 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Layer, Schema } from "effect";
+
+import { AppStoreReconciliationService } from "../services/paymentProviders/appStore/app-store-reconciliation-service.ts";
+import { AppStorePaymentProvider } from "../services/paymentProviders/appStore/payment-provider.ts";
+import { AppStoreReconcileOriginalTransaction } from "./definitions.ts";
+import { appStore } from "./paymentDependencies.ts";
+
+const ReconciliationResult = Schema.Struct({
+  eventsApplied: Schema.Number,
+  eventsFailed: Schema.Number,
+  eventsSkippedIdempotent: Schema.Number,
+  statusesProcessed: Schema.Number,
+  transactionsProcessed: Schema.Number,
+});
+
+/** App Store authoritative-history reconciliation registration. */
+export const AppStoreReconcileOriginalTransactionRegistration = WorkflowRegistration.make(
+  AppStoreReconcileOriginalTransaction,
+  {
+    dependencies: AppStoreReconciliationService.layer.pipe(
+      Layer.provide(AppStorePaymentProvider.layer),
+      Layer.provide(appStore),
+    ),
+    run: (input, ctx) =>
+      ctx.step({
+        name: `app-store-reconcile:${input.paymentProviderConfigurationId}:${input.originalTransactionId}:${input.reason}`,
+        success: ReconciliationResult,
+        retry: "none",
+        execute: Effect.gen(function* () {
+          const reconciliation = yield* AppStoreReconciliationService;
+          return yield* reconciliation.reconcileOriginalTransaction({
+            originalTransactionId: input.originalTransactionId,
+            paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+            reason: input.reason,
+            triggeredAt: new Date(input.triggeredAt),
+          });
+        }),
+      }),
+  },
+);
diff --git a/packages/core/src/workflows/AppStoreReplayParkedNotifications.ts b/packages/core/src/workflows/AppStoreReplayParkedNotifications.ts
new file mode 100644
index 000000000..a5321ff5d
--- /dev/null
+++ b/packages/core/src/workflows/AppStoreReplayParkedNotifications.ts
@@ -0,0 +1,32 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Layer, Schema } from "effect";
+
+import { AppStoreWebhookHandlerService } from "../services/paymentProviders/appStore/app-store-webhook-handler-service.ts";
+import { AppStoreReplayParkedNotifications } from "./definitions.ts";
+import { appStore } from "./paymentDependencies.ts";
+
+const ReplayResult = Schema.Struct({
+  appliedCount: Schema.Number,
+  failedCount: Schema.Number,
+  totalParked: Schema.Number,
+});
+
+/** App Store product-mapping replay registration. */
+export const AppStoreReplayParkedNotificationsRegistration = WorkflowRegistration.make(
+  AppStoreReplayParkedNotifications,
+  {
+    dependencies: AppStoreWebhookHandlerService.layer.pipe(Layer.provide(appStore)),
+    run: (input, ctx) =>
+      ctx.step({
+        name: `app-store-replay-parked:${input.paymentProviderConfigurationId}:${input.providerProductKey}`,
+        success: ReplayResult,
+        execute: Effect.gen(function* () {
+          const handler = yield* AppStoreWebhookHandlerService;
+          return yield* handler.replayParkedNotificationsForProductMapping({
+            paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+            providerProductKey: input.providerProductKey,
+          });
+        }),
+      }),
+  },
+);
diff --git a/packages/core/src/workflows/AppStoreReplayParkedSdkNotifications.ts b/packages/core/src/workflows/AppStoreReplayParkedSdkNotifications.ts
new file mode 100644
index 000000000..d73cf986b
--- /dev/null
+++ b/packages/core/src/workflows/AppStoreReplayParkedSdkNotifications.ts
@@ -0,0 +1,32 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Layer, Schema } from "effect";
+
+import { AppStoreWebhookHandlerService } from "../services/paymentProviders/appStore/app-store-webhook-handler-service.ts";
+import { AppStoreReplayParkedSdkNotifications } from "./definitions.ts";
+import { appStore } from "./paymentDependencies.ts";
+
+const ReplayResult = Schema.Struct({
+  appliedCount: Schema.Number,
+  failedCount: Schema.Number,
+  totalParked: Schema.Number,
+});
+
+/** App Store SDK-confirmation replay registration. */
+export const AppStoreReplayParkedSdkNotificationsRegistration = WorkflowRegistration.make(
+  AppStoreReplayParkedSdkNotifications,
+  {
+    dependencies: AppStoreWebhookHandlerService.layer.pipe(Layer.provide(appStore)),
+    run: (input, ctx) =>
+      ctx.step({
+        name: `app-store-replay-parked-sdk:${input.paymentProviderConfigurationId}:${input.originalTransactionId}`,
+        success: ReplayResult,
+        execute: Effect.gen(function* () {
+          const handler = yield* AppStoreWebhookHandlerService;
+          return yield* handler.replayParkedNotificationsForSdkConfirmation({
+            originalTransactionId: input.originalTransactionId,
+            paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+          });
+        }),
+      }),
+  },
+);
diff --git a/packages/core/src/workflows/DeliverWebhook.ts b/packages/core/src/workflows/DeliverWebhook.ts
new file mode 100644
index 000000000..c2464a176
--- /dev/null
+++ b/packages/core/src/workflows/DeliverWebhook.ts
@@ -0,0 +1,84 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Schema } from "effect";
+
+import {
+  nextWebhookDeliveryRetryTime,
+  WebhookDeliveryService,
+} from "../services/webhookDispatch/WebhookDeliveryService.ts";
+import { DeliverWebhook } from "./definitions.ts";
+
+const SendWebhookResult = Schema.Struct({
+  durationMs: Schema.Number,
+  errorMessage: Schema.NullOr(Schema.String),
+  responseBody: Schema.NullOr(Schema.String),
+  statusCode: Schema.NullOr(Schema.Number),
+  succeeded: Schema.Boolean,
+});
+
+/** Durable webhook delivery registration. */
+export const DeliverWebhookRegistration = WorkflowRegistration.make(DeliverWebhook, {
+  dependencies: WebhookDeliveryService.layer,
+  run: (input, ctx) =>
+    Effect.gen(function* () {
+      let attemptNumber = input.attemptNumber;
+
+      while (true) {
+        const attempt = { ...input, attemptNumber };
+        const result = yield* ctx.step({
+          name: `send-${input.deliveryId}-${attemptNumber}`,
+          success: SendWebhookResult,
+          execute: Effect.gen(function* () {
+            const delivery = yield* WebhookDeliveryService;
+            return yield* delivery.send(attempt);
+          }),
+        });
+
+        yield* ctx.step({
+          name: `record-attempt-${input.deliveryId}-${attemptNumber}`,
+          success: Schema.Void,
+          execute: Effect.gen(function* () {
+            const delivery = yield* WebhookDeliveryService;
+            yield* delivery.recordAttempt(attempt, result);
+          }),
+        });
+
+        if (result.succeeded) {
+          yield* ctx.step({
+            name: `mark-succeeded-${input.deliveryId}-${attemptNumber}`,
+            success: Schema.Void,
+            execute: Effect.gen(function* () {
+              const delivery = yield* WebhookDeliveryService;
+              yield* delivery.markSucceeded(attempt);
+            }),
+          });
+          return;
+        }
+
+        const nextAttemptNumber = attemptNumber + 1;
+        const retryTime = nextWebhookDeliveryRetryTime(nextAttemptNumber);
+
+        if (!retryTime) {
+          yield* ctx.step({
+            name: `mark-exhausted-${input.deliveryId}-${attemptNumber}`,
+            success: Schema.Void,
+            execute: Effect.gen(function* () {
+              const delivery = yield* WebhookDeliveryService;
+              yield* delivery.markExhausted(attempt);
+            }),
+          });
+          return;
+        }
+
+        yield* ctx.step({
+          name: `mark-failed-${input.deliveryId}-${attemptNumber}`,
+          success: Schema.Void,
+          execute: Effect.gen(function* () {
+            const delivery = yield* WebhookDeliveryService;
+            yield* delivery.markFailed(attempt, retryTime);
+          }),
+        });
+        yield* ctx.sleepUntil(`retry-${input.deliveryId}-${nextAttemptNumber}`, retryTime);
+        attemptNumber = nextAttemptNumber;
+      }
+    }),
+});
diff --git a/packages/core/src/workflows/FxRateSync.ts b/packages/core/src/workflows/FxRateSync.ts
new file mode 100644
index 000000000..cded51a97
--- /dev/null
+++ b/packages/core/src/workflows/FxRateSync.ts
@@ -0,0 +1,40 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Config, Effect, Redacted, Schema } from "effect";
+
+import { FxRateService } from "../services/fxRates/FxRateService.ts";
+import { FxRateSync } from "./definitions.ts";
+
+/** Daily foreign-exchange refresh registration. */
+export const FxRateSyncRegistration = WorkflowRegistration.make(FxRateSync, {
+  dependencies: FxRateService.layer({
+    apiKey: Config.redacted("EXCHANGE_RATE_API_KEY").pipe(
+      Config.withDefault(Redacted.make("")),
+      Effect.map(Redacted.value),
+      Effect.orDie,
+    ),
+    baseUrl: Config.string("EXCHANGE_RATE_API_BASE_URL").pipe(
+      Config.withDefault("https://v6.exchangerate-api.com/v6"),
+      Effect.orDie,
+    ),
+  }),
+  cron: {
+    schedule: "0 5 * * *",
+    payload: (scheduledTime) => ({ runId: scheduledTime.toISOString() }),
+  },
+  run: (input, ctx) =>
+    Effect.gen(function* () {
+      const refreshedCount = yield* ctx.step({
+        name: `refresh-latest-${input.runId}`,
+        success: Schema.Number,
+        execute: Effect.gen(function* () {
+          const fxRate = yield* FxRateService;
+          return yield* fxRate.refreshLatest();
+        }).pipe(
+          Effect.tap((count) =>
+            Effect.logInfo(`FxRateSyncWorkflow refreshed ${count} rate(s)`, input),
+          ),
+        ),
+      });
+      return { refreshedCount };
+    }),
+});
diff --git a/packages/core/src/workflows/GooglePlayReplayParkedNotifications.ts b/packages/core/src/workflows/GooglePlayReplayParkedNotifications.ts
new file mode 100644
index 000000000..e90cc78d9
--- /dev/null
+++ b/packages/core/src/workflows/GooglePlayReplayParkedNotifications.ts
@@ -0,0 +1,32 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Layer, Schema } from "effect";
+
+import { GooglePlayWebhookHandlerService } from "../services/paymentProviders/googlePlay/webhook-handler-service.ts";
+import { GooglePlayReplayParkedNotifications } from "./definitions.ts";
+import { googlePlay } from "./paymentDependencies.ts";
+
+const ReplayResult = Schema.Struct({
+  appliedCount: Schema.Number,
+  failedCount: Schema.Number,
+  totalParked: Schema.Number,
+});
+
+/** Google Play product-mapping replay registration. */
+export const GooglePlayReplayParkedNotificationsRegistration = WorkflowRegistration.make(
+  GooglePlayReplayParkedNotifications,
+  {
+    dependencies: GooglePlayWebhookHandlerService.layer.pipe(Layer.provide(googlePlay)),
+    run: (input, ctx) =>
+      ctx.step({
+        name: `google-play-replay-parked:${input.paymentProviderConfigurationId}:${input.providerProductKey}`,
+        success: ReplayResult,
+        execute: Effect.gen(function* () {
+          const handler = yield* GooglePlayWebhookHandlerService;
+          return yield* handler.replayParkedNotificationsForProductMapping({
+            paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+            providerProductKey: input.providerProductKey,
+          });
+        }),
+      }),
+  },
+);
diff --git a/packages/core/src/workflows/PurchaseLedgerDrain.ts b/packages/core/src/workflows/PurchaseLedgerDrain.ts
new file mode 100644
index 000000000..c6da4fd5f
--- /dev/null
+++ b/packages/core/src/workflows/PurchaseLedgerDrain.ts
@@ -0,0 +1,63 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Schema } from "effect";
+
+import { PurchaseLedgerWorkerService } from "../services/purchaseProcessing/PurchaseLedgerWorkerService.ts";
+import { PurchaseLedgerDrain } from "./definitions.ts";
+
+const PollResult = Schema.Struct({
+  claimedCount: Schema.Number,
+  deadLetteredCount: Schema.Number,
+  publishedCount: Schema.Number,
+  retriedCount: Schema.Number,
+  staleClaimsReleased: Schema.Number,
+});
+
+/** Every-minute, bounded purchase-ledger drain registration. */
+export const PurchaseLedgerDrainRegistration = WorkflowRegistration.make(PurchaseLedgerDrain, {
+  dependencies: PurchaseLedgerWorkerService.layer,
+  cron: {
+    schedule: "* * * * *",
+    payload: (scheduledTime) => ({ runId: scheduledTime.toISOString() }),
+  },
+  run: (input, ctx) =>
+    Effect.gen(function* () {
+      let batches = 0;
+      let claimedCount = 0;
+      let deadLetteredCount = 0;
+      let publishedCount = 0;
+      let retriedCount = 0;
+      let staleClaimsReleased = 0;
+
+      for (let index = 0; index < 10; index++) {
+        const result = yield* ctx.step({
+          name: `drain-${input.runId}-batch-${index}`,
+          success: PollResult,
+          execute: Effect.gen(function* () {
+            const worker = yield* PurchaseLedgerWorkerService;
+            return yield* worker.poll({
+              batchSize: 100,
+              maxAttempts: 8,
+              staleClaimSeconds: 5 * 60,
+            });
+          }),
+        });
+
+        batches++;
+        claimedCount += result.claimedCount;
+        deadLetteredCount += result.deadLetteredCount;
+        publishedCount += result.publishedCount;
+        retriedCount += result.retriedCount;
+        staleClaimsReleased += result.staleClaimsReleased;
+        if (result.claimedCount === 0) break;
+      }
+
+      return {
+        batches,
+        claimedCount,
+        deadLetteredCount,
+        publishedCount,
+        retriedCount,
+        staleClaimsReleased,
+      };
+    }),
+});
diff --git a/packages/core/src/workflows/StripeReplayParkedNotifications.ts b/packages/core/src/workflows/StripeReplayParkedNotifications.ts
new file mode 100644
index 000000000..b98b61f7c
--- /dev/null
+++ b/packages/core/src/workflows/StripeReplayParkedNotifications.ts
@@ -0,0 +1,32 @@
+import * as WorkflowRegistration from "@voidhash/platform/WorkflowRegistration";
+import { Effect, Layer, Schema } from "effect";
+
+import { StripeWebhookHandlerService } from "../services/paymentProviders/stripe/stripe-webhook-handler-service.ts";
+import { StripeReplayParkedNotifications } from "./definitions.ts";
+import { stripe } from "./paymentDependencies.ts";
+
+const ReplayResult = Schema.Struct({
+  appliedCount: Schema.Number,
+  failedCount: Schema.Number,
+  totalParked: Schema.Number,
+});
+
+/** Stripe product-mapping replay registration. */
+export const StripeReplayParkedNotificationsRegistration = WorkflowRegistration.make(
+  StripeReplayParkedNotifications,
+  {
+    dependencies: StripeWebhookHandlerService.layer.pipe(Layer.provide(stripe)),
+    run: (input, ctx) =>
+      ctx.step({
+        name: `stripe-replay-parked:${input.paymentProviderConfigurationId}:${input.providerProductKey}`,
+        success: ReplayResult,
+        execute: Effect.gen(function* () {
+          const handler = yield* StripeWebhookHandlerService;
+          return yield* handler.replayParkedNotificationsForProductMapping({
+            paymentProviderConfigurationId: input.paymentProviderConfigurationId,
+            providerProductKey: input.providerProductKey,
+          });
+        }),
+      }),
+  },
+);
diff --git a/packages/core/src/workflows/definitions.ts b/packages/core/src/workflows/definitions.ts
new file mode 100644
index 000000000..f5c3dbde7
--- /dev/null
+++ b/packages/core/src/workflows/definitions.ts
@@ -0,0 +1,128 @@
+import * as Workflow from "@voidhash/platform/Workflow";
+import { Schema } from "effect";
+
+const replayResult = Schema.Struct({
+  appliedCount: Schema.Number,
+  failedCount: Schema.Number,
+  totalParked: Schema.Number,
+});
+
+const replayPayload = {
+  paymentProviderConfigurationId: Schema.String,
+  paymentProviderProductId: Schema.String,
+  providerProductKey: Schema.String,
+  requestedAt: Schema.String,
+};
+
+/** Delivers one outbound webhook with durable retries. */
+export const DeliverWebhook = Workflow.define({
+  name: "DeliverWebhookWorkflow",
+  payload: {
+    attemptNumber: Schema.Number,
+    deliveryId: Schema.String,
+    endpointId: Schema.String,
+    eventType: Schema.String,
+    payload: Schema.Unknown,
+    secret: Schema.String,
+    url: Schema.String,
+  },
+  success: Schema.Void,
+  idempotencyKey: ({ deliveryId }) => deliveryId,
+});
+
+export type DeliverWebhookInput = Schema.Struct.Type<typeof DeliverWebhook.payload>;
+
+/** Refreshes the durable foreign-exchange rate cache. */
+export const FxRateSync = Workflow.define({
+  name: "FxRateSyncWorkflow",
+  payload: { runId: Schema.String },
+  success: Schema.Struct({ refreshedCount: Schema.Number }),
+  idempotencyKey: ({ runId }) => runId,
+});
+
+/** Drains durable purchase-ledger rows into analytics ingestion. */
+export const PurchaseLedgerDrain = Workflow.define({
+  name: "PurchaseLedgerDrainWorkflow",
+  payload: { runId: Schema.String },
+  success: Schema.Struct({
+    batches: Schema.Number,
+    claimedCount: Schema.Number,
+    deadLetteredCount: Schema.Number,
+    publishedCount: Schema.Number,
+    retriedCount: Schema.Number,
+    staleClaimsReleased: Schema.Number,
+  }),
+  idempotencyKey: ({ runId }) => runId,
+});
+
+/** Expires App Store notifications that outlive the SDK-confirmation window. */
+export const AppStoreExpireParkedNotifications = Workflow.define({
+  name: "AppStoreExpireParkedNotificationsWorkflow",
+  payload: { triggeredAt: Schema.String },
+  success: Schema.Struct({ expired: Schema.Number }),
+  idempotencyKey: ({ triggeredAt }) => triggeredAt,
+});
+
+/** Replays App Store notifications after a product mapping is created. */
+export const AppStoreReplayParkedNotifications = Workflow.define({
+  name: "AppStoreReplayParkedNotificationsWorkflow",
+  payload: replayPayload,
+  success: replayResult,
+  idempotencyKey: ({ paymentProviderConfigurationId, paymentProviderProductId, requestedAt }) =>
+    `${paymentProviderConfigurationId}:${paymentProviderProductId}:${requestedAt}`,
+});
+
+export type AppStoreReplayParkedNotificationsInput = Schema.Struct.Type<
+  typeof AppStoreReplayParkedNotifications.payload
+>;
+
+/** Replays App Store notifications after the SDK confirms a transaction series. */
+export const AppStoreReplayParkedSdkNotifications = Workflow.define({
+  name: "AppStoreReplayParkedSdkNotificationsWorkflow",
+  payload: {
+    originalTransactionId: Schema.String,
+    paymentProviderConfigurationId: Schema.String,
+    requestedAt: Schema.String,
+  },
+  success: replayResult,
+  idempotencyKey: ({ originalTransactionId, paymentProviderConfigurationId, requestedAt }) =>
+    `${paymentProviderConfigurationId}:${originalTransactionId}:${requestedAt}`,
+});
+
+/** Reconciles an App Store transaction series against Apple's history. */
+export const AppStoreReconcileOriginalTransaction = Workflow.define({
+  name: "AppStoreReconcileOriginalTransactionWorkflow",
+  payload: {
+    originalTransactionId: Schema.String,
+    paymentProviderConfigurationId: Schema.String,
+    reason: Schema.Literals(["first_seen", "admin_repair", "install_backfill"]),
+    triggeredAt: Schema.String,
+  },
+  success: Schema.Struct({
+    eventsApplied: Schema.Number,
+    eventsFailed: Schema.Number,
+    eventsSkippedIdempotent: Schema.Number,
+    statusesProcessed: Schema.Number,
+    transactionsProcessed: Schema.Number,
+  }),
+  idempotencyKey: ({ originalTransactionId, paymentProviderConfigurationId, triggeredAt }) =>
+    `${paymentProviderConfigurationId}:${originalTransactionId}:${triggeredAt}`,
+});
+
+/** Replays Google Play notifications after a product mapping is created. */
+export const GooglePlayReplayParkedNotifications = Workflow.define({
+  name: "GooglePlayReplayParkedNotificationsWorkflow",
+  payload: replayPayload,
+  success: replayResult,
+  idempotencyKey: ({ paymentProviderConfigurationId, paymentProviderProductId, requestedAt }) =>
+    `${paymentProviderConfigurationId}:${paymentProviderProductId}:${requestedAt}`,
+});
+
+/** Replays Stripe events after a product mapping is created. */
+export const StripeReplayParkedNotifications = Workflow.define({
+  name: "StripeReplayParkedNotificationsWorkflow",
+  payload: replayPayload,
+  success: replayResult,
+  idempotencyKey: ({ paymentProviderConfigurationId, paymentProviderProductId, requestedAt }) =>
+    `${paymentProviderConfigurationId}:${paymentProviderProductId}:${requestedAt}`,
+});
diff --git a/packages/core/src/workflows/paymentDependencies.ts b/packages/core/src/workflows/paymentDependencies.ts
new file mode 100644
index 000000000..719f4aa30
--- /dev/null
+++ b/packages/core/src/workflows/paymentDependencies.ts
@@ -0,0 +1,66 @@
+import { AppStoreServerSdk } from "@voidhash/app-store-server-sdk";
+import { Config, Effect, Layer, Redacted } from "effect";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+
+import { FxRateService } from "../services/fxRates/FxRateService.ts";
+import { GooglePlayServerApi } from "../services/paymentProviders/googlePlay/sdk-context.ts";
+import { PerkGrantService } from "../services/perkGrants/PerkGrantService.ts";
+import { IdentityProjectionPublisher } from "../services/personIdentity/IdentityProjectionPublisher.ts";
+import { PersonIdentityService } from "../services/personIdentity/PersonIdentityService.ts";
+import { PurchaseProcessingService } from "../services/purchaseProcessing/PurchaseProcessingService.ts";
+import { PaymentConfigSecretCrypto } from "../utils/crypto/PaymentConfigSecretCrypto.ts";
+
+const fxRates = FxRateService.layer({
+  apiKey: Config.redacted("EXCHANGE_RATE_API_KEY").pipe(
+    Config.withDefault(Redacted.make("")),
+    Effect.map(Redacted.value),
+    Effect.orDie,
+  ),
+  baseUrl: Config.string("EXCHANGE_RATE_API_BASE_URL").pipe(
+    Config.withDefault("https://v6.exchangerate-api.com/v6"),
+    Effect.orDie,
+  ),
+});
+
+const purchaseProcessing = PurchaseProcessingService.layer.pipe(
+  Layer.provide(PerkGrantService.layer),
+);
+
+const personIdentity = PersonIdentityService.layer.pipe(
+  Layer.provide(IdentityProjectionPublisher.noop),
+);
+
+const paymentCrypto = PaymentConfigSecretCrypto.layer({
+  key: Config.redacted("ENCRYPTION_KEY").pipe(
+    Config.withDefault(Redacted.make("")),
+    Effect.map(Redacted.value),
+    Effect.orDie,
+  ),
+});
+
+/** Shared dependencies for App Store workflow activities. */
+export const appStore = Layer.mergeAll(
+  AppStoreServerSdk.layer.pipe(Layer.provide(FetchHttpClient.layer)),
+  fxRates,
+  purchaseProcessing,
+  personIdentity,
+  paymentCrypto,
+);
+
+/** Shared dependencies for Google Play workflow activities. */
+export const googlePlay = Layer.mergeAll(
+  GooglePlayServerApi.layer.pipe(Layer.provide(FetchHttpClient.layer)),
+  fxRates,
+  purchaseProcessing,
+  personIdentity,
+  paymentCrypto,
+);
+
+/** Shared dependencies for Stripe workflow activities. */
+export const stripe = Layer.mergeAll(
+  FetchHttpClient.layer,
+  fxRates,
+  purchaseProcessing,
+  personIdentity,
+  paymentCrypto,
+);
diff --git a/packages/core/src/workflows/registry.test.ts b/packages/core/src/workflows/registry.test.ts
new file mode 100644
index 000000000..aa98ad677
--- /dev/null
+++ b/packages/core/src/workflows/registry.test.ts
@@ -0,0 +1,113 @@
+import { Effect } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import * as TestWorkflowRunner from "@voidhash/platform/TestWorkflowRunner";
+import * as Workflow from "@voidhash/platform/Workflow";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
+import {
+  AppStoreReplayParkedNotifications,
+  AppStoreReplayParkedSdkNotifications,
+  GooglePlayReplayParkedNotifications,
+  StripeReplayParkedNotifications,
+} from "./definitions.ts";
+import { backendWorkflows } from "./registry.ts";
+
+const workflowNames = [
+  "DeliverWebhookWorkflow",
+  "FxRateSyncWorkflow",
+  "PurchaseLedgerDrainWorkflow",
+  "AppStoreExpireParkedNotificationsWorkflow",
+  "AppStoreReplayParkedNotificationsWorkflow",
+  "AppStoreReplayParkedSdkNotificationsWorkflow",
+  "AppStoreReconcileOriginalTransactionWorkflow",
+  "GooglePlayReplayParkedNotificationsWorkflow",
+  "StripeReplayParkedNotificationsWorkflow",
+] as const;
+
+describe("backend workflow registry", () => {
+  it("contains the canonical workflow set and cron metadata", () => {
+    expect(backendWorkflows.map((registration) => registration.workflow.name)).toEqual(
+      workflowNames,
+    );
+    expect(
+      backendWorkflows.flatMap((registration) =>
+        registration.cron
+          ? [[registration.workflow.name, registration.cron.schedule] as const]
+          : [],
+      ),
+    ).toEqual([
+      ["FxRateSyncWorkflow", "0 5 * * *"],
+      ["PurchaseLedgerDrainWorkflow", "* * * * *"],
+      ["AppStoreExpireParkedNotificationsWorkflow", "0 4 * * *"],
+    ]);
+  });
+
+  it("derives cron payloads from the scheduled time", async () => {
+    const runner = TestWorkflowRunner.make();
+    const scheduledTime = new Date("2026-08-05T05:00:00.000Z");
+
+    await Effect.runPromise(
+      Effect.forEach(
+        backendWorkflows,
+        (registration) => registration.cron?.dispatch(scheduledTime) ?? Effect.void,
+        { discard: true },
+      ).pipe(
+        Effect.provideService(WorkflowRunner, runner),
+        Effect.provideService(PlatformRuntime, PlatformRuntime.of({})),
+      ),
+    );
+
+    expect(runner.dispatches.map(({ payload, workflow }) => [workflow.name, payload])).toEqual([
+      ["FxRateSyncWorkflow", { runId: scheduledTime.toISOString() }],
+      ["PurchaseLedgerDrainWorkflow", { runId: scheduledTime.toISOString() }],
+      ["AppStoreExpireParkedNotificationsWorkflow", { triggeredAt: scheduledTime.toISOString() }],
+    ]);
+  });
+
+  it("includes requestedAt in every replay idempotency key", () => {
+    const productReplay = {
+      paymentProviderConfigurationId: "configuration",
+      paymentProviderProductId: "product",
+      providerProductKey: "provider-key",
+    };
+    const sdkReplay = {
+      originalTransactionId: "original-transaction",
+      paymentProviderConfigurationId: "configuration",
+    };
+
+    for (const workflow of [
+      AppStoreReplayParkedNotifications,
+      GooglePlayReplayParkedNotifications,
+      StripeReplayParkedNotifications,
+    ]) {
+      expect(workflow.idempotencyKey({ ...productReplay, requestedAt: "first" })).not.toBe(
+        workflow.idempotencyKey({ ...productReplay, requestedAt: "second" }),
+      );
+    }
+    expect(
+      AppStoreReplayParkedSdkNotifications.idempotencyKey({
+        ...sdkReplay,
+        requestedAt: "first",
+      }),
+    ).not.toBe(
+      AppStoreReplayParkedSdkNotifications.idempotencyKey({
+        ...sdkReplay,
+        requestedAt: "second",
+      }),
+    );
+  });
+
+  it("bounds long durable operation names deterministically", async () => {
+    const short = "app-store-replay:configuration:product";
+    const long = `app-store-replay:${"configuration".repeat(24)}:${"product".repeat(24)}`;
+
+    expect(await Effect.runPromise(Workflow.durableOperationName(short))).toBe(short);
+    const first = await Effect.runPromise(Workflow.durableOperationName(long));
+    const second = await Effect.runPromise(Workflow.durableOperationName(long));
+
+    expect(first).toBe(second);
+    expect(new TextEncoder().encode(first).byteLength).toBeLessThanOrEqual(96);
+    expect(first).not.toBe(long);
+  });
+});
diff --git a/packages/core/src/workflows/registry.ts b/packages/core/src/workflows/registry.ts
new file mode 100644
index 000000000..abd01cce4
--- /dev/null
+++ b/packages/core/src/workflows/registry.ts
@@ -0,0 +1,29 @@
+import type { WorkflowRegistration } from "@voidhash/platform/WorkflowRegistration";
+
+import type { AnalyticsDispatchService } from "../services/analyticsIngest/AnalyticsDispatchService.ts";
+import type { Db } from "@voidhash/db";
+import { AppStoreExpireParkedNotificationsRegistration } from "./AppStoreExpireParkedNotifications.ts";
+import { AppStoreReconcileOriginalTransactionRegistration } from "./AppStoreReconcileOriginalTransaction.ts";
+import { AppStoreReplayParkedNotificationsRegistration } from "./AppStoreReplayParkedNotifications.ts";
+import { AppStoreReplayParkedSdkNotificationsRegistration } from "./AppStoreReplayParkedSdkNotifications.ts";
+import { DeliverWebhookRegistration } from "./DeliverWebhook.ts";
+import { FxRateSyncRegistration } from "./FxRateSync.ts";
+import { GooglePlayReplayParkedNotificationsRegistration } from "./GooglePlayReplayParkedNotifications.ts";
+import { PurchaseLedgerDrainRegistration } from "./PurchaseLedgerDrain.ts";
+import { StripeReplayParkedNotificationsRegistration } from "./StripeReplayParkedNotifications.ts";
+
+/** Infrastructure every backend workflow registration may consume. */
+export type BackendWorkflowInfra = Db | AnalyticsDispatchService;
+
+/** Complete backend workflow registry shared by every platform adapter. */
+export const backendWorkflows: ReadonlyArray<WorkflowRegistration<BackendWorkflowInfra>> = [
+  DeliverWebhookRegistration,
+  FxRateSyncRegistration,
+  PurchaseLedgerDrainRegistration,
+  AppStoreExpireParkedNotificationsRegistration,
+  AppStoreReplayParkedNotificationsRegistration,
+  AppStoreReplayParkedSdkNotificationsRegistration,
+  AppStoreReconcileOriginalTransactionRegistration,
+  GooglePlayReplayParkedNotificationsRegistration,
+  StripeReplayParkedNotificationsRegistration,
+];
diff --git a/packages/core/sst-env.d.ts b/packages/core/sst-env.d.ts
index eec65b9bd..cf5e5fbe5 100644
--- a/packages/core/sst-env.d.ts
+++ b/packages/core/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/packages/core/test/_testing/CoreAuthSession.ts b/packages/core/test/_testing/CoreAuthSession.ts
new file mode 100644
index 000000000..43cfdfba4
--- /dev/null
+++ b/packages/core/test/_testing/CoreAuthSession.ts
@@ -0,0 +1,70 @@
+import {
+  type AnyAuthSession,
+  AuthSession,
+  type UserSession,
+} from "@voidhash/core/domain/auth/Auth";
+import { Effect } from "effect";
+
+import { CoreTestFixture } from "./CoreTestFixture";
+
+/**
+ * Default authenticated session for tests: a `user`-method session for the
+ * seeded {@link CoreTestFixture} principal, holding `organization:all` /
+ * `project:all` so `checkProjectPermission(fixture.projectId, "project:all")`
+ * passes. Override fields (e.g. narrower permissions) by passing a custom
+ * session to {@link CoreAuthSession.authenticate}.
+ */
+const defaultUserSession = (): UserSession => ({
+  cookie: null,
+  method: "user",
+  name: `${CoreTestFixture.userName} <${CoreTestFixture.userEmail}>`,
+  organizations: [
+    {
+      id: CoreTestFixture.organizationId,
+      logo: null,
+      name: CoreTestFixture.organizationName,
+      permissions: ["organization:all"],
+      slug: CoreTestFixture.organizationSlug,
+      workosOrganizationId: CoreTestFixture.workosOrganizationId,
+    },
+  ],
+  person: null,
+  projects: [
+    {
+      id: CoreTestFixture.projectId,
+      logo: null,
+      name: CoreTestFixture.projectName,
+      organizationId: CoreTestFixture.organizationId,
+      permissions: ["project:all"],
+      slug: CoreTestFixture.projectSlug,
+    },
+  ],
+  user: {
+    createdAt: new Date(0),
+    email: CoreTestFixture.userEmail,
+    emailVerified: true,
+    id: CoreTestFixture.userId,
+    image: null,
+    name: CoreTestFixture.userName,
+    role: null,
+    updatedAt: new Date(0),
+    workosUserId: CoreTestFixture.workosUserId,
+  },
+});
+
+export const CoreAuthSession = {
+  /**
+   * Pipeable that provides {@link AuthSession} to a test effect. Call with no
+   * arguments for the default full-permission fixture user, or pass a custom
+   * session to exercise other auth methods / permission sets:
+   *
+   * ```ts
+   * effect.pipe(CoreAuthSession.authenticate())
+   * effect.pipe(CoreAuthSession.authenticate(mySecretKeySession))
+   * ```
+   */
+  authenticate:
+    (session: AnyAuthSession = defaultUserSession()) =>
+    <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(Effect.provideService(AuthSession, session)),
+};
diff --git a/packages/core/test/_testing/CoreIntegrationTestHarness.ts b/packages/core/test/_testing/CoreIntegrationTestHarness.ts
new file mode 100644
index 000000000..5b6c3584e
--- /dev/null
+++ b/packages/core/test/_testing/CoreIntegrationTestHarness.ts
@@ -0,0 +1,206 @@
+import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
+import { AuthSession } from "@voidhash/core/domain/auth/Auth";
+import { generateId } from "@voidhash/core/utils";
+import {
+  AuditLogPort,
+  AuditLogPortError,
+  ProjectSchemaCache,
+  PublicFileStore,
+  SchemaCacheInvalidationService,
+} from "@voidhash/core/services";
+import { AuditLogActorType, Db, auditLogs } from "@voidhash/db";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import * as TestWorkflowRunner from "@voidhash/platform/TestWorkflowRunner";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
+import { Effect, Layer, Option } from "effect";
+import { inject, test as vitestTest } from "vitest";
+import type { CoreTestConnections } from "./CoreTestConnections.ts";
+
+import type {} from "./provided-context.d.ts";
+
+/**
+ * The common services every core integration test gets for free. The harness
+ * provides infra (`Db`, `ClickhouseWebClient`) plus the cross-cutting support
+ * services (`ProjectSchemaCache` stub, database-backed `AuditLogPort`,
+ * `SchemaCacheInvalidationService`) that most feature-service layers depend on.
+ * A test still provides its own service-under-test layer (e.g.
+ * `Effect.provide(PerkService.layer)`); its remaining requirements must fall
+ * within this set, which the wrapped {@link CoreIntegrationTestHarness} `test`
+ * enforces via `R extends HarnessServices`.
+ */
+type HarnessServices =
+  | Db
+  | ClickhouseWebClient.ClickhouseWebClient
+  | ProjectSchemaCache
+  | AuditLogPort
+  | PublicFileStore
+  | SchemaCacheInvalidationService
+  | PlatformRuntime
+  | WorkflowRunner;
+
+/** Default per-test timeout; the heavy deploy already happened in globalSetup. */
+const DEFAULT_TEST_TIMEOUT = 120_000;
+
+/**
+ * In-memory {@link ProjectSchemaCache} — a fresh per-test map so cached
+ * schemas never leak between tests. Mirrors the Durable Object port the
+ * Cloudflare backend provides at runtime.
+ */
+const makeProjectSchemaCacheStub = () => {
+  const store = new Map<string, unknown>();
+  return {
+    getByName: (projectId: string) => ({
+      get: () => Effect.sync(() => store.get(projectId) ?? null),
+      set: (schema: unknown) =>
+        Effect.sync(() => {
+          store.set(projectId, schema);
+        }),
+      invalidate: () =>
+        Effect.sync(() => {
+          store.delete(projectId);
+        }),
+    }),
+  };
+};
+
+const ProjectSchemaCacheStubLive = Layer.effect(
+  ProjectSchemaCache,
+  Effect.sync(makeProjectSchemaCacheStub),
+);
+
+/** Stable public base for the in-memory {@link PublicFileStore} stub. */
+const PUBLIC_FILE_STORE_BASE_URL = "https://files.test.invalid";
+
+/**
+ * In-memory {@link PublicFileStore} — a fresh per-test map so stored avatars
+ * never leak between tests. Mirrors the R2 adapter the Cloudflare backend
+ * provides at runtime; URLs resolve under a stable, obviously-non-routable base.
+ */
+const makePublicFileStoreStub = () => {
+  const store = new Map<string, { body: Uint8Array; contentType: string | null }>();
+  return {
+    publicBaseUrl: PUBLIC_FILE_STORE_BASE_URL,
+    publicUrl: (key: string) => `${PUBLIC_FILE_STORE_BASE_URL}/files/${key}`,
+    putObject: (input: { key: string; body: Uint8Array; contentType: string | undefined }) =>
+      Effect.sync(() => {
+        store.set(input.key, { body: input.body, contentType: input.contentType ?? null });
+      }),
+    getObject: (key: string) => Effect.sync(() => store.get(key) ?? null),
+    deleteObject: (key: string) =>
+      Effect.sync(() => {
+        store.delete(key);
+      }),
+  };
+};
+
+const PublicFileStoreStubLive = Layer.effect(PublicFileStore, Effect.sync(makePublicFileStoreStub));
+
+/** Test-only audit writer that preserves mutation side-effect assertions without an EE dependency. */
+const AuditLogPortTestLive: Layer.Layer<AuditLogPort, never, Db> = Layer.effect(
+  AuditLogPort,
+  Effect.gen(function* () {
+    const db = yield* Db;
+    return AuditLogPort.of({
+      append: (input) =>
+        Effect.gen(function* () {
+          const maybeSession = yield* Effect.serviceOption(AuthSession);
+          const session = Option.isSome(maybeSession) ? maybeSession.value : null;
+          yield* db.insert(auditLogs).values({
+            action: input.action,
+            actorType: input.actorType ?? AuditLogActorType.User,
+            actorUserId: session?.user?.id ?? null,
+            changes: input.changes ?? null,
+            entityId: input.entityId,
+            entityType: input.entityType,
+            id: generateId("auditLog"),
+            metadata: input.metadata ?? null,
+            parentEntityId: input.parentEntityId ?? null,
+            projectId: input.projectId,
+          });
+        }).pipe(Effect.mapError((error) => new AuditLogPortError({ cause: String(error.cause) }))),
+    });
+  }),
+);
+
+/**
+ * Build the live infra + support layer from the shared
+ * {@link CoreTestConnections}. Every credential is real (Db/Clickhouse over
+ * the network); only the schema cache is a stub.
+ */
+const makeHarnessLayer = (tc: CoreTestConnections): Layer.Layer<HarnessServices> => {
+  const DbLive: Layer.Layer<Db> = Db.layer(tc.db);
+  const ClickhouseLive = ClickhouseWebClient.layer(tc.clickhouse).pipe(Layer.orDie);
+  const InfraLayer = Layer.mergeAll(
+    DbLive,
+    ClickhouseLive,
+    ProjectSchemaCacheStubLive,
+    PublicFileStoreStubLive,
+  );
+
+  const AuditLogSupportLayer = AuditLogPortTestLive.pipe(Layer.provide(InfraLayer));
+
+  const SupportLayer = Layer.mergeAll(
+    AuditLogSupportLayer,
+    SchemaCacheInvalidationService.layer,
+  ).pipe(Layer.provide(InfraLayer));
+
+  const WorkflowTestLayer = Layer.mergeAll(
+    Layer.succeed(WorkflowRunner, TestWorkflowRunner.make()),
+    Layer.succeed(PlatformRuntime, PlatformRuntime.of({})),
+  );
+
+  return Layer.mergeAll(InfraLayer, SupportLayer, WorkflowTestLayer);
+};
+
+const timeoutOf = (options: number | { timeout?: number } | undefined): number =>
+  (typeof options === "number" ? options : options?.timeout) ?? DEFAULT_TEST_TIMEOUT;
+
+export const CoreIntegrationTestHarness = {
+  /**
+   * Returns a lean `test` that injects the common core services into every test
+   * (and `stack`, the once-per-run deploy output shared via `globalSetup`).
+   * Tests just `yield*` a service and assert; provide the service-under-test's
+   * own layer and authenticate via `CoreAuthSession.authenticate()`:
+   *
+   * ```ts
+   * const { test } = CoreIntegrationTestHarness.make();
+   * test("…", Effect.gen(function* () { … })
+   *   .pipe(Effect.provide(PerkService.layer), CoreAuthSession.authenticate()));
+   * ```
+   *
+   * The environment is provisioned once per run by the active composition's
+   * `globalSetup` (locally: `test/_testing/globalSetup.ts` over the self-host
+   * stack) and shared through vitest's `provide`/`inject` channel.
+   */
+  make: () => {
+    // Resolved lazily inside each test/effect: vitest's injected context is set
+    // by globalSetup before any file runs, but `inject` must be read at runtime.
+    const stack = Effect.suspend(() => Effect.succeed(inject("coreStackOutput")));
+
+    const test = <E, R extends HarnessServices>(
+      name: string,
+      eff: Effect.Effect<void, E, R>,
+      options?: number | { timeout?: number },
+    ): void =>
+      vitestTest(
+        name,
+        async () => {
+          const testConnections = inject("coreStackOutput")?.testConnections ?? null;
+          if (testConnections === null) {
+            throw new Error(
+              "CoreIntegrationTestHarness: coreStackOutput missing or testConnections is null — globalSetup failed, or the composition refused to expose credentials.",
+            );
+          }
+          // `R extends HarnessServices` guarantees the layer satisfies every
+          // requirement, but TS won't reduce `Exclude<R, HarnessServices>` to
+          // `never` for a generic `R`, so assert the discharged type.
+          await Effect.runPromise(
+            eff.pipe(Effect.provide(makeHarnessLayer(testConnections))) as Effect.Effect<void, E>,
+          );
+        },
+        timeoutOf(options),
+      );
+
+    return { stack, test };
+  },
+};
diff --git a/packages/core/test/_testing/CoreTestConnections.ts b/packages/core/test/_testing/CoreTestConnections.ts
new file mode 100644
index 000000000..f1669ef24
--- /dev/null
+++ b/packages/core/test/_testing/CoreTestConnections.ts
@@ -0,0 +1,56 @@
+/**
+ * The complete environment contract for the core integration suite.
+ *
+ * This is the seam between the open-core tests and whatever composition runs
+ * them: the Community repo's `globalSetup` derives these values from the local
+ * self-host stack's environment, while downstream compositions (the managed
+ * cloud) provision their own infrastructure and inject the same shape. Tests
+ * never know which composition produced it.
+ */
+export interface CoreTestConnections {
+  readonly db: {
+    readonly host: string;
+    readonly port: number;
+    readonly username: string;
+    readonly password: string;
+    readonly databaseName: string;
+  };
+  readonly clickhouse: {
+    readonly url: string;
+    readonly username: string;
+    readonly password: string;
+    readonly database: string;
+  };
+}
+
+/**
+ * The once-per-run output a composition's `globalSetup` shares with every test
+ * file. Compositions may inject a structural superset (the managed cloud adds
+ * deploy artifacts such as URLs); the suite only relies on this shape.
+ */
+export interface CoreStackOutput {
+  readonly testConnections: CoreTestConnections | null;
+}
+
+/**
+ * Builds the contract from environment variables, matching the names the
+ * self-host stack (repo-root `.env`) and `scripts/run-local-integration.mjs`
+ * already use. Defaults target the local docker-compose dev stack.
+ */
+export const coreTestConnectionsFromEnv = (
+  env: Record<string, string | undefined> = process.env,
+): CoreTestConnections => ({
+  db: {
+    host: env.DATABASE_HOST ?? "127.0.0.1",
+    port: Number(env.DATABASE_PORT ?? "5432"),
+    username: env.DATABASE_USERNAME ?? "voidhash",
+    password: env.DATABASE_PASSWORD ?? "password",
+    databaseName: env.DATABASE_NAME ?? "voidhash",
+  },
+  clickhouse: {
+    url: env.CLICKHOUSE_URL ?? "http://127.0.0.1:8123",
+    username: env.CLICKHOUSE_USERNAME ?? "voidhash_app",
+    password: env.CLICKHOUSE_PASSWORD ?? "password",
+    database: env.CLICKHOUSE_DATABASE ?? "voidhash",
+  },
+});
diff --git a/packages/core/test/_testing/CoreTestFixture.ts b/packages/core/test/_testing/CoreTestFixture.ts
new file mode 100644
index 000000000..d8271c525
--- /dev/null
+++ b/packages/core/test/_testing/CoreTestFixture.ts
@@ -0,0 +1,28 @@
+/**
+ * The single, deterministic test container shared by every core integration
+ * test (and reused across runs). Seeding upserts these rows once-if-absent so
+ * all junk entities a test creates live under one org/project/user, and
+ * {@link CoreAuthSession} builds its session from the same constants so
+ * permission checks resolve against the seeded project.
+ *
+ * IDs are stable, human-readable, and prefixed `it_` so they are easy to spot
+ * (and bulk-delete) in a shared database.
+ */
+export const CoreTestFixture = {
+  userId: "it_user",
+  userEmail: "integration@voidhash.test",
+  userName: "Integration Test User",
+  workosUserId: "it_workos_user",
+
+  organizationId: "it_org",
+  organizationName: "Integration Test Org",
+  organizationSlug: "it-org",
+  workosOrganizationId: "it_workos_org",
+
+  memberId: "it_member",
+  workosMembershipId: "it_workos_membership",
+
+  projectId: "it_project",
+  projectName: "Integration Test Project",
+  projectSlug: "it-project",
+} as const;
diff --git a/packages/core/test/_testing/CoreTestSeed.ts b/packages/core/test/_testing/CoreTestSeed.ts
new file mode 100644
index 000000000..6377b06b3
--- /dev/null
+++ b/packages/core/test/_testing/CoreTestSeed.ts
@@ -0,0 +1,142 @@
+import {
+  Db,
+  auditLogs,
+  eq,
+  inArray,
+  member,
+  organization,
+  paymentProviderConfigurationProducts,
+  paymentProviderConfigurations,
+  paywallLocations,
+  perks,
+  productPerks,
+  products,
+  projects,
+  user,
+} from "@voidhash/db";
+import { Effect } from "effect";
+
+import { CoreTestFixture } from "./CoreTestFixture";
+
+/**
+ * Upsert the shared fixture container (user → organization → membership →
+ * project) once-if-absent. Idempotent via `ON DUPLICATE KEY UPDATE`, so the
+ * rows are reused across runs and concurrent local runs never collide. Run once
+ * from `globalSetup`; requires {@link Db}.
+ */
+export const seedFixture = Effect.gen(function* () {
+  const db = yield* Db;
+
+  yield* db
+    .insert(user)
+    .values({
+      createdAt: new Date(),
+      email: CoreTestFixture.userEmail,
+      emailVerified: true,
+      id: CoreTestFixture.userId,
+      name: CoreTestFixture.userName,
+      updatedAt: new Date(),
+      workosUserId: CoreTestFixture.workosUserId,
+    })
+    // Heal the full canonical row on reuse: a prior run's test could have
+    // updated this shared user (e.g. matched it by the unique email and
+    // overwritten name/workosUserId), and integration tests assert against
+    // these exact values. Resetting them keeps every run deterministic.
+    .onConflictDoUpdate({
+      target: user.id,
+      set: {
+        email: CoreTestFixture.userEmail,
+        emailVerified: true,
+        name: CoreTestFixture.userName,
+        workosUserId: CoreTestFixture.workosUserId,
+      },
+    });
+
+  yield* db
+    .insert(organization)
+    .values({
+      createdAt: new Date(),
+      id: CoreTestFixture.organizationId,
+      name: CoreTestFixture.organizationName,
+      slug: CoreTestFixture.organizationSlug,
+      workosOrganizationId: CoreTestFixture.workosOrganizationId,
+    })
+    .onConflictDoUpdate({
+      target: organization.id,
+      set: { name: CoreTestFixture.organizationName },
+    });
+
+  yield* db
+    .insert(member)
+    .values({
+      createdAt: new Date(),
+      id: CoreTestFixture.memberId,
+      organizationId: CoreTestFixture.organizationId,
+      role: "owner",
+      userId: CoreTestFixture.userId,
+      workosMembershipId: CoreTestFixture.workosMembershipId,
+    })
+    .onConflictDoUpdate({ target: member.id, set: { role: "owner" } });
+
+  yield* db
+    .insert(projects)
+    .values({
+      id: CoreTestFixture.projectId,
+      name: CoreTestFixture.projectName,
+      organizationId: CoreTestFixture.organizationId,
+      slug: CoreTestFixture.projectSlug,
+    })
+    .onConflictDoUpdate({ target: projects.id, set: { name: CoreTestFixture.projectName } });
+});
+
+/**
+ * Best-effort sweep of the entities tests create under the fixture project,
+ * deepest foreign-key dependents first. The container (user/org/member/project)
+ * is intentionally retained so it is reused next run. Each delete is wrapped in
+ * `Effect.ignore` so a missing table / FK quirk never aborts the whole sweep.
+ * Run once from `globalSetup` teardown; requires {@link Db}.
+ */
+export const cleanupFixture = Effect.gen(function* () {
+  const db = yield* Db;
+  const projectId = CoreTestFixture.projectId;
+
+  const ids = (rows: ReadonlyArray<{ readonly id: string }>) => rows.map((row) => row.id);
+  const productIds = yield* db
+    .select({ id: products.id })
+    .from(products)
+    .where(eq(products.projectId, projectId))
+    .pipe(
+      Effect.map(ids),
+      Effect.catch(() => Effect.succeed([] as string[])),
+    );
+  const perkIds = yield* db
+    .select({ id: perks.id })
+    .from(perks)
+    .where(eq(perks.projectId, projectId))
+    .pipe(
+      Effect.map(ids),
+      Effect.catch(() => Effect.succeed([] as string[])),
+    );
+
+  if (productIds.length > 0) {
+    yield* db
+      .delete(paymentProviderConfigurationProducts)
+      .where(inArray(paymentProviderConfigurationProducts.productId, productIds))
+      .pipe(Effect.ignore);
+  }
+  if (perkIds.length > 0) {
+    yield* db.delete(productPerks).where(inArray(productPerks.perkId, perkIds)).pipe(Effect.ignore);
+  }
+
+  yield* db.delete(auditLogs).where(eq(auditLogs.projectId, projectId)).pipe(Effect.ignore);
+  yield* db
+    .delete(paywallLocations)
+    .where(eq(paywallLocations.projectId, projectId))
+    .pipe(Effect.ignore);
+  yield* db
+    .delete(paymentProviderConfigurations)
+    .where(eq(paymentProviderConfigurations.projectId, projectId))
+    .pipe(Effect.ignore);
+  yield* db.delete(products).where(eq(products.projectId, projectId)).pipe(Effect.ignore);
+  yield* db.delete(perks).where(eq(perks.projectId, projectId)).pipe(Effect.ignore);
+});
diff --git a/packages/core/test/_testing/PurchaseIntegrationTestHarness.ts b/packages/core/test/_testing/PurchaseIntegrationTestHarness.ts
new file mode 100644
index 000000000..e0f43b454
--- /dev/null
+++ b/packages/core/test/_testing/PurchaseIntegrationTestHarness.ts
@@ -0,0 +1,22 @@
+import { Db } from "@voidhash/db";
+import { Effect } from "effect";
+import { test as vitestTest } from "vitest";
+
+const databaseConfig = {
+  databaseName: process.env.DATABASE_NAME ?? "voidhash",
+  host: process.env.DATABASE_HOST ?? "127.0.0.1",
+  password: process.env.DATABASE_PASSWORD ?? "password",
+  port: Number(process.env.DATABASE_PORT ?? "5432"),
+  username: process.env.DATABASE_USERNAME ?? "voidhash",
+};
+
+/** Lean Postgres-only harness for purchase-provider integration tests. */
+export const PurchaseIntegrationTestHarness = {
+  make: () => ({
+    test: <E>(name: string, effect: Effect.Effect<void, E, Db>): void => {
+      vitestTest(name, () =>
+        Effect.runPromise(effect.pipe(Effect.provide(Db.layer(databaseConfig)))),
+      );
+    },
+  }),
+};
diff --git a/packages/core/test/_testing/ReactNativePurchaseHarness.ts b/packages/core/test/_testing/ReactNativePurchaseHarness.ts
new file mode 100644
index 000000000..0374aebb1
--- /dev/null
+++ b/packages/core/test/_testing/ReactNativePurchaseHarness.ts
@@ -0,0 +1,108 @@
+import type { VoidhashCoreClient } from "@voidhash/generated-clients";
+import { Effect } from "effect";
+
+import { CacheManager } from "../../../../libraries/react-native/src/core/caching/cache-manager.ts";
+import type { Transaction } from "../../../../libraries/react-native/src/core/entities/transaction.ts";
+import { bindReactNativeSdkClient } from "../../../../libraries/react-native/src/core/networking/api-client.ts";
+import type { PlatformInfo } from "../../../../libraries/react-native/src/core/platform/platform-provider.ts";
+import type {
+  RuntimeProductDefinition,
+  RuntimeSchema,
+} from "../../../../libraries/react-native/src/core/schema/runtime.ts";
+import { TransactionService } from "../../../../libraries/react-native/src/core/transactions/transaction-service.ts";
+import {
+  createEffectTestHarness,
+  createInMemoryCacheAdapter,
+} from "../../../../libraries/react-native/tests/helpers/effect-test-harness.ts";
+
+export { Transaction } from "../../../../libraries/react-native/src/core/entities/transaction.ts";
+export type { RuntimeSchema } from "../../../../libraries/react-native/src/core/schema/runtime.ts";
+
+interface ReactNativePurchaseHarnessOptions {
+  readonly client: VoidhashCoreClient;
+  readonly distinctId: string;
+  readonly onAcknowledge?: (
+    transaction: Transaction,
+    productType: RuntimeProductDefinition["type"] | undefined,
+  ) => Effect.Effect<void, unknown>;
+  readonly pendingTransactions?: ReadonlyArray<Transaction>;
+  readonly platform: Partial<PlatformInfo>;
+  readonly purchaseHistory?: ReadonlyArray<Transaction>;
+  readonly syncTransactionShouldFailTimes?: number;
+}
+
+/** Runs the real React Native transaction service against a generated HTTP client. */
+export const makeReactNativePurchaseHarness = (options: ReactNativePurchaseHarnessOptions) => {
+  const acknowledgedTransactions: Transaction[] = [];
+  const state = { personRefreshAttempts: 0, syncTransactionAttempts: 0 };
+  let remainingSyncFailures = options.syncTransactionShouldFailTimes ?? 0;
+  const cache = createInMemoryCacheAdapter();
+  const paymentAdapter = {
+    acknowledgePurchase: (
+      transaction: Transaction,
+      productType: RuntimeProductDefinition["type"] | undefined,
+    ) =>
+      Effect.gen(function* () {
+        acknowledgedTransactions.push(transaction);
+        if (options.onAcknowledge) {
+          yield* options.onAcknowledge(transaction, productType);
+        }
+      }),
+    buyProduct: () => Effect.die("Direct native purchase must not run in restore harness"),
+    endConnection: () => Effect.void,
+    getPendingTransactions: () => Effect.succeed(options.pendingTransactions ?? []),
+    getProducts: () => Effect.succeed([]),
+    getPurchaseHistory: () => Effect.succeed(options.purchaseHistory ?? []),
+    initConnection: () => Effect.void,
+  };
+  const boundClient = bindReactNativeSdkClient(options.client);
+  const apiClient = {
+    ...boundClient,
+    sdk: {
+      ...boundClient.sdk,
+      getPerson: (request: Parameters<typeof boundClient.sdk.getPerson>[0]) => {
+        state.personRefreshAttempts += 1;
+        return boundClient.sdk.getPerson(request);
+      },
+      syncTransaction: (request: Parameters<typeof boundClient.sdk.syncTransaction>[0]) => {
+        state.syncTransactionAttempts += 1;
+        if (remainingSyncFailures > 0) {
+          remainingSyncFailures -= 1;
+          return Effect.fail(new Error("Simulated SDK transport failure"));
+        }
+        return boundClient.sdk.syncTransaction(request);
+      },
+    },
+  };
+  const harness = createEffectTestHarness({
+    apiClient,
+    cacheAdapter: cache.adapter,
+    paymentAdapter,
+    platform: options.platform,
+    publishableKey: "pk_purchase_integration",
+  });
+
+  const initialize = harness.runtime.runPromise(
+    Effect.gen(function* () {
+      const cacheManager = yield* CacheManager;
+      yield* cacheManager.set("distinctId", options.distinctId);
+    }),
+  );
+
+  return {
+    acknowledgedTransactions,
+    dispose: () => harness.runtime.dispose(),
+    initialize,
+    process: (transaction: Transaction, schema: RuntimeSchema) =>
+      harness.runtime.runPromise(
+        Effect.flatMap(TransactionService, (service) =>
+          service.processObservedTransaction(transaction, schema),
+        ),
+      ),
+    restore: (schema: RuntimeSchema) =>
+      harness.runtime.runPromise(
+        Effect.flatMap(TransactionService, (service) => service.restorePurchases(schema)),
+      ),
+    state,
+  };
+};
diff --git a/packages/core/test/_testing/globalSetup.ts b/packages/core/test/_testing/globalSetup.ts
new file mode 100644
index 000000000..9ddca05ac
--- /dev/null
+++ b/packages/core/test/_testing/globalSetup.ts
@@ -0,0 +1,45 @@
+import { Db } from "@voidhash/db";
+import * as Effect from "effect/Effect";
+
+import {
+  coreTestConnectionsFromEnv,
+  type CoreStackOutput,
+} from "./CoreTestConnections.ts";
+import { cleanupFixture, seedFixture } from "./CoreTestSeed.ts";
+
+/**
+ * Community composition of the core integration environment: the local
+ * self-host stack. Connections are derived from the environment (see
+ * the repo-root `.env.example` and `scripts/run-local-integration.mjs`), the shared
+ * fixture is seeded, and the contract is shared with every test file via
+ * vitest's `provide`/`inject`.
+ *
+ * Downstream compositions run the exact same suite by supplying their own
+ * globalSetup: provision infrastructure however they like, then `provide` the
+ * same `coreStackOutput` shape. Provisioning is the composition's
+ * responsibility; the suite only consumes the contract.
+ */
+export default async function setup({
+  provide,
+}: {
+  readonly provide: (key: "coreStackOutput", value: CoreStackOutput) => void;
+}) {
+  const testConnections = coreTestConnectionsFromEnv();
+  const database = Db.layer(testConnections.db);
+
+  try {
+    await Effect.runPromise(seedFixture.pipe(Effect.provide(database)));
+  } catch (cause) {
+    throw new Error(
+      "Core integration setup could not seed the fixture. Is the self-host stack running? " +
+        "Start it with `pnpm stack:up` (see selfhost/README.md) or point DATABASE_* at a migrated database.",
+      { cause },
+    );
+  }
+
+  provide("coreStackOutput", { testConnections });
+
+  return async () => {
+    await Effect.runPromise(cleanupFixture.pipe(Effect.provide(database)));
+  };
+}
diff --git a/packages/core/test/_testing/provided-context.d.ts b/packages/core/test/_testing/provided-context.d.ts
new file mode 100644
index 000000000..2e694b583
--- /dev/null
+++ b/packages/core/test/_testing/provided-context.d.ts
@@ -0,0 +1,11 @@
+import type { CoreStackOutput } from "./CoreTestConnections.ts";
+
+// Typed channel for the once-per-run environment output that a composition's
+// `globalSetup` shares with every integration test file via vitest's
+// `provide` / `inject`. Kept deliberately narrow: downstream compositions may
+// provide richer objects, but the open-core suite depends only on this shape.
+declare module "vitest" {
+  interface ProvidedContext {
+    coreStackOutput: CoreStackOutput;
+  }
+}
diff --git a/packages/core/test/_testing/purchaseGlobalSetup.ts b/packages/core/test/_testing/purchaseGlobalSetup.ts
new file mode 100644
index 000000000..fe7c297ec
--- /dev/null
+++ b/packages/core/test/_testing/purchaseGlobalSetup.ts
@@ -0,0 +1,19 @@
+import { Db } from "@voidhash/db";
+import { Effect } from "effect";
+
+import { cleanupFixture, seedFixture } from "./CoreTestSeed.ts";
+
+const databaseConfig = {
+  databaseName: process.env.DATABASE_NAME ?? "voidhash",
+  host: process.env.DATABASE_HOST ?? "127.0.0.1",
+  password: process.env.DATABASE_PASSWORD ?? "password",
+  port: Number(process.env.DATABASE_PORT ?? "5432"),
+  username: process.env.DATABASE_USERNAME ?? "voidhash",
+};
+
+export default async function setup() {
+  const database = Db.layer(databaseConfig);
+  await Effect.runPromise(seedFixture.pipe(Effect.provide(database)));
+
+  return () => Effect.runPromise(cleanupFixture.pipe(Effect.provide(database)));
+}
diff --git a/packages/core/test/integration-harness.integration.test.ts b/packages/core/test/integration-harness.integration.test.ts
index 724ff71cb..6e7e22d03 100644
--- a/packages/core/test/integration-harness.integration.test.ts
+++ b/packages/core/test/integration-harness.integration.test.ts
@@ -5,17 +5,13 @@ import { CoreIntegrationTestHarness } from "@testing/CoreIntegrationTestHarness"
 const { stack, test } = CoreIntegrationTestHarness.make();
 
 test(
-  "deploys the backend stack",
+  "shares the environment contract with the suite",
   Effect.gen(function* () {
     const output = yield* stack;
-    expect(output.backendUrl).toBeDefined();
-    expect(output.hyperdriveId).toBeDefined();
-    expect(output.mimicDbUrl).toBeDefined();
-    expect(output.wwwUrl).toBeDefined();
-    // Ephemeral stages expose credentials for the in-process harness layers.
+    // The composition (self-host locally, richer stacks downstream) must
+    // expose credentials for the in-process harness layers.
     expect(output.testConnections).not.toBeNull();
     expect(output.testConnections?.db.host).toBeDefined();
     expect(output.testConnections?.clickhouse.url).toBeDefined();
-    expect(output.testConnections?.workos.clientId).toBeDefined();
   }),
 );
diff --git a/packages/core/test/runtime-context-types.ts b/packages/core/test/runtime-context-types.ts
index dbc59b52d..b8f10e120 100644
--- a/packages/core/test/runtime-context-types.ts
+++ b/packages/core/test/runtime-context-types.ts
@@ -1,5 +1,5 @@
 import type { Effect } from "effect";
-import type { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import type { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 import type {
   PolicyCounterStoreShape,
diff --git a/packages/core/test/services/analyticsIngest/AnalyticsIngestDlqService.integration.test.ts b/packages/core/test/services/analyticsIngest/AnalyticsIngestDlqService.integration.test.ts
index 35482d226..6e0508b27 100644
--- a/packages/core/test/services/analyticsIngest/AnalyticsIngestDlqService.integration.test.ts
+++ b/packages/core/test/services/analyticsIngest/AnalyticsIngestDlqService.integration.test.ts
@@ -41,7 +41,7 @@ import {
   CaptureIngress,
   type PublishableCaptureEvent,
 } from "@voidhash/core/services/analyticsIngest/CaptureIngress";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 import { CoreAuthSession } from "@testing/CoreAuthSession";
 import { CoreIntegrationTestHarness } from "@testing/CoreIntegrationTestHarness";
diff --git a/packages/core/test/services/analyticsIngest/EventCaptureService.integration.test.ts b/packages/core/test/services/analyticsIngest/EventCaptureService.integration.test.ts
index a8d6e35e8..23ce7f311 100644
--- a/packages/core/test/services/analyticsIngest/EventCaptureService.integration.test.ts
+++ b/packages/core/test/services/analyticsIngest/EventCaptureService.integration.test.ts
@@ -50,7 +50,7 @@ import {
 import { apiKeys, captureProjectPolicies, Db, eq, inArray } from "@voidhash/db";
 import { Effect, Layer } from "effect";
 import { describe, expect } from "vitest";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 import { CoreIntegrationTestHarness } from "@testing/CoreIntegrationTestHarness";
 import { CoreTestFixture } from "@testing/CoreTestFixture";
diff --git a/packages/core/test/services/analyticsIngest/EventProcessorService.integration.test.ts b/packages/core/test/services/analyticsIngest/EventProcessorService.integration.test.ts
index 2b360eb42..07314c672 100644
--- a/packages/core/test/services/analyticsIngest/EventProcessorService.integration.test.ts
+++ b/packages/core/test/services/analyticsIngest/EventProcessorService.integration.test.ts
@@ -51,7 +51,6 @@ import { AnalyticsIngestDlqService } from "@voidhash/core/services/analyticsInge
 import { CaptureIngress } from "@voidhash/core/services/analyticsIngest/CaptureIngress";
 import { PersonIdentityService } from "@voidhash/core/services/personIdentity/PersonIdentityService";
 import { IdentityProjectionPublisher } from "@voidhash/core/services/personIdentity/IdentityProjectionPublisher";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { REVENUE_TRUSTED_SOURCE_TOPIC } from "@voidhash/core/domain/internalAnalytics/InternalAnalyticsEvents";
 import {
   Db,
@@ -80,23 +79,15 @@ const organizationId = CoreTestFixture.organizationId;
  * harness does not provide. After this layer, the only outstanding requirement
  * is `Db` (plus the harness's own services), satisfying `R extends
  * HarnessServices`. The DLQ + identity collaborators are the real layers so the
- * DB side effects they produce can be verified; the queue/workflow ports that
- * carry no in-process seam are wired to their no-op variants.
+ * DB side effects they produce can be verified; external publication is wired
+ * to its no-op variant.
  */
-const IdentifyWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 const TestLayer = EventProcessorService.layer.pipe(
   Layer.provide(DlqProducer.dbLive),
   Layer.provide(AnalyticsIngestDlqService.layer),
   Layer.provide(CaptureIngress.noop),
   Layer.provide(PersonIdentityService.layer),
   Layer.provide(IdentityProjectionPublisher.noop),
-  // `PersonIdentityService.identifyDistinctId` resolves the completion workflow
-  // lazily, so the requirement surfaces on `processRecordToOutputs`'s effect
-  // rather than on the layer — merge the stub so the effect can draw it.
-  Layer.provideMerge(IdentifyWorkflowStub),
 );
 
 /** Monotonic counter so ids stay unique even within the same millisecond. */
diff --git a/packages/core/test/services/organizations/OrganizationService.integration.test.ts b/packages/core/test/services/organizations/OrganizationService.integration.test.ts
index 1cb3f9f8e..754ebef99 100644
--- a/packages/core/test/services/organizations/OrganizationService.integration.test.ts
+++ b/packages/core/test/services/organizations/OrganizationService.integration.test.ts
@@ -7,7 +7,7 @@
  * source of truth and every write goes there first, then is mirrored to the
  * `organization` / `member` tables. WorkOS itself is an external provider we
  * cannot stand up in-process, so the tests provide a configurable fake
- * {@link WorkosOrgPort} (the same provider-agnostic seam the app root wires a
+ * {@link OrgDirectoryPort} (the same provider-agnostic seam the app root wires a
  * live `@workos-inc/node` adapter into) to drive successes and failures.
  * Everything below the port — the DB writes, transactions, rollback
  * compensation, slug uniqueness, and permission checks — runs against the
@@ -44,15 +44,15 @@ import {
   OrganizationLifecyclePortError,
   OrganizationService,
   OrganizationServiceError,
-  WorkosOrgPort,
+  OrgDirectoryPort,
 } from "@voidhash/core/services";
 import { OrganizationNotFoundError } from "@voidhash/core/domain/organization/Organization";
-import { WorkosOrgPortError } from "@voidhash/core/services/organizations/WorkosOrgPort";
+import { OrgDirectoryPortError } from "@voidhash/core/services/organizations/OrgDirectoryPort";
 import type {
-  WorkosPortMembership,
-  WorkosPortOrganization,
-  WorkosPortUser,
-} from "@voidhash/core/services/organizations/WorkosOrgPort";
+  OrgDirectoryMembership,
+  OrgDirectoryOrganization,
+  OrgDirectoryUser,
+} from "@voidhash/core/services/organizations/OrgDirectoryPort";
 import {
   ActionForbiddenError,
   type SecretKeySession,
@@ -184,7 +184,7 @@ const withCleanup = <E, R>(
   return body(tracked).pipe(Effect.ensuring(cleanup(tracked)));
 };
 
-// --- fake WorkosOrgPort -----------------------------------------------------
+// --- fake OrgDirectoryPort -----------------------------------------------------
 
 /** Records every call the service makes against the port. */
 interface PortCalls {
@@ -206,27 +206,27 @@ interface FakePortConfig {
   readonly onCreateOrganization?: (input: {
     name: string;
     externalId: string;
-  }) => Effect.Effect<WorkosPortOrganization, WorkosOrgPortError>;
-  readonly onUpdateOrganization?: () => Effect.Effect<WorkosPortOrganization, WorkosOrgPortError>;
+  }) => Effect.Effect<OrgDirectoryOrganization, OrgDirectoryPortError>;
+  readonly onUpdateOrganization?: () => Effect.Effect<OrgDirectoryOrganization, OrgDirectoryPortError>;
   readonly onCreateMembership?: (input: {
     workosOrganizationId: string;
     workosUserId: string;
-  }) => Effect.Effect<WorkosPortMembership, WorkosOrgPortError>;
-  readonly onDeleteMembership?: () => Effect.Effect<void, WorkosOrgPortError>;
-  readonly onUpdateMembershipRole?: () => Effect.Effect<WorkosPortMembership, WorkosOrgPortError>;
-  readonly findUserByEmail?: WorkosPortUser | null;
-  readonly listMembershipsForUser?: ReadonlyArray<WorkosPortMembership>;
+  }) => Effect.Effect<OrgDirectoryMembership, OrgDirectoryPortError>;
+  readonly onDeleteMembership?: () => Effect.Effect<void, OrgDirectoryPortError>;
+  readonly onUpdateMembershipRole?: () => Effect.Effect<OrgDirectoryMembership, OrgDirectoryPortError>;
+  readonly findUserByEmail?: OrgDirectoryUser | null;
+  readonly listMembershipsForUser?: ReadonlyArray<OrgDirectoryMembership>;
 }
 
-const portError = (message: string) => new WorkosOrgPortError({ cause: "fake", message });
+const portError = (message: string) => new OrgDirectoryPortError({ cause: "fake", message });
 
 interface FakePort {
   readonly calls: PortCalls;
-  readonly layer: Layer.Layer<WorkosOrgPort>;
+  readonly layer: Layer.Layer<OrgDirectoryPort>;
 }
 
 /**
- * Build a fake {@link WorkosOrgPort} layer plus the call log it records into.
+ * Build a fake {@link OrgDirectoryPort} layer plus the call log it records into.
  * Defaults are "everything succeeds"; pass overrides to inject failures or
  * pre-existing WorkOS state. The returned `calls` object lets tests assert
  * which port operations ran (e.g. that a rollback `deleteOrganization` fired).
@@ -244,7 +244,7 @@ const makeFakePort = (config: FakePortConfig = {}): FakePort => {
   };
 
   let portSeq = 0;
-  const layer = Layer.succeed(WorkosOrgPort, {
+  const layer = Layer.succeed(OrgDirectoryPort, {
     createMembership: (input) => {
       calls.createMembership.push(input);
       if (config.onCreateMembership) return config.onCreateMembership(input);
@@ -253,7 +253,7 @@ const makeFakePort = (config: FakePortConfig = {}): FakePort => {
         organizationId: input.workosOrganizationId,
         role: input.roleSlug ?? "member",
         userId: input.workosUserId,
-      } satisfies WorkosPortMembership);
+      } satisfies OrgDirectoryMembership);
     },
     createOrganization: (input) => {
       calls.createOrganization.push(input);
@@ -262,7 +262,7 @@ const makeFakePort = (config: FakePortConfig = {}): FakePort => {
         externalId: input.externalId,
         id: `wo_${Date.now()}_${portSeq++}`,
         name: input.name,
-      } satisfies WorkosPortOrganization);
+      } satisfies OrgDirectoryOrganization);
     },
     deleteMembership: (workosMembershipId) => {
       calls.deleteMembership.push(workosMembershipId);
@@ -292,7 +292,7 @@ const makeFakePort = (config: FakePortConfig = {}): FakePort => {
         organizationId: "wo_x",
         role: input.roleSlug,
         userId: "wu_x",
-      } satisfies WorkosPortMembership);
+      } satisfies OrgDirectoryMembership);
     },
     updateOrganization: (input) => {
       calls.updateOrganization.push(input);
@@ -301,7 +301,7 @@ const makeFakePort = (config: FakePortConfig = {}): FakePort => {
         externalId: null,
         id: input.workosOrganizationId,
         name: input.name ?? "fake",
-      } satisfies WorkosPortOrganization);
+      } satisfies OrgDirectoryOrganization);
     },
   });
 
diff --git a/packages/core/test/services/paymentProviders/PaymentProviderProductService.integration.test.ts b/packages/core/test/services/paymentProviders/PaymentProviderProductService.integration.test.ts
index eb3bf5abf..a257bb740 100644
--- a/packages/core/test/services/paymentProviders/PaymentProviderProductService.integration.test.ts
+++ b/packages/core/test/services/paymentProviders/PaymentProviderProductService.integration.test.ts
@@ -47,11 +47,12 @@ import {
   StripePaymentProvider,
 } from "@voidhash/core/services/paymentProviders/PaymentProvider";
 import {
-  AppStoreReplayParkedNotificationsWorkflow,
+  AppStoreReplayParkedNotifications,
   type AppStoreReplayParkedNotificationsInput,
-} from "@voidhash/core/services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow";
-import { GooglePlayReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow";
-import { StripeReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/StripeReplayParkedNotificationsWorkflow";
+} from "@voidhash/core/workflows/definitions";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import * as TestWorkflowRunner from "@voidhash/platform/TestWorkflowRunner";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
 import { ActionForbiddenError, type UserSession } from "@voidhash/core/domain/auth/Auth";
 import {
   PaymentProviderProductNotFoundError,
@@ -145,23 +146,22 @@ const makeServiceLayer = (dispatches: DispatchLog) => {
     title: "Google Play",
     type: "native",
   };
+  const runner = TestWorkflowRunner.make();
 
   const StubbedProviders = Layer.mergeAll(
     Layer.succeed(StripePaymentProvider, stripeStub),
     Layer.succeed(AppStorePaymentProvider, appStoreStub),
     Layer.succeed(GooglePlayPaymentProvider, googlePlayStub),
-    Layer.succeed(AppStoreReplayParkedNotificationsWorkflow, {
-      dispatch: (input: AppStoreReplayParkedNotificationsInput) =>
+    Layer.succeed(WorkflowRunner, {
+      ...runner,
+      dispatch: (workflow, input) =>
         Effect.sync(() => {
-          dispatches.push(input);
-        }),
-    }),
-    Layer.succeed(GooglePlayReplayParkedNotificationsWorkflow, {
-      dispatch: () => Effect.void,
+          if (workflow.name === AppStoreReplayParkedNotifications.name) {
+            dispatches.push(input as AppStoreReplayParkedNotificationsInput);
+          }
+        }).pipe(Effect.andThen(runner.dispatch(workflow, input))),
     }),
-    // Stripe replay port: not exercised by these App-Store-focused assertions,
-    // stubbed to a no-op so the service's request-time requirement is satisfied.
-    Layer.succeed(StripeReplayParkedNotificationsWorkflow, { dispatch: () => Effect.void }),
+    Layer.succeed(PlatformRuntime, PlatformRuntime.of({})),
   );
 
   return PaymentProviderProductService.layer.pipe(Layer.provideMerge(StubbedProviders));
diff --git a/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProvider.integration.test.ts b/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProvider.integration.test.ts
index c5ea840db..3d8af0716 100644
--- a/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProvider.integration.test.ts
+++ b/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProvider.integration.test.ts
@@ -25,10 +25,6 @@
  * infrastructure of their own:
  *  - `PerkGrantService.layer` (real, `Db` + `AuthSession`),
  *  - `IdentityProjectionPublisher.noop` (synchronous projection is a no-op),
- *  - an in-memory `IdentifyDistinctIdCompletionWorkflow` (the async identity-
- *    migration workflow is a Cloudflare adapter at runtime; the only path that
- *    dispatches it — the webhook-stand-in merge — wraps the call in a logging
- *    `catch`, so a no-op dispatch is faithful),
  *  - `AppStoreServerSdk.layer` over `FetchHttpClient.layer` (the REST SDK is
  *    only touched by `buildSdkContextFromConfiguration`; the `record*` paths
  *    operate purely on already-decoded JWS payloads and never make a request).
@@ -62,7 +58,6 @@ import {
   PurchaseProcessingService,
 } from "@voidhash/core/services";
 import { AppStorePaymentProvider } from "@voidhash/core/services/paymentProviders/appStore/payment-provider";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import {
   ACCOUNT_TOKEN_SERVICE_ID,
@@ -91,7 +86,6 @@ import {
   personIdentities,
   persons,
   products,
-  projects,
   purchaseLedger,
   purchases,
   subscriptions,
@@ -110,17 +104,6 @@ const projectId = CoreTestFixture.projectId;
 let seq = 0;
 const uniq = (label: string) => `it-as-${label}-${Date.now()}-${seq++}`;
 
-/**
- * In-memory no-op for the async identity-migration completion workflow. The
- * real adapter is a Cloudflare Workflow wired at the application root; the only
- * engine path that dispatches it (webhook-stand-in merge) wraps the call in a
- * logging `catch`, so a no-op faithfully represents "dispatched, fire-and-
- * forget".
- */
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 /**
  * Full dependency graph for the App Store record engine. Everything here is
  * either a real `Db`-backed service or a leaf stub with no infrastructure of
@@ -128,8 +111,7 @@ const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflo
  * per-test `AuthSession` supplied by `CoreAuthSession.authenticate`. The two
  * `provideMerge` layers cascade downward: the inner leaf stubs satisfy
  * `PurchaseProcessingService` (needs `PerkGrantService`) and
- * `PersonIdentityService` (needs `IdentityProjectionPublisher` +
- * `IdentifyDistinctIdCompletionWorkflow`).
+ * `PersonIdentityService` (needs `IdentityProjectionPublisher`).
  */
 const AppStoreEngineLive = AppStorePaymentProvider.layer.pipe(
   Layer.provideMerge(
@@ -141,13 +123,7 @@ const AppStoreEngineLive = AppStorePaymentProvider.layer.pipe(
       AppStoreServerSdk.layer.pipe(Layer.provide(FetchHttpClient.layer)),
     ),
   ),
-  Layer.provideMerge(
-    Layer.mergeAll(
-      PerkGrantService.layer,
-      IdentityProjectionPublisher.noop,
-      CompletionWorkflowStub,
-    ),
-  ),
+  Layer.provideMerge(Layer.mergeAll(PerkGrantService.layer, IdentityProjectionPublisher.noop)),
 );
 
 // ----------------------------------------------------------------------------
diff --git a/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProviderService.integration.test.ts b/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProviderService.integration.test.ts
index 4959cd4fa..70c4d13fe 100644
--- a/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProviderService.integration.test.ts
+++ b/packages/core/test/services/paymentProviders/appStore/AppStorePaymentProviderService.integration.test.ts
@@ -48,7 +48,6 @@ import {
   AppStorePaymentProviderServiceError,
   AppStoreTransactionVerifier,
 } from "@voidhash/core/services";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import { deriveAccountToken } from "@voidhash/core/utils/crypto/account-token";
 import { generateId } from "@voidhash/core/utils";
@@ -80,7 +79,7 @@ import {
   type RuntimeSchema,
   Transaction as ReactNativeTransaction,
 } from "@testing/ReactNativePurchaseHarness";
-import { makePurchaseSdkHttpHandler } from "../../../../../../apps/backend/src/testing/PurchaseSdkHttpHarness.ts";
+import { makePurchaseSdkHttpHandler } from "../../../../../backend/src/testing/PurchaseSdkHttpHarness.ts";
 
 const { test } = PurchaseIntegrationTestHarness.make();
 
@@ -97,10 +96,6 @@ const uniq = (label: string) => `it-asps-${label}-${Date.now()}-${seq++}`;
  * `PersonIdentityService` dependency graph, so it must be provided to build
  * the layer.
  */
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 const googlePlayStub = Layer.succeed(GooglePlayPaymentProviderService, {
   acceptRtdnNotification: () => Effect.die("Google Play webhook must not run"),
   processSdkTransaction: () => Effect.die("Google Play purchase must not run"),
@@ -151,13 +146,7 @@ const AppStoreEngineLive = AppStorePaymentProvider.layer.pipe(
       AppStoreServerSdk.layer.pipe(Layer.provide(FetchHttpClient.layer)),
     ),
   ),
-  Layer.provideMerge(
-    Layer.mergeAll(
-      PerkGrantService.layer,
-      IdentityProjectionPublisher.noop,
-      CompletionWorkflowStub,
-    ),
-  ),
+  Layer.provideMerge(Layer.mergeAll(PerkGrantService.layer, IdentityProjectionPublisher.noop)),
 );
 
 const AppStoreServiceLive = AppStorePaymentProviderServiceLive.pipe(
@@ -184,7 +173,6 @@ describe("AppStorePaymentProviderService.processSdkTransaction", () => {
       const providerProductId = generateId("paymentProviderProduct");
       const productId = generateId("product");
       const purchasedAt = Date.now();
-      const receivedAt = new Date(purchasedAt);
       const idempotencyKey = `apple:${transactionId}:purchase:${purchasedAt}`;
       let personId: string | undefined;
       let disposeHttp: (() => Promise<void>) | undefined;
@@ -312,7 +300,6 @@ describe("AppStorePaymentProviderService.processSdkTransaction", () => {
               IdentityProjectionPublisher.noop,
               serviceLayer,
               googlePlayStub,
-              CompletionWorkflowStub,
             ),
           ),
         );
diff --git a/packages/core/test/services/paymentProviders/appStore/AppStoreReconciliationService.integration.test.ts b/packages/core/test/services/paymentProviders/appStore/AppStoreReconciliationService.integration.test.ts
index 252db865e..0f0d018ca 100644
--- a/packages/core/test/services/paymentProviders/appStore/AppStoreReconciliationService.integration.test.ts
+++ b/packages/core/test/services/paymentProviders/appStore/AppStoreReconciliationService.integration.test.ts
@@ -58,7 +58,6 @@ import { AppStorePaymentProvider } from "@voidhash/core/services/paymentProvider
 import { FxRateService } from "@voidhash/core/services/fxRates/FxRateService";
 import { PersonIdentityService } from "@voidhash/core/services/personIdentity/PersonIdentityService";
 import { IdentityProjectionPublisher } from "@voidhash/core/services/personIdentity/IdentityProjectionPublisher";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PurchaseProcessingService } from "@voidhash/core/services/purchaseProcessing/PurchaseProcessingService";
 import { PerkGrantService } from "@voidhash/core/services/perkGrants/PerkGrantService";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
@@ -91,10 +90,6 @@ const stubFxFetcher = {
  * (surfaces on the effect, not the layer); none of the paths under test
  * dispatches it, so a void stub suffices.
  */
-const IdentifyWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 /**
  * Service-under-test layer composed with the full `AppStorePaymentProvider`
  * record graph it depends on, mirroring `stacks/backend/workflows/
@@ -117,7 +112,6 @@ const TestLayer = AppStoreReconciliationService.layer.pipe(
       Layer.provide(PaymentConfigSecretCrypto.layer({ key: Effect.succeed("") })),
     ),
   ),
-  Layer.provideMerge(IdentifyWorkflowStub),
 );
 
 /** Read a payment-provider configuration row straight from the DB. */
diff --git a/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProvider.integration.test.ts b/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProvider.integration.test.ts
index 2c635a427..814c3701b 100644
--- a/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProvider.integration.test.ts
+++ b/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProvider.integration.test.ts
@@ -28,7 +28,6 @@ import {
   PurchaseProcessingService,
 } from "@voidhash/core/services";
 import { GooglePlayPaymentProvider } from "@voidhash/core/services/paymentProviders/googlePlay/payment-provider";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import {
   ACCOUNT_TOKEN_SERVICE_ID,
@@ -73,10 +72,6 @@ const projectId = CoreTestFixture.projectId;
 let seq = 0;
 const uniq = (label: string) => `it-gp-${label}-${Date.now()}-${seq++}`;
 
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 /**
  * Full dependency graph for the Google Play record engine. Everything is either
  * a real `Db`-backed service or a leaf stub, so the only escaping requirements
@@ -92,13 +87,7 @@ const GooglePlayEngineLive = GooglePlayPaymentProvider.layer.pipe(
       GooglePlayServerApi.layer,
     ),
   ),
-  Layer.provideMerge(
-    Layer.mergeAll(
-      PerkGrantService.layer,
-      IdentityProjectionPublisher.noop,
-      CompletionWorkflowStub,
-    ),
-  ),
+  Layer.provideMerge(Layer.mergeAll(PerkGrantService.layer, IdentityProjectionPublisher.noop)),
 );
 
 // ----------------------------------------------------------------------------
diff --git a/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProviderService.integration.test.ts b/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProviderService.integration.test.ts
index 9cf08045a..108e74b3a 100644
--- a/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProviderService.integration.test.ts
+++ b/packages/core/test/services/paymentProviders/googlePlay/GooglePlayPaymentProviderService.integration.test.ts
@@ -17,7 +17,6 @@ import {
 import type { PublishableKeySession } from "@voidhash/core/domain/auth/Auth";
 import { GooglePlayPaymentProvider } from "@voidhash/core/services/paymentProviders/googlePlay/payment-provider";
 import { GooglePlayServerApi } from "@voidhash/core/services/paymentProviders/googlePlay/sdk-context";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import { deriveAccountToken } from "@voidhash/core/utils/crypto/account-token";
 import { generateId } from "@voidhash/core/utils";
@@ -45,17 +44,13 @@ import {
   type RuntimeSchema,
   Transaction as ReactNativeTransaction,
 } from "@testing/ReactNativePurchaseHarness";
-import { makePurchaseSdkHttpHandler } from "../../../../../../apps/backend/src/testing/PurchaseSdkHttpHarness.ts";
+import { makePurchaseSdkHttpHandler } from "../../../../../backend/src/testing/PurchaseSdkHttpHarness.ts";
 
 const { test } = PurchaseIntegrationTestHarness.make();
 const projectId = CoreTestFixture.projectId;
 let sequence = 0;
 const unique = (label: string) => `it-gp-sdk-${label}-${Date.now()}-${sequence++}`;
 
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 const appStoreStub = Layer.succeed(AppStorePaymentProviderService, {
   acceptServerNotification: () => Effect.die("App Store webhook must not run"),
   processSdkTransaction: () => Effect.die("App Store purchase must not run"),
@@ -99,13 +94,7 @@ const GooglePlayEngineLive = GooglePlayPaymentProvider.layer.pipe(
       GooglePlayServerApi.layer,
     ),
   ),
-  Layer.provideMerge(
-    Layer.mergeAll(
-      PerkGrantService.layer,
-      IdentityProjectionPublisher.noop,
-      CompletionWorkflowStub,
-    ),
-  ),
+  Layer.provideMerge(Layer.mergeAll(PerkGrantService.layer, IdentityProjectionPublisher.noop)),
 );
 
 describe("GooglePlayPaymentProviderService.processSdkTransaction", () => {
@@ -248,7 +237,6 @@ describe("GooglePlayPaymentProviderService.processSdkTransaction", () => {
               IdentityProjectionPublisher.noop,
               serviceLayer,
               appStoreStub,
-              CompletionWorkflowStub,
             ),
           ),
         );
diff --git a/packages/core/test/services/paymentProviders/googlePlay/GooglePlayWebhookHandlerService.integration.test.ts b/packages/core/test/services/paymentProviders/googlePlay/GooglePlayWebhookHandlerService.integration.test.ts
index d3b19f199..47d0b1f06 100644
--- a/packages/core/test/services/paymentProviders/googlePlay/GooglePlayWebhookHandlerService.integration.test.ts
+++ b/packages/core/test/services/paymentProviders/googlePlay/GooglePlayWebhookHandlerService.integration.test.ts
@@ -21,7 +21,6 @@ import {
   PersonIdentityService,
   PurchaseProcessingService,
 } from "@voidhash/core/services";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import { generateId } from "@voidhash/core/utils";
 import { GooglePlayPaymentProviderConfigurationNotFoundError } from "../../../../src/services/paymentProviders/googlePlay/errors.ts";
@@ -46,10 +45,6 @@ const projectId = CoreTestFixture.projectId;
 let seq = 0;
 const uniq = (label: string) => `it-gpwh-${label}-${Date.now()}-${seq++}`;
 
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 const HandlerLive = GooglePlayWebhookHandlerService.layer.pipe(
   Layer.provideMerge(
     Layer.mergeAll(
@@ -60,13 +55,7 @@ const HandlerLive = GooglePlayWebhookHandlerService.layer.pipe(
       GooglePlayServerApi.layer,
     ),
   ),
-  Layer.provideMerge(
-    Layer.mergeAll(
-      PerkGrantService.layer,
-      IdentityProjectionPublisher.noop,
-      CompletionWorkflowStub,
-    ),
-  ),
+  Layer.provideMerge(Layer.mergeAll(PerkGrantService.layer, IdentityProjectionPublisher.noop)),
 );
 
 /** Base64-encoded Pub/Sub push envelope around a DeveloperNotification. */
diff --git a/packages/core/test/services/paymentProviders/stripe/stripe-test-support.ts b/packages/core/test/services/paymentProviders/stripe/stripe-test-support.ts
index a23cb58e3..6fa42736d 100644
--- a/packages/core/test/services/paymentProviders/stripe/stripe-test-support.ts
+++ b/packages/core/test/services/paymentProviders/stripe/stripe-test-support.ts
@@ -29,7 +29,6 @@ import {
 import { StripePaymentProvider } from "@voidhash/core/services/paymentProviders/stripe/payment-provider";
 import { StripePaymentProviderServiceLive } from "@voidhash/core/services/paymentProviders/stripe/payment-provider-service";
 import { StripeWebhookHandlerService } from "@voidhash/core/services/paymentProviders/stripe/stripe-webhook-handler-service";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
 import { generateId } from "@voidhash/core/utils";
 import { ProductType } from "@voidhash/lib/constants";
@@ -184,10 +183,6 @@ export const checkoutLineItemsRoute = (input: {
   path: `/v1/checkout/sessions/${input.sessionId}/line_items`,
 });
 
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 const stripeLeafDeps = (httpClient: HttpClient.HttpClient) =>
   Layer.mergeAll(
     PurchaseProcessingService.layer,
@@ -197,11 +192,7 @@ const stripeLeafDeps = (httpClient: HttpClient.HttpClient) =>
     Layer.succeed(HttpClient.HttpClient, httpClient),
   );
 
-const stripeLeafStubs = Layer.mergeAll(
-  PerkGrantService.layer,
-  IdentityProjectionPublisher.noop,
-  CompletionWorkflowStub,
-);
+const stripeLeafStubs = Layer.mergeAll(PerkGrantService.layer, IdentityProjectionPublisher.noop);
 
 /**
  * Full dependency graph for the Stripe record engine, over a fake `HttpClient`.
diff --git a/packages/core/test/services/personIdentity/PersonIdentityService.integration.test.ts b/packages/core/test/services/personIdentity/PersonIdentityService.integration.test.ts
index b1c10518f..00917d9df 100644
--- a/packages/core/test/services/personIdentity/PersonIdentityService.integration.test.ts
+++ b/packages/core/test/services/personIdentity/PersonIdentityService.integration.test.ts
@@ -30,14 +30,10 @@
  *    ({@link PersonServiceError}), paired with a DB-state assertion proving the
  *    rejected write left nothing behind.
  */
-import { Effect, Layer, Ref } from "effect";
+import { Effect, Layer } from "effect";
 import { describe, expect, it } from "vitest";
 
 import { IdentityProjectionPublisher, PersonIdentityService } from "@voidhash/core/services";
-import {
-  type IdentifyDistinctIdCompletionInput,
-  IdentifyDistinctIdCompletionWorkflow,
-} from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { PersonServiceError } from "@voidhash/core/services/persons/PersonService";
 import { ANONYMOUS_USER_ID_PREFIX } from "@voidhash/lib";
 import {
@@ -217,36 +213,9 @@ const withCleanup = <E, R>(
   }).pipe(Effect.ensuring(cleanup(tracked)));
 };
 
-// --- workflow dispatch tracking stub ----------------------------------------
-
-/**
- * A {@link IdentifyDistinctIdCompletionWorkflow} layer that records every
- * `dispatch` payload into the supplied {@link Ref}. The concrete workflow is a
- * Cloudflare Workflow (no in-process seam), so this stub lets us assert *that*
- * (and with what payload) `identifyDistinctId` schedules the async migration.
- */
-const trackingWorkflowLayer = (ref: Ref.Ref<ReadonlyArray<IdentifyDistinctIdCompletionInput>>) =>
-  Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-    dispatch: (input) => Ref.update(ref, (calls) => [...calls, input]),
-  });
-
-/**
- * Build the service-under-test wiring for one test: the real
- * {@link PersonIdentityService} layer over the noop projection publisher,
- * merged with a fresh dispatch-tracking workflow stub. The workflow is resolved
- * inside `identifyDistinctId`'s body (not at layer-build time), so it must be
- * provided at the call-site level — hence it is merged into `layer` rather than
- * provided *into* `PersonIdentityService.layer`. The `Ref` is created
- * synchronously so the same instance can be closed over by both the provided
- * `layer` (which discharges `R` to the harness services) and the assertions.
- */
 const makeServiceWiring = () => {
-  const dispatches = Effect.runSync(Ref.make<ReadonlyArray<IdentifyDistinctIdCompletionInput>>([]));
-  const layer = Layer.mergeAll(
-    PersonIdentityService.layer.pipe(Layer.provide(IdentityProjectionPublisher.noop)),
-    trackingWorkflowLayer(dispatches),
-  );
-  return { dispatches, layer };
+  const layer = PersonIdentityService.layer.pipe(Layer.provide(IdentityProjectionPublisher.noop));
+  return { layer };
 };
 
 const baseInput = (distinctId: string, eventTimestamp: Date) => ({
@@ -518,7 +487,6 @@ describe("PersonIdentityService.identifyDistinctId", () => {
           "from-anon",
         );
         yield* Effect.sleep("20 millis");
-        expect(yield* Ref.get(promote.dispatches)).toEqual([]);
         expect(yield* findMigrationJobsForDistinctId(distinctId)).toEqual([]);
       }),
     ).pipe(Effect.provide(promote.layer), CoreAuthSession.authenticate()),
@@ -548,7 +516,6 @@ describe("PersonIdentityService.identifyDistinctId", () => {
       // before any insert, and the early failure precedes dispatch).
       expect(yield* findIdentityRow(distinctId)).toBeUndefined();
       expect(yield* findIdentityRow(previousDistinctId)).toBeUndefined();
-      expect(yield* Ref.get(anonTarget.dispatches)).toEqual([]);
     }).pipe(Effect.provide(anonTarget.layer), CoreAuthSession.authenticate()),
   );
 
@@ -574,7 +541,6 @@ describe("PersonIdentityService.identifyDistinctId", () => {
         expect(yield* findIdentityRow(distinctId)).toBeDefined();
         expect(yield* findMigrationJobsForDistinctId(distinctId)).toEqual([]);
         yield* Effect.sleep("50 millis");
-        expect(yield* Ref.get(selfIdentify.dispatches)).toEqual([]);
       }),
     ).pipe(Effect.provide(selfIdentify.layer), CoreAuthSession.authenticate()),
   );
@@ -621,7 +587,6 @@ describe("PersonIdentityService.identifyDistinctId", () => {
         // Conflict short-circuits the async path: no job, no dispatch.
         expect(yield* findMigrationJobsForDistinctId(distinctId)).toEqual([]);
         yield* Effect.sleep("50 millis");
-        expect(yield* Ref.get(conflict.dispatches)).toEqual([]);
       }),
     ).pipe(Effect.provide(conflict.layer), CoreAuthSession.authenticate()),
   );
@@ -750,7 +715,8 @@ describe("PersonIdentityService — order-agnostic behavior (Option B)", () => {
         });
 
         const row = yield* findPersonRow(personId!);
-        expect((row?.traits as Record<string, unknown>).plan).toBe("pro");
+        expect(row).toBeDefined();
+        expect((row!.traits as Record<string, unknown>).plan).toBe("pro");
         expect(row?.traitsMeta?.plan?.ts).toBe(newer.getTime());
         expect(row?.traitsMeta?.plan?.mode).toBe("set");
       }),
diff --git a/packages/core/test/services/persons/PersonService.integration.test.ts b/packages/core/test/services/persons/PersonService.integration.test.ts
index 4640bbc84..ba034f080 100644
--- a/packages/core/test/services/persons/PersonService.integration.test.ts
+++ b/packages/core/test/services/persons/PersonService.integration.test.ts
@@ -11,12 +11,8 @@
  * method's return value.
  *
  * Dependency wiring: `PersonService` needs `PersonIdentityService`, which in
- * turn needs an `IdentityProjectionPublisher` and an abstract
- * `IdentifyDistinctIdCompletionWorkflow`. Neither is a harness service, so the
- * test provides the publisher's {@link IdentityProjectionPublisher.noop} (the
- * intended test/seam variant) and a no-op completion-workflow layer. The
- * completion workflow is only ever dispatched from `identifyDistinctId`, which
- * `PersonService` never calls, so the stub is purely there to satisfy the type.
+ * turn needs an `IdentityProjectionPublisher`. The test provides the
+ * publisher's {@link IdentityProjectionPublisher.noop} test variant.
  *
  * Conventions used throughout (see PerkService.integration.test.ts):
  *  - Every test shares the one seeded fixture project ({@link CoreTestFixture})
@@ -37,14 +33,9 @@ import { describe, expect, test as vitestTest } from "vitest";
 import { PersonService } from "@voidhash/core/services/persons/PersonService";
 import { PersonIdentityService } from "@voidhash/core/services/personIdentity/PersonIdentityService";
 import { IdentityProjectionPublisher } from "@voidhash/core/services/personIdentity/IdentityProjectionPublisher";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
-import {
-  PersonIdentityKind,
-  PersonNotFoundError,
-  type PersonProfile,
-} from "@voidhash/core/domain/person/Person";
+import { PersonIdentityKind, PersonNotFoundError } from "@voidhash/core/domain/person/Person";
 import { ActionForbiddenError, type UserSession } from "@voidhash/core/domain/auth/Auth";
-import { Db, PersonOrigin, and, eq, inArray, personIdentities, persons } from "@voidhash/db";
+import { Db, PersonOrigin, inArray, personIdentities, persons } from "@voidhash/db";
 
 import { CoreAuthSession } from "@testing/CoreAuthSession";
 import { CoreIntegrationTestHarness } from "@testing/CoreIntegrationTestHarness";
@@ -65,14 +56,9 @@ const uniqueDistinctId = (label: string) => `it-person-${label}-${Date.now()}-${
  * seam variant and the completion workflow is a no-op (only dispatched by
  * `identifyDistinctId`, which `PersonService` never calls).
  */
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 const PersonServiceUnderTest = PersonService.layer.pipe(
   Layer.provideMerge(PersonIdentityService.layer),
   Layer.provide(IdentityProjectionPublisher.noop),
-  Layer.provide(CompletionWorkflowStub),
 );
 
 /** Read a person row straight from the database, bypassing the service. */
diff --git a/packages/core/test/services/purchaseProcessing/PurchaseLedgerWorkerService.integration.test.ts b/packages/core/test/services/purchaseProcessing/PurchaseLedgerWorkerService.integration.test.ts
index df2d58ef1..d2c7bba69 100644
--- a/packages/core/test/services/purchaseProcessing/PurchaseLedgerWorkerService.integration.test.ts
+++ b/packages/core/test/services/purchaseProcessing/PurchaseLedgerWorkerService.integration.test.ts
@@ -40,7 +40,7 @@
  */
 import { Effect, Layer } from "effect";
 import { describe, expect, test as vitestTest } from "vitest";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
 
 import { AnalyticsDispatchService } from "@voidhash/core/services/analyticsIngest/AnalyticsDispatchService";
 import { PurchaseLedgerWorkerService } from "@voidhash/core/services/purchaseProcessing/PurchaseLedgerWorkerService";
diff --git a/packages/core/test/services/sdk/SdkService.integration.test.ts b/packages/core/test/services/sdk/SdkService.integration.test.ts
index 24018bc9d..d843970f6 100644
--- a/packages/core/test/services/sdk/SdkService.integration.test.ts
+++ b/packages/core/test/services/sdk/SdkService.integration.test.ts
@@ -7,12 +7,8 @@
  * `SdkService` owns no domain logic — it composes `PersonIdentityService`,
  * `PerkGrantService`, `PurchaseService`, `AppStorePaymentProviderService` and
  * the pure snapshot-builder. So these tests provide each collaborator's *real*
- * layer (all of which bottom out at harness services) plus two stubs for the
- * abstract ports core never implements:
- *  - `IdentityProjectionPublisher.noop` (analytics fan-out is a no-op here), and
- *  - an inert {@link IdentifyDistinctIdCompletionWorkflow} (the durable
- *    source-merge job is a Cloudflare Workflow with no in-process seam — we
- *    only assert the *synchronous* identify transaction commits).
+ * layer (all of which bottom out at harness services) plus
+ * `IdentityProjectionPublisher.noop` (analytics fan-out is a no-op here).
  *  - `AppStorePaymentProviderService` is itself a stub tag in core (the Apple
  *    REST client / reconcile workflows live in `internal/`), so its layer is
  *    provided per-test to exercise both the success and failure branches of
@@ -48,7 +44,6 @@ import {
   AppStorePaymentProviderServiceError,
 } from "@voidhash/core/services/paymentProviders/AppStorePaymentProviderService";
 import { GooglePlayPaymentProviderService } from "@voidhash/core/services/paymentProviders/GooglePlayPaymentProviderService";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
 import { AuthenticationError, type PublishableKeySession } from "@voidhash/core/domain/auth/Auth";
 import {
   SdkPersonNotFoundError,
@@ -84,15 +79,6 @@ const uniqueAnonId = (label: string) => `vh:anon:${uniqueDistinctId(label)}`;
 // Collaborator wiring
 // =============================================================================
 
-/**
- * Inert {@link IdentifyDistinctIdCompletionWorkflow}: the real adapter is a
- * Cloudflare Workflow with no in-process runtime, so dispatch is a no-op. The
- * synchronous identify transaction (the part under test) commits regardless.
- */
-const CompletionWorkflowStub = Layer.succeed(IdentifyDistinctIdCompletionWorkflow, {
-  dispatch: () => Effect.void,
-});
-
 /**
  * `AppStorePaymentProviderService` stub. The real Apple-backed implementation
  * lives in `internal/` and needs a signed JWS payload + REST client we don't
@@ -111,11 +97,7 @@ const appStoreStub = (
 
 /**
  * Full layer the SdkService-under-test needs: the service itself plus every
- * real collaborator (each bottoms out at harness `Db`/`AuthSession`) and the
- * two stubs. `IdentifyDistinctIdCompletionWorkflow` is resolved *inside*
- * `PersonIdentityService.identifyDistinctId` at call time, so it surfaces as a
- * method-level requirement of `SdkService` — it must be in the output layer
- * (via `provideMerge`), not merely fed into `PersonIdentityService.layer`.
+ * real collaborator (each bottoms out at harness `Db`/`AuthSession`).
  * `AppStorePaymentProviderService` is layered in per-test.
  */
 /**
@@ -142,7 +124,6 @@ const sdkLayer = (appStore: Layer.Layer<AppStorePaymentProviderService>) =>
         IdentityProjectionPublisher.noop,
         appStore,
         googlePlayStub,
-        CompletionWorkflowStub,
       ),
     ),
   );
@@ -901,7 +882,6 @@ describe("SdkService.submitPurchaseTransaction", () => {
                     return Effect.succeed({ personId: submitGooglePersonId });
                   },
                 }),
-                CompletionWorkflowStub,
               ),
             ),
           ),
diff --git a/packages/core/test/services/voidql/corpus.ts b/packages/core/test/services/voidql/corpus.ts
new file mode 100644
index 000000000..b11c1d517
--- /dev/null
+++ b/packages/core/test/services/voidql/corpus.ts
@@ -0,0 +1,369 @@
+/**
+ * The supported VoidQL query corpus, shared by the compile-only unit suite and
+ * the live-ClickHouse integration suite so both prove the same surface.
+ */
+import type { Capability } from "../../../src/services/voidql/catalog/types.ts";
+import { makeAuthorizedScope } from "../../../src/services/voidql/scope.ts";
+
+export 
+const SCOPE = makeAuthorizedScope({
+  organizationId: "org_compatibility",
+  availableProjectIds: ["project_a", "project_b"],
+});
+export const CAPABILITIES = new Set<Capability>(["pii"]);
+
+export interface SupportedQuery {
+  readonly name: string;
+  readonly sql: string;
+  readonly baseReferences: number;
+  readonly contains?: readonly string[];
+  readonly boundValues?: readonly unknown[];
+}
+
+export const SUPPORTED_QUERIES: readonly SupportedQuery[] = [
+  {
+    name: "constant SELECT without FROM",
+    sql: "SELECT 1 AS one, true AS enabled, NULL AS missing",
+    baseReferences: 0,
+  },
+  {
+    name: "explicit and implicit projection aliases",
+    sql: "SELECT event_name AS explicit_name, project_id implicit_project FROM events",
+    baseReferences: 1,
+    contains: ["AS explicit_name", "AS implicit_project"],
+  },
+  {
+    name: "expression alias reused by a later projection",
+    sql: "SELECT upper(event_name) AS normalized, length(normalized) AS normalized_length FROM events",
+    baseReferences: 1,
+    contains: ["upper(", "length(normalized)"],
+  },
+  {
+    name: "projection alias reused in WHERE",
+    sql: "SELECT lower(event_name) AS normalized FROM events WHERE normalized LIKE 'purchase%'",
+    baseReferences: 1,
+    contains: ["WHERE (normalized LIKE"],
+    boundValues: ["purchase%"],
+  },
+  {
+    name: "projection aliases reused in GROUP BY, HAVING, and ORDER BY",
+    sql: "SELECT toStartOfDay(event_ts) AS day, count() AS total FROM events GROUP BY day HAVING total > 1 ORDER BY total DESC",
+    baseReferences: 1,
+    contains: ["GROUP BY day", "HAVING (total >", "ORDER BY total DESC"],
+  },
+  {
+    name: "explicit table alias",
+    sql: "SELECT e.event_id FROM events AS e",
+    baseReferences: 1,
+    contains: ["AS e", "e.event_id"],
+  },
+  {
+    name: "implicit table alias",
+    sql: "SELECT e.event_id FROM events e",
+    baseReferences: 1,
+    contains: ["AS e", "e.event_id"],
+  },
+  {
+    name: "SELECT ALL",
+    sql: "SELECT ALL event_name FROM events",
+    baseReferences: 1,
+  },
+  {
+    name: "SELECT DISTINCT",
+    sql: "SELECT DISTINCT event_name FROM events",
+    baseReferences: 1,
+    contains: ["SELECT DISTINCT"],
+  },
+  {
+    name: "SELECT DISTINCT ON",
+    sql: "SELECT DISTINCT ON (person_id) person_id, event_ts FROM events ORDER BY event_ts DESC",
+    baseReferences: 1,
+    contains: ["SELECT DISTINCT ON (", "ORDER BY"],
+  },
+  {
+    name: "arithmetic precedence and unary negation",
+    sql: "SELECT -(1 + 2 * 3) AS result FROM events LIMIT 1",
+    baseReferences: 1,
+  },
+  {
+    name: "boolean comparison precedence",
+    sql: "SELECT event_id FROM events WHERE event_name = 'a' OR event_name = 'b' AND project_id != 'c'",
+    baseReferences: 1,
+    boundValues: ["a", "b", "c"],
+  },
+  {
+    name: "LIKE and NOT LIKE",
+    sql: "SELECT event_id FROM events WHERE event_name LIKE 'a%' AND event_name NOT LIKE '%bot%'",
+    baseReferences: 1,
+    boundValues: ["a%", "%bot%"],
+  },
+  {
+    name: "ILIKE and NOT ILIKE",
+    sql: "SELECT event_id FROM events WHERE event_name ILIKE 'a%' AND event_name NOT ILIKE '%bot%'",
+    baseReferences: 1,
+    contains: [" ILIKE ", " NOT ILIKE "],
+    boundValues: ["a%", "%bot%"],
+  },
+  {
+    name: "IN and NOT IN literal lists",
+    sql: "SELECT event_id FROM events WHERE event_name IN ('a', 'b') AND project_id NOT IN ('x', 'y')",
+    baseReferences: 1,
+    boundValues: ["a", "b", "x", "y"],
+  },
+  {
+    name: "BETWEEN and NOT BETWEEN",
+    sql: "SELECT event_id FROM events WHERE event_ts BETWEEN '2026-01-01' AND '2026-01-31' AND event_name NOT BETWEEN 'a' AND 'z'",
+    baseReferences: 1,
+  },
+  {
+    name: "IS NULL and IS NOT NULL",
+    sql: "SELECT event_id FROM events WHERE person_id IS NULL OR distinct_id IS NOT NULL",
+    baseReferences: 1,
+  },
+  {
+    name: "searched and simple CASE",
+    sql: "SELECT CASE WHEN event_name = 'a' THEN 'first' ELSE 'other' END AS searched, CASE event_name WHEN 'b' THEN 'second' ELSE 'other' END AS simple FROM events",
+    baseReferences: 1,
+    boundValues: ["a", "first", "b", "second", "other"],
+  },
+  {
+    name: "PREWHERE lowered safely ahead of WHERE",
+    sql: "SELECT event_id FROM events PREWHERE event_ts >= '2026-01-01' WHERE event_name = 'signup'",
+    baseReferences: 1,
+    contains: [" WHERE ", " AND "],
+    boundValues: ["signup"],
+  },
+  {
+    name: "GROUP BY and HAVING",
+    sql: "SELECT event_name, count() AS total FROM events GROUP BY event_name HAVING count() > 10",
+    baseReferences: 1,
+    contains: ["GROUP BY", "HAVING"],
+  },
+  {
+    name: "GROUP BY WITH ROLLUP and TOTALS",
+    sql: "SELECT event_name, count() AS total FROM events GROUP BY event_name WITH ROLLUP WITH TOTALS",
+    baseReferences: 1,
+    contains: ["WITH ROLLUP", "WITH TOTALS"],
+  },
+  {
+    name: "GROUP BY WITH CUBE",
+    sql: "SELECT event_name, project_id, count() AS total FROM events GROUP BY event_name, project_id WITH CUBE",
+    baseReferences: 1,
+    contains: ["WITH CUBE"],
+  },
+  {
+    name: "multi-column ORDER BY",
+    sql: "SELECT event_name, event_ts FROM events ORDER BY event_name ASC, event_ts DESC",
+    baseReferences: 1,
+    contains: ["ORDER BY", " ASC", " DESC"],
+  },
+  {
+    name: "ORDER BY NULLS FIRST and NULLS LAST",
+    sql: "SELECT event_name, event_ts FROM events ORDER BY event_name ASC NULLS FIRST, event_ts DESC NULLS LAST",
+    baseReferences: 1,
+    contains: ["NULLS FIRST", "NULLS LAST"],
+  },
+  {
+    name: "row-number window with partition and ordering",
+    sql: "SELECT event_id, rowNumber() OVER (PARTITION BY person_id ORDER BY event_ts DESC) AS row_num FROM events",
+    baseReferences: 1,
+    contains: ["row_number() OVER (PARTITION BY", "ORDER BY"],
+  },
+  {
+    name: "aggregate window with an unbounded frame",
+    sql: "SELECT event_id, sum(1) OVER (PARTITION BY person_id ORDER BY event_ts ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW) AS running_total FROM events",
+    baseReferences: 1,
+    contains: ["ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW"],
+  },
+  {
+    name: "QUALIFY over a window alias",
+    sql: "SELECT event_id, rowNumber() OVER (PARTITION BY person_id ORDER BY event_ts DESC) AS row_num FROM events QUALIFY row_num = 1",
+    baseReferences: 1,
+    contains: [" QUALIFY (row_num ="],
+  },
+  {
+    name: "LIMIT count OFFSET offset",
+    sql: "SELECT event_id FROM events LIMIT 10 OFFSET 5",
+    baseReferences: 1,
+    contains: ["LIMIT 10 OFFSET 5"],
+  },
+  {
+    name: "LIMIT offset, count",
+    sql: "SELECT event_id FROM events LIMIT 5, 10",
+    baseReferences: 1,
+    contains: ["LIMIT 10 OFFSET 5"],
+  },
+  {
+    name: "LIMIT WITH TIES",
+    sql: "SELECT event_name FROM events ORDER BY event_name LIMIT 10 WITH TIES",
+    baseReferences: 1,
+    contains: ["LIMIT 10 WITH TIES"],
+  },
+  {
+    name: "LIMIT BY plus result LIMIT",
+    sql: "SELECT event_name, event_ts FROM events ORDER BY event_ts DESC LIMIT 2 BY event_name LIMIT 10",
+    baseReferences: 1,
+    contains: ["LIMIT 2 BY", "LIMIT 10"],
+  },
+  {
+    name: "INNER JOIN with ON",
+    sql: "SELECT e.event_id FROM events AS e INNER JOIN persons AS p ON p.person_id = e.person_id",
+    baseReferences: 2,
+    contains: ["INNER JOIN", " ON "],
+  },
+  {
+    name: "LEFT OUTER JOIN",
+    sql: "SELECT e.event_id FROM events AS e LEFT OUTER JOIN persons AS p ON p.person_id = e.person_id",
+    baseReferences: 2,
+    contains: ["LEFT JOIN"],
+  },
+  {
+    name: "RIGHT OUTER JOIN",
+    sql: "SELECT e.event_id FROM events AS e RIGHT OUTER JOIN persons AS p ON p.person_id = e.person_id",
+    baseReferences: 2,
+    contains: ["RIGHT JOIN"],
+  },
+  {
+    name: "FULL OUTER JOIN",
+    sql: "SELECT e.event_id FROM events AS e FULL OUTER JOIN persons AS p ON p.person_id = e.person_id",
+    baseReferences: 2,
+    contains: ["FULL JOIN"],
+  },
+  {
+    name: "CROSS JOIN",
+    sql: "SELECT count() AS combinations FROM events AS e CROSS JOIN persons AS p",
+    baseReferences: 2,
+    contains: ["CROSS JOIN"],
+  },
+  {
+    name: "JOIN USING",
+    sql: "SELECT e.event_name FROM events AS e JOIN persons AS p USING (project_id)",
+    baseReferences: 2,
+    contains: ["USING (project_id)"],
+  },
+  {
+    name: "derived-table subquery",
+    sql: "SELECT recent.event_id FROM (SELECT event_id FROM events WHERE event_ts >= '2026-01-01') AS recent",
+    baseReferences: 1,
+  },
+  {
+    name: "scalar subquery",
+    sql: "SELECT (SELECT count() FROM persons) AS person_count",
+    baseReferences: 1,
+    contains: ["( SELECT count()"],
+  },
+  {
+    name: "IN subquery",
+    sql: "SELECT event_id FROM events WHERE event_id IN (SELECT event_id FROM events WHERE event_name = 'signup')",
+    baseReferences: 2,
+    boundValues: ["signup"],
+  },
+  {
+    name: "EXISTS subquery",
+    sql: "SELECT e.event_id FROM events AS e WHERE EXISTS (SELECT p.person_id FROM persons AS p WHERE p.project_id = 'project_a')",
+    baseReferences: 2,
+    contains: ["EXISTS ( SELECT"],
+    boundValues: ["project_a"],
+  },
+  {
+    name: "NOT EXISTS subquery",
+    sql: "SELECT e.event_id FROM events AS e WHERE NOT EXISTS (SELECT p.person_id FROM persons AS p WHERE p.project_id = 'project_a')",
+    baseReferences: 2,
+    contains: ["NOT EXISTS"],
+    boundValues: ["project_a"],
+  },
+  {
+    name: "single CTE",
+    sql: "WITH recent AS (SELECT event_id FROM events WHERE event_ts >= '2026-01-01') SELECT count() AS total FROM recent",
+    baseReferences: 1,
+    contains: ["WITH recent AS"],
+  },
+  {
+    name: "dependent CTEs",
+    sql: "WITH base AS (SELECT event_id FROM events), copied AS (SELECT event_id FROM base) SELECT count() AS total FROM copied",
+    baseReferences: 1,
+    contains: ["WITH base AS", ", copied AS"],
+  },
+  {
+    name: "UNION ALL",
+    sql: "SELECT event_id AS id FROM events UNION ALL SELECT person_id AS id FROM persons",
+    baseReferences: 2,
+    contains: [" UNION ALL ", ") AS voidql_union LIMIT 100000"],
+  },
+  {
+    name: "three UNION ALL arms",
+    sql: "SELECT event_id AS id FROM events UNION ALL SELECT person_id AS id FROM persons UNION ALL SELECT event_id AS id FROM revenue",
+    baseReferences: 3,
+    contains: [" UNION ALL "],
+  },
+  {
+    name: "UNION DISTINCT",
+    sql: "SELECT event_id AS id FROM events UNION DISTINCT SELECT person_id AS id FROM persons",
+    baseReferences: 2,
+    contains: [" UNION DISTINCT "],
+  },
+  {
+    name: "INTERSECT",
+    sql: "SELECT project_id FROM events INTERSECT SELECT project_id FROM persons",
+    baseReferences: 2,
+    contains: [" INTERSECT "],
+  },
+  {
+    name: "EXCEPT",
+    sql: "SELECT project_id FROM events EXCEPT SELECT project_id FROM persons",
+    baseReferences: 2,
+    contains: [" EXCEPT "],
+  },
+  {
+    name: "UNION ALL inside a CTE",
+    sql: "WITH ids AS (SELECT event_id AS id FROM events UNION ALL SELECT person_id AS id FROM persons) SELECT count() AS total FROM ids",
+    baseReferences: 2,
+  },
+  {
+    name: "aggregate function family",
+    sql: "SELECT count(), countIf(event_name = 'a'), countDistinct(person_id), sum(1), sumIf(1, event_name = 'a'), avg(1), min(event_ts), max(event_ts), any(event_name), argMin(event_name, event_ts), argMax(event_name, event_ts) FROM events",
+    baseReferences: 1,
+  },
+  {
+    name: "conditional function family",
+    sql: "SELECT if(event_name = 'a', 'yes', 'no'), multiIf(event_name = 'a', 'a', event_name = 'b', 'b', 'other'), coalesce(person_id, distinct_id), nullIf(person_id, ''), ifNull(person_id, ''), greatest(1, 2), least(1, 2) FROM events",
+    baseReferences: 1,
+  },
+  {
+    name: "string function family",
+    sql: "SELECT lower(event_name), upper(event_name), length(event_name), trim(event_name), concat(event_name, project_id), substring(event_name, 1, 3), startsWith(event_name, 'a'), endsWith(event_name, 'z'), position(event_name, 'x'), replaceAll(event_name, 'a', 'b'), match(event_name, '^a'), replaceRegexpAll(event_name, 'a', 'b'), cityHash64(event_id) FROM events",
+    baseReferences: 1,
+  },
+  {
+    name: "date function family",
+    sql: "SELECT toStartOfMinute(event_ts), toStartOfHour(event_ts), toStartOfDay(event_ts), toStartOfWeek(event_ts), toStartOfMonth(event_ts), toStartOfQuarter(event_ts), toStartOfYear(event_ts), toDate(event_ts), dateDiff('day', event_ts, event_ts), toYear(event_ts), toMonth(event_ts), toDayOfWeek(event_ts) FROM events",
+    baseReferences: 1,
+  },
+  {
+    name: "math and safe cast function family",
+    sql: "SELECT round(amount_usd, 2), floor(amount_usd), ceil(amount_usd), abs(amount_usd), sqrt(amount_usd), pow(amount_usd, 2), exp(amount_usd), log(amount_usd), toFloat64OrNull(properties.amount), toInt64OrNull(properties.quantity), toDateOrNull(properties.date) FROM revenue",
+    baseReferences: 1,
+  },
+  {
+    name: "JSON property namespaces",
+    sql: "SELECT properties.plan, context.locale FROM events WHERE properties.plan = 'pro'",
+    baseReferences: 1,
+    boundValues: ["plan", "locale", "pro"],
+  },
+  {
+    name: "PII columns and traits with capability",
+    sql: "SELECT email, name, traits.plan FROM persons WHERE traits.plan = 'pro'",
+    baseReferences: 1,
+    boundValues: ["plan", "pro"],
+  },
+  {
+    name: "qualified catalog star",
+    sql: "SELECT e.* FROM events AS e",
+    baseReferences: 1,
+  },
+  {
+    name: "comments and trailing semicolon",
+    sql: "/* leading */ SELECT event_id -- projection\nFROM events;",
+    baseReferences: 1,
+  },
+];
diff --git a/packages/core/test/services/voidql/query-compatibility.integration.test.ts b/packages/core/test/services/voidql/query-compatibility.integration.test.ts
new file mode 100644
index 000000000..95bdce827
--- /dev/null
+++ b/packages/core/test/services/voidql/query-compatibility.integration.test.ts
@@ -0,0 +1,47 @@
+/**
+ * Executes the supported VoidQL corpus against a live ClickHouse, proving the
+ * compiled SQL is accepted by the real parameter substrate rather than only by
+ * the compiler's own model of it.
+ *
+ * Previously an environment-gated block inside the unit suite, where it never
+ * ran: the flag was set by no tier.
+ *
+ * The connection comes from the harness — {@link ClickhouseWebClient} bound to
+ * the injected test connections — rather than from the environment, so the case
+ * runs unchanged under every composition: the self-host stack locally, a
+ * provisioned deployment downstream. Only acceptance is asserted, so the
+ * harness's read-write binding proves what a least-privilege one would: every
+ * compiled statement parses, resolves, and binds its parameters.
+ */
+import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
+import { Effect } from "effect";
+import { describe } from "vitest";
+
+import { CoreIntegrationTestHarness } from "@testing/CoreIntegrationTestHarness";
+
+import { compileToIr } from "../../../src/services/voidql/compile.ts";
+import { toStatement } from "../../../src/services/voidql/ir.ts";
+import { CAPABILITIES, SCOPE, SUPPORTED_QUERIES } from "./corpus.ts";
+
+const { test } = CoreIntegrationTestHarness.make();
+
+describe("VoidQL live ClickHouse compatibility", () => {
+  test(
+    "executes every supported query through the real parameter substrate",
+    Effect.gen(function* () {
+      const ch = yield* ClickhouseWebClient.ClickhouseWebClient;
+
+      for (const testCase of SUPPORTED_QUERIES) {
+        const compiled = compileToIr(testCase.sql, SCOPE, CAPABILITIES);
+        yield* toStatement(ch, compiled.pieces).pipe(
+          Effect.mapError(
+            (cause) =>
+              new Error(`ClickHouse rejected compatibility case '${testCase.name}'.`, {
+                cause,
+              }),
+          ),
+        );
+      }
+    }),
+  );
+});
diff --git a/packages/core/test/services/voidql/query-compatibility.test.ts b/packages/core/test/services/voidql/query-compatibility.test.ts
index 42b13de73..cba785d75 100644
--- a/packages/core/test/services/voidql/query-compatibility.test.ts
+++ b/packages/core/test/services/voidql/query-compatibility.test.ts
@@ -5,380 +5,19 @@
  * ClickHouse SELECT surface; administrative, mutating, external-source, and
  * settings/output clauses belong in the permanent rejection corpus below.
  */
-import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
 import { Effect } from "effect";
-import * as Reactivity from "effect/unstable/reactivity/Reactivity";
 
 import { describe, expect, it } from "../../../src/testing/effect-vitest.ts";
 
-import type { Capability } from "../../../src/services/voidql/catalog/types.ts";
 import { compileToIr } from "../../../src/services/voidql/compile.ts";
 import { registeredFunctionNames } from "../../../src/services/voidql/functions.ts";
-import { renderDebugSql, toStatement } from "../../../src/services/voidql/ir.ts";
-import { makeAuthorizedScope } from "../../../src/services/voidql/scope.ts";
+import { renderDebugSql } from "../../../src/services/voidql/ir.ts";
 import { verify } from "../../../src/services/voidql/verify.ts";
-
-const SCOPE = makeAuthorizedScope({
-  organizationId: "org_compatibility",
-  availableProjectIds: ["project_a", "project_b"],
-});
-const CAPABILITIES = new Set<Capability>(["pii"]);
-
-interface SupportedQuery {
-  readonly name: string;
-  readonly sql: string;
-  readonly baseReferences: number;
-  readonly contains?: readonly string[];
-  readonly boundValues?: readonly unknown[];
-}
-
-const SUPPORTED_QUERIES: readonly SupportedQuery[] = [
-  {
-    name: "constant SELECT without FROM",
-    sql: "SELECT 1 AS one, true AS enabled, NULL AS missing",
-    baseReferences: 0,
-  },
-  {
-    name: "explicit and implicit projection aliases",
-    sql: "SELECT event_name AS explicit_name, project_id implicit_project FROM events",
-    baseReferences: 1,
-    contains: ["AS explicit_name", "AS implicit_project"],
-  },
-  {
-    name: "expression alias reused by a later projection",
-    sql: "SELECT upper(event_name) AS normalized, length(normalized) AS normalized_length FROM events",
-    baseReferences: 1,
-    contains: ["upper(", "length(normalized)"],
-  },
-  {
-    name: "projection alias reused in WHERE",
-    sql: "SELECT lower(event_name) AS normalized FROM events WHERE normalized LIKE 'purchase%'",
-    baseReferences: 1,
-    contains: ["WHERE (normalized LIKE"],
-    boundValues: ["purchase%"],
-  },
-  {
-    name: "projection aliases reused in GROUP BY, HAVING, and ORDER BY",
-    sql: "SELECT toStartOfDay(event_ts) AS day, count() AS total FROM events GROUP BY day HAVING total > 1 ORDER BY total DESC",
-    baseReferences: 1,
-    contains: ["GROUP BY day", "HAVING (total >", "ORDER BY total DESC"],
-  },
-  {
-    name: "explicit table alias",
-    sql: "SELECT e.event_id FROM events AS e",
-    baseReferences: 1,
-    contains: ["AS e", "e.event_id"],
-  },
-  {
-    name: "implicit table alias",
-    sql: "SELECT e.event_id FROM events e",
-    baseReferences: 1,
-    contains: ["AS e", "e.event_id"],
-  },
-  {
-    name: "SELECT ALL",
-    sql: "SELECT ALL event_name FROM events",
-    baseReferences: 1,
-  },
-  {
-    name: "SELECT DISTINCT",
-    sql: "SELECT DISTINCT event_name FROM events",
-    baseReferences: 1,
-    contains: ["SELECT DISTINCT"],
-  },
-  {
-    name: "SELECT DISTINCT ON",
-    sql: "SELECT DISTINCT ON (person_id) person_id, event_ts FROM events ORDER BY event_ts DESC",
-    baseReferences: 1,
-    contains: ["SELECT DISTINCT ON (", "ORDER BY"],
-  },
-  {
-    name: "arithmetic precedence and unary negation",
-    sql: "SELECT -(1 + 2 * 3) AS result FROM events LIMIT 1",
-    baseReferences: 1,
-  },
-  {
-    name: "boolean comparison precedence",
-    sql: "SELECT event_id FROM events WHERE event_name = 'a' OR event_name = 'b' AND project_id != 'c'",
-    baseReferences: 1,
-    boundValues: ["a", "b", "c"],
-  },
-  {
-    name: "LIKE and NOT LIKE",
-    sql: "SELECT event_id FROM events WHERE event_name LIKE 'a%' AND event_name NOT LIKE '%bot%'",
-    baseReferences: 1,
-    boundValues: ["a%", "%bot%"],
-  },
-  {
-    name: "ILIKE and NOT ILIKE",
-    sql: "SELECT event_id FROM events WHERE event_name ILIKE 'a%' AND event_name NOT ILIKE '%bot%'",
-    baseReferences: 1,
-    contains: [" ILIKE ", " NOT ILIKE "],
-    boundValues: ["a%", "%bot%"],
-  },
-  {
-    name: "IN and NOT IN literal lists",
-    sql: "SELECT event_id FROM events WHERE event_name IN ('a', 'b') AND project_id NOT IN ('x', 'y')",
-    baseReferences: 1,
-    boundValues: ["a", "b", "x", "y"],
-  },
-  {
-    name: "BETWEEN and NOT BETWEEN",
-    sql: "SELECT event_id FROM events WHERE event_ts BETWEEN '2026-01-01' AND '2026-01-31' AND event_name NOT BETWEEN 'a' AND 'z'",
-    baseReferences: 1,
-  },
-  {
-    name: "IS NULL and IS NOT NULL",
-    sql: "SELECT event_id FROM events WHERE person_id IS NULL OR distinct_id IS NOT NULL",
-    baseReferences: 1,
-  },
-  {
-    name: "searched and simple CASE",
-    sql: "SELECT CASE WHEN event_name = 'a' THEN 'first' ELSE 'other' END AS searched, CASE event_name WHEN 'b' THEN 'second' ELSE 'other' END AS simple FROM events",
-    baseReferences: 1,
-    boundValues: ["a", "first", "b", "second", "other"],
-  },
-  {
-    name: "PREWHERE lowered safely ahead of WHERE",
-    sql: "SELECT event_id FROM events PREWHERE event_ts >= '2026-01-01' WHERE event_name = 'signup'",
-    baseReferences: 1,
-    contains: [" WHERE ", " AND "],
-    boundValues: ["signup"],
-  },
-  {
-    name: "GROUP BY and HAVING",
-    sql: "SELECT event_name, count() AS total FROM events GROUP BY event_name HAVING count() > 10",
-    baseReferences: 1,
-    contains: ["GROUP BY", "HAVING"],
-  },
-  {
-    name: "GROUP BY WITH ROLLUP and TOTALS",
-    sql: "SELECT event_name, count() AS total FROM events GROUP BY event_name WITH ROLLUP WITH TOTALS",
-    baseReferences: 1,
-    contains: ["WITH ROLLUP", "WITH TOTALS"],
-  },
-  {
-    name: "GROUP BY WITH CUBE",
-    sql: "SELECT event_name, project_id, count() AS total FROM events GROUP BY event_name, project_id WITH CUBE",
-    baseReferences: 1,
-    contains: ["WITH CUBE"],
-  },
-  {
-    name: "multi-column ORDER BY",
-    sql: "SELECT event_name, event_ts FROM events ORDER BY event_name ASC, event_ts DESC",
-    baseReferences: 1,
-    contains: ["ORDER BY", " ASC", " DESC"],
-  },
-  {
-    name: "ORDER BY NULLS FIRST and NULLS LAST",
-    sql: "SELECT event_name, event_ts FROM events ORDER BY event_name ASC NULLS FIRST, event_ts DESC NULLS LAST",
-    baseReferences: 1,
-    contains: ["NULLS FIRST", "NULLS LAST"],
-  },
-  {
-    name: "row-number window with partition and ordering",
-    sql: "SELECT event_id, rowNumber() OVER (PARTITION BY person_id ORDER BY event_ts DESC) AS row_num FROM events",
-    baseReferences: 1,
-    contains: ["row_number() OVER (PARTITION BY", "ORDER BY"],
-  },
-  {
-    name: "aggregate window with an unbounded frame",
-    sql: "SELECT event_id, sum(1) OVER (PARTITION BY person_id ORDER BY event_ts ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW) AS running_total FROM events",
-    baseReferences: 1,
-    contains: ["ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW"],
-  },
-  {
-    name: "QUALIFY over a window alias",
-    sql: "SELECT event_id, rowNumber() OVER (PARTITION BY person_id ORDER BY event_ts DESC) AS row_num FROM events QUALIFY row_num = 1",
-    baseReferences: 1,
-    contains: [" QUALIFY (row_num ="],
-  },
-  {
-    name: "LIMIT count OFFSET offset",
-    sql: "SELECT event_id FROM events LIMIT 10 OFFSET 5",
-    baseReferences: 1,
-    contains: ["LIMIT 10 OFFSET 5"],
-  },
-  {
-    name: "LIMIT offset, count",
-    sql: "SELECT event_id FROM events LIMIT 5, 10",
-    baseReferences: 1,
-    contains: ["LIMIT 10 OFFSET 5"],
-  },
-  {
-    name: "LIMIT WITH TIES",
-    sql: "SELECT event_name FROM events ORDER BY event_name LIMIT 10 WITH TIES",
-    baseReferences: 1,
-    contains: ["LIMIT 10 WITH TIES"],
-  },
-  {
-    name: "LIMIT BY plus result LIMIT",
-    sql: "SELECT event_name, event_ts FROM events ORDER BY event_ts DESC LIMIT 2 BY event_name LIMIT 10",
-    baseReferences: 1,
-    contains: ["LIMIT 2 BY", "LIMIT 10"],
-  },
-  {
-    name: "INNER JOIN with ON",
-    sql: "SELECT e.event_id FROM events AS e INNER JOIN persons AS p ON p.person_id = e.person_id",
-    baseReferences: 2,
-    contains: ["INNER JOIN", " ON "],
-  },
-  {
-    name: "LEFT OUTER JOIN",
-    sql: "SELECT e.event_id FROM events AS e LEFT OUTER JOIN persons AS p ON p.person_id = e.person_id",
-    baseReferences: 2,
-    contains: ["LEFT JOIN"],
-  },
-  {
-    name: "RIGHT OUTER JOIN",
-    sql: "SELECT e.event_id FROM events AS e RIGHT OUTER JOIN persons AS p ON p.person_id = e.person_id",
-    baseReferences: 2,
-    contains: ["RIGHT JOIN"],
-  },
-  {
-    name: "FULL OUTER JOIN",
-    sql: "SELECT e.event_id FROM events AS e FULL OUTER JOIN persons AS p ON p.person_id = e.person_id",
-    baseReferences: 2,
-    contains: ["FULL JOIN"],
-  },
-  {
-    name: "CROSS JOIN",
-    sql: "SELECT count() AS combinations FROM events AS e CROSS JOIN persons AS p",
-    baseReferences: 2,
-    contains: ["CROSS JOIN"],
-  },
-  {
-    name: "JOIN USING",
-    sql: "SELECT e.event_name FROM events AS e JOIN persons AS p USING (project_id)",
-    baseReferences: 2,
-    contains: ["USING (project_id)"],
-  },
-  {
-    name: "derived-table subquery",
-    sql: "SELECT recent.event_id FROM (SELECT event_id FROM events WHERE event_ts >= '2026-01-01') AS recent",
-    baseReferences: 1,
-  },
-  {
-    name: "scalar subquery",
-    sql: "SELECT (SELECT count() FROM persons) AS person_count",
-    baseReferences: 1,
-    contains: ["( SELECT count()"],
-  },
-  {
-    name: "IN subquery",
-    sql: "SELECT event_id FROM events WHERE event_id IN (SELECT event_id FROM events WHERE event_name = 'signup')",
-    baseReferences: 2,
-    boundValues: ["signup"],
-  },
-  {
-    name: "EXISTS subquery",
-    sql: "SELECT e.event_id FROM events AS e WHERE EXISTS (SELECT p.person_id FROM persons AS p WHERE p.project_id = 'project_a')",
-    baseReferences: 2,
-    contains: ["EXISTS ( SELECT"],
-    boundValues: ["project_a"],
-  },
-  {
-    name: "NOT EXISTS subquery",
-    sql: "SELECT e.event_id FROM events AS e WHERE NOT EXISTS (SELECT p.person_id FROM persons AS p WHERE p.project_id = 'project_a')",
-    baseReferences: 2,
-    contains: ["NOT EXISTS"],
-    boundValues: ["project_a"],
-  },
-  {
-    name: "single CTE",
-    sql: "WITH recent AS (SELECT event_id FROM events WHERE event_ts >= '2026-01-01') SELECT count() AS total FROM recent",
-    baseReferences: 1,
-    contains: ["WITH recent AS"],
-  },
-  {
-    name: "dependent CTEs",
-    sql: "WITH base AS (SELECT event_id FROM events), copied AS (SELECT event_id FROM base) SELECT count() AS total FROM copied",
-    baseReferences: 1,
-    contains: ["WITH base AS", ", copied AS"],
-  },
-  {
-    name: "UNION ALL",
-    sql: "SELECT event_id AS id FROM events UNION ALL SELECT person_id AS id FROM persons",
-    baseReferences: 2,
-    contains: [" UNION ALL ", ") AS voidql_union LIMIT 100000"],
-  },
-  {
-    name: "three UNION ALL arms",
-    sql: "SELECT event_id AS id FROM events UNION ALL SELECT person_id AS id FROM persons UNION ALL SELECT event_id AS id FROM revenue",
-    baseReferences: 3,
-    contains: [" UNION ALL "],
-  },
-  {
-    name: "UNION DISTINCT",
-    sql: "SELECT event_id AS id FROM events UNION DISTINCT SELECT person_id AS id FROM persons",
-    baseReferences: 2,
-    contains: [" UNION DISTINCT "],
-  },
-  {
-    name: "INTERSECT",
-    sql: "SELECT project_id FROM events INTERSECT SELECT project_id FROM persons",
-    baseReferences: 2,
-    contains: [" INTERSECT "],
-  },
-  {
-    name: "EXCEPT",
-    sql: "SELECT project_id FROM events EXCEPT SELECT project_id FROM persons",
-    baseReferences: 2,
-    contains: [" EXCEPT "],
-  },
-  {
-    name: "UNION ALL inside a CTE",
-    sql: "WITH ids AS (SELECT event_id AS id FROM events UNION ALL SELECT person_id AS id FROM persons) SELECT count() AS total FROM ids",
-    baseReferences: 2,
-  },
-  {
-    name: "aggregate function family",
-    sql: "SELECT count(), countIf(event_name = 'a'), countDistinct(person_id), sum(1), sumIf(1, event_name = 'a'), avg(1), min(event_ts), max(event_ts), any(event_name), argMin(event_name, event_ts), argMax(event_name, event_ts) FROM events",
-    baseReferences: 1,
-  },
-  {
-    name: "conditional function family",
-    sql: "SELECT if(event_name = 'a', 'yes', 'no'), multiIf(event_name = 'a', 'a', event_name = 'b', 'b', 'other'), coalesce(person_id, distinct_id), nullIf(person_id, ''), ifNull(person_id, ''), greatest(1, 2), least(1, 2) FROM events",
-    baseReferences: 1,
-  },
-  {
-    name: "string function family",
-    sql: "SELECT lower(event_name), upper(event_name), length(event_name), trim(event_name), concat(event_name, project_id), substring(event_name, 1, 3), startsWith(event_name, 'a'), endsWith(event_name, 'z'), position(event_name, 'x'), replaceAll(event_name, 'a', 'b'), match(event_name, '^a'), replaceRegexpAll(event_name, 'a', 'b'), cityHash64(event_id) FROM events",
-    baseReferences: 1,
-  },
-  {
-    name: "date function family",
-    sql: "SELECT toStartOfMinute(event_ts), toStartOfHour(event_ts), toStartOfDay(event_ts), toStartOfWeek(event_ts), toStartOfMonth(event_ts), toStartOfQuarter(event_ts), toStartOfYear(event_ts), toDate(event_ts), dateDiff('day', event_ts, event_ts), toYear(event_ts), toMonth(event_ts), toDayOfWeek(event_ts) FROM events",
-    baseReferences: 1,
-  },
-  {
-    name: "math and safe cast function family",
-    sql: "SELECT round(amount_usd, 2), floor(amount_usd), ceil(amount_usd), abs(amount_usd), sqrt(amount_usd), pow(amount_usd, 2), exp(amount_usd), log(amount_usd), toFloat64OrNull(properties.amount), toInt64OrNull(properties.quantity), toDateOrNull(properties.date) FROM revenue",
-    baseReferences: 1,
-  },
-  {
-    name: "JSON property namespaces",
-    sql: "SELECT properties.plan, context.locale FROM events WHERE properties.plan = 'pro'",
-    baseReferences: 1,
-    boundValues: ["plan", "locale", "pro"],
-  },
-  {
-    name: "PII columns and traits with capability",
-    sql: "SELECT email, name, traits.plan FROM persons WHERE traits.plan = 'pro'",
-    baseReferences: 1,
-    boundValues: ["plan", "pro"],
-  },
-  {
-    name: "qualified catalog star",
-    sql: "SELECT e.* FROM events AS e",
-    baseReferences: 1,
-  },
-  {
-    name: "comments and trailing semicolon",
-    sql: "/* leading */ SELECT event_id -- projection\nFROM events;",
-    baseReferences: 1,
-  },
-];
+import {
+  CAPABILITIES,
+  SCOPE,
+  SUPPORTED_QUERIES,
+} from "./corpus.ts";
 
 describe("VoidQL supported ClickHouse SELECT compatibility corpus", () => {
   for (const testCase of SUPPORTED_QUERIES) {
@@ -395,35 +34,6 @@ describe("VoidQL supported ClickHouse SELECT compatibility corpus", () => {
   }
 });
 
-const describeClickhouse = process.env.VOIDQL_CLICKHOUSE_TEST === "1" ? describe : describe.skip;
-
-describeClickhouse("VoidQL live ClickHouse compatibility", () => {
-  it("executes every supported query through the real parameter substrate", async () => {
-    const ch = await Effect.runPromise(
-      ClickhouseWebClient.makeUnchecked(() => ({
-        url: process.env.CLICKHOUSE_URL ?? "http://127.0.0.1:8123",
-        database: process.env.CLICKHOUSE_DATABASE ?? "voidhash",
-        username: process.env.CLICKHOUSE_ANALYTICS_QUERY_USERNAME ?? "voidhash_query",
-        password: process.env.CLICKHOUSE_ANALYTICS_QUERY_PASSWORD ?? "password",
-      })).pipe(Effect.provide(Reactivity.layer)),
-    );
-
-    for (const testCase of SUPPORTED_QUERIES) {
-      const compiled = compileToIr(testCase.sql, SCOPE, CAPABILITIES);
-      await Effect.runPromise(
-        toStatement(ch, compiled.pieces).pipe(
-          Effect.mapError(
-            (cause) =>
-              new Error(`ClickHouse rejected compatibility case '${testCase.name}'.`, {
-                cause,
-              }),
-          ),
-        ),
-      );
-    }
-  });
-});
-
 describe("VoidQL function allowlist snapshot", () => {
   it("lists every callable function intentionally", () => {
     expect([...registeredFunctionNames()].sort()).toEqual(
diff --git a/packages/core/test/services/webhookDispatch/WebhookDeliveryService.integration.test.ts b/packages/core/test/services/webhookDispatch/WebhookDeliveryService.integration.test.ts
index 12dc5812e..0f58f8512 100644
--- a/packages/core/test/services/webhookDispatch/WebhookDeliveryService.integration.test.ts
+++ b/packages/core/test/services/webhookDispatch/WebhookDeliveryService.integration.test.ts
@@ -29,7 +29,7 @@ import { Effect } from "effect";
 import { describe, expect } from "vitest";
 
 import { WebhookDeliveryService } from "@voidhash/core/services/webhookDispatch/WebhookDeliveryService";
-import type { DeliverWebhookInput } from "@voidhash/core/services/webhookDispatch/WebhookDeliveryWorkflow";
+import type { DeliverWebhookInput } from "@voidhash/core/workflows/definitions";
 import {
   Db,
   WebhookDeliveryStatus,
diff --git a/packages/core/test/services/webhookDispatch/WebhookDispatchService.integration.test.ts b/packages/core/test/services/webhookDispatch/WebhookDispatchService.integration.test.ts
index 73e6c6048..6d0e352ba 100644
--- a/packages/core/test/services/webhookDispatch/WebhookDispatchService.integration.test.ts
+++ b/packages/core/test/services/webhookDispatch/WebhookDispatchService.integration.test.ts
@@ -3,8 +3,8 @@
  * backend stack provisioned once by `test/_testing/globalSetup.ts` (live
  * PlanetScale DB). The producer side of outbound webhooks: `emit` finds the
  * project's active, subscribed endpoints, writes a `webhook_delivery` row per
- * endpoint, then forks a fire-and-forget dispatch onto {@link
- * WebhookDeliveryWorkflow}.
+ * endpoint, then forks a fire-and-forget dispatch of the shared
+ * `DeliverWebhook` definition.
  *
  * Each test drives `emit` end-to-end and verifies the *persisted* side effects
  * rather than just the return value:
@@ -13,11 +13,9 @@
  *  - the `deliveriesCreated` count returned,
  *  - the dispatch hand-off recorded by an in-process workflow stub.
  *
- * `WebhookDeliveryWorkflow` is an abstract port whose only concrete adapter is a
- * Cloudflare Workflow — there is no in-process seam for it — so it is replaced
- * by a recording stub layer that captures each `dispatch` call. The real
- * delivery (HTTP POST + retry) is the workflow runtime's concern and is covered
- * by a `test.todo` below.
+ * A recording workflow runner captures each dispatch. The real delivery (HTTP
+ * POST + retry) is the workflow runtime's concern and is covered by a
+ * `test.todo` below.
  *
  * Conventions used throughout:
  *  - Every test shares the one seeded fixture project ({@link CoreTestFixture})
@@ -34,10 +32,10 @@ import { Effect, Layer, Ref } from "effect";
 import { describe, expect, test as vitestTest } from "vitest";
 
 import { WebhookDispatchService } from "@voidhash/core/services/webhookDispatch/WebhookDispatchService";
-import {
-  type DeliverWebhookInput,
-  WebhookDeliveryWorkflow,
-} from "@voidhash/core/services/webhookDispatch/WebhookDeliveryWorkflow";
+import type { DeliverWebhookInput } from "@voidhash/core/workflows/definitions";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import * as TestWorkflowRunner from "@voidhash/platform/TestWorkflowRunner";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
 import { WebhookServiceError } from "@voidhash/core/services/webhookManager/WebhookManagerService";
 import {
   WebhookDeliveryStatus,
@@ -60,27 +58,26 @@ let idSeq = 0;
 const uniqueId = (label: string) => `it-wh-${label}-${Date.now()}-${idSeq++}`;
 
 /**
- * Recording {@link WebhookDeliveryWorkflow} stub. The concrete adapter is a
- * Cloudflare Workflow with no in-process seam, so dispatches are captured into a
- * `Ref` instead. `dispatch` returns immediately (`Effect.void`); the service
- * forks it fire-and-forget, so a test reads the recorded calls after giving the
- * detached fibers a tick to run.
+ * Recording workflow runner. Dispatches are captured into a `Ref`; the service
+ * forks them fire-and-forget, so a test reads the recorded calls after giving
+ * the detached fibers a tick to run.
  */
 const makeRecordingWorkflow = Effect.gen(function* () {
   const calls = yield* Ref.make<ReadonlyArray<DeliverWebhookInput>>([]);
-  const layer = Layer.succeed(WebhookDeliveryWorkflow, {
-    dispatch: (input: DeliverWebhookInput) => Ref.update(calls, (prev) => [...prev, input]),
-  });
+  const runner = TestWorkflowRunner.make();
+  const layer = Layer.mergeAll(
+    Layer.succeed(WorkflowRunner, {
+      ...runner,
+      dispatch: (workflow, input) =>
+        Ref.update(calls, (prev) => [...prev, input as DeliverWebhookInput]).pipe(
+          Effect.andThen(runner.dispatch(workflow, input)),
+        ),
+    }),
+    Layer.succeed(PlatformRuntime, PlatformRuntime.of({})),
+  );
   return { calls, layer } as const;
 });
 
-/** Read a single delivery row straight from the database, bypassing the service. */
-const findDeliveryRow = (id: string) =>
-  Effect.gen(function* () {
-    const db = yield* Db;
-    return yield* db.query.webhookDeliveries.findFirst({ where: { id } });
-  });
-
 /** All delivery rows recorded for a given endpoint. */
 const findDeliveriesForEndpoint = (endpointId: string) =>
   Effect.gen(function* () {
@@ -156,19 +153,18 @@ const withCleanup = <E, R>(
 
 /**
  * Provide the service-under-test layer backed by a fresh recording workflow
- * stub, and expose that stub's `calls` Ref to the body. The harness supplies
- * `Db`; the stub discharges {@link WebhookDeliveryWorkflow}, the service's only
- * non-harness dependency.
+ * runner, and expose its `calls` Ref to the body. The harness supplies `Db` and
+ * the shared runtime services.
  */
 const runEmit = <E>(
   body: (
     recorded: Ref.Ref<ReadonlyArray<DeliverWebhookInput>>,
-  ) => Effect.Effect<void, E, Db | WebhookDispatchService>,
+  ) => Effect.Effect<void, E, Db | WebhookDispatchService | WorkflowRunner | PlatformRuntime>,
 ): Effect.Effect<void, E, Db> =>
   Effect.gen(function* () {
     const workflow = yield* makeRecordingWorkflow;
     yield* body(workflow.calls).pipe(
-      Effect.provide(WebhookDispatchService.layer.pipe(Layer.provide(workflow.layer))),
+      Effect.provide(WebhookDispatchService.layer.pipe(Layer.provideMerge(workflow.layer))),
     );
   });
 
@@ -412,11 +408,10 @@ describe("WebhookDispatchService.emit", () => {
   );
 
   // Real outbound delivery (signed HTTP POST + retry/backoff + attempt-log rows)
-  // lives in the Cloudflare `DeliverWebhookWorkflow` adapter behind the abstract
-  // `WebhookDeliveryWorkflow` port. There is no in-process seam for it, so it is
-  // deferred to an app-level test running against the workflow runtime. The
-  // producer's hand-off (delivery row + dispatch call) is fully covered above.
+  // is deferred to an app-level test running against a durable workflow
+  // runtime. The producer's hand-off (delivery row + dispatch call) is fully
+  // covered above.
   vitestTest.todo(
-    "delivers the webhook over HTTP and records attempt rows — deferred: requires the Cloudflare Workflow runtime backing WebhookDeliveryWorkflow",
+    "delivers the webhook over HTTP and records attempt rows — deferred: requires a durable workflow runtime",
   );
 });
diff --git a/packages/core/test/services/webhookManager/WebhookManagerService.integration.test.ts b/packages/core/test/services/webhookManager/WebhookManagerService.integration.test.ts
index f6055634c..75d61d102 100644
--- a/packages/core/test/services/webhookManager/WebhookManagerService.integration.test.ts
+++ b/packages/core/test/services/webhookManager/WebhookManagerService.integration.test.ts
@@ -14,9 +14,7 @@
  *  - the matching `audit_log` row (entity, action, actor, change snapshot),
  *  - the generated `whsec_<64 hex>` secret on create / rotate.
  *
- * The concrete {@link WebhookDeliveryWorkflow} is a Cloudflare Workflow adapter
- * wired at the application root and absent in-process, so we substitute a
- * recording stub (mirroring `apps/backend` `TestLayers`). `updateEndpoint`
+ * The test substitutes a recording workflow runner. `updateEndpoint`
  * intentionally does *not* dispatch; only `retryDelivery` and `testEndpoint`
  * hand a delivery off, and they do so via `Effect.forkDetach` (fire-and-forget).
  * Those tests assert the synchronous, deterministic persisted state and use
@@ -40,10 +38,10 @@ import {
   WebhookEndpointNotFoundError,
   WebhookValidationError,
 } from "@voidhash/core/domain/webhook/Webhook";
-import {
-  type DeliverWebhookInput,
-  WebhookDeliveryWorkflow,
-} from "@voidhash/core/services/webhookDispatch/WebhookDeliveryWorkflow";
+import type { DeliverWebhookInput } from "@voidhash/core/workflows/definitions";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import * as TestWorkflowRunner from "@voidhash/platform/TestWorkflowRunner";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
 import {
   AuditLogAction,
   AuditLogActorType,
@@ -73,28 +71,34 @@ let seq = 0;
 const uniqueSlug = (label: string) => `it-wh-${label}-${Date.now()}-${seq++}`;
 
 // ---------------------------------------------------------------------------
-// Recording WebhookDeliveryWorkflow stub. The concrete adapter is a Cloudflare
-// Workflow wired at the app root; here we substitute a layer whose `dispatch`
-// records its input (and completes a Deferred so a test can await the detached
-// fork). One fresh recorder per test so calls never leak between tests.
+// Recording workflow runner. The layer records each dispatch and completes a
+// Deferred so a test can await the detached fork. One fresh recorder per test
+// keeps calls isolated.
 // ---------------------------------------------------------------------------
 
 interface Recorder {
   readonly calls: DeliverWebhookInput[];
   readonly firstDispatch: Deferred.Deferred<DeliverWebhookInput>;
-  readonly layer: Layer.Layer<WebhookDeliveryWorkflow>;
+  readonly layer: Layer.Layer<WorkflowRunner | PlatformRuntime>;
 }
 
 const makeRecorder = (): Recorder => {
   const calls: DeliverWebhookInput[] = [];
   const firstDispatch = Deferred.makeUnsafe<DeliverWebhookInput>();
-  const layer = Layer.succeed(WebhookDeliveryWorkflow, {
-    dispatch: (input: DeliverWebhookInput) =>
-      Effect.gen(function* () {
-        calls.push(input);
-        yield* Deferred.succeed(firstDispatch, input);
-      }),
-  });
+  const runner = TestWorkflowRunner.make();
+  const layer = Layer.mergeAll(
+    Layer.succeed(WorkflowRunner, {
+      ...runner,
+      dispatch: (workflow, input) =>
+        Effect.gen(function* () {
+          const delivery = input as DeliverWebhookInput;
+          calls.push(delivery);
+          yield* Deferred.succeed(firstDispatch, delivery);
+          return yield* runner.dispatch(workflow, input);
+        }),
+    }),
+    Layer.succeed(PlatformRuntime, PlatformRuntime.of({})),
+  );
   return { calls, firstDispatch, layer };
 };
 
diff --git a/packages/core/test/utils/permissions.test.ts b/packages/core/test/utils/permissions.test.ts
index 43f659508..a272ab4c7 100644
--- a/packages/core/test/utils/permissions.test.ts
+++ b/packages/core/test/utils/permissions.test.ts
@@ -182,7 +182,7 @@ describe("checkProjectPermission", () => {
     // ActionForbiddenError. We pin that real boundary here so a future change
     // making the service genuinely optional shows up as a test break.
     const exit = await Effect.runPromiseExit(
-      // biome-ignore lint/suspicious/noExplicitAny: deliberately running without
+      // deliberately running without
       // the AuthSession requirement satisfied to observe the missing-service defect.
       checkProjectPermission(
         "project_target",
diff --git a/packages/core/tsconfig.json b/packages/core/tsconfig.json
index d41a38d00..76f6ed59b 100644
--- a/packages/core/tsconfig.json
+++ b/packages/core/tsconfig.json
@@ -3,8 +3,13 @@
   "include": ["src", "test", "sst-env.d.ts"],
   "exclude": [
     "**/node_modules/**",
-    "**/*.integration.test.ts",
-    "test/services/paymentProviders/stripe/stripe-test-support.ts"
+    // These three reach across package roots (react-native SDK internals and
+    // the backend's SDK HTTP harness), which rootDir rejects. They are also
+    // excluded from the shared-fixture integration run; the purchase pipeline
+    // typechecks them in their home packages.
+    "test/_testing/ReactNativePurchaseHarness.ts",
+    "test/services/paymentProviders/appStore/AppStorePaymentProviderService.integration.test.ts",
+    "test/services/paymentProviders/googlePlay/GooglePlayPaymentProviderService.integration.test.ts"
   ],
   "compilerOptions": {
     "rootDir": ".",
diff --git a/packages/core/vitest.integration.mts b/packages/core/vitest.integration.mts
new file mode 100644
index 000000000..331d18572
--- /dev/null
+++ b/packages/core/vitest.integration.mts
@@ -0,0 +1,35 @@
+import { defineConfig } from "vite-plus";
+
+// The integration suite runs against a provisioned environment: locally the
+// self-host stack (`pnpm test:integration`), downstream whatever the
+// composition's globalSetup provides. Files run sequentially — they share one
+// database and one seeded fixture container.
+//
+// `isolate: false` keeps the module registry between files. Re-importing the
+// module graph per file cost ~90s of a 110s run; the tests themselves are ~16s.
+export default defineConfig({
+  resolve: {
+    tsconfigPaths: true,
+  },
+  test: {
+    environment: "node",
+    include: ["./**/*.integration.test.ts"],
+    exclude: [
+      // Purchase-provider flows exercised through the SDK HTTP harness; run
+      // via the dedicated purchase pipeline, not the shared-fixture suite.
+      "./test/services/paymentProviders/appStore/AppStorePaymentProviderService.integration.test.ts",
+      "./test/services/paymentProviders/googlePlay/GooglePlayPaymentProviderService.integration.test.ts",
+      "./node_modules/**",
+      "./dist/**",
+    ],
+    globalSetup: ["./test/_testing/globalSetup.ts"],
+    passWithNoTests: true,
+    reporters: ["verbose"],
+    pool: "threads",
+    isolate: false,
+    fileParallelism: false,
+    hookTimeout: 300_000,
+    teardownTimeout: 300_000,
+    testTimeout: 120_000,
+  },
+});
diff --git a/packages/core/vitest.unit.mts b/packages/core/vitest.unit.mts
index 7f23222f6..4d8eb60c4 100644
--- a/packages/core/vitest.unit.mts
+++ b/packages/core/vitest.unit.mts
@@ -1,9 +1,12 @@
 import { defineConfig } from "vite-plus";
 
+// Unit tier: every `*.test.ts` except the stack-backed integration files.
+// `scripts/check-test-tiers.mjs` enforces this split across the repository.
 export default defineConfig({
   test: {
-    exclude: ["./**/*.integration.test.ts", "./node_modules/**"],
+    environment: "node",
     include: ["./**/*.test.ts"],
+    exclude: ["./**/*.integration.test.ts", "./node_modules/**", "./dist/**"],
     reporters: ["verbose"],
   },
 });
diff --git a/packages/db/src/schema.ts b/packages/db/src/schema.ts
index 8c59a5106..b57caa401 100644
--- a/packages/db/src/schema.ts
+++ b/packages/db/src/schema.ts
@@ -1292,7 +1292,6 @@ export const appStoreTransactions = pgTable(
 );
 
 // Design file
-// biome-ignore lint/suspicious/noEmptyInterface: ok
 export interface DesignFileMetadata {}
 
 // Paywall source enum — how the paywall is authored.
diff --git a/packages/db/src/types.ts b/packages/db/src/types.ts
index 59bf2bca3..85fcce6ca 100644
--- a/packages/db/src/types.ts
+++ b/packages/db/src/types.ts
@@ -2,7 +2,6 @@ import type { InferInsertModel, InferSelectModel, Table } from "drizzle-orm";
 
 import type * as schema from "./schema.ts";
 
-// biome-ignore lint/suspicious/noExplicitAny: should be ok
 type InferUpdateModel<T extends Table<any>> = Partial<InferSelectModel<T>> & {
   id: string;
 };
diff --git a/packages/db/tests/migrations.integration.test.ts b/packages/db/tests/migrations.integration.test.ts
index b6d979f17..e0c291402 100644
--- a/packages/db/tests/migrations.integration.test.ts
+++ b/packages/db/tests/migrations.integration.test.ts
@@ -20,7 +20,6 @@ const config: DbConfig = {
   port: adminConfig.port,
   username: adminConfig.user,
 };
-const describeMigrations = process.env.DB_MIGRATIONS_TEST === "1" ? describe : describe.skip;
 
 const withAdminClient = async (run: (client: Client) => Promise<void>) => {
   const client = new Client(adminConfig);
@@ -32,7 +31,7 @@ const withAdminClient = async (run: (client: Client) => Promise<void>) => {
   }
 };
 
-describeMigrations("application database migrations", () => {
+describe("application database migrations", () => {
   beforeAll(() =>
     withAdminClient(async (client) => {
       await client.query(`CREATE DATABASE "${databaseName}"`);
diff --git a/packages/db/vitest.integration.mts b/packages/db/vitest.integration.mts
new file mode 100644
index 000000000..b2228511b
--- /dev/null
+++ b/packages/db/vitest.integration.mts
@@ -0,0 +1,16 @@
+import { defineConfig } from "vite-plus";
+
+// Integration tier: runs against the provisioned self-host stack via
+// `pnpm test:integration`. Timeouts are generous because these tests wait on
+// real containers rather than fakes.
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["./**/*.integration.test.ts"],
+    exclude: ["./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
+    hookTimeout: 300_000,
+    teardownTimeout: 300_000,
+    testTimeout: 120_000,
+  },
+});
diff --git a/packages/db/vitest.mts b/packages/db/vitest.mts
index 2f6ca2f90..0373f4661 100644
--- a/packages/db/vitest.mts
+++ b/packages/db/vitest.mts
@@ -1,10 +1,14 @@
 import { defineConfig } from "vite-plus";
 
+// Unit tier: the package's only suite is its migration integration test, so
+// this tier is intentionally empty rather than absent — `turbo test` stays
+// uniform across packages.
 export default defineConfig({
   test: {
     environment: "node",
-    exclude: ["./node_modules/**"],
-    include: ["./tests/**/*.test.ts"],
+    include: ["./**/*.test.ts"],
+    exclude: ["./**/*.integration.test.ts", "./node_modules/**", "./dist/**"],
     reporters: ["verbose"],
+    passWithNoTests: true,
   },
 });
diff --git a/packages/emails/sst-env.d.ts b/packages/emails/sst-env.d.ts
index eec65b9bd..cf5e5fbe5 100644
--- a/packages/emails/sst-env.d.ts
+++ b/packages/emails/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/packages/generated-clients/sst-env.d.ts b/packages/generated-clients/sst-env.d.ts
index f2ed71576..b3584169c 100644
--- a/packages/generated-clients/sst-env.d.ts
+++ b/packages/generated-clients/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../../sst-env.d.ts" />
 
diff --git a/packages/paywall-renderer-preact/src/components/component.tsx b/packages/paywall-renderer-preact/src/components/component.tsx
index 54e95e62d..31670e2e5 100644
--- a/packages/paywall-renderer-preact/src/components/component.tsx
+++ b/packages/paywall-renderer-preact/src/components/component.tsx
@@ -94,7 +94,7 @@ function PreviewNodeView({
       return (
         <div style={previewNodeStyle(node.style, node.type, node.motion)}>
           {node.children.map((child, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: preview trees are immutable per contentHash+state
+            // preview trees are immutable per contentHash+state
             <PreviewNodeView fireAction={fireAction} key={index} node={child} slot={slot} />
           ))}
         </div>
@@ -106,7 +106,7 @@ function PreviewNodeView({
       return (
         <div onClick={onClick} style={previewNodeStyle(node.style, "pressable", node.motion)}>
           {node.children.map((child, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: preview trees are immutable per contentHash+state
+            // preview trees are immutable per contentHash+state
             <PreviewNodeView fireAction={fireAction} key={index} node={child} slot={slot} />
           ))}
         </div>
diff --git a/packages/paywall-renderer-preact/sst-env.d.ts b/packages/paywall-renderer-preact/sst-env.d.ts
index eec65b9bd..cf5e5fbe5 100644
--- a/packages/paywall-renderer-preact/sst-env.d.ts
+++ b/packages/paywall-renderer-preact/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/packages/paywall-renderer-web-core/sst-env.d.ts b/packages/paywall-renderer-web-core/sst-env.d.ts
index eec65b9bd..cf5e5fbe5 100644
--- a/packages/paywall-renderer-web-core/sst-env.d.ts
+++ b/packages/paywall-renderer-web-core/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/packages/platform/LICENSE.md b/packages/platform/LICENSE.md
new file mode 100644
index 000000000..19bae3588
--- /dev/null
+++ b/packages/platform/LICENSE.md
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+Everyone is permitted to copy and distribute verbatim copies
+of this license document, but changing it is not allowed.
+
+                            Preamble
+
+The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate. Many developers of free software are heartened and
+encouraged by the resulting cooperation. However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community. It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server. Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals. This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+0. Definitions.
+
+"This License" refers to version 3 of the GNU Affero General Public License.
+
+"Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy. The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+1. Source Code.
+
+The "source code" for a work means the preferred form of the work
+for making modifications to it. "Object code" means any non-source
+form of a work.
+
+A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+The Corresponding Source for a work in source code form is that
+same work.
+
+2. Basic Permissions.
+
+All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force. You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright. Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under
+the conditions stated below. Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+4. Conveying Verbatim Copies.
+
+You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+5. Conveying Modified Source Versions.
+
+You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+6. Conveying Non-Source Forms.
+
+You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling. In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage. For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product. A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source. The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed. Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+7. Additional Terms.
+
+"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+8. Termination.
+
+You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or
+run a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License. You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+13. Remote Network Interaction; Use with the GNU General Public License.
+
+Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software. This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time. Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number. If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source. For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code. There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
diff --git a/packages/platform/package.json b/packages/platform/package.json
new file mode 100644
index 000000000..1782ecce4
--- /dev/null
+++ b/packages/platform/package.json
@@ -0,0 +1,44 @@
+{
+  "name": "@voidhash/platform",
+  "version": "0.0.1-alpha.1",
+  "private": true,
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/voidhashcom/voidhash",
+    "directory": "packages/platform"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./CronScheduler": "./src/CronScheduler.ts",
+    "./EffectWorkflowRunner": "./src/EffectWorkflowRunner.ts",
+    "./MemoryWorkflowRunner": "./src/MemoryWorkflowRunner.ts",
+    "./TestWorkflowRunner": "./src/TestWorkflowRunner.ts",
+    "./DurableEntity": "./src/DurableEntity.ts",
+    "./KeyValueStore": "./src/KeyValueStore.ts",
+    "./Mailer": "./src/Mailer.ts",
+    "./ObjectStore": "./src/ObjectStore.ts",
+    "./PlatformRuntime": "./src/PlatformRuntime.ts",
+    "./Primitive": "./src/Primitive.ts",
+    "./Queue": "./src/Queue.ts",
+    "./Screenshot": "./src/Screenshot.ts",
+    "./Workflow": "./src/Workflow.ts",
+    "./WorkflowRegistration": "./src/WorkflowRegistration.ts",
+    "./WorkflowRunner": "./src/WorkflowRunner.ts",
+    "./conformance": "./src/conformance/index.ts"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "typecheck-go": "tsgo --noEmit"
+  },
+  "devDependencies": {
+    "@voidhash/tsconfig": "workspace:*",
+    "effect": "catalog:",
+    "typescript": "catalog:",
+    "vite-plus": "catalog:"
+  },
+  "peerDependencies": {
+    "effect": "catalog:"
+  }
+}
diff --git a/packages/platform/src/CronScheduler.ts b/packages/platform/src/CronScheduler.ts
new file mode 100644
index 000000000..b878ed528
--- /dev/null
+++ b/packages/platform/src/CronScheduler.ts
@@ -0,0 +1,94 @@
+import { Context, Effect, Schema } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+import type { PrimitiveDefinition } from "./Primitive.ts";
+
+/** Stable failure raised by a scheduled-job driver. */
+export class CronSchedulerError extends Schema.TaggedErrorClass<CronSchedulerError>(
+  "CronSchedulerError",
+)("CronSchedulerError", {
+  cause: Schema.String,
+  jobName: Schema.String,
+  operation: Schema.String,
+}) {}
+
+/** Metadata passed to a scheduled job invocation. */
+export interface CronJobContext {
+  readonly scheduledTime: Date;
+  readonly catchUp: boolean;
+}
+
+/** A provider-neutral scheduled job definition. */
+export interface CronJob<R = never> {
+  readonly name: string;
+  readonly expression: string;
+  readonly timeZone?: string;
+  readonly leaseMillis?: number;
+  readonly run: (context: CronJobContext) => Effect.Effect<void, unknown, R>;
+}
+
+/** Polling policy for a long-running scheduled job. */
+export interface CronRunOptions {
+  readonly pollIntervalMillis?: number;
+}
+
+/** Provider-neutral persisted cron capabilities. */
+export interface CronSchedulerShape {
+  /** Claims and runs at most one due schedule slot. */
+  readonly tick: <R>(
+    job: CronJob<R>,
+    now?: Date,
+  ) => Effect.Effect<boolean, CronSchedulerError, PlatformRuntime | R>;
+  /** Polls a job until the enclosing Effect fiber is interrupted. */
+  readonly run: <R>(
+    job: CronJob<R>,
+    options?: CronRunOptions,
+  ) => Effect.Effect<never, CronSchedulerError, PlatformRuntime | R>;
+}
+
+/** Provider-neutral cron runtime used by application composition roots. */
+export class CronScheduler extends Context.Service<CronScheduler, CronSchedulerShape>()(
+  "@voidhash/platform/CronScheduler",
+) {}
+
+/** Cron-job constructors. */
+export const CronJob = {
+  /** Defines a provider-neutral cron job while preserving its requirements. */
+  define: <R>(job: CronJob<R>): CronJob<R> => job,
+};
+
+/**
+ * A scheduled job definition with operations bound to the installed runtime.
+ *
+ * Both the single-node scheduler and cloud cron triggers bind the same
+ * definition, so a schedule is declared exactly once.
+ */
+export interface CronDefinition<Name extends string, R>
+  extends CronJob<R>, PrimitiveDefinition<"cron", Name> {
+  readonly name: Name;
+  /** Claims and executes at most one due schedule slot. */
+  readonly tick: (
+    now?: Date,
+  ) => Effect.Effect<boolean, CronSchedulerError, CronScheduler | PlatformRuntime | R>;
+  /** Runs this schedule until its enclosing fiber is interrupted. */
+  readonly start: (
+    options?: CronRunOptions,
+  ) => Effect.Effect<never, CronSchedulerError, CronScheduler | PlatformRuntime | R>;
+}
+
+/** Creates a scheduled job definition without selecting a runtime backend. */
+export const ScheduledJob = {
+  /** Creates a scheduled job definition without selecting a runtime backend. */
+  define: <const Name extends string, R>(
+    job: CronJob<R> & { readonly name: Name },
+  ): CronDefinition<Name, R> => {
+    const definition = { ...job, kind: "cron" as const };
+    return {
+      ...definition,
+      tick: (now) =>
+        CronScheduler.pipe(Effect.flatMap((scheduler) => scheduler.tick(definition, now))),
+      start: (options) =>
+        CronScheduler.pipe(Effect.flatMap((scheduler) => scheduler.run(definition, options))),
+    };
+  },
+};
diff --git a/packages/platform/src/DurableEntity.ts b/packages/platform/src/DurableEntity.ts
new file mode 100644
index 000000000..96db227e7
--- /dev/null
+++ b/packages/platform/src/DurableEntity.ts
@@ -0,0 +1,103 @@
+import { Context, type Effect } from "effect";
+
+/** Stable identity of one durable entity instance. */
+export interface DurableEntityAddress {
+  readonly type: string;
+  readonly id: string;
+}
+
+/** Runtime-neutral WebSocket session attached to an entity. */
+export interface DurableEntitySession {
+  readonly id: string;
+  readonly send: (message: string | Uint8Array) => Effect.Effect<void>;
+  readonly close: (code?: number, reason?: string) => Effect.Effect<void>;
+  readonly getAttachment: Effect.Effect<unknown | undefined>;
+  readonly setAttachment: (attachment: unknown) => Effect.Effect<void>;
+}
+
+/** Entity-local key-value storage. */
+export interface DurableEntityKeyValue {
+  readonly get: (key: string) => Effect.Effect<unknown | undefined>;
+  readonly put: (key: string, value: unknown) => Effect.Effect<void>;
+  readonly delete: (key: string) => Effect.Effect<void>;
+}
+
+/** Optional embedded SQL store supplied by adapters that support it. */
+export interface DurableEntitySql {
+  readonly execute: <Row extends Readonly<Record<string, unknown>>>(
+    statement: string,
+    bindings?: ReadonlyArray<unknown>,
+  ) => Effect.Effect<ReadonlyArray<Row>>;
+}
+
+/** One replaceable persisted alarm for an entity. */
+export interface DurableEntityAlarm {
+  readonly get: Effect.Effect<number | undefined>;
+  readonly set: (scheduledTime: number) => Effect.Effect<void>;
+  readonly delete: Effect.Effect<void>;
+}
+
+/** A persisted alarm whose scheduled time has arrived. */
+export interface DueDurableEntityAlarm {
+  readonly address: DurableEntityAddress;
+  readonly scheduledTime: number;
+}
+
+/** Control plane a scheduler polls to find the entities whose alarms are due. */
+export interface DurableEntityAlarmControlShape {
+  readonly listDueAlarms: (
+    now: number,
+    limit: number,
+  ) => Effect.Effect<ReadonlyArray<DueDurableEntityAlarm>>;
+}
+
+/**
+ * Exposes persisted alarms to an out-of-band dispatcher.
+ *
+ * Runtimes whose entity storage fires alarms by itself (Cloudflare Durable
+ * Objects) never publish this service; runtimes whose storage cannot enumerate
+ * pending alarms have to, or an armed alarm can never fire.
+ */
+export class DurableEntityAlarmControl extends Context.Service<
+  DurableEntityAlarmControl,
+  DurableEntityAlarmControlShape
+>()("@voidhash/platform/DurableEntityAlarmControl") {}
+
+/** Live sessions currently attached to an entity instance. */
+export interface DurableEntitySessions {
+  readonly get: (sessionId: string) => Effect.Effect<DurableEntitySession | undefined>;
+  readonly list: Effect.Effect<ReadonlyArray<DurableEntitySession>>;
+  readonly attach: (session: DurableEntitySession) => Effect.Effect<void>;
+  readonly remove: (sessionId: string) => Effect.Effect<void>;
+}
+
+/** Capabilities visible while one entity operation holds its serialized turn. */
+export interface DurableEntityContext {
+  readonly address: DurableEntityAddress;
+  readonly keyValue: DurableEntityKeyValue;
+  readonly sql?: DurableEntitySql;
+  readonly alarm: DurableEntityAlarm;
+  readonly sessions: DurableEntitySessions;
+}
+
+/** First-party host contract for identity-addressed, serialized entity execution. */
+export interface DurableEntityHostShape {
+  readonly run: <A, E, R>(
+    address: DurableEntityAddress,
+    operation: (context: DurableEntityContext) => Effect.Effect<A, E, R>,
+  ) => Effect.Effect<A, E, R>;
+}
+
+/**
+ * Hosts durable entity operations without exposing Cloudflare or single-node
+ * runtime types to application code.
+ */
+export class DurableEntityHost extends Context.Service<DurableEntityHost, DurableEntityHostShape>()(
+  "@voidhash/platform/DurableEntityHost",
+) {}
+
+/** Creates a stable entity address in first-party vocabulary. */
+export const makeDurableEntityAddress = (type: string, id: string): DurableEntityAddress => ({
+  type,
+  id,
+});
diff --git a/packages/platform/src/EffectWorkflowRunner.ts b/packages/platform/src/EffectWorkflowRunner.ts
new file mode 100644
index 000000000..a7f8169ca
--- /dev/null
+++ b/packages/platform/src/EffectWorkflowRunner.ts
@@ -0,0 +1,245 @@
+import { Cause, Effect, Exit, Layer, Option, Schema } from "effect";
+import { Activity, DurableClock, Workflow, WorkflowEngine } from "effect/unstable/workflow";
+
+import { PlatformRuntime } from "./PlatformRuntime.ts";
+import * as WorkflowContract from "./Workflow.ts";
+import {
+  type WorkflowExecutionResult,
+  WorkflowRunner,
+  WorkflowRunnerError,
+  type WorkflowRunnerShape,
+} from "./WorkflowRunner.ts";
+
+/**
+ * Maps the provider-neutral `WorkflowRunner` contract onto Effect's
+ * `WorkflowEngine`.
+ *
+ * This lives beside the contracts rather than in one adapter because every
+ * backend built on Effect's durable-execution primitives shares the mapping;
+ * only the engine underneath differs (Postgres tables, cluster entities, an
+ * in-memory engine for tests). Backends that are not Effect-based implement
+ * `WorkflowRunner` directly instead.
+ */
+const runnerError = (workflowName: string, operation: string, cause: unknown) =>
+  new WorkflowRunnerError({ workflowName, operation, cause: String(cause) });
+
+const catchRunnerCause = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+  workflowName: string,
+  operation: string,
+): Effect.Effect<A, WorkflowRunnerError, R> =>
+  effect.pipe(
+    Effect.catchCause((cause) => {
+      const squashed = Cause.squash(cause);
+      return Effect.fail(
+        squashed instanceof WorkflowRunnerError
+          ? squashed
+          : runnerError(workflowName, operation, Cause.pretty(cause)),
+      );
+    }),
+  );
+
+const toNativeWorkflow = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  workflow: WorkflowContract.Workflow<Name, Payload, Success>,
+) =>
+  Workflow.make(workflow.name, {
+    payload: workflow.payload,
+    success: workflow.success,
+    error: WorkflowRunnerError,
+    idempotencyKey: workflow.idempotencyKey,
+  });
+
+const executionResult = <A>(
+  result: Workflow.Result<A, WorkflowRunnerError>,
+): Effect.Effect<WorkflowExecutionResult<A>> => {
+  if (result._tag === "Suspended") {
+    return Effect.succeed({ status: "suspended" });
+  }
+  return Effect.succeed(
+    Exit.match(result.exit, {
+      onFailure: (cause) => {
+        if (Cause.hasInterrupts(cause)) {
+          return { status: "interrupted" as const };
+        }
+        const error = Cause.squash(cause);
+        return {
+          status: "failed" as const,
+          error:
+            error instanceof WorkflowRunnerError ? error : runnerError("unknown", "poll", error),
+        };
+      },
+      onSuccess: (value) => ({ status: "succeeded" as const, value }),
+    }),
+  );
+};
+
+const makeStep = <Success extends Schema.Top, R>(
+  workflowName: string,
+  dependencies: Layer.Layer<R>,
+  options: WorkflowContract.StepOptions<Success, R>,
+): Effect.Effect<Success["Type"], WorkflowRunnerError, WorkflowRunner | PlatformRuntime> =>
+  WorkflowContract.durableOperationName(options.name).pipe(
+    Effect.flatMap(
+      (name) =>
+        Activity.make({
+          name,
+          success: options.success,
+          error: WorkflowRunnerError,
+          execute: catchRunnerCause(
+            PlatformRuntime.pipe(
+              Effect.andThen(options.execute.pipe(Effect.provide(dependencies))),
+            ),
+            workflowName,
+            `step:${options.name}`,
+          ),
+        }) as unknown as Effect.Effect<
+          Success["Type"],
+          WorkflowRunnerError,
+          WorkflowRunner | PlatformRuntime
+        >,
+    ),
+  );
+
+const sleepUntil = (
+  workflowName: string,
+  name: string,
+  scheduledTime: Date,
+): Effect.Effect<void, WorkflowRunnerError, PlatformRuntime> =>
+  WorkflowContract.durableOperationName(name).pipe(
+    Effect.flatMap((durableName) =>
+      catchRunnerCause(
+        PlatformRuntime.pipe(
+          Effect.andThen(
+            Effect.suspend(() => {
+              const delay = scheduledTime.getTime() - Date.now();
+              return delay <= 0
+                ? Effect.void
+                : DurableClock.sleep({
+                    name: durableName,
+                    duration: delay,
+                    inMemoryThreshold: 1,
+                  });
+            }),
+          ),
+        ),
+        workflowName,
+        `sleep:${name}`,
+      ),
+    ),
+  ) as unknown as Effect.Effect<void, WorkflowRunnerError, PlatformRuntime>;
+
+type AnyWorkflowDefinition = WorkflowContract.Workflow<string, Schema.Struct.Fields, Schema.Top>;
+
+type AnyWorkflowHandler<RSteps> = (
+  payload: Schema.Struct.Type<Schema.Struct.Fields>,
+  context: WorkflowContract.Context<RSteps>,
+) => Effect.Effect<unknown, unknown, WorkflowRunner | PlatformRuntime>;
+
+/** Builds the provider-neutral runner facade over one Effect workflow engine. */
+export const make = (engine: WorkflowEngine.WorkflowEngine["Service"]): WorkflowRunnerShape =>
+  ({
+    register: <RSteps>(
+      workflow: AnyWorkflowDefinition,
+      handler: AnyWorkflowHandler<RSteps>,
+      dependencies: Layer.Layer<RSteps>,
+    ) => {
+      const native = toNativeWorkflow(workflow);
+      return catchRunnerCause(
+        engine.register(native, (payload, executionId) => {
+          const context: WorkflowContract.Context<RSteps> = {
+            executionId,
+            step: (options) => makeStep(workflow.name, dependencies, options),
+            sleepUntil: (name, scheduledTime) => sleepUntil(workflow.name, name, scheduledTime),
+          };
+          return catchRunnerCause(
+            PlatformRuntime.pipe(Effect.andThen(handler(payload, context))),
+            workflow.name,
+            "run",
+            // Activities and durable clocks inside the body resolve the engine
+            // from context. Engines differ in whether they install themselves
+            // around a handler, so the runner always does it.
+          ).pipe(Effect.provideService(WorkflowEngine.WorkflowEngine, engine));
+        }),
+        workflow.name,
+        "register",
+      );
+    },
+    dispatch: (
+      workflow: AnyWorkflowDefinition,
+      payload: Schema.Struct.Type<Schema.Struct.Fields>,
+    ) => {
+      const native = toNativeWorkflow(workflow);
+      return catchRunnerCause(
+        PlatformRuntime.pipe(
+          Effect.andThen(native.execute(payload, { discard: true })),
+          Effect.provideService(WorkflowEngine.WorkflowEngine, engine),
+        ),
+        workflow.name,
+        "dispatch",
+      );
+    },
+    execute: (
+      workflow: AnyWorkflowDefinition,
+      payload: Schema.Struct.Type<Schema.Struct.Fields>,
+    ) => {
+      const native = toNativeWorkflow(workflow);
+      return catchRunnerCause(
+        PlatformRuntime.pipe(
+          Effect.andThen(native.execute(payload)),
+          Effect.provideService(WorkflowEngine.WorkflowEngine, engine),
+        ),
+        workflow.name,
+        "execute",
+      );
+    },
+    poll: (workflow: AnyWorkflowDefinition, executionId: string) => {
+      const native = toNativeWorkflow(workflow);
+      return catchRunnerCause(
+        PlatformRuntime.pipe(
+          Effect.andThen(native.poll(executionId)),
+          Effect.provideService(WorkflowEngine.WorkflowEngine, engine),
+          Effect.flatMap(
+            Option.match({
+              onNone: () => Effect.succeedNone,
+              onSome: (result) => executionResult(result).pipe(Effect.map(Option.some)),
+            }),
+          ),
+        ),
+        workflow.name,
+        "poll",
+      );
+    },
+    resume: (workflow: AnyWorkflowDefinition, executionId: string) => {
+      const native = toNativeWorkflow(workflow);
+      return catchRunnerCause(
+        PlatformRuntime.pipe(
+          Effect.andThen(native.resume(executionId)),
+          Effect.provideService(WorkflowEngine.WorkflowEngine, engine),
+        ),
+        workflow.name,
+        "resume",
+      );
+    },
+    interrupt: (workflow: AnyWorkflowDefinition, executionId: string) => {
+      const native = toNativeWorkflow(workflow);
+      return catchRunnerCause(
+        PlatformRuntime.pipe(
+          Effect.andThen(native.interrupt(executionId)),
+          Effect.provideService(WorkflowEngine.WorkflowEngine, engine),
+        ),
+        workflow.name,
+        "interrupt",
+      );
+    },
+  }) as unknown as WorkflowRunnerShape;
+
+/**
+ * Provides `WorkflowRunner` from whichever Effect `WorkflowEngine` is in
+ * context, so an adapter only has to supply its engine layer.
+ */
+export const layer: Layer.Layer<WorkflowRunner, never, WorkflowEngine.WorkflowEngine> =
+  Layer.effect(WorkflowRunner, Effect.map(WorkflowEngine.WorkflowEngine, make));
diff --git a/packages/platform/src/KeyValueStore.ts b/packages/platform/src/KeyValueStore.ts
new file mode 100644
index 000000000..49cdc92b2
--- /dev/null
+++ b/packages/platform/src/KeyValueStore.ts
@@ -0,0 +1,79 @@
+import type { Effect, Option, Schema } from "effect";
+import { Context, Schema as EffectSchema } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+
+/** Stable failure raised by a platform key-value operation. */
+export class KeyValueStoreError extends EffectSchema.TaggedErrorClass<KeyValueStoreError>(
+  "KeyValueStoreError",
+)("KeyValueStoreError", {
+  cause: EffectSchema.String,
+  namespace: EffectSchema.String,
+  operation: EffectSchema.String,
+}) {}
+
+/** Optional expiry applied when a key-value entry is written. */
+export interface KeyValuePutOptions {
+  readonly ttlMillis?: number;
+}
+
+/** A typed key-value entry used by atomic bulk writes. */
+export interface KeyValueEntry<A> {
+  readonly key: string;
+  readonly value: A;
+}
+
+/** Provider-neutral typed key-value runtime. */
+export interface KeyValueStoreShape {
+  /** Reads and schema-decodes one unexpired value. */
+  readonly get: <A, I>(
+    namespace: string,
+    key: string,
+    schema: Schema.Codec<A, I>,
+  ) => Effect.Effect<Option.Option<A>, KeyValueStoreError, PlatformRuntime>;
+  /** Schema-encodes and writes one value. */
+  readonly put: <A, I>(
+    namespace: string,
+    key: string,
+    value: A,
+    schema: Schema.Codec<A, I>,
+    options?: KeyValuePutOptions,
+  ) => Effect.Effect<void, KeyValueStoreError, PlatformRuntime>;
+  /** Atomically schema-encodes and writes a value batch. */
+  readonly putMany: <A, I>(
+    namespace: string,
+    entries: ReadonlyArray<KeyValueEntry<A>>,
+    schema: Schema.Codec<A, I>,
+    options?: KeyValuePutOptions,
+  ) => Effect.Effect<void, KeyValueStoreError, PlatformRuntime>;
+  /** Returns the subset of keys that currently have unexpired values. */
+  readonly existingKeys: (
+    namespace: string,
+    keys: ReadonlyArray<string>,
+  ) => Effect.Effect<ReadonlySet<string>, KeyValueStoreError, PlatformRuntime>;
+  /** Deletes one key. */
+  readonly delete: (
+    namespace: string,
+    key: string,
+  ) => Effect.Effect<void, KeyValueStoreError, PlatformRuntime>;
+  /** Atomically deletes a key batch. */
+  readonly deleteMany: (
+    namespace: string,
+    keys: ReadonlyArray<string>,
+  ) => Effect.Effect<void, KeyValueStoreError, PlatformRuntime>;
+  /** Atomically increments an integer counter and returns its new value. */
+  readonly increment: (
+    namespace: string,
+    key: string,
+    options?: KeyValuePutOptions,
+  ) => Effect.Effect<number, KeyValueStoreError, PlatformRuntime>;
+  /** Deletes a bounded batch of expired entries and returns the deleted count. */
+  readonly pruneExpired: (
+    limit: number,
+  ) => Effect.Effect<number, KeyValueStoreError, PlatformRuntime>;
+}
+
+/** Provider-neutral key-value runtime used by application composition roots. */
+export class KeyValueStore extends Context.Service<KeyValueStore, KeyValueStoreShape>()(
+  "@voidhash/platform/KeyValueStore",
+) {}
diff --git a/packages/platform/src/Mailer.ts b/packages/platform/src/Mailer.ts
new file mode 100644
index 000000000..cf28e7418
--- /dev/null
+++ b/packages/platform/src/Mailer.ts
@@ -0,0 +1,49 @@
+import type { Effect } from "effect";
+import { Context, Schema } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+
+/** Stable failure raised by a mail-delivery adapter. */
+export class MailerError extends Schema.TaggedErrorClass<MailerError>("MailerError")(
+  "MailerError",
+  {
+    cause: Schema.String,
+    operation: Schema.String,
+  },
+) {}
+
+/** Structured email mailbox. */
+export interface MailAddress {
+  readonly address: string;
+  readonly name?: string;
+}
+
+/** Provider-neutral email message input. */
+export interface MailMessage {
+  readonly from?: MailAddress;
+  readonly to: ReadonlyArray<MailAddress>;
+  readonly cc?: ReadonlyArray<MailAddress>;
+  readonly bcc?: ReadonlyArray<MailAddress>;
+  readonly replyTo?: MailAddress;
+  readonly subject: string;
+  readonly text?: string;
+  readonly html?: string;
+  readonly headers?: Readonly<Record<string, string>>;
+}
+
+/** Delivery acknowledgement returned by the SMTP server. */
+export interface MailDeliveryResult {
+  readonly messageId: string;
+  readonly accepted: ReadonlyArray<string>;
+  readonly rejected: ReadonlyArray<string>;
+}
+
+/** Provider-neutral mail-delivery capabilities. */
+export interface MailerShape {
+  readonly send: (
+    message: MailMessage,
+  ) => Effect.Effect<MailDeliveryResult, MailerError, PlatformRuntime>;
+}
+
+/** Provider-neutral transactional email delivery service. */
+export class Mailer extends Context.Service<Mailer, MailerShape>()("@voidhash/platform/Mailer") {}
diff --git a/packages/platform/src/MemoryWorkflowRunner.ts b/packages/platform/src/MemoryWorkflowRunner.ts
new file mode 100644
index 000000000..3436f91e9
--- /dev/null
+++ b/packages/platform/src/MemoryWorkflowRunner.ts
@@ -0,0 +1,7 @@
+import { Layer } from "effect";
+import { WorkflowEngine } from "effect/unstable/workflow";
+
+import * as EffectWorkflowRunner from "./EffectWorkflowRunner.ts";
+
+/** In-process workflow runner backed by Effect's dependency-free memory engine. */
+export const layer = EffectWorkflowRunner.layer.pipe(Layer.provide(WorkflowEngine.layerMemory));
diff --git a/packages/platform/src/ObjectStore.ts b/packages/platform/src/ObjectStore.ts
new file mode 100644
index 000000000..d79d2e569
--- /dev/null
+++ b/packages/platform/src/ObjectStore.ts
@@ -0,0 +1,56 @@
+import type { Effect, Option } from "effect";
+import { Context, Schema } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+
+/** Stable failure raised by an object-storage adapter. */
+export class ObjectStoreError extends Schema.TaggedErrorClass<ObjectStoreError>("ObjectStoreError")(
+  "ObjectStoreError",
+  {
+    bucketName: Schema.String,
+    cause: Schema.String,
+    key: Schema.String,
+    operation: Schema.String,
+  },
+) {}
+
+/** Raw bytes and metadata returned for a stored object. */
+export interface StoredObject {
+  readonly body: Uint8Array;
+  readonly contentType: string | null;
+  readonly etag: string | null;
+  readonly size: number;
+}
+
+/** Metadata returned without downloading an object body. */
+export interface StoredObjectHead {
+  readonly contentType: string | null;
+  readonly etag: string | null;
+  readonly size: number;
+}
+
+/** Input for an idempotent object write. */
+export interface PutObjectInput {
+  readonly key: string;
+  readonly body: Uint8Array;
+  readonly contentType?: string;
+  readonly cacheControl?: string;
+}
+
+/** Provider-neutral object-storage capabilities for one bucket. */
+export interface ObjectStoreShape {
+  readonly bucketName: string;
+  readonly put: (input: PutObjectInput) => Effect.Effect<void, ObjectStoreError, PlatformRuntime>;
+  readonly get: (
+    key: string,
+  ) => Effect.Effect<Option.Option<StoredObject>, ObjectStoreError, PlatformRuntime>;
+  readonly head: (
+    key: string,
+  ) => Effect.Effect<Option.Option<StoredObjectHead>, ObjectStoreError, PlatformRuntime>;
+  readonly delete: (key: string) => Effect.Effect<void, ObjectStoreError, PlatformRuntime>;
+}
+
+/** Provider-neutral object store for a bucket selected by its live layer. */
+export class ObjectStore extends Context.Service<ObjectStore, ObjectStoreShape>()(
+  "@voidhash/platform/ObjectStore",
+) {}
diff --git a/packages/platform/src/PlatformRuntime.ts b/packages/platform/src/PlatformRuntime.ts
new file mode 100644
index 000000000..b1fd4922f
--- /dev/null
+++ b/packages/platform/src/PlatformRuntime.ts
@@ -0,0 +1,11 @@
+import { Context } from "effect";
+
+export type PlatformRuntimeShape = Readonly<Record<never, never>>;
+
+/**
+ * Marks effects that may only execute inside a configured platform runtime.
+ * Runtime adapters provide this service at their handler boundaries.
+ */
+export class PlatformRuntime extends Context.Service<PlatformRuntime, PlatformRuntimeShape>()(
+  "@voidhash/platform/PlatformRuntime",
+) {}
diff --git a/packages/platform/src/Primitive.ts b/packages/platform/src/Primitive.ts
new file mode 100644
index 000000000..5aee1de30
--- /dev/null
+++ b/packages/platform/src/Primitive.ts
@@ -0,0 +1,11 @@
+/** Resource kinds understood by platform runtimes and deployment adapters. */
+export type PrimitiveKind = "cron" | "durable-entity" | "queue" | "queue-consumer" | "workflow";
+
+/** Provider-neutral identity shared by every platform primitive definition. */
+export interface PrimitiveDefinition<
+  Kind extends PrimitiveKind = PrimitiveKind,
+  Name extends string = string,
+> {
+  readonly kind: Kind;
+  readonly name: Name;
+}
diff --git a/packages/platform/src/Queue.ts b/packages/platform/src/Queue.ts
new file mode 100644
index 000000000..4c214cac4
--- /dev/null
+++ b/packages/platform/src/Queue.ts
@@ -0,0 +1,126 @@
+import type { Schema } from "effect";
+import { Context, Effect, Schema as EffectSchema } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+import type { PrimitiveDefinition } from "./Primitive.ts";
+
+/** Stable failure raised when a typed queue message cannot be published. */
+export class QueueProducerError extends EffectSchema.TaggedErrorClass<QueueProducerError>(
+  "QueueProducerError",
+)("QueueProducerError", {
+  cause: EffectSchema.String,
+  queueName: EffectSchema.String,
+}) {}
+
+/** Provider-neutral typed queue publisher. */
+export interface QueueProducer<A> {
+  /** Publishes one schema-encoded message. */
+  readonly publish: (message: A) => Effect.Effect<void, QueueProducerError, PlatformRuntime>;
+  /** Atomically publishes a schema-encoded message batch when the adapter supports it. */
+  readonly publishBatch: (
+    messages: ReadonlyArray<A>,
+  ) => Effect.Effect<void, QueueProducerError, PlatformRuntime>;
+}
+
+/** Stable failure raised by a queue consumer driver. */
+export class QueueConsumerError extends EffectSchema.TaggedErrorClass<QueueConsumerError>(
+  "QueueConsumerError",
+)("QueueConsumerError", {
+  cause: EffectSchema.String,
+  queueName: EffectSchema.String,
+}) {}
+
+/** Provider-neutral delivery and retry policy for a queue consumer. */
+export interface QueueConsumerOptions {
+  readonly batchSize?: number;
+  readonly maxRetries?: number;
+  readonly retryDelayMillis?: number;
+  readonly visibilityTimeoutMillis?: number;
+  readonly pollIntervalMillis?: number;
+  readonly deadLetterQueue?: string;
+}
+
+/** Runtime queue capabilities shared by cloud and single-node adapters. */
+export interface QueueDriverShape {
+  /** Creates a typed producer for a logical queue. */
+  readonly producer: <A, I>(queueName: string, schema: Schema.Codec<A, I>) => QueueProducer<A>;
+  /** Claims and handles at most one available batch, returning its claimed row count. */
+  readonly processBatch: <A, I, R>(
+    queueName: string,
+    schema: Schema.Codec<A, I>,
+    handleBatch: (messages: ReadonlyArray<A>) => Effect.Effect<void, unknown, R>,
+    options?: QueueConsumerOptions,
+  ) => Effect.Effect<number, QueueConsumerError, PlatformRuntime | R>;
+  /** Polls and handles batches until the enclosing Effect scope is interrupted. */
+  readonly consumeBatch: <A, I, R>(
+    queueName: string,
+    schema: Schema.Codec<A, I>,
+    handleBatch: (messages: ReadonlyArray<A>) => Effect.Effect<void, unknown, R>,
+    options?: QueueConsumerOptions,
+  ) => Effect.Effect<never, QueueConsumerError, PlatformRuntime | R>;
+}
+
+/** Provider-neutral queue runtime used by application composition roots. */
+export class QueueDriver extends Context.Service<QueueDriver, QueueDriverShape>()(
+  "@voidhash/platform/QueueDriver",
+) {}
+
+/**
+ * A typed queue definition and producer facade.
+ *
+ * Definitions are the single canonical declaration of a queue: every runtime
+ * composition derives its physical resource name from `name`, so logical names
+ * cannot drift between deployment targets.
+ */
+export interface QueueDefinition<Name extends string, A, I>
+  extends PrimitiveDefinition<"queue", Name> {
+  readonly schema: Schema.Codec<A, I>;
+  /** Publishes one message through the installed queue runtime. */
+  readonly publish: (
+    message: A,
+  ) => Effect.Effect<void, QueueProducerError, QueueDriver | PlatformRuntime>;
+  /** Publishes one atomic batch when supported by the installed runtime. */
+  readonly publishBatch: (
+    messages: ReadonlyArray<A>,
+  ) => Effect.Effect<void, QueueProducerError, QueueDriver | PlatformRuntime>;
+}
+
+/** A queue consumer definition executed by the selected runtime. */
+export interface QueueConsumerDefinition<Name extends string, A, I, R>
+  extends PrimitiveDefinition<"queue-consumer", Name> {
+  readonly queue: QueueDefinition<string, A, I>;
+  readonly options?: QueueConsumerOptions;
+  readonly handler: (messages: ReadonlyArray<A>) => Effect.Effect<void, unknown, R>;
+}
+
+/** Creates a typed queue definition without selecting a runtime backend. */
+export const defineQueue = <const Name extends string, A, I>(
+  name: Name,
+  schema: Schema.Codec<A, I>,
+): QueueDefinition<Name, A, I> => ({
+  kind: "queue",
+  name,
+  schema,
+  publish: (message) =>
+    QueueDriver.pipe(Effect.flatMap((driver) => driver.producer(name, schema).publish(message))),
+  publishBatch: (messages) =>
+    QueueDriver.pipe(
+      Effect.flatMap((driver) => driver.producer(name, schema).publishBatch(messages)),
+    ),
+});
+
+/** Defines a typed queue consumer without selecting a runtime backend. */
+export const defineQueueConsumer = <const Name extends string, A, I, R>(
+  name: Name,
+  options: {
+    readonly queue: QueueDefinition<string, A, I>;
+    readonly handler: (messages: ReadonlyArray<A>) => Effect.Effect<void, unknown, R>;
+    readonly options?: QueueConsumerOptions;
+  },
+): QueueConsumerDefinition<Name, A, I, R> => ({
+  kind: "queue-consumer",
+  name,
+  queue: options.queue,
+  handler: options.handler,
+  options: options.options,
+});
diff --git a/packages/platform/src/Screenshot.ts b/packages/platform/src/Screenshot.ts
new file mode 100644
index 000000000..3b97620e0
--- /dev/null
+++ b/packages/platform/src/Screenshot.ts
@@ -0,0 +1,33 @@
+import type { Effect } from "effect";
+import { Context, Schema } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+
+/** Stable failure raised by an HTML screenshot adapter. */
+export class ScreenshotError extends Schema.TaggedErrorClass<ScreenshotError>("ScreenshotError")(
+  "ScreenshotError",
+  {
+    cause: Schema.String,
+    operation: Schema.String,
+  },
+) {}
+
+/** Viewport and document input for a PNG screenshot. */
+export interface ScreenshotOptions {
+  readonly html: string;
+  readonly width: number;
+  readonly height: number;
+  readonly deviceScaleFactor: number;
+}
+
+/** Provider-neutral HTML screenshot capabilities. */
+export interface ScreenshotShape {
+  readonly renderPng: (
+    options: ScreenshotOptions,
+  ) => Effect.Effect<Uint8Array, ScreenshotError, PlatformRuntime>;
+}
+
+/** Provider-neutral renderer for self-contained HTML documents. */
+export class Screenshot extends Context.Service<Screenshot, ScreenshotShape>()(
+  "@voidhash/platform/Screenshot",
+) {}
diff --git a/packages/platform/src/TestWorkflowRunner.ts b/packages/platform/src/TestWorkflowRunner.ts
new file mode 100644
index 000000000..406d4973b
--- /dev/null
+++ b/packages/platform/src/TestWorkflowRunner.ts
@@ -0,0 +1,41 @@
+import { Effect, Option } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+import type * as Workflow from "./Workflow.ts";
+import type { WorkflowExecutionResult, WorkflowRunnerShape } from "./WorkflowRunner.ts";
+
+/** One workflow dispatch captured by a recording test runner. */
+export interface Dispatch {
+  readonly workflow: Workflow.Any;
+  readonly payload: unknown;
+  readonly executionId: string;
+}
+
+/** Recording runner returned by {@link make}. */
+export interface TestWorkflowRunner extends WorkflowRunnerShape {
+  readonly dispatches: Array<Dispatch>;
+}
+
+/** Creates a dependency-free runner that records workflow dispatches. */
+export const make = (): TestWorkflowRunner => {
+  const dispatches: Array<Dispatch> = [];
+
+  const dispatch: WorkflowRunnerShape["dispatch"] = (workflow, payload) => {
+    const executionId = workflow.idempotencyKey(payload);
+    dispatches.push({ executionId, payload, workflow: workflow as Workflow.Any });
+    return Effect.succeed(executionId) as Effect.Effect<string, never, PlatformRuntime>;
+  };
+
+  return {
+    dispatches,
+    register: () => Effect.void,
+    dispatch,
+    execute: (workflow, payload) =>
+      dispatch(workflow, payload).pipe(
+        Effect.andThen(Effect.die(new Error("TestWorkflowRunner does not execute workflows"))),
+      ) as never,
+    poll: () => Effect.succeed(Option.none<WorkflowExecutionResult<never>>()) as never,
+    resume: () => Effect.void,
+    interrupt: () => Effect.void,
+  };
+};
diff --git a/packages/platform/src/Workflow.ts b/packages/platform/src/Workflow.ts
new file mode 100644
index 000000000..1f769bde1
--- /dev/null
+++ b/packages/platform/src/Workflow.ts
@@ -0,0 +1,158 @@
+import type { Option, Schema } from "effect";
+import { Effect } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+import {
+  WorkflowRunner,
+  type WorkflowExecutionResult,
+  type WorkflowRunnerError,
+} from "./WorkflowRunner.ts";
+
+/** Provider-neutral durable workflow definition. */
+export interface Workflow<
+  Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+> {
+  readonly name: Name;
+  readonly payload: Payload;
+  readonly success: Success;
+  readonly idempotencyKey: (payload: Schema.Struct.Type<Payload>) => string;
+}
+
+/** Any provider-neutral durable workflow definition. */
+export type Any = Workflow<string, any, any>;
+
+/** Retry policy understood by every workflow adapter. */
+export type StepRetry = "platform-default" | "none";
+
+/** Options for one durable workflow activity. */
+export interface StepOptions<Success extends Schema.Top, RSteps> {
+  readonly name: string;
+  readonly success: Success;
+  readonly execute: Effect.Effect<
+    Success["Type"],
+    unknown,
+    RSteps | WorkflowRunner | PlatformRuntime
+  >;
+  readonly retry?: StepRetry;
+}
+
+/** Durable operations available while a workflow handler is running. */
+export interface Context<RSteps> {
+  readonly executionId: string;
+  readonly step: <Success extends Schema.Top>(
+    options: StepOptions<Success, RSteps>,
+  ) => Effect.Effect<Success["Type"], WorkflowRunnerError, WorkflowRunner | PlatformRuntime>;
+  readonly sleepUntil: (
+    name: string,
+    scheduledTime: Date,
+  ) => Effect.Effect<void, WorkflowRunnerError, PlatformRuntime>;
+}
+
+const MAX_DURABLE_OPERATION_NAME_BYTES = 96;
+
+/**
+ * Bounds a task or clock name for durable backends while preserving short,
+ * readable names verbatim. Long names use a readable prefix plus the complete
+ * SHA-256 digest, so identifiers accepted by workflow payload schemas cannot
+ * overflow a provider's composed persistence key.
+ */
+export const durableOperationName = (name: string): Effect.Effect<string> => {
+  const encoded = new TextEncoder().encode(name);
+  if (encoded.byteLength <= MAX_DURABLE_OPERATION_NAME_BYTES) return Effect.succeed(name);
+
+  return Effect.promise(async () => {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", encoded));
+    const hash = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    const prefix = name.slice(0, 24).replaceAll(/[^a-zA-Z0-9._-]/g, "_");
+    return `${prefix}:${hash}`;
+  });
+};
+
+/** Defines a provider-neutral workflow while preserving schema inference. */
+export const define = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  definition: Workflow<Name, Payload, Success>,
+): Workflow<Name, Payload, Success> => definition;
+
+/** Starts a workflow and returns its stable execution ID. */
+export const dispatch = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  workflow: Workflow<Name, Payload, Success>,
+  payload: Schema.Struct.Type<Payload>,
+): Effect.Effect<string, WorkflowRunnerError, WorkflowRunner | PlatformRuntime> =>
+  WorkflowRunner.pipe(Effect.flatMap((runner) => runner.dispatch(workflow, payload)));
+
+/** Starts a workflow, logging and terminating the caller fiber if dispatch fails. */
+export const dispatchAndForget = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  workflow: Workflow<Name, Payload, Success>,
+  payload: Schema.Struct.Type<Payload>,
+): Effect.Effect<void, never, WorkflowRunner | PlatformRuntime> =>
+  dispatch(workflow, payload).pipe(
+    Effect.tapError((error) =>
+      Effect.logError("Failed to dispatch workflow", {
+        error,
+        workflowName: workflow.name,
+      }),
+    ),
+    Effect.orDie,
+    Effect.asVoid,
+  );
+
+/** Starts or joins a workflow and awaits successful completion. */
+export const execute = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  workflow: Workflow<Name, Payload, Success>,
+  payload: Schema.Struct.Type<Payload>,
+): Effect.Effect<Success["Type"], WorkflowRunnerError, WorkflowRunner | PlatformRuntime> =>
+  WorkflowRunner.pipe(Effect.flatMap((runner) => runner.execute(workflow, payload)));
+
+/** Reads one persisted workflow execution result. */
+export const poll = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  workflow: Workflow<Name, Payload, Success>,
+  executionId: string,
+): Effect.Effect<
+  Option.Option<WorkflowExecutionResult<Success["Type"]>>,
+  WorkflowRunnerError,
+  WorkflowRunner | PlatformRuntime
+> => WorkflowRunner.pipe(Effect.flatMap((runner) => runner.poll(workflow, executionId)));
+
+/** Resumes a suspended workflow execution. */
+export const resume = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  workflow: Workflow<Name, Payload, Success>,
+  executionId: string,
+): Effect.Effect<void, WorkflowRunnerError, WorkflowRunner | PlatformRuntime> =>
+  WorkflowRunner.pipe(Effect.flatMap((runner) => runner.resume(workflow, executionId)));
+
+/** Interrupts a workflow execution. */
+export const interrupt = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+>(
+  workflow: Workflow<Name, Payload, Success>,
+  executionId: string,
+): Effect.Effect<void, WorkflowRunnerError, WorkflowRunner | PlatformRuntime> =>
+  WorkflowRunner.pipe(Effect.flatMap((runner) => runner.interrupt(workflow, executionId)));
diff --git a/packages/platform/src/WorkflowRegistration.ts b/packages/platform/src/WorkflowRegistration.ts
new file mode 100644
index 000000000..ed939f71d
--- /dev/null
+++ b/packages/platform/src/WorkflowRegistration.ts
@@ -0,0 +1,66 @@
+import type { Scope, Schema } from "effect";
+import { Effect, Layer } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+import * as Workflow from "./Workflow.ts";
+import { WorkflowRunner, type WorkflowRunnerError } from "./WorkflowRunner.ts";
+
+/** Cron trigger attached to a workflow registration. */
+export interface Cron<Payload> {
+  readonly schedule: string;
+  readonly payload: (scheduledTime: Date) => Payload;
+}
+
+/** A shared workflow body, dependency blueprint, and optional trigger. */
+export interface WorkflowRegistration<RIn> {
+  readonly workflow: Workflow.Any;
+  readonly cron?: {
+    readonly schedule: string;
+    readonly dispatch: (
+      scheduledTime: Date,
+    ) => Effect.Effect<void, never, WorkflowRunner | PlatformRuntime>;
+  };
+  readonly register: (
+    infrastructure: Layer.Layer<RIn>,
+  ) => Effect.Effect<void, WorkflowRunnerError, WorkflowRunner | PlatformRuntime | Scope.Scope>;
+}
+
+/** Creates a shared workflow registration without selecting a runtime backend. */
+export const make = <
+  const Name extends string,
+  Payload extends Schema.Struct.Fields,
+  Success extends Schema.Top,
+  RSteps,
+  RIn,
+>(
+  workflow: Workflow.Workflow<Name, Payload, Success>,
+  options: {
+    readonly dependencies: Layer.Layer<RSteps, never, RIn>;
+    readonly run: (
+      payload: Schema.Struct.Type<Payload>,
+      context: Workflow.Context<RSteps | RIn>,
+    ) => Effect.Effect<Success["Type"], unknown, WorkflowRunner | PlatformRuntime>;
+    readonly cron?: Cron<Schema.Struct.Type<Payload>>;
+  },
+): WorkflowRegistration<RIn> => ({
+  workflow,
+  ...(options.cron === undefined
+    ? {}
+    : {
+        cron: {
+          schedule: options.cron.schedule,
+          dispatch: (scheduledTime: Date) =>
+            Workflow.dispatchAndForget(workflow, options.cron!.payload(scheduledTime)),
+        },
+      }),
+  register: (infrastructure) =>
+    WorkflowRunner.pipe(
+      Effect.flatMap((runner) =>
+        runner.register(
+          workflow,
+          options.run,
+          options.dependencies.pipe(Layer.provideMerge(infrastructure)),
+        ),
+      ),
+    ),
+});
diff --git a/packages/platform/src/WorkflowRunner.ts b/packages/platform/src/WorkflowRunner.ts
new file mode 100644
index 000000000..c5d4bebea
--- /dev/null
+++ b/packages/platform/src/WorkflowRunner.ts
@@ -0,0 +1,87 @@
+import type { Option, Scope } from "effect";
+import { Context, Effect, Layer, Schema } from "effect";
+
+import type { PlatformRuntime } from "./PlatformRuntime.ts";
+import type * as Workflow from "./Workflow.ts";
+
+/** Stable failure raised by a durable workflow runtime. */
+export class WorkflowRunnerError extends Schema.TaggedErrorClass<WorkflowRunnerError>(
+  "WorkflowRunnerError",
+)("WorkflowRunnerError", {
+  cause: Schema.String,
+  operation: Schema.String,
+  workflowName: Schema.String,
+}) {}
+
+/** Persisted state returned when polling a workflow execution. */
+export type WorkflowExecutionResult<A> =
+  | { readonly status: "interrupted" }
+  | { readonly status: "suspended" }
+  | { readonly status: "succeeded"; readonly value: A }
+  | { readonly status: "failed"; readonly error: WorkflowRunnerError };
+
+/** Provider-neutral durable workflow capabilities. */
+export interface WorkflowRunnerShape {
+  readonly register: <
+    Name extends string,
+    Payload extends Schema.Struct.Fields,
+    Success extends Schema.Top,
+    RSteps,
+  >(
+    workflow: Workflow.Workflow<Name, Payload, Success>,
+    run: (
+      payload: Schema.Struct.Type<Payload>,
+      context: Workflow.Context<RSteps>,
+    ) => Effect.Effect<Success["Type"], unknown, WorkflowRunner | PlatformRuntime>,
+    dependencies: Layer.Layer<RSteps>,
+  ) => Effect.Effect<void, WorkflowRunnerError, Scope.Scope | PlatformRuntime>;
+  readonly dispatch: <
+    Name extends string,
+    Payload extends Schema.Struct.Fields,
+    Success extends Schema.Top,
+  >(
+    workflow: Workflow.Workflow<Name, Payload, Success>,
+    payload: Schema.Struct.Type<Payload>,
+  ) => Effect.Effect<string, WorkflowRunnerError, PlatformRuntime>;
+  readonly execute: <
+    Name extends string,
+    Payload extends Schema.Struct.Fields,
+    Success extends Schema.Top,
+  >(
+    workflow: Workflow.Workflow<Name, Payload, Success>,
+    payload: Schema.Struct.Type<Payload>,
+  ) => Effect.Effect<Success["Type"], WorkflowRunnerError, PlatformRuntime>;
+  readonly poll: <
+    Name extends string,
+    Payload extends Schema.Struct.Fields,
+    Success extends Schema.Top,
+  >(
+    workflow: Workflow.Workflow<Name, Payload, Success>,
+    executionId: string,
+  ) => Effect.Effect<
+    Option.Option<WorkflowExecutionResult<Success["Type"]>>,
+    WorkflowRunnerError,
+    PlatformRuntime
+  >;
+  readonly resume: <
+    Name extends string,
+    Payload extends Schema.Struct.Fields,
+    Success extends Schema.Top,
+  >(
+    workflow: Workflow.Workflow<Name, Payload, Success>,
+    executionId: string,
+  ) => Effect.Effect<void, WorkflowRunnerError, PlatformRuntime>;
+  readonly interrupt: <
+    Name extends string,
+    Payload extends Schema.Struct.Fields,
+    Success extends Schema.Top,
+  >(
+    workflow: Workflow.Workflow<Name, Payload, Success>,
+    executionId: string,
+  ) => Effect.Effect<void, WorkflowRunnerError, PlatformRuntime>;
+}
+
+/** Provider-neutral durable workflow runtime used by composition roots. */
+export class WorkflowRunner extends Context.Service<WorkflowRunner, WorkflowRunnerShape>()(
+  "@voidhash/platform/WorkflowRunner",
+) {}
diff --git a/packages/platform/src/conformance/CronScheduler.ts b/packages/platform/src/conformance/CronScheduler.ts
new file mode 100644
index 000000000..43b0f4083
--- /dev/null
+++ b/packages/platform/src/conformance/CronScheduler.ts
@@ -0,0 +1,117 @@
+import { Effect, Layer } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { CronScheduler, type CronJobContext } from "../CronScheduler.ts";
+import type { PlatformRuntime } from "../PlatformRuntime.ts";
+
+/** Wiring one adapter must supply for the cron conformance suite. */
+export interface CronConformanceOptions {
+  readonly name: string;
+  /** Builds an isolated scheduler; called once per test so slots never leak. */
+  readonly layer: () => Layer.Layer<CronScheduler | PlatformRuntime>;
+}
+
+const MINUTELY = "* * * * *";
+
+/**
+ * Behaviour every cron scheduler must exhibit.
+ *
+ * `tick` is the unit of the contract: it claims at most one due slot, reports
+ * whether it ran one, and never replays a slot it has already completed. A
+ * schedule seen for the first time is armed rather than fired, so deploying a
+ * new job does not immediately execute it.
+ */
+export const cronSchedulerConformance = (options: CronConformanceOptions): void => {
+  const run = <A, E>(
+    effect: Effect.Effect<A, E, CronScheduler | PlatformRuntime>,
+  ): Promise<A> =>
+    Effect.runPromise(
+      Effect.scoped(effect.pipe(Effect.provide(options.layer()))) as Effect.Effect<A, E>,
+    );
+
+  const job = (name: string, contexts: Array<CronJobContext>) => ({
+    name,
+    expression: MINUTELY,
+    run: (context: CronJobContext) => Effect.sync(() => void contexts.push(context)),
+  });
+
+  describe(`${options.name}: cron scheduler conformance`, () => {
+    it("arms a newly seen schedule without running it", async () => {
+      const contexts: Array<CronJobContext> = [];
+
+      const ran = await run(
+        Effect.gen(function* () {
+          const scheduler = yield* CronScheduler;
+          return yield* scheduler.tick(job("conformance-arm", contexts), new Date());
+        }),
+      );
+
+      expect(ran).toBe(false);
+      expect(contexts).toEqual([]);
+    });
+
+    it("runs a due slot exactly once", async () => {
+      const contexts: Array<CronJobContext> = [];
+      const start = new Date("2026-01-01T00:00:30.000Z");
+      // One minute later the armed slot is due; the slot after it is not.
+      const later = new Date("2026-01-01T00:01:30.000Z");
+
+      const [armed, due, repeated] = await run(
+        Effect.gen(function* () {
+          const scheduler = yield* CronScheduler;
+          const definition = job("conformance-slot", contexts);
+          const armed = yield* scheduler.tick(definition, start);
+          const due = yield* scheduler.tick(definition, later);
+          const repeated = yield* scheduler.tick(definition, later);
+          return [armed, due, repeated] as const;
+        }),
+      );
+
+      expect(armed).toBe(false);
+      expect(due).toBe(true);
+      // The slot already ran, and the following slot is not yet due.
+      expect(repeated).toBe(false);
+      expect(contexts).toHaveLength(1);
+    });
+
+    it("marks a late slot as a catch-up run", async () => {
+      const contexts: Array<CronJobContext> = [];
+      const start = new Date("2026-01-01T00:00:30.000Z");
+      const late = new Date("2026-01-01T01:00:30.000Z");
+
+      await run(
+        Effect.gen(function* () {
+          const scheduler = yield* CronScheduler;
+          const definition = job("conformance-catchup", contexts);
+          yield* scheduler.tick(definition, start);
+          yield* scheduler.tick(definition, late);
+        }),
+      );
+
+      expect(contexts).toHaveLength(1);
+      expect(contexts[0]?.catchUp).toBe(true);
+      // The slot reported is the one that was due, not the current time.
+      expect(contexts[0]?.scheduledTime.getTime()).toBeLessThan(late.getTime());
+    });
+
+    it("surfaces a failing job as a scheduler error", async () => {
+      const start = new Date("2026-01-01T00:00:30.000Z");
+      const later = new Date("2026-01-01T00:01:30.000Z");
+
+      const exit = await run(
+        Effect.gen(function* () {
+          const scheduler = yield* CronScheduler;
+          const definition = {
+            name: "conformance-failure",
+            expression: MINUTELY,
+            run: () => Effect.fail("boom"),
+          };
+          yield* scheduler.tick(definition, start);
+          return yield* Effect.exit(scheduler.tick(definition, later));
+        }),
+      );
+
+      expect(exit._tag).toBe("Failure");
+    });
+  });
+};
diff --git a/packages/platform/src/conformance/DurableEntity.ts b/packages/platform/src/conformance/DurableEntity.ts
new file mode 100644
index 000000000..9586a9295
--- /dev/null
+++ b/packages/platform/src/conformance/DurableEntity.ts
@@ -0,0 +1,473 @@
+import { Effect, Layer } from "effect";
+import { describe, expect, it } from "vitest";
+
+import {
+  DurableEntityAlarmControl,
+  DurableEntityHost,
+  makeDurableEntityAddress,
+  type DurableEntitySession,
+} from "../DurableEntity.ts";
+
+/** Wiring one adapter must supply for the durable entity conformance suite. */
+export interface DurableEntityConformanceOptions {
+  readonly name: string;
+  /** Builds an isolated host; called once per test so state never leaks. */
+  readonly layer: () => Layer.Layer<DurableEntityHost>;
+  /** Adapters without a WebSocket story opt out of the session assertions. */
+  readonly supportsSessions?: boolean;
+  /**
+   * Present when the adapter publishes {@link DurableEntityAlarmControl}; the
+   * factory builds the host beside its control plane so the alarm-dispatch
+   * assertions can drive both halves of one instance.
+   */
+  readonly supportsAlarmDispatch?: () => Layer.Layer<
+    DurableEntityHost | DurableEntityAlarmControl
+  >;
+  /**
+   * Present when the adapter refuses session work it does not own; the factory
+   * builds a host whose shards belong to a different runner.
+   */
+  readonly requiresShardLocality?: () => Layer.Layer<DurableEntityHost>;
+}
+
+/** Records every frame and close a host delivered to one attached session. */
+interface RecordingSession {
+  readonly session: DurableEntitySession;
+  readonly frames: Array<string | Uint8Array>;
+  readonly closes: Array<{ readonly code?: number; readonly reason?: string }>;
+}
+
+const recordingSession = (id: string): RecordingSession => {
+  const frames: Array<string | Uint8Array> = [];
+  const closes: Array<{ readonly code?: number; readonly reason?: string }> = [];
+  let attachment: unknown;
+  return {
+    frames,
+    closes,
+    session: {
+      id,
+      send: (message) => Effect.sync(() => void frames.push(message)),
+      close: (code, reason) => Effect.sync(() => void closes.push({ code, reason })),
+      getAttachment: Effect.sync(() => attachment),
+      setAttachment: (next) =>
+        Effect.sync(() => {
+          attachment = next;
+        }),
+    },
+  };
+};
+
+const testSession = (id: string): DurableEntitySession => recordingSession(id).session;
+
+/**
+ * Behaviour every durable entity host must exhibit: operations on one address
+ * run one at a time, different addresses make progress independently, and
+ * entity-local state outlives the operation that wrote it.
+ */
+export const durableEntityHostConformance = (
+  options: DurableEntityConformanceOptions,
+): void => {
+  const runWith = <A, E, R>(
+    layer: Layer.Layer<R>,
+    effect: Effect.Effect<A, E, R>,
+  ): Promise<A> =>
+    Effect.runPromise(
+      Effect.scoped(effect.pipe(Effect.provide(layer))) as Effect.Effect<A, E>,
+    );
+
+  const run = <A, E>(effect: Effect.Effect<A, E, DurableEntityHost>): Promise<A> =>
+    runWith(options.layer(), effect);
+
+  describe(`${options.name}: durable entity host conformance`, () => {
+    it("serializes one address while letting different addresses overlap", async () => {
+      const events: Array<string> = [];
+      const first = makeDurableEntityAddress("document", "first");
+      const second = makeDurableEntityAddress("document", "second");
+
+      await run(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+          yield* Effect.all(
+            [
+              host.run(first, () =>
+                Effect.gen(function* () {
+                  events.push("first:start");
+                  yield* Effect.sleep("40 millis");
+                  events.push("first:end");
+                }),
+              ),
+              host.run(first, () => Effect.sync(() => void events.push("first:next"))),
+              host.run(second, () =>
+                Effect.gen(function* () {
+                  events.push("second:start");
+                  yield* Effect.sleep("5 millis");
+                  events.push("second:end");
+                }),
+              ),
+            ],
+            { concurrency: "unbounded" },
+          );
+        }),
+      );
+
+      // The short second-address turn finishes before the long first-address
+      // turn, and the queued first-address turn only starts once it is done.
+      expect(events.indexOf("second:end")).toBeLessThan(events.indexOf("first:end"));
+      expect(events.indexOf("first:end")).toBeLessThan(events.indexOf("first:next"));
+    });
+
+    it("retains key-value state across separate turns", async () => {
+      const address = makeDurableEntityAddress("document", "stateful");
+
+      const value = await run(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+          yield* host.run(address, (entity) => entity.keyValue.put("value", { count: 1 }));
+          return yield* host.run(address, (entity) => entity.keyValue.get("value"));
+        }),
+      );
+
+      expect(value).toEqual({ count: 1 });
+    });
+
+    it("deletes key-value state", async () => {
+      const address = makeDurableEntityAddress("document", "deletes");
+
+      const value = await run(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+          yield* host.run(address, (entity) => entity.keyValue.put("value", "present"));
+          yield* host.run(address, (entity) => entity.keyValue.delete("value"));
+          return yield* host.run(address, (entity) => entity.keyValue.get("value"));
+        }),
+      );
+
+      expect(value).toBeUndefined();
+    });
+
+    it("round-trips a replaceable alarm", async () => {
+      const address = makeDurableEntityAddress("document", "alarms");
+
+      const [set, cleared] = await run(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+          yield* host.run(address, (entity) => entity.alarm.set(1234));
+          const set = yield* host.run(address, (entity) => entity.alarm.get);
+          yield* host.run(address, (entity) => entity.alarm.delete);
+          const cleared = yield* host.run(address, (entity) => entity.alarm.get);
+          return [set, cleared] as const;
+        }),
+      );
+
+      expect(set).toBe(1234);
+      expect(cleared).toBeUndefined();
+    });
+
+    it("isolates state between addresses", async () => {
+      const first = makeDurableEntityAddress("document", "isolated-a");
+      const second = makeDurableEntityAddress("document", "isolated-b");
+
+      const value = await run(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+          yield* host.run(first, (entity) => entity.keyValue.put("value", "a"));
+          return yield* host.run(second, (entity) => entity.keyValue.get("value"));
+        }),
+      );
+
+      expect(value).toBeUndefined();
+    });
+
+    if (options.supportsSessions !== false) {
+      it("tracks attached sessions", async () => {
+        const address = makeDurableEntityAddress("document", "sessions");
+
+        const [attached, remaining] = await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) => entity.sessions.attach(testSession("s-1")));
+            const attached = yield* host.run(address, (entity) => entity.sessions.list);
+            yield* host.run(address, (entity) => entity.sessions.remove("s-1"));
+            const remaining = yield* host.run(address, (entity) => entity.sessions.list);
+            return [attached, remaining] as const;
+          }),
+        );
+
+        expect(attached.map((session) => session.id)).toEqual(["s-1"]);
+        expect(remaining).toEqual([]);
+      });
+
+      it("replaces an attachment that reuses a session id", async () => {
+        const address = makeDurableEntityAddress("document", "session-reattach");
+        const first = recordingSession("s-1");
+        const second = recordingSession("s-1");
+
+        const sessions = await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) => entity.sessions.attach(first.session));
+            yield* host.run(address, (entity) => entity.sessions.attach(second.session));
+            return yield* host.run(address, (entity) => entity.sessions.list);
+          }),
+        );
+
+        expect(sessions).toHaveLength(1);
+        // Identity, not just the id: a reconnect must not keep delivering to
+        // the socket it replaced.
+        expect(sessions[0]).toBe(second.session);
+      });
+
+      it("looks sessions up by id and forgets unknown ids", async () => {
+        const address = makeDurableEntityAddress("document", "session-lookup");
+
+        const [found, missing, afterRemove] = await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) => entity.sessions.attach(testSession("s-1")));
+            const found = yield* host.run(address, (entity) => entity.sessions.get("s-1"));
+            const missing = yield* host.run(address, (entity) => entity.sessions.get("s-2"));
+            // Removing an id that was never attached is a no-op, not an error.
+            yield* host.run(address, (entity) => entity.sessions.remove("s-2"));
+            yield* host.run(address, (entity) => entity.sessions.remove("s-1"));
+            const afterRemove = yield* host.run(address, (entity) => entity.sessions.get("s-1"));
+            return [found, missing, afterRemove] as const;
+          }),
+        );
+
+        expect(found?.id).toBe("s-1");
+        expect(missing).toBeUndefined();
+        expect(afterRemove).toBeUndefined();
+      });
+
+      it("isolates sessions between addresses", async () => {
+        const first = makeDurableEntityAddress("document", "session-isolated-a");
+        const second = makeDurableEntityAddress("document", "session-isolated-b");
+
+        const sessions = await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(first, (entity) => entity.sessions.attach(testSession("s-1")));
+            return yield* host.run(second, (entity) => entity.sessions.list);
+          }),
+        );
+
+        expect(sessions).toEqual([]);
+      });
+
+      it("drops sessions when the host is rebuilt", async () => {
+        const address = makeDurableEntityAddress("document", `session-restart-${Date.now()}`);
+
+        await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) => entity.sessions.attach(testSession("s-1")));
+          }),
+        );
+
+        // A socket belongs to the process that holds it open, so a new host
+        // must never resurrect one from storage.
+        const sessions = await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            return yield* host.run(address, (entity) => entity.sessions.list);
+          }),
+        );
+
+        expect(sessions).toEqual([]);
+      });
+
+      it("delivers text and binary frames to every attached session exactly once", async () => {
+        const address = makeDurableEntityAddress("document", "session-delivery");
+        const first = recordingSession("s-1");
+        const second = recordingSession("s-2");
+        const binary = new Uint8Array([1, 2, 3]);
+
+        await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) =>
+              Effect.gen(function* () {
+                yield* entity.sessions.attach(first.session);
+                yield* entity.sessions.attach(second.session);
+              }),
+            );
+            yield* host.run(address, (entity) =>
+              Effect.gen(function* () {
+                const sessions = yield* entity.sessions.list;
+                yield* Effect.forEach(sessions, (session) => session.send("hello"), {
+                  discard: true,
+                });
+                yield* Effect.forEach(sessions, (session) => session.send(binary), {
+                  discard: true,
+                });
+              }),
+            );
+          }),
+        );
+
+        for (const recorded of [first, second]) {
+          expect(recorded.frames).toHaveLength(2);
+          expect(recorded.frames[0]).toBe("hello");
+          // The frame must arrive as bytes, not as a stringified array or a
+          // JSON round trip of one.
+          expect(recorded.frames[1]).toBeInstanceOf(Uint8Array);
+          expect(Array.from(recorded.frames[1] as Uint8Array)).toEqual([1, 2, 3]);
+        }
+      });
+
+      it("propagates the close code and reason to the transport", async () => {
+        const address = makeDurableEntityAddress("document", "session-close");
+        const recorded = recordingSession("s-1");
+
+        await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) => entity.sessions.attach(recorded.session));
+            yield* host.run(address, (entity) =>
+              entity.sessions.list.pipe(
+                Effect.flatMap((sessions) =>
+                  Effect.forEach(sessions, (session) => session.close(1008, "policy"), {
+                    discard: true,
+                  }),
+                ),
+              ),
+            );
+          }),
+        );
+
+        expect(recorded.closes).toEqual([{ code: 1008, reason: "policy" }]);
+      });
+
+      it("keeps session attachments readable from a later turn", async () => {
+        const address = makeDurableEntityAddress("document", "session-attachment");
+
+        const attachment = await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) =>
+              Effect.gen(function* () {
+                const session = testSession("s-1");
+                yield* entity.sessions.attach(session);
+                yield* session.setAttachment({ authenticated: true });
+              }),
+            );
+            return yield* host.run(address, (entity) =>
+              entity.sessions.list.pipe(
+                Effect.flatMap((sessions) => sessions[0]!.getAttachment),
+              ),
+            );
+          }),
+        );
+
+        expect(attachment).toEqual({ authenticated: true });
+      });
+
+      it("sends on a session while a turn for that address is still running", async () => {
+        const address = makeDurableEntityAddress("document", "session-outside-turn");
+        const recorded = recordingSession("s-1");
+        const events: Array<string> = [];
+
+        await run(
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) => entity.sessions.attach(recorded.session));
+            const session = yield* host.run(address, (entity) =>
+              entity.sessions.list.pipe(Effect.map((sessions) => sessions[0]!)),
+            );
+            yield* Effect.all(
+              [
+                host.run(address, () =>
+                  Effect.sleep("200 millis").pipe(
+                    Effect.andThen(Effect.sync(() => void events.push("turn:end"))),
+                  ),
+                ),
+                // A held turn must not stall delivery: the session handle is a
+                // plain socket reference, not something the entity lock owns.
+                Effect.sleep("20 millis").pipe(
+                  Effect.andThen(session.send("out-of-band")),
+                  Effect.andThen(Effect.sync(() => void events.push("sent"))),
+                ),
+              ],
+              { concurrency: "unbounded" },
+            );
+          }),
+        );
+
+        expect(recorded.frames).toEqual(["out-of-band"]);
+        expect(events).toEqual(["sent", "turn:end"]);
+      });
+    }
+
+    const alarmDispatchLayer = options.supportsAlarmDispatch;
+    if (alarmDispatchLayer !== undefined) {
+      it("reports an armed alarm as due exactly once and forgets it after delete", async () => {
+        // Adapters back this with one shared table, so the addresses have to be
+        // unique per run or a previous run's rows would answer the assertion.
+        const suffix = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+        const address = makeDurableEntityAddress("document", `alarm-due-${suffix}`);
+        const future = makeDurableEntityAddress("document", `alarm-future-${suffix}`);
+        const now = Date.now();
+
+        const [due, afterDelete] = await runWith(
+          alarmDispatchLayer(),
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            const control = yield* DurableEntityAlarmControl;
+            yield* host.run(address, (entity) => entity.alarm.set(now - 1_000));
+            yield* host.run(future, (entity) => entity.alarm.set(now + 600_000));
+            const due = yield* control.listDueAlarms(now, 100);
+            yield* host.run(address, (entity) => entity.alarm.delete);
+            yield* host.run(future, (entity) => entity.alarm.delete);
+            const afterDelete = yield* control.listDueAlarms(now, 100);
+            return [due, afterDelete] as const;
+          }),
+        );
+
+        const matching = due.filter((alarm) => alarm.address.id === address.id);
+        expect(matching).toEqual([{ address, scheduledTime: now - 1_000 }]);
+        // An alarm that has not come due yet must stay invisible to the
+        // dispatcher, or it would fire early on every poll.
+        expect(due.some((alarm) => alarm.address.id === future.id)).toBe(false);
+        expect(afterDelete.some((alarm) => alarm.address.id === address.id)).toBe(false);
+      });
+    }
+
+    const unownedLayer = options.requiresShardLocality;
+    if (unownedLayer !== undefined) {
+      it("refuses to attach a session the runner does not own", async () => {
+        const address = makeDurableEntityAddress("document", "unowned-attach");
+
+        const failed = await runWith(
+          unownedLayer(),
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            const exit = yield* Effect.exit(
+              host.run(address, (entity) => entity.sessions.attach(testSession("s-1"))),
+            );
+            return exit._tag === "Failure";
+          }),
+        );
+
+        expect(failed).toBe(true);
+      });
+
+      it("keeps session reads and removals total on an unowned address", async () => {
+        const address = makeDurableEntityAddress("document", "unowned-reads");
+
+        const [sessions, found] = await runWith(
+          unownedLayer(),
+          Effect.gen(function* () {
+            const host = yield* DurableEntityHost;
+            yield* host.run(address, (entity) => entity.sessions.remove("s-1"));
+            const sessions = yield* host.run(address, (entity) => entity.sessions.list);
+            const found = yield* host.run(address, (entity) => entity.sessions.get("s-1"));
+            return [sessions, found] as const;
+          }),
+        );
+
+        expect(sessions).toEqual([]);
+        expect(found).toBeUndefined();
+      });
+    }
+  });
+};
diff --git a/packages/platform/src/conformance/Queue.ts b/packages/platform/src/conformance/Queue.ts
new file mode 100644
index 000000000..594f1b50f
--- /dev/null
+++ b/packages/platform/src/conformance/Queue.ts
@@ -0,0 +1,167 @@
+import { Effect, Layer, Schema } from "effect";
+import { describe, expect, it } from "vitest";
+
+import type { PlatformRuntime } from "../PlatformRuntime.ts";
+import { QueueDriver } from "../Queue.ts";
+
+const Message = Schema.Struct({ id: Schema.String });
+
+/**
+ * Durable stores keep undelivered rows between runs, so queue names are
+ * per-run to stop one run's leftovers from leaking into the next.
+ */
+const runId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+type Message = typeof Message.Type;
+
+/** Wiring one adapter must supply for the queue conformance suite. */
+export interface QueueConformanceOptions {
+  /** Adapter name, used in test titles. */
+  readonly name: string;
+  /** Builds an isolated driver; called once per test so state never leaks. */
+  readonly layer: () => Layer.Layer<QueueDriver | PlatformRuntime>;
+  /**
+   * Adapters that deliver whole batches can raise this; adapters that deliver
+   * one message at a time leave it at 1.
+   */
+  readonly maxBatchSize?: number;
+}
+
+/**
+ * Behaviour every queue driver must exhibit, regardless of backend.
+ *
+ * The contract is at-least-once delivery with bounded retries: messages
+ * survive a failing handler, poison payloads are acknowledged rather than
+ * redelivered forever, and exhausted messages reach the dead-letter queue when
+ * one is configured.
+ */
+export const queueDriverConformance = (options: QueueConformanceOptions): void => {
+  const run = <A, E>(effect: Effect.Effect<A, E, QueueDriver | PlatformRuntime>): Promise<A> =>
+    Effect.runPromise(Effect.scoped(effect.pipe(Effect.provide(options.layer()))) as Effect.Effect<A, E>);
+
+  describe(`${options.name}: queue driver conformance`, () => {
+    it("delivers a published message to a consumer", async () => {
+      const seen: Array<string> = [];
+
+      await run(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          yield* driver.producer(`conformance-basic-${runId}`, Message).publish({ id: "first" });
+
+          const claimed = yield* driver.processBatch(
+            `conformance-basic-${runId}`,
+            Message,
+            (messages: ReadonlyArray<Message>) =>
+              Effect.sync(() => void seen.push(...messages.map((message) => message.id))),
+          );
+
+          expect(claimed).toBeGreaterThan(0);
+        }),
+      );
+
+      expect(seen).toEqual(["first"]);
+    });
+
+    it("reports an empty queue instead of blocking", async () => {
+      const claimed = await run(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          return yield* driver.processBatch(`conformance-empty-${runId}`, Message, () => Effect.void, {
+            pollIntervalMillis: 50,
+          });
+        }),
+      );
+
+      expect(claimed).toBe(0);
+    });
+
+    it("redelivers a message after the handler fails", async () => {
+      const attempts: Array<string> = [];
+
+      await run(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          yield* driver.producer(`conformance-retry-${runId}`, Message).publish({ id: "retry-me" });
+
+          const consume = (shouldFail: boolean) =>
+            driver.processBatch(
+              `conformance-retry-${runId}`,
+              Message,
+              (messages: ReadonlyArray<Message>) =>
+                Effect.sync(() => void attempts.push(...messages.map((m) => m.id))).pipe(
+                  Effect.andThen(shouldFail ? Effect.fail("boom") : Effect.void),
+                ),
+              { maxRetries: 2, pollIntervalMillis: 100, retryDelayMillis: 1 },
+            );
+
+          yield* consume(true);
+          yield* consume(false);
+        }),
+      );
+
+      expect(attempts).toEqual(["retry-me", "retry-me"]);
+    });
+
+    it("dead-letters a message once retries are exhausted", async () => {
+      const dead: Array<string> = [];
+
+      await run(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          yield* driver.producer(`conformance-dlq-${runId}`, Message).publish({ id: "doomed" });
+
+          // Zero retries: the first failure is terminal.
+          yield* driver.processBatch(`conformance-dlq-${runId}`, Message, () => Effect.fail("boom"), {
+            maxRetries: 0,
+            deadLetterQueue: `conformance-dlq-dead-${runId}`,
+            pollIntervalMillis: 100,
+            retryDelayMillis: 1,
+          });
+
+          const claimed = yield* driver.processBatch(
+            `conformance-dlq-dead-${runId}`,
+            Message,
+            (messages: ReadonlyArray<Message>) =>
+              Effect.sync(() => void dead.push(...messages.map((m) => m.id))),
+            { pollIntervalMillis: 200 },
+          );
+          expect(claimed).toBeGreaterThan(0);
+        }),
+      );
+
+      expect(dead).toEqual(["doomed"]);
+    });
+
+    it("acknowledges an undecodable payload instead of redelivering it forever", async () => {
+      const seen: Array<string> = [];
+
+      await run(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          // Publish through a schema the consumer cannot decode.
+          yield* driver
+            .producer(`conformance-poison-${runId}`, Schema.Struct({ unexpected: Schema.Number }))
+            .publish({ unexpected: 1 });
+          yield* driver.producer(`conformance-poison-${runId}`, Message).publish({ id: "good" });
+
+          yield* driver.processBatch(
+            `conformance-poison-${runId}`,
+            Message,
+            (messages: ReadonlyArray<Message>) =>
+              Effect.sync(() => void seen.push(...messages.map((m) => m.id))),
+            { pollIntervalMillis: 100 },
+          );
+          yield* driver.processBatch(
+            `conformance-poison-${runId}`,
+            Message,
+            (messages: ReadonlyArray<Message>) =>
+              Effect.sync(() => void seen.push(...messages.map((m) => m.id))),
+            { pollIntervalMillis: 100 },
+          );
+        }),
+      );
+
+      // The poison payload is dropped; the healthy message still arrives.
+      expect(seen).toEqual(["good"]);
+    });
+  });
+};
diff --git a/packages/platform/src/conformance/Workflow.ts b/packages/platform/src/conformance/Workflow.ts
new file mode 100644
index 000000000..3c65236b6
--- /dev/null
+++ b/packages/platform/src/conformance/Workflow.ts
@@ -0,0 +1,184 @@
+import { Effect, Layer, Schedule, type Scope, Schema } from "effect";
+import { describe, expect, it } from "vitest";
+
+import type { PlatformRuntime } from "../PlatformRuntime.ts";
+import * as Workflow from "../Workflow.ts";
+import { WorkflowRunner } from "../WorkflowRunner.ts";
+
+/** Wiring one adapter must supply for the workflow conformance suite. */
+export interface WorkflowConformanceOptions {
+  readonly name: string;
+  /** Builds an isolated runner; called once per test so state never leaks. */
+  readonly layer: () => Layer.Layer<WorkflowRunner | PlatformRuntime>;
+}
+
+/**
+ * Durable backends keep completed executions forever, and an execution ID is
+ * derived from the idempotency key. Without a per-run suffix a second run of
+ * this suite would join the previous run's finished executions and observe no
+ * handler side effects.
+ */
+const runId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+
+const Greet = Workflow.define({
+  name: "conformance-greet",
+  payload: { subject: Schema.String },
+  success: Schema.String,
+  idempotencyKey: (payload) => payload.subject,
+});
+
+/**
+ * Behaviour every durable workflow runner must exhibit: a registered workflow
+ * runs to a persisted result, steps inside it are durable units, and the
+ * execution ID derived from the idempotency key makes a repeated dispatch join
+ * the original run instead of starting a second one.
+ */
+export const workflowRunnerConformance = (options: WorkflowConformanceOptions): void => {
+  // Registering a workflow handler is scoped: the handler stays installed for
+  // the lifetime of the scope, so each test discharges its own.
+  const run = <A, E>(
+    effect: Effect.Effect<A, E, WorkflowRunner | PlatformRuntime | Scope.Scope>,
+  ): Promise<A> =>
+    Effect.runPromise(
+      Effect.scoped(effect.pipe(Effect.provide(options.layer()))) as Effect.Effect<A, E>,
+    );
+
+  /**
+   * Waits for a dispatched execution to reach a persisted result.
+   *
+   * `dispatch` only starts a workflow; backends that run it on another fiber or
+   * another runner settle it after the call returns, so the suite polls instead
+   * of assuming the result is already there.
+   */
+  const awaitResult = (executionId: string) =>
+    Effect.gen(function* () {
+      const runner = yield* WorkflowRunner;
+      return yield* Effect.retry(
+        runner
+          .poll(Greet, executionId)
+          .pipe(
+            Effect.flatMap((result) =>
+              result._tag === "Some" && result.value.status !== "suspended"
+                ? Effect.succeed(result)
+                : Effect.fail("pending" as const),
+            ),
+          ),
+        { times: 100, schedule: Schedule.spaced("20 millis") },
+      );
+    });
+
+  describe(`${options.name}: workflow runner conformance`, () => {
+    it("executes a registered workflow and returns its result", async () => {
+      const result = await run(
+        Effect.gen(function* () {
+          const runner = yield* WorkflowRunner;
+          yield* runner.register(
+            Greet,
+            (payload) => Effect.succeed(`hello ${payload.subject}`),
+            Layer.empty,
+          );
+          return yield* runner.execute(Greet, { subject: `world-${runId}` });
+        }),
+      );
+
+      expect(result).toBe(`hello world-${runId}`);
+    });
+
+    it("runs durable steps inside a workflow body", async () => {
+      const steps: Array<string> = [];
+
+      const result = await run(
+        Effect.gen(function* () {
+          const runner = yield* WorkflowRunner;
+          yield* runner.register(
+            Greet,
+            (payload, context) =>
+              Effect.gen(function* () {
+                const upper = yield* context.step({
+                  name: "shout",
+                  success: Schema.String,
+                  execute: Effect.sync(() => {
+                    steps.push("shout");
+                    return payload.subject.toUpperCase();
+                  }),
+                });
+                return `hello ${upper}`;
+              }),
+            Layer.empty,
+          );
+          return yield* runner.execute(Greet, { subject: `steps-${runId}` });
+        }),
+      );
+
+      expect(result).toBe(`hello ${`steps-${runId}`.toUpperCase()}`);
+      expect(steps).toEqual(["shout"]);
+    });
+
+    it("derives a stable execution ID from the idempotency key", async () => {
+      const started: Array<string> = [];
+
+      const [first, second] = await run(
+        Effect.gen(function* () {
+          const runner = yield* WorkflowRunner;
+          yield* runner.register(
+            Greet,
+            (payload) =>
+              Effect.sync(() => {
+                started.push(payload.subject);
+                return `hello ${payload.subject}`;
+              }),
+            Layer.empty,
+          );
+          const first = yield* runner.dispatch(Greet, { subject: `same-${runId}` });
+          yield* awaitResult(first);
+          const second = yield* runner.dispatch(Greet, { subject: `same-${runId}` });
+          yield* awaitResult(second);
+          return [first, second] as const;
+        }),
+      );
+
+      expect(first).toBe(second);
+      // The second dispatch joins the completed run rather than re-running it.
+      expect(started).toEqual([`same-${runId}`]);
+    });
+
+    it("polls a completed execution", async () => {
+      const polled = await run(
+        Effect.gen(function* () {
+          const runner = yield* WorkflowRunner;
+          yield* runner.register(
+            Greet,
+            (payload) => Effect.succeed(`hello ${payload.subject}`),
+            Layer.empty,
+          );
+          const executionId = yield* runner.dispatch(Greet, { subject: `polled-${runId}` });
+          return yield* awaitResult(executionId);
+        }),
+      );
+
+      expect(polled._tag).toBe("Some");
+      if (polled._tag === "Some") {
+        expect(polled.value.status).toBe("succeeded");
+        if (polled.value.status === "succeeded") {
+          expect(polled.value.value).toBe(`hello polled-${runId}`);
+        }
+      }
+    });
+
+    it("reports a failing workflow as a failed execution", async () => {
+      const polled = await run(
+        Effect.gen(function* () {
+          const runner = yield* WorkflowRunner;
+          yield* runner.register(Greet, () => Effect.fail("boom"), Layer.empty);
+          const executionId = yield* runner.dispatch(Greet, { subject: `failing-${runId}` });
+          return yield* awaitResult(executionId);
+        }),
+      );
+
+      expect(polled._tag).toBe("Some");
+      if (polled._tag === "Some") {
+        expect(polled.value.status).toBe("failed");
+      }
+    });
+  });
+};
diff --git a/packages/platform/src/conformance/index.ts b/packages/platform/src/conformance/index.ts
new file mode 100644
index 000000000..806fa08a8
--- /dev/null
+++ b/packages/platform/src/conformance/index.ts
@@ -0,0 +1,13 @@
+export {
+  cronSchedulerConformance,
+  type CronConformanceOptions,
+} from "./CronScheduler.ts";
+export {
+  durableEntityHostConformance,
+  type DurableEntityConformanceOptions,
+} from "./DurableEntity.ts";
+export { queueDriverConformance, type QueueConformanceOptions } from "./Queue.ts";
+export {
+  workflowRunnerConformance,
+  type WorkflowConformanceOptions,
+} from "./Workflow.ts";
diff --git a/packages/platform/src/index.ts b/packages/platform/src/index.ts
new file mode 100644
index 000000000..9edccca09
--- /dev/null
+++ b/packages/platform/src/index.ts
@@ -0,0 +1,74 @@
+export {
+  type CronDefinition,
+  CronJob,
+  type CronJobContext,
+  type CronRunOptions,
+  CronScheduler,
+  CronSchedulerError,
+  type CronSchedulerShape,
+  ScheduledJob,
+} from "./CronScheduler.ts";
+export { type PrimitiveDefinition, type PrimitiveKind } from "./Primitive.ts";
+export {
+  type DueDurableEntityAlarm,
+  DurableEntityAlarmControl,
+  type DurableEntityAlarmControlShape,
+  DurableEntityHost,
+  makeDurableEntityAddress,
+  type DurableEntityAddress,
+  type DurableEntityAlarm,
+  type DurableEntityContext,
+  type DurableEntityHostShape,
+  type DurableEntityKeyValue,
+  type DurableEntitySession,
+  type DurableEntitySessions,
+  type DurableEntitySql,
+} from "./DurableEntity.ts";
+export {
+  type KeyValueEntry,
+  type KeyValuePutOptions,
+  KeyValueStore,
+  KeyValueStoreError,
+  type KeyValueStoreShape,
+} from "./KeyValueStore.ts";
+export {
+  type MailAddress,
+  type MailDeliveryResult,
+  Mailer,
+  MailerError,
+  type MailerShape,
+  type MailMessage,
+} from "./Mailer.ts";
+export {
+  ObjectStore,
+  ObjectStoreError,
+  type ObjectStoreShape,
+  type PutObjectInput,
+  type StoredObject,
+  type StoredObjectHead,
+} from "./ObjectStore.ts";
+export { PlatformRuntime, type PlatformRuntimeShape } from "./PlatformRuntime.ts";
+export {
+  defineQueue,
+  defineQueueConsumer,
+  type QueueConsumerDefinition,
+  QueueConsumerError,
+  type QueueConsumerOptions,
+  type QueueDefinition,
+  QueueDriver,
+  type QueueDriverShape,
+  QueueProducerError,
+  type QueueProducer,
+} from "./Queue.ts";
+export {
+  Screenshot,
+  ScreenshotError,
+  type ScreenshotOptions,
+  type ScreenshotShape,
+} from "./Screenshot.ts";
+export {
+  type WorkflowExecutionResult,
+  WorkflowRunner,
+  WorkflowRunnerError,
+  type WorkflowRunnerShape,
+} from "./WorkflowRunner.ts";
diff --git a/packages/platform/tsconfig.json b/packages/platform/tsconfig.json
new file mode 100644
index 000000000..c530b0614
--- /dev/null
+++ b/packages/platform/tsconfig.json
@@ -0,0 +1,5 @@
+{
+  "extends": "@voidhash/tsconfig/internal-package-typescript-6.json",
+  "include": ["src"],
+  "exclude": ["**/node_modules/**"]
+}
diff --git a/packages/rpc/sst-env.d.ts b/packages/rpc/sst-env.d.ts
index eec65b9bd..cf5e5fbe5 100644
--- a/packages/rpc/sst-env.d.ts
+++ b/packages/rpc/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/packages/shared/sst-env.d.ts b/packages/shared/sst-env.d.ts
index f2ed71576..b3584169c 100644
--- a/packages/shared/sst-env.d.ts
+++ b/packages/shared/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../../../sst-env.d.ts" />
 
diff --git a/packages/ui/components/data-table-skeleton.tsx b/packages/ui/components/data-table-skeleton.tsx
index 2d53bba05..fc9a488c8 100644
--- a/packages/ui/components/data-table-skeleton.tsx
+++ b/packages/ui/components/data-table-skeleton.tsx
@@ -9,7 +9,6 @@ export function DataTableSkeleton() {
             which desyncs SSR markup from the client tree and breaks hydration. */}
         <TableBody>
           {Array.from({ length: 10 }).map((_, index) => (
-            // biome-ignore lint/suspicious/noArrayIndexKey: skeleton
             <TableRow key={index}>
               <TableCell>
                 <Skeleton className="h-4 w-full" />
diff --git a/packages/ui/components/gradient-avatar.tsx b/packages/ui/components/gradient-avatar.tsx
index 89d774e88..7a5f74429 100644
--- a/packages/ui/components/gradient-avatar.tsx
+++ b/packages/ui/components/gradient-avatar.tsx
@@ -5,10 +5,7 @@ function simpleHash(str: string): number {
   let hash = 0;
   for (let i = 0; i < str.length; i++) {
     const char = str.codePointAt(i) ?? 0;
-    // biome-ignore lint/nursery/noBitwiseOperators: required
     hash = (hash << 5) - hash + char;
-    // biome-ignore lint/style/useShorthandAssign: required
-    // biome-ignore lint/nursery/noBitwiseOperators: required
     hash &= hash; // Convert to 32-bit integer
   }
   return Math.abs(hash);
@@ -86,9 +83,7 @@ class ColorHash {
       return Array.isArray(paramValue) ? paramValue.concat() : [paramValue];
     });
 
-    // biome-ignore lint/style/noNonNullAssertion: required
     this.L = L!;
-    // biome-ignore lint/style/noNonNullAssertion: required
     this.S = S!;
 
     if (typeof options.hue === "number") {
@@ -117,13 +112,10 @@ class ColorHash {
     let hash = simpleHash(str);
     const hueResolution = 727;
     let H: number;
-    // biome-ignore lint/style/useConst: let me live
     let S: number;
-    // biome-ignore lint/style/useConst: let me live
     let L: number;
 
     if (this.hueRanges.length) {
-      // biome-ignore lint/style/noNonNullAssertion: required
       const range = this.hueRanges[hash % this.hueRanges.length]!;
       H =
         (((hash / this.hueRanges.length) % hueResolution) * (range.max - range.min)) /
@@ -133,13 +125,10 @@ class ColorHash {
       H = hash % 359;
     }
     hash = Math.ceil(hash / 360);
-    // biome-ignore lint/style/noNonNullAssertion: required
     S = this.S[hash % this.S.length]!;
     hash = Math.ceil(hash / this.S.length);
-    // biome-ignore lint/style/noNonNullAssertion: required
     L = this.L[hash % this.L.length]!;
 
-    // biome-ignore lint/style/noNonNullAssertion: required
     return [H, S!, L!];
   }
 
@@ -184,7 +173,6 @@ const stringToColours = (s: string): string[] => colorHash.hexPair(s);
 const generateColours = (s: string): [string, string] => {
   const s1 = s.slice(0, s.length / 2);
   const [c1, c2] = stringToColours(s1);
-  // biome-ignore lint/style/noNonNullAssertion: required
   return [c1!, c2!];
 };
 
@@ -230,7 +218,6 @@ export function GradientAvatar({
       {src ? (
         <AvatarImage alt={alt} src={avatarSrc} />
       ) : (
-        // biome-ignore lint/performance/noImgElement: custom image loading
         <img alt={alt} className="aspect-square size-full" src={avatarSrc} />
       )}
       <AvatarFallback>{fallback?.slice(0, 2)}</AvatarFallback>
diff --git a/packages/ui/components/spinner.tsx b/packages/ui/components/spinner.tsx
index b56af8f88..46b296bdf 100644
--- a/packages/ui/components/spinner.tsx
+++ b/packages/ui/components/spinner.tsx
@@ -8,7 +8,6 @@ export function Spinner({
   ...props
 }: React.HTMLAttributes<HTMLDivElement> & { pathClassName?: string }) {
   return (
-    // biome-ignore lint/a11y/useSemanticElements: shadcn
     <div aria-label="Loading..." role="status" {...props}>
       <svg className={cn("animate-spin", "text-foreground", className)} viewBox="3 3 18 18">
         <title>Loading...</title>
diff --git a/packages/ui/components/theme-provider-tanstack.tsx b/packages/ui/components/theme-provider-tanstack.tsx
index af90e0454..220790f06 100644
--- a/packages/ui/components/theme-provider-tanstack.tsx
+++ b/packages/ui/components/theme-provider-tanstack.tsx
@@ -53,7 +53,6 @@ const colorSchemes = new Set(["light", "dark"]);
 const MEDIA = "(prefers-color-scheme: dark)";
 const isServer = typeof window === "undefined";
 const ThemeContext = React.createContext<UseThemeProps | undefined>(undefined);
-// biome-ignore lint/suspicious/noEmptyBlockStatements: default value
 const defaultContext: UseThemeProps = { setTheme: (_) => {}, themes: [] };
 
 export const useTheme = () => React.useContext(ThemeContext) ?? defaultContext;
@@ -89,7 +88,6 @@ const Theme = ({
   const attrs = value ? Object.values(value) : themes;
 
   // apply selected theme function (light, dark, system)
-  // biome-ignore lint/correctness/useExhaustiveDependencies: <explanation>
   const applyTheme = React.useCallback((theme: string | undefined) => {
     let resolved = theme;
     if (!resolved) {
@@ -137,9 +135,7 @@ const Theme = ({
   }, []);
 
   // Set theme state and save to local storage
-  // biome-ignore lint/correctness/useExhaustiveDependencies: <explanation>
   const setTheme = React.useCallback(
-    // biome-ignore lint/suspicious/noExplicitAny: <explanation>
     (value: any) => {
       const newTheme = typeof value === "function" ? value(theme) : value;
       setThemeState(newTheme);
@@ -154,7 +150,6 @@ const Theme = ({
     [theme],
   );
 
-  // biome-ignore lint/correctness/useExhaustiveDependencies: <explanation>
   const handleMediaQuery = React.useCallback(
     (e: MediaQueryListEvent | MediaQueryList) => {
       getSystemTheme(e);
@@ -178,7 +173,6 @@ const Theme = ({
   }, [handleMediaQuery]);
 
   // localStorage event handling, allow to sync theme changes between tabs
-  // biome-ignore lint/correctness/useExhaustiveDependencies: <explanation>
   React.useEffect(() => {
     const handleStorage = (e: StorageEvent) => {
       if (e.key !== storageKey) {
@@ -195,7 +189,6 @@ const Theme = ({
   }, [setTheme]);
 
   // Whenever theme or forcedTheme changes, apply it
-  // biome-ignore lint/correctness/useExhaustiveDependencies: <explanation>
   React.useEffect(() => {
     applyTheme(forcedTheme ?? theme);
   }, [forcedTheme, theme]);
@@ -255,12 +248,12 @@ const ThemeScript = React.memo(
 
     return (
       <script
-        // biome-ignore lint/security/noDangerouslySetInnerHtml: Needed to inject script before hydration
+        // Needed to inject script before hydration
         dangerouslySetInnerHTML={{
           __html: `(${script.toString()})(${scriptArgs})`,
         }}
         nonce={typeof window === "undefined" ? nonce : ""}
-        // biome-ignore lint/security/noDangerouslySetInnerHtml: Needed to inject script before hydration
+        // Needed to inject script before hydration
         suppressHydrationWarning
       />
       // <></>
@@ -314,7 +307,6 @@ const getSystemTheme = (e?: MediaQueryList | MediaQueryListEvent) => {
   next-themes can be found at https://github.com/pacocoursey/next-themes under the MIT license.
 */
 
-// biome-ignore lint/suspicious/noExplicitAny: <explanation>
 export const script: (...args: any[]) => void = (
   attribute,
   storageKey,
diff --git a/packages/ui/components/ui/breadcrumb.tsx b/packages/ui/components/ui/breadcrumb.tsx
index 641fe10e4..f78cdc570 100644
--- a/packages/ui/components/ui/breadcrumb.tsx
+++ b/packages/ui/components/ui/breadcrumb.tsx
@@ -53,7 +53,6 @@ function BreadcrumbLink({
 
 function BreadcrumbPage({ className, ...props }: React.ComponentProps<"span">) {
   return (
-    // biome-ignore lint/a11y/useFocusableInteractive: shadcn
     <span
       aria-current="page"
       aria-disabled="true"
diff --git a/packages/ui/components/ui/carousel.tsx b/packages/ui/components/ui/carousel.tsx
index d4f307ad0..dae56420b 100644
--- a/packages/ui/components/ui/carousel.tsx
+++ b/packages/ui/components/ui/carousel.tsx
@@ -121,7 +121,6 @@ function Carousel({
         scrollPrev,
       }}
     >
-      {/** biome-ignore lint/a11y/useSemanticElements: shadcn */}
       <div
         aria-roledescription="carousel"
         className={cn("relative", className)}
diff --git a/packages/ui/components/ui/chart.tsx b/packages/ui/components/ui/chart.tsx
index 0377fbe90..a1d7be6d8 100644
--- a/packages/ui/components/ui/chart.tsx
+++ b/packages/ui/components/ui/chart.tsx
@@ -81,7 +81,6 @@ const ChartStyle = ({ id, config }: { id: string; config: ChartConfig }) => {
 
   return (
     <style
-      // biome-ignore lint/security/noDangerouslySetInnerHtml: shadcn, should be safe
       dangerouslySetInnerHTML={{
         __html: Object.entries(THEMES)
           .map(
diff --git a/packages/ui/components/ui/dropzone.tsx b/packages/ui/components/ui/dropzone.tsx
index 633841714..a3ac27027 100644
--- a/packages/ui/components/ui/dropzone.tsx
+++ b/packages/ui/components/ui/dropzone.tsx
@@ -1,5 +1,3 @@
-/** biome-ignore-all lint/a11y/noStaticElementInteractions: shadcn */
-/** biome-ignore-all lint/nursery/noNoninteractiveElementInteractions: shadcn */
 import { UploadIcon } from "lucide-react";
 import * as React from "react";
 
diff --git a/packages/ui/components/ui/input-otp.tsx b/packages/ui/components/ui/input-otp.tsx
index cfcb03009..5242bf835 100644
--- a/packages/ui/components/ui/input-otp.tsx
+++ b/packages/ui/components/ui/input-otp.tsx
@@ -61,9 +61,6 @@ function InputOTPSlot({
 
 function InputOTPSeparator({ ...props }: React.ComponentProps<"div">) {
   return (
-    // biome-ignore lint/a11y/useFocusableInteractive: shadcn
-    // biome-ignore lint/a11y/useSemanticElements: shadcn
-    // biome-ignore lint/a11y/useAriaPropsForRole: shadcn
     <div data-slot="input-otp-separator" role="separator" {...props}>
       <MinusIcon />
     </div>
diff --git a/packages/ui/components/ui/sidebar.tsx b/packages/ui/components/ui/sidebar.tsx
index 79f649863..8a88a46bf 100644
--- a/packages/ui/components/ui/sidebar.tsx
+++ b/packages/ui/components/ui/sidebar.tsx
@@ -72,7 +72,6 @@ function SidebarProvider({
       }
 
       // This sets the cookie to keep the sidebar state.
-      // biome-ignore lint/suspicious/noDocumentCookie: shadcn
       document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`;
     },
     [setOpenProp, open],
diff --git a/packages/ui/components/ui/slider.tsx b/packages/ui/components/ui/slider.tsx
index 9dc6ab858..c999e43d2 100644
--- a/packages/ui/components/ui/slider.tsx
+++ b/packages/ui/components/ui/slider.tsx
@@ -48,7 +48,6 @@ function Slider({
         <SliderPrimitive.Thumb
           className="block size-4 shrink-0 rounded-full bg-white shadow-md ring-ring/50 transition-[color,box-shadow] hover:ring-4 focus-visible:outline-hidden focus-visible:ring-4 disabled:pointer-events-none disabled:opacity-50"
           data-slot="slider-thumb"
-          // biome-ignore lint/suspicious/noArrayIndexKey: shadcn
           key={index}
         />
       ))}
diff --git a/packages/ui/hooks/use-confirmation-dialog.tsx b/packages/ui/hooks/use-confirmation-dialog.tsx
index f43de66d3..534d17690 100644
--- a/packages/ui/hooks/use-confirmation-dialog.tsx
+++ b/packages/ui/hooks/use-confirmation-dialog.tsx
@@ -53,7 +53,6 @@ export function useConfirmDialog() {
   }, [resolveCallback]);
 
   const ConfirmationDialog = useCallback(() => {
-    // biome-ignore lint/correctness/useHookAtTopLevel: Nested component
     const [confirmInput, setConfirmInput] = useState<string | undefined>();
     return (
       <AlertDialog open={isOpen}>
diff --git a/patches/brace-expansion@5.0.8.patch b/patches/brace-expansion@5.0.9.patch
similarity index 94%
rename from patches/brace-expansion@5.0.8.patch
rename to patches/brace-expansion@5.0.9.patch
index 907b3ff61..9ddbc46d7 100644
--- a/patches/brace-expansion@5.0.8.patch
+++ b/patches/brace-expansion@5.0.9.patch
@@ -1,7 +1,7 @@
 diff --git a/dist/commonjs/index.js b/dist/commonjs/index.js
 --- a/dist/commonjs/index.js
 +++ b/dist/commonjs/index.js
-@@ -259,5 +259,8 @@
+@@ -285,5 +285,8 @@
          str = m.post;
      }
      return acc;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fed3c6d2d..5bcabe3e2 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,6 +9,9 @@ catalogs:
     '@better-auth/api-key':
       specifier: ^1.6.23
       version: 1.6.23
+    '@effect-aws/client-s3':
+      specifier: 2.0.0-beta.4
+      version: 2.0.0-beta.4
     '@effect/language-service':
       specifier: ^0.86.2
       version: 0.86.6
@@ -60,6 +63,9 @@ catalogs:
     '@tanstack/zod-adapter':
       specifier: 1.167.0
       version: 1.167.0
+    '@types/nodemailer':
+      specifier: 8.0.1
+      version: 8.0.1
     '@types/react':
       specifier: ^19.1.0
       version: 19.1.17
@@ -93,6 +99,12 @@ catalogs:
     lucide-react:
       specifier: ^0.555.0
       version: 0.555.0
+    nodemailer:
+      specifier: 9.0.3
+      version: 9.0.3
+    playwright-core:
+      specifier: 1.61.1
+      version: 1.61.1
     react:
       specifier: 19.2.7
       version: 19.2.7
@@ -137,7 +149,8 @@ overrides:
   '@babel/core@<=7.29.0': 7.29.6
   '@esbuild-kit/core-utils>esbuild': 0.25.0
   '@expo/cli>tar': 7.5.21
-  '@expo/metro-config>postcss': 8.5.18
+  '@expo/metro-config>postcss': 8.5.23
+  '@hono/node-server@<2.0.10': 2.0.10
   '@isaacs/brace-expansion@<=5.0.0': 5.0.1
   '@tanstack/react-start@>=1.0.0 <1.167.30': 1.167.30
   '@tootallnate/once@<2.0.1': 2.0.1
@@ -145,12 +158,12 @@ overrides:
   '@srsholmes/vitest-react-native>esbuild': 0.28.1
   ajv@<7: 6.14.0
   ajv@>=7.0.0-alpha.0 <8.18.0: 8.18.0
-  brace-expansion@<=5.0.7: 5.0.8
+  brace-expansion@<=5.0.8: 5.0.9
   bundle-require>esbuild: 0.28.1
   defu@<=6.1.4: 6.1.7
   drizzle-orm@<0.45.2: 0.45.2
   effect: 4.0.0-beta.100
-  fast-uri@<=3.1.3: 3.1.4
+  fast-uri@<=3.1.4: 3.1.5
   fast-xml-parser@>=5.9.3 <5.10.1: 5.10.1
   fdir>picomatch: 4.0.4
   flatted@<=3.4.1: 3.4.2
@@ -158,7 +171,8 @@ overrides:
   h3-v2: npm:h3@2.0.1-rc.18
   js-yaml@<3.15.0: 3.15.0
   js-yaml@>=4.0.0 <4.3.0: 4.3.0
-  postcss@>=8.0.0 <8.5.18: 8.5.18
+  hono@>=4 <4.12.34: 4.12.34
+  postcss@>=8.0.0 <8.5.23: 8.5.23
   kysely: 0.28.17
   lodash@>=4.0.0 <=4.17.23: 4.18.0
   minimatch@<3.1.4: 3.1.4
@@ -169,12 +183,14 @@ overrides:
   picomatch@<2.3.2: 2.3.2
   picomatch@>=3.0.0 <3.0.2: 3.0.2
   picomatch@>=4.0.0 <4.0.4: 4.0.4
-  postcss@<8.5.10: 8.5.10
   rollup@>=4 <4.59.0: 4.59.0
   shell-quote@>=1.1.0 <=1.8.3: 1.10.0
-  tar@>=7 <7.5.11: 7.5.19
+  socket.io-parser@<4.2.7: 4.2.7
+  tar@>=7 <7.5.21: 7.5.21
   tsup>esbuild: 0.28.1
-  undici@>=6 <6.27.0: 6.27.0
+  undici@>=6 <6.28.0: 6.28.0
+  undici@>=7 <7.29.0: 7.29.0
+  valibot@<1.4.2: 1.4.2
   vite@>=7 <=7.3.4: 7.3.5
   vite>esbuild: 0.28.1
   vitest@>=3 <3.2.6: 3.2.7
@@ -188,7 +204,7 @@ pnpmfileChecksum: sha256-FmQ3RWUsIKZQg8qJsKhZOw8G3ylUwk93HvwW4x5Nr5A=
 
 patchedDependencies:
   '@earendil-works/pi-ai@0.80.7': 3fbb9897213abf111acd834b26232ea390b59077e07751ef66a6e45bd00a4bd3
-  brace-expansion@5.0.8: ca2c07b933974ca774e3e37039d8c563bb28f04710ba4c7162a31a96faff77b9
+  brace-expansion@5.0.9: f142ba995ebb0372d071486e30b1fb522c19e147dfe3674c8c7dcd9a04308337
   fumadocs-openapi@11.2.2: c83454a6fabd7750546f414aed1bf257afa0bee4b25e2e9dc6c858e1dda4fa29
 
 importers:
@@ -229,9 +245,6 @@ importers:
         specifier: 'catalog:'
         version: 6.0.3
     devDependencies:
-      '@biomejs/biome':
-        specifier: 2.3.11
-        version: 2.3.11
       dotenv-cli:
         specifier: ^8.0.0
         version: 8.0.0
@@ -241,24 +254,30 @@ importers:
       tsx:
         specifier: ^4.19.3
         version: 4.21.0
-      ultracite:
-        specifier: 5.0.39
-        version: 5.0.39(@types/debug@4.1.12)(@types/node@24.10.4)(jsdom@26.1.0)(tsx@4.21.0)
+      vite-plus:
+        specifier: 'catalog:'
+        version: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@24.10.4)(esbuild@0.25.12)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
 
   apps/backend:
     dependencies:
+      '@effect/platform-node':
+        specifier: 'catalog:'
+        version: 4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1)
+      '@effect/sql-pg':
+        specifier: 'catalog:'
+        version: 4.0.0-beta.100(effect@4.0.0-beta.100)
       '@voidhash/agent':
         specifier: workspace:*
         version: link:../../packages/agent
-      '@voidhash/ai-shared':
-        specifier: workspace:*
-        version: link:../../packages/ai-shared
       '@voidhash/api-contracts':
         specifier: workspace:*
         version: link:../../packages/api-contracts
       '@voidhash/app-store-server-sdk':
         specifier: workspace:*
         version: link:../../packages/app-store-server-sdk
+      '@voidhash/backend':
+        specifier: workspace:*
+        version: link:../../packages/backend
       '@voidhash/clickhouse-db':
         specifier: workspace:*
         version: link:../../packages/clickhouse-db
@@ -268,79 +287,73 @@ importers:
       '@voidhash/db':
         specifier: workspace:*
         version: link:../../packages/db
-      '@voidhash/google-play-server-sdk':
+      '@voidhash/mimic-core':
+        specifier: workspace:*
+        version: link:../../packages/mimic-core
+      '@voidhash/mimic-db':
         specifier: workspace:*
-        version: link:../../packages/google-play-server-sdk
+        version: link:../mimic-db
       '@voidhash/mimic-schema':
         specifier: workspace:*
         version: link:../../packages/mimic-schema
-      '@voidhash/paywall-builtins':
-        specifier: workspace:*
-        version: link:../../packages/paywall-builtins
       '@voidhash/paywall-renderer-preact':
         specifier: workspace:*
         version: link:../../packages/paywall-renderer-preact
-      '@voidhash/paywall-workspace':
+      '@voidhash/paywall-renderer-web-core':
         specifier: workspace:*
-        version: link:../../packages/paywall-workspace
-      '@voidhash/rpc':
+        version: link:../../packages/paywall-renderer-web-core
+      '@voidhash/paywalls':
         specifier: workspace:*
-        version: link:../../packages/rpc
-      '@workos-inc/node':
-        specifier: 9.2.0
-        version: 9.2.0
+        version: link:../../libraries/paywalls
+      '@voidhash/platform':
+        specifier: workspace:*
+        version: link:../../packages/platform
+      '@voidhash/platform-selfhost':
+        specifier: workspace:*
+        version: link:../../selfhost/platform
       effect:
         specifier: 4.0.0-beta.100
         version: 4.0.0-beta.100
+      esbuild:
+        specifier: ^0.25.10
+        version: 0.25.12
       jose:
         specifier: 'catalog:'
         version: 6.1.3
-      just-bash:
-        specifier: 3.1.0
-        version: 3.1.0
       preact:
         specifier: ^10.25.4
         version: 10.29.2
-      zod:
-        specifier: 'catalog:'
-        version: 4.3.6
-    devDependencies:
-      '@effect/platform-bun':
+      react:
         specifier: 'catalog:'
-        version: 4.0.0-beta.100(effect@4.0.0-beta.100)
-      '@effect/platform-node':
+        version: 19.2.7
+      react-dom:
         specifier: 'catalog:'
-        version: 4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1)
-      '@orbian/sdk':
-        specifier: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526
-        version: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)
-      '@types/bun':
-        specifier: latest
-        version: 1.3.14
+        version: 19.2.7(react@19.2.7)
+      srvx:
+        specifier: 0.11.15
+        version: 0.11.15
+      tsx:
+        specifier: ^4.19.3
+        version: 4.21.0
+      ws:
+        specifier: 8.21.0
+        version: 8.21.0
+    devDependencies:
       '@types/node':
-        specifier: ^20
-        version: 20.19.43
-      '@types/react':
-        specifier: ^19
-        version: 19.1.17
-      '@types/react-dom':
-        specifier: ^19
-        version: 19.1.9(@types/react@19.1.17)
+        specifier: ^24.0.12
+        version: 24.10.4
+      '@types/ws':
+        specifier: ^8.18.1
+        version: 8.18.1
       '@voidhash/tsconfig':
         specifier: workspace:*
         version: link:../../packages/tsconfig
-      alchemy:
-        specifier: 'catalog:'
-        version: 2.0.0-beta.66(f09abdaaa75b5aa3c10f8f33d5a1d709)
       typescript:
         specifier: 'catalog:'
         version: 6.0.3
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3)
-      vitest:
-        specifier: 'catalog:'
-        version: '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(@vitest/ui@4.1.0(@voidzero-dev/vite-plus-test@0.1.24))(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)'
+        version: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@24.10.4)(esbuild@0.25.12)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
 
   apps/cli:
     dependencies:
@@ -392,7 +405,7 @@ importers:
         version: 10.0.0
       tsup:
         specifier: ^8.5.1
-        version: 8.5.1(jiti@2.7.0)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
+        version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
       tsx:
         specifier: ^4.19.3
         version: 4.21.0
@@ -508,15 +521,15 @@ importers:
       '@effect/sql-pg':
         specifier: 'catalog:'
         version: 4.0.0-beta.100(effect@4.0.0-beta.100)
-      '@orbian/sdk':
-        specifier: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526
-        version: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)
       '@voidhash/mimic-core':
         specifier: workspace:*
         version: link:../../packages/mimic-core
       '@voidhash/mimic-server':
         specifier: workspace:*
         version: link:../../packages/mimic-server
+      '@voidhash/platform':
+        specifier: workspace:*
+        version: link:../../packages/platform
       effect:
         specifier: 4.0.0-beta.100
         version: 4.0.0-beta.100
@@ -729,15 +742,6 @@ importers:
       '@voidhash/ui':
         specifier: workspace:*
         version: link:../../packages/ui
-      '@workos-inc/node':
-        specifier: 8.13.0
-        version: 8.13.0
-      '@workos/authkit-session':
-        specifier: 0.5.2
-        version: 0.5.2(@workos-inc/node@8.13.0)(typescript@6.0.3)
-      '@workos/authkit-tanstack-react-start':
-        specifier: 0.8.2
-        version: 0.8.2(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@tanstack/react-start@1.168.10(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(rolldown@1.1.5)(rollup@4.59.0)(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)))(@workos-inc/node@8.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)
       class-variance-authority:
         specifier: ^0.7.1
         version: 0.7.1
@@ -769,7 +773,7 @@ importers:
         specifier: 15.2.0
         version: 15.2.0(@types/mdast@4.0.4)(@types/mdx@2.0.14)(@types/react@19.1.17)(fumadocs-core@16.11.5(@mdx-js/mdx@3.1.1)(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.1.17)(lucide-react@0.555.0(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.3.6))(react@19.2.7)(rolldown@1.1.5)(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))
       fumadocs-openapi:
-        specifier: ^11.2.2
+        specifier: 11.2.2
         version: 11.2.2(patch_hash=c83454a6fabd7750546f414aed1bf257afa0bee4b25e2e9dc6c858e1dda4fa29)(@scalar/api-client-react@2.0.36(react@19.2.7)(tailwindcss@4.3.2)(typescript@6.0.3))(@types/react@19.1.17)(date-fns@4.4.0)(fumadocs-core@16.11.5(@mdx-js/mdx@3.1.1)(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.1.17)(lucide-react@0.555.0(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.3.6))(fumadocs-ui@16.11.5(@types/mdx@2.0.14)(@types/react-dom@19.1.9(@types/react@19.1.17))(@types/react@19.1.17)(fumadocs-core@16.11.5(@mdx-js/mdx@3.1.1)(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@types/estree-jsx@1.0.5)(@types/hast@3.0.5)(@types/mdast@4.0.4)(@types/react@19.1.17)(lucide-react@0.555.0(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(zod@4.3.6))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tailwindcss@4.3.2))(json-schema-typed@8.0.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       fumadocs-ui:
         specifier: 16.11.5
@@ -873,7 +877,7 @@ importers:
     devDependencies:
       '@effect/vitest':
         specifier: 'catalog:'
-        version: 4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3))(effect@4.0.0-beta.100)
+        version: 4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24)(effect@4.0.0-beta.100)
       '@tailwindcss/vite':
         specifier: 'catalog:'
         version: 4.3.0(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))
@@ -965,7 +969,7 @@ importers:
         specifier: 4.0.0-beta.100
         version: 4.0.0-beta.100
       postcss:
-        specifier: ^8.5.18
+        specifier: 8.5.23
         version: 8.5.23
       react:
         specifier: ^19.0.0
@@ -1119,7 +1123,7 @@ importers:
         version: 4.0.0-beta.100
       tsup:
         specifier: ^8.5.1
-        version: 8.5.1(jiti@2.7.0)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
+        version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
       tsx:
         specifier: ^4.19.3
         version: 4.21.0
@@ -1162,7 +1166,7 @@ importers:
         version: 19.2.7(react@19.2.7)
       tsup:
         specifier: ^8.5.1
-        version: 8.5.1(jiti@2.7.0)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
+        version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
       tsx:
         specifier: ^4.19.3
         version: 4.21.0
@@ -1233,9 +1237,6 @@ importers:
       typescript:
         specifier: 5.9.3
         version: 5.9.3
-      ultracite:
-        specifier: 5.0.39
-        version: 5.0.39(@types/debug@4.1.12)(@types/node@24.10.4)(jiti@2.7.0)(jsdom@26.1.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
       vite-tsconfig-paths:
         specifier: 'catalog:'
         version: 5.1.4(typescript@5.9.3)(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))
@@ -1272,7 +1273,7 @@ importers:
         version: 19.2.7(react@19.2.7)
       tsup:
         specifier: ^8.5.1
-        version: 8.5.1(jiti@2.7.0)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
+        version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3)
       tsx:
         specifier: ^4.19.3
         version: 4.21.0
@@ -1294,9 +1295,9 @@ importers:
       '@earendil-works/pi-ai':
         specifier: 0.80.7
         version: 0.80.7(patch_hash=3fbb9897213abf111acd834b26232ea390b59077e07751ef66a6e45bd00a4bd3)(ws@8.21.0)(zod@4.4.3)
-      '@orbian/sdk':
-        specifier: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526
-        version: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)
+      '@voidhash/platform':
+        specifier: workspace:*
+        version: link:../platform
       effect:
         specifier: 4.0.0-beta.100
         version: 4.0.0-beta.100
@@ -1304,9 +1305,9 @@ importers:
         specifier: 1.1.38
         version: 1.1.38
     devDependencies:
-      '@orbian/node':
-        specifier: https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526
-        version: https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)
+      '@voidhash/platform-selfhost':
+        specifier: workspace:*
+        version: link:../../selfhost/platform
       '@voidhash/tsconfig':
         specifier: workspace:*
         version: link:../tsconfig
@@ -1392,6 +1393,100 @@ importers:
         specifier: ^3.2.7
         version: 3.2.7(@types/debug@4.1.12)(@types/node@24.10.4)(jiti@2.7.0)(jsdom@26.1.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
 
+  packages/backend:
+    dependencies:
+      '@voidhash/agent':
+        specifier: workspace:*
+        version: link:../agent
+      '@voidhash/ai-shared':
+        specifier: workspace:*
+        version: link:../ai-shared
+      '@voidhash/api-contracts':
+        specifier: workspace:*
+        version: link:../api-contracts
+      '@voidhash/app-store-server-sdk':
+        specifier: workspace:*
+        version: link:../app-store-server-sdk
+      '@voidhash/clickhouse-db':
+        specifier: workspace:*
+        version: link:../clickhouse-db
+      '@voidhash/core':
+        specifier: workspace:*
+        version: link:../core
+      '@voidhash/db':
+        specifier: workspace:*
+        version: link:../db
+      '@voidhash/google-play-server-sdk':
+        specifier: workspace:*
+        version: link:../google-play-server-sdk
+      '@voidhash/mimic-schema':
+        specifier: workspace:*
+        version: link:../mimic-schema
+      '@voidhash/paywall-builtins':
+        specifier: workspace:*
+        version: link:../paywall-builtins
+      '@voidhash/paywall-renderer-preact':
+        specifier: workspace:*
+        version: link:../paywall-renderer-preact
+      '@voidhash/paywall-workspace':
+        specifier: workspace:*
+        version: link:../paywall-workspace
+      '@voidhash/rpc':
+        specifier: workspace:*
+        version: link:../rpc
+      effect:
+        specifier: 4.0.0-beta.100
+        version: 4.0.0-beta.100
+      jose:
+        specifier: 'catalog:'
+        version: 6.1.3
+      just-bash:
+        specifier: 3.1.0
+        version: 3.1.0
+      preact:
+        specifier: ^10.25.4
+        version: 10.29.2
+      zod:
+        specifier: 'catalog:'
+        version: 4.3.6
+    devDependencies:
+      '@effect/platform-bun':
+        specifier: 'catalog:'
+        version: 4.0.0-beta.100(effect@4.0.0-beta.100)
+      '@effect/platform-node':
+        specifier: 'catalog:'
+        version: 4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1)
+      '@types/bun':
+        specifier: latest
+        version: 1.3.14
+      '@types/node':
+        specifier: ^20
+        version: 20.19.43
+      '@types/react':
+        specifier: ^19
+        version: 19.1.17
+      '@types/react-dom':
+        specifier: ^19
+        version: 19.1.9(@types/react@19.1.17)
+      '@voidhash/platform':
+        specifier: workspace:*
+        version: link:../platform
+      '@voidhash/tsconfig':
+        specifier: workspace:*
+        version: link:../tsconfig
+      alchemy:
+        specifier: 'catalog:'
+        version: 2.0.0-beta.66(02a466f039edb2b8425f2a7410b99d3a)
+      typescript:
+        specifier: 'catalog:'
+        version: 6.0.3
+      vite-plus:
+        specifier: 'catalog:'
+        version: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
+      vitest:
+        specifier: 'catalog:'
+        version: '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)'
+
   packages/clickhouse-db:
     dependencies:
       '@clickhouse/client-web':
@@ -1419,9 +1514,6 @@ importers:
       '@effect/sql-clickhouse':
         specifier: 'catalog:'
         version: 4.0.0-beta.100(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100)
-      '@orbian/sdk':
-        specifier: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526
-        version: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)
       '@paralleldrive/cuid2':
         specifier: ^2.2.2
         version: 2.3.1
@@ -1449,12 +1541,12 @@ importers:
       '@voidhash/paywall-workspace':
         specifier: workspace:*
         version: link:../paywall-workspace
+      '@voidhash/platform':
+        specifier: workspace:*
+        version: link:../platform
       '@voidhash/rpc':
         specifier: workspace:*
         version: link:../rpc
-      '@workos-inc/node':
-        specifier: 9.2.0
-        version: 9.2.0
       effect:
         specifier: 4.0.0-beta.100
         version: 4.0.0-beta.100
@@ -1863,6 +1955,21 @@ importers:
         specifier: ^3.2.7
         version: 3.2.7(@types/debug@4.1.12)(@types/node@20.19.43)(jiti@2.7.0)(jsdom@26.1.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
 
+  packages/platform:
+    devDependencies:
+      '@voidhash/tsconfig':
+        specifier: workspace:*
+        version: link:../tsconfig
+      effect:
+        specifier: 4.0.0-beta.100
+        version: 4.0.0-beta.100
+      typescript:
+        specifier: 'catalog:'
+        version: 6.0.3
+      vite-plus:
+        specifier: 'catalog:'
+        version: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@24.10.4)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
+
   packages/rpc:
     dependencies:
       effect:
@@ -1982,93 +2089,33 @@ importers:
         specifier: 6.0.3
         version: 6.0.3
 
-  selfhost/entry:
+  selfhost/platform:
     dependencies:
-      '@effect/platform-node':
+      '@effect-aws/client-s3':
         specifier: 'catalog:'
-        version: 4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1)
+        version: 2.0.0-beta.4(effect@4.0.0-beta.100)
       '@effect/sql-pg':
         specifier: 'catalog:'
         version: 4.0.0-beta.100(effect@4.0.0-beta.100)
-      '@orbian/node':
-        specifier: https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526
-        version: https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)
-      '@orbian/sdk':
-        specifier: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526
-        version: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)
-      '@voidhash/agent':
-        specifier: workspace:*
-        version: link:../../packages/agent
-      '@voidhash/api-contracts':
-        specifier: workspace:*
-        version: link:../../packages/api-contracts
-      '@voidhash/app-store-server-sdk':
-        specifier: workspace:*
-        version: link:../../packages/app-store-server-sdk
-      '@voidhash/backend':
-        specifier: workspace:*
-        version: link:../../apps/backend
-      '@voidhash/clickhouse-db':
-        specifier: workspace:*
-        version: link:../../packages/clickhouse-db
-      '@voidhash/core':
-        specifier: workspace:*
-        version: link:../../packages/core
-      '@voidhash/db':
-        specifier: workspace:*
-        version: link:../../packages/db
-      '@voidhash/mimic-core':
-        specifier: workspace:*
-        version: link:../../packages/mimic-core
-      '@voidhash/mimic-db':
-        specifier: workspace:*
-        version: link:../../apps/mimic-db
-      '@voidhash/mimic-schema':
+      '@voidhash/platform':
         specifier: workspace:*
-        version: link:../../packages/mimic-schema
-      '@voidhash/paywall-renderer-preact':
-        specifier: workspace:*
-        version: link:../../packages/paywall-renderer-preact
-      '@voidhash/paywall-renderer-web-core':
-        specifier: workspace:*
-        version: link:../../packages/paywall-renderer-web-core
-      '@voidhash/paywalls':
-        specifier: workspace:*
-        version: link:../../libraries/paywalls
+        version: link:../../packages/platform
       effect:
         specifier: 4.0.0-beta.100
         version: 4.0.0-beta.100
-      esbuild:
-        specifier: ^0.25.10
-        version: 0.25.12
-      jose:
+      nodemailer:
         specifier: 'catalog:'
-        version: 6.1.3
-      preact:
-        specifier: ^10.25.4
-        version: 10.29.2
-      react:
-        specifier: 'catalog:'
-        version: 19.2.7
-      react-dom:
+        version: 9.0.3
+      playwright-core:
         specifier: 'catalog:'
-        version: 19.2.7(react@19.2.7)
-      srvx:
-        specifier: 0.11.15
-        version: 0.11.15
-      tsx:
-        specifier: ^4.19.3
-        version: 4.21.0
-      ws:
-        specifier: 8.21.0
-        version: 8.21.0
+        version: 1.61.1
     devDependencies:
       '@types/node':
         specifier: ^24.0.12
         version: 24.10.4
-      '@types/ws':
-        specifier: ^8.18.1
-        version: 8.18.1
+      '@types/nodemailer':
+        specifier: 'catalog:'
+        version: 8.0.1
       '@voidhash/tsconfig':
         specifier: workspace:*
         version: link:../../packages/tsconfig
@@ -2077,7 +2124,7 @@ importers:
         version: 6.0.3
       vite-plus:
         specifier: 'catalog:'
-        version: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@24.10.4)(esbuild@0.25.12)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
+        version: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@24.10.4)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
 
 packages:
 
@@ -3231,63 +3278,6 @@ packages:
   '@better-fetch/fetch@1.3.1':
     resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==}
 
-  '@biomejs/biome@2.3.11':
-    resolution: {integrity: sha512-/zt+6qazBWguPG6+eWmiELqO+9jRsMZ/DBU3lfuU2ngtIQYzymocHhKiZRyrbra4aCOoyTg/BmY+6WH5mv9xmQ==}
-    engines: {node: '>=14.21.3'}
-    hasBin: true
-
-  '@biomejs/cli-darwin-arm64@2.3.11':
-    resolution: {integrity: sha512-/uXXkBcPKVQY7rc9Ys2CrlirBJYbpESEDme7RKiBD6MmqR2w3j0+ZZXRIL2xiaNPsIMMNhP1YnA+jRRxoOAFrA==}
-    engines: {node: '>=14.21.3'}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@biomejs/cli-darwin-x64@2.3.11':
-    resolution: {integrity: sha512-fh7nnvbweDPm2xEmFjfmq7zSUiox88plgdHF9OIW4i99WnXrAC3o2P3ag9judoUMv8FCSUnlwJCM1B64nO5Fbg==}
-    engines: {node: '>=14.21.3'}
-    cpu: [x64]
-    os: [darwin]
-
-  '@biomejs/cli-linux-arm64-musl@2.3.11':
-    resolution: {integrity: sha512-XPSQ+XIPZMLaZ6zveQdwNjbX+QdROEd1zPgMwD47zvHV+tCGB88VH+aynyGxAHdzL+Tm/+DtKST5SECs4iwCLg==}
-    engines: {node: '>=14.21.3'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
-  '@biomejs/cli-linux-arm64@2.3.11':
-    resolution: {integrity: sha512-l4xkGa9E7Uc0/05qU2lMYfN1H+fzzkHgaJoy98wO+b/7Gl78srbCRRgwYSW+BTLixTBrM6Ede5NSBwt7rd/i6g==}
-    engines: {node: '>=14.21.3'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
-  '@biomejs/cli-linux-x64-musl@2.3.11':
-    resolution: {integrity: sha512-vU7a8wLs5C9yJ4CB8a44r12aXYb8yYgBn+WeyzbMjaCMklzCv1oXr8x+VEyWodgJt9bDmhiaW/I0RHbn7rsNmw==}
-    engines: {node: '>=14.21.3'}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
-  '@biomejs/cli-linux-x64@2.3.11':
-    resolution: {integrity: sha512-/1s9V/H3cSe0r0Mv/Z8JryF5x9ywRxywomqZVLHAoa/uN0eY7F8gEngWKNS5vbbN/BsfpCG5yeBT5ENh50Frxg==}
-    engines: {node: '>=14.21.3'}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  '@biomejs/cli-win32-arm64@2.3.11':
-    resolution: {integrity: sha512-PZQ6ElCOnkYapSsysiTy0+fYX+agXPlWugh6+eQ6uPKI3vKAqNp6TnMhoM3oY2NltSB89hz59o8xIfOdyhi9Iw==}
-    engines: {node: '>=14.21.3'}
-    cpu: [arm64]
-    os: [win32]
-
-  '@biomejs/cli-win32-x64@2.3.11':
-    resolution: {integrity: sha512-43VrG813EW+b5+YbDbz31uUsheX+qFKCpXeY9kfdAx+ww3naKxeVkTD9zLIWxUPfJquANMHrmW3wbe/037G0Qg==}
-    engines: {node: '>=14.21.3'}
-    cpu: [x64]
-    os: [win32]
-
   '@borewit/text-codec@0.2.2':
     resolution: {integrity: sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ==}
 
@@ -3312,16 +3302,10 @@ packages:
   '@chronark/zod-bird@0.3.10':
     resolution: {integrity: sha512-QkGvy8Lz+NTGPOfBH2lIEAxiaizp9vrEufxsi1wYz8WM0/ADqs4hUqO1zRjt7ntoZdKiXCcnpZtzUMdOjfo5AQ==}
 
-  '@clack/core@0.5.0':
-    resolution: {integrity: sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow==}
-
   '@clack/core@1.4.3':
     resolution: {integrity: sha512-/kr3UWNtdJfxZtPgDqUOmG2pvwlmcLGheex5yiZKdwbzZJxhV+HMNR9QNmyY5cGwTNV6LrR7Jtp+KjhUAP1qBQ==}
     engines: {node: '>= 20.12.0'}
 
-  '@clack/prompts@0.11.0':
-    resolution: {integrity: sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw==}
-
   '@clack/prompts@1.7.0':
     resolution: {integrity: sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A==}
     engines: {node: '>= 20.12.0'}
@@ -3642,11 +3626,6 @@ packages:
     peerDependencies:
       effect: 4.0.0-beta.100
 
-  '@effect/sql-pg@4.0.0-beta.84':
-    resolution: {integrity: sha512-DPEwPlbF4ECwQIMpGLKORB+Dxvvv8Hf9yUGrY3QtorT2U9xyzFAi6NAhU0HGox+WfSvnBvfFGK2Z9Y3UBEQOnw==}
-    peerDependencies:
-      effect: 4.0.0-beta.100
-
   '@effect/vitest@4.0.0-beta.100':
     resolution: {integrity: sha512-WoxrzPuxc+4QXb+7D1j8PwaBb9zVxHM2yw0sDz7fXij1Sx7X7T6LkYJ7m2xzWbfskIXxIdXVA+NnDSF8qAOGsw==}
     peerDependencies:
@@ -4417,11 +4396,11 @@ packages:
     peerDependencies:
       vue: ^3.2.0
 
-  '@hono/node-server@1.19.9':
-    resolution: {integrity: sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==}
-    engines: {node: '>=18.14.1'}
+  '@hono/node-server@2.0.10':
+    resolution: {integrity: sha512-ZcnNVhKTmyDJeg0UlnZjvM73JBsTAuhrH/J4fjwGOw59PwOW51r4J+p6CsKZWXdKSme4MFqU62CZMOsdDrU4CA==}
+    engines: {node: '>=20'}
     peerDependencies:
-      hono: ^4
+      hono: 4.12.34
 
   '@hookform/resolvers@5.4.0':
     resolution: {integrity: sha512-EIsqr/t/qbinPIhGjMdtvutIN1Kk4uwbROE9/UQ93CAVGR7GkA7Y92+fX80OzXi/OB67jVFYwKGO1WzkxmkFZw==}
@@ -5073,30 +5052,6 @@ packages:
     resolution: {integrity: sha512-a61ljmRVVyG5MC/698C8/FfFDw5a8LOIvyOLW5fztgUXqUpc1jOfQzOitSCbge657OgXXThmY3Tk8fpiDb4UcA==}
     engines: {node: '>= 20.0.0'}
 
-  '@orbian/core@https://pkg.voidha.sh/orbian-core/fc444ba':
-    resolution: {tarball: https://pkg.voidha.sh/orbian-core/fc444ba}
-    version: 0.0.0-gfc444ba
-    peerDependencies:
-      effect: 4.0.0-beta.100
-
-  '@orbian/node@https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526':
-    resolution: {tarball: https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526}
-    version: 0.0.0-gfc444ba
-    peerDependencies:
-      effect: 4.0.0-beta.100
-
-  '@orbian/sdk@https://pkg.voidha.sh/orbian-sdk/fc444ba':
-    resolution: {tarball: https://pkg.voidha.sh/orbian-sdk/fc444ba}
-    version: 0.0.0-gfc444ba
-    peerDependencies:
-      effect: 4.0.0-beta.100
-
-  '@orbian/sdk@https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526':
-    resolution: {tarball: https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526}
-    version: 0.0.0-gfc444ba
-    peerDependencies:
-      effect: 4.0.0-beta.100
-
   '@oxc-project/runtime@0.133.0':
     resolution: {integrity: sha512-PkvjA1Lq5++V5S1E6Patr92ZVcieE6EalDr1VJTqv4BnjZdOUC4W3p8k1wMXSd5/2aFP4b/A6N5sg2Bkzcr9vQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -7288,7 +7243,7 @@ packages:
     peerDependencies:
       arktype: ^2.1.0
       typescript: '>=5.0.0'
-      valibot: ^1.0.0-beta.7 || ^1.0.0
+      valibot: 1.4.2
       zod: ^3.24.0 || ^4.0.0
     peerDependenciesMeta:
       arktype:
@@ -8052,6 +8007,9 @@ packages:
   '@types/node@24.10.4':
     resolution: {integrity: sha512-vnDVpYPMzs4wunl27jHrfmwojOGKya0xyM3sH+UE5iv5uPS6vX7UIoh6m+vQc5LGBq52HBKPIn/zcSZVzeDEZg==}
 
+  '@types/nodemailer@8.0.1':
+    resolution: {integrity: sha512-PxpaInm8V1JQDd4j0ds5HfvWQk8JupS1C0Picb96QJsrrRDjBH+DlK7L4ZdNSqNULhiZRQHc40nLVShaGxXAMw==}
+
   '@types/offscreencanvas@2019.7.3':
     resolution: {integrity: sha512-ieXiYmgSRXUDeOntE1InxjWyvEelZGP63M+cGuquuRLuIKKT1osnkXjxev9B7d1nXSug5vpunx+gNlbVxMlC9A==}
 
@@ -8642,29 +8600,6 @@ packages:
   '@webgpu/types@0.1.71':
     resolution: {integrity: sha512-mMy8/ODcKhab808co15eW+yN+HgXoQxRQHTiBV9Mrvl1r0ufnid7YOcI+gi4eUWSWl9ezD6TW2KXccrL8HCh2A==}
 
-  '@workos-inc/node@8.13.0':
-    resolution: {integrity: sha512-NgQKHpwh8AbT4KvAsW91Y+4f4jja2IvFPQ5atcy5NUxUMVRgXzRFEee3erawfXrTmiCVqJjd9PljHySKBXmHKQ==}
-    engines: {node: '>=20.15.0'}
-
-  '@workos-inc/node@9.2.0':
-    resolution: {integrity: sha512-JAEjrwgr8aETOS7YzHmSlPj+1LCXonAKGX1/B89hIZ+l+YgQGJrdFZnBqBSlDnqUaOtxDZkGwg7V3LFNkF+evg==}
-    engines: {node: '>=22.11.0'}
-
-  '@workos/authkit-session@0.5.2':
-    resolution: {integrity: sha512-1Gf04z6IzxKkq+wLaSF85LMgguoXNz3wR6RwPxO431WkUl7eIXECI2ovhzBsaCSSIpSMJaDL6QtjKd+9PClO6g==}
-    engines: {node: '>=20.0.0'}
-    peerDependencies:
-      '@workos-inc/node': ^8.0.0 || ^9.0.0
-
-  '@workos/authkit-tanstack-react-start@0.8.2':
-    resolution: {integrity: sha512-WXow2hqmfeHPbEUvXT1LDe+LDqX+fiAtHcpMujhGoXR/TK7FhnPvPUcEMkihfknCJKBxnyOi4zkk1xtgkqRFUA==}
-    engines: {node: '>=20.0.0'}
-    peerDependencies:
-      '@tanstack/react-router': '>=1.0.0'
-      '@tanstack/react-start': 1.167.30
-      react: ^18.0 || ^19.0
-      react-dom: ^18.0 || ^19.0
-
   '@xmldom/xmldom@0.8.13':
     resolution: {integrity: sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==}
     engines: {node: '>=10.0.0'}
@@ -9213,8 +9148,8 @@ packages:
     resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==}
     engines: {node: '>= 5.10.0'}
 
-  brace-expansion@5.0.8:
-    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
+  brace-expansion@5.0.9:
+    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
     engines: {node: 20 || >=22}
 
   braces@3.0.3:
@@ -9522,10 +9457,6 @@ packages:
     resolution: {integrity: sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==}
     engines: {node: '>=18'}
 
-  commander@14.0.2:
-    resolution: {integrity: sha512-TywoWNNRbhoD0BXs1P3ZEScW8W5iKrnbithIl0YH+uCmBd0QpPOA8yc82DS3BIE5Ma6FnBVUsJ7wVUDz4dvOWQ==}
-    engines: {node: '>=20'}
-
   commander@2.20.3:
     resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
 
@@ -10133,7 +10064,7 @@ packages:
       sql.js: '>=1'
       sqlite3: '>=5'
       typebox: '>=1.0.0'
-      valibot: '>=1.0.0-beta.7'
+      valibot: 1.4.2
       zod: ^3.25.0 || ^4.0.0
     peerDependenciesMeta:
       '@aws-sdk/client-rds-data':
@@ -10920,8 +10851,8 @@ packages:
   fast-text-encoding@1.0.6:
     resolution: {integrity: sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w==}
 
-  fast-uri@3.1.4:
-    resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==}
+  fast-uri@3.1.5:
+    resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
 
   fast-wrap-ansi@0.2.2:
     resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -11271,9 +11202,6 @@ packages:
     resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
     engines: {node: '>= 0.4'}
 
-  get-tsconfig@4.13.0:
-    resolution: {integrity: sha512-1VKTZJCwBrvbd+Wn3AOgQP/2Av+TfTCOlE4AcRJE72W1ksZXbAx8PPBR9RzgTeSPzlPMHrbANMH3LbltH73wxQ==}
-
   get-tsconfig@4.14.0:
     resolution: {integrity: sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==}
 
@@ -11492,8 +11420,8 @@ packages:
   hls.js@1.6.16:
     resolution: {integrity: sha512-VSIRpLfRwlAAdGL4wiTucx2ScRipo0ed1FBatWkyt832jC4CReKstga6yIhYVwGu9LOBjuX9wzmRMeQdBJtzEA==}
 
-  hono@4.11.4:
-    resolution: {integrity: sha512-U7tt8JsyrxSRKspfhtLET79pU8K+tInj5QZXs1jSugO1Vq5dFj3kmZsRldo29mTBfcjDRVRXrEZ6LS63Cog9ZA==}
+  hono@4.12.34:
+    resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==}
     engines: {node: '>=16.9.0'}
 
   hookable@6.1.1:
@@ -11683,9 +11611,6 @@ packages:
     resolution: {integrity: sha512-BXNqFQ66oOsR82g9ajFFsR8ZKrjVvYCLyeML9IvSMAsP56XH2VXBdZjmI11p65nXXJxTEt1hie3J2QeFJVgrtQ==}
     engines: {node: '>=12.22.0'}
 
-  iron-webcrypto@2.0.0:
-    resolution: {integrity: sha512-rtffZKDUHciZElM8mjFCufBC7nVhCxHYyWHESqs89OioEDz4parOofd8/uhrejh/INhQFfYQfByS22LlezR9sQ==}
-
   is-absolute-url@4.0.1:
     resolution: {integrity: sha512-/51/TKE88Lmm7Gc4/8btclNXWS+g50wXhYJq8HWIBAGUBnoAdRu1aXeh364t/O7wXDAcTJDP8PNuNKWUDWie+A==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -13429,9 +13354,6 @@ packages:
   pg-cloudflare@1.4.0:
     resolution: {integrity: sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==}
 
-  pg-connection-string@2.12.0:
-    resolution: {integrity: sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ==}
-
   pg-connection-string@2.14.0:
     resolution: {integrity: sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==}
 
@@ -13578,7 +13500,7 @@ packages:
     engines: {node: '>= 18'}
     peerDependencies:
       jiti: '>=1.21.0'
-      postcss: 8.5.10
+      postcss: 8.5.23
       tsx: ^4.8.1
       yaml: 2.8.3
     peerDependenciesMeta:
@@ -13591,10 +13513,6 @@ packages:
       yaml:
         optional: true
 
-  postcss@8.5.18:
-    resolution: {integrity: sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==}
-    engines: {node: ^10 || ^12 || >=14}
-
   postcss@8.5.23:
     resolution: {integrity: sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==}
     engines: {node: ^10 || ^12 || >=14}
@@ -14651,8 +14569,8 @@ packages:
   socket.io-adapter@2.5.8:
     resolution: {integrity: sha512-6Oy52pbg+kvdCVvjcN+FnY7BvxZ7cIHNScbvztT/It5d0vbwoJoVZmF2gjJmnV0/4WlXRfG15zc45ySk9Ah8bw==}
 
-  socket.io-parser@4.2.6:
-    resolution: {integrity: sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==}
+  socket.io-parser@4.2.7:
+    resolution: {integrity: sha512-IH/iSeO9T6gz1KkFleGDWkG9N3dl4jXVYUtMhIqH10Md0ttMer8nUNWiP1DKuNrybD2xBrixLJdCC9J6ECoYkg==}
     engines: {node: '>=10.0.0'}
 
   socket.io@4.8.3:
@@ -15002,10 +14920,6 @@ packages:
     resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==}
     engines: {node: '>=6'}
 
-  tar@7.5.19:
-    resolution: {integrity: sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==}
-    engines: {node: '>=18'}
-
   tar@7.5.21:
     resolution: {integrity: sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==}
     engines: {node: '>=18'}
@@ -15287,7 +15201,7 @@ packages:
     peerDependencies:
       '@microsoft/api-extractor': ^7.36.0
       '@swc/core': ^1
-      postcss: 8.5.10
+      postcss: 8.5.23
       typescript: '>=4.5.0'
     peerDependenciesMeta:
       '@microsoft/api-extractor':
@@ -15404,10 +15318,6 @@ packages:
     resolution: {integrity: sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==}
     engines: {node: '>=18'}
 
-  ultracite@5.0.39:
-    resolution: {integrity: sha512-yyrftv3h7aIGEWYVfRGWn8fBB6vbCjmTK57LQr48uZsB1r/xs1vEHlwdZe4m7xfH5Bmch6xf7q9aylh0vVtkrQ==}
-    hasBin: true
-
   unbox-primitive@1.1.0:
     resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
     engines: {node: '>= 0.4'}
@@ -15427,12 +15337,12 @@ packages:
   undici-types@7.16.0:
     resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
 
-  undici@6.27.0:
-    resolution: {integrity: sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==}
+  undici@6.28.0:
+    resolution: {integrity: sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==}
     engines: {node: '>=18.17'}
 
-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
   undici@8.9.0:
@@ -15621,14 +15531,6 @@ packages:
     resolution: {integrity: sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==}
     engines: {node: '>=10.12.0'}
 
-  valibot@1.2.0:
-    resolution: {integrity: sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==}
-    peerDependencies:
-      typescript: '>=5'
-    peerDependenciesMeta:
-      typescript:
-        optional: true
-
   valibot@1.4.2:
     resolution: {integrity: sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg==}
     peerDependencies:
@@ -17645,7 +17547,7 @@ snapshots:
       jose: 6.1.3
       kysely: 0.28.17
       nanostores: 1.4.0
-      zod: 4.3.6
+      zod: 4.4.3
     optionalDependencies:
       '@cloudflare/workers-types': 5.20260731.1
       '@opentelemetry/api': 1.9.0
@@ -17691,41 +17593,6 @@ snapshots:
 
   '@better-fetch/fetch@1.3.1': {}
 
-  '@biomejs/biome@2.3.11':
-    optionalDependencies:
-      '@biomejs/cli-darwin-arm64': 2.3.11
-      '@biomejs/cli-darwin-x64': 2.3.11
-      '@biomejs/cli-linux-arm64': 2.3.11
-      '@biomejs/cli-linux-arm64-musl': 2.3.11
-      '@biomejs/cli-linux-x64': 2.3.11
-      '@biomejs/cli-linux-x64-musl': 2.3.11
-      '@biomejs/cli-win32-arm64': 2.3.11
-      '@biomejs/cli-win32-x64': 2.3.11
-
-  '@biomejs/cli-darwin-arm64@2.3.11':
-    optional: true
-
-  '@biomejs/cli-darwin-x64@2.3.11':
-    optional: true
-
-  '@biomejs/cli-linux-arm64-musl@2.3.11':
-    optional: true
-
-  '@biomejs/cli-linux-arm64@2.3.11':
-    optional: true
-
-  '@biomejs/cli-linux-x64-musl@2.3.11':
-    optional: true
-
-  '@biomejs/cli-linux-x64@2.3.11':
-    optional: true
-
-  '@biomejs/cli-win32-arm64@2.3.11':
-    optional: true
-
-  '@biomejs/cli-win32-x64@2.3.11':
-    optional: true
-
   '@borewit/text-codec@0.2.2': {}
 
   '@braintree/sanitize-url@7.1.2': {}
@@ -17751,22 +17618,11 @@ snapshots:
     dependencies:
       zod: 3.25.76
 
-  '@clack/core@0.5.0':
-    dependencies:
-      picocolors: 1.1.1
-      sisteransi: 1.0.5
-
   '@clack/core@1.4.3':
     dependencies:
       fast-wrap-ansi: 0.2.2
       sisteransi: 1.0.5
 
-  '@clack/prompts@0.11.0':
-    dependencies:
-      '@clack/core': 0.5.0
-      picocolors: 1.1.1
-      sisteransi: 1.0.5
-
   '@clack/prompts@1.7.0':
     dependencies:
       '@clack/core': 1.4.3
@@ -17957,13 +17813,14 @@ snapshots:
       '@distilled.cloud/core': 0.30.3(effect@4.0.0-beta.100)
       effect: 4.0.0-beta.100
 
-  '@distilled.cloud/cloudflare-rolldown-plugin@0.15.0(rolldown@1.1.5)(workerd@1.20260722.1)':
+  '@distilled.cloud/cloudflare-rolldown-plugin@0.15.0(rolldown@1.1.5)(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(workerd@1.20260722.1)':
     dependencies:
       '@cloudflare/unenv-preset': 2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260722.1)
       magic-string: 0.30.21
       unenv: 2.0.0-rc.24
     optionalDependencies:
       rolldown: 1.1.5
+      vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
     transitivePeerDependencies:
       - workerd
 
@@ -17977,12 +17834,13 @@ snapshots:
       '@effect/platform-bun': 4.0.0-beta.100(effect@4.0.0-beta.100)
       '@effect/platform-node': 4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1)
 
-  '@distilled.cloud/cloudflare-vite-plugin@0.15.0(@distilled.cloud/cloudflare-runtime@0.15.0(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100))(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100)(rolldown@1.1.5)(workerd@1.20260722.1)':
+  '@distilled.cloud/cloudflare-vite-plugin@0.15.0(@distilled.cloud/cloudflare-runtime@0.15.0(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100))(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100)(rolldown@1.1.5)(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(workerd@1.20260722.1)':
     dependencies:
       '@distilled.cloud/cloudflare': 0.30.3(effect@4.0.0-beta.100)
-      '@distilled.cloud/cloudflare-rolldown-plugin': 0.15.0(rolldown@1.1.5)(workerd@1.20260722.1)
+      '@distilled.cloud/cloudflare-rolldown-plugin': 0.15.0(rolldown@1.1.5)(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(workerd@1.20260722.1)
       '@distilled.cloud/cloudflare-runtime': 0.15.0(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100)
       effect: 4.0.0-beta.100
+      vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
     optionalDependencies:
       '@effect/platform-bun': 4.0.0-beta.100(effect@4.0.0-beta.100)
       '@effect/platform-node': 4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1)
@@ -18172,21 +18030,10 @@ snapshots:
     transitivePeerDependencies:
       - pg-native
 
-  '@effect/sql-pg@4.0.0-beta.84(effect@4.0.0-beta.100)':
+  '@effect/vitest@4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3))(effect@4.0.0-beta.100)':
     dependencies:
       effect: 4.0.0-beta.100
-      pg: 8.22.0
-      pg-connection-string: 2.12.0
-      pg-cursor: 2.21.0(pg@8.22.0)
-      pg-pool: 3.14.0(pg@8.22.0)
-      pg-types: 4.1.0
-    transitivePeerDependencies:
-      - pg-native
-
-  '@effect/vitest@4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3))(effect@4.0.0-beta.100)':
-    dependencies:
-      effect: 4.0.0-beta.100
-      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(@vitest/ui@4.1.0(@voidzero-dev/vite-plus-test@0.1.24))(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)'
+      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)'
 
   '@effect/vitest@4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@24.10.4)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@5.9.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3))(effect@4.0.0-beta.100)':
     dependencies:
@@ -18198,6 +18045,11 @@ snapshots:
       effect: 4.0.0-beta.100
       vitest: '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@24.10.4)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)'
 
+  '@effect/vitest@4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24)(effect@4.0.0-beta.100)':
+    dependencies:
+      effect: 4.0.0-beta.100
+      vitest: '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(@vitest/ui@4.1.0(@voidzero-dev/vite-plus-test@0.1.24))(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)'
+
   '@effect/vitest@4.0.0-beta.100(effect@4.0.0-beta.100)(vitest@3.2.7(@types/debug@4.1.12)(@types/node@24.10.4)(jiti@2.7.0)(jsdom@26.1.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))':
     dependencies:
       effect: 4.0.0-beta.100
@@ -18593,7 +18445,7 @@ snapshots:
       structured-headers: 0.4.1
       tar: 7.5.21
       terminal-link: 2.1.1
-      undici: 6.27.0
+      undici: 6.28.0
       wrap-ansi: 7.0.0
       ws: 8.21.0
     optionalDependencies:
@@ -18668,7 +18520,7 @@ snapshots:
       structured-headers: 0.4.1
       tar: 7.5.21
       terminal-link: 2.1.1
-      undici: 6.27.0
+      undici: 6.28.0
       wrap-ansi: 7.0.0
       ws: 8.21.0
     optionalDependencies:
@@ -18809,7 +18661,7 @@ snapshots:
       jsc-safe-url: 0.2.4
       lightningcss: 1.32.0
       minimatch: 9.0.7
-      postcss: 8.5.18
+      postcss: 8.5.23
       resolve-from: 5.0.0
     optionalDependencies:
       expo: 54.0.33(@babel/core@7.29.6)(@expo/metro-runtime@6.1.2)(expo-router@6.0.23)(react-native@0.81.5(@babel/core@7.29.6)(@types/react@19.1.17)(react@19.2.7))(react@19.2.7)
@@ -19042,9 +18894,9 @@ snapshots:
       '@tanstack/vue-virtual': 3.13.32(vue@3.5.40(typescript@6.0.3))
       vue: 3.5.40(typescript@6.0.3)
 
-  '@hono/node-server@1.19.9(hono@4.11.4)':
+  '@hono/node-server@2.0.10(hono@4.12.34)':
     dependencies:
-      hono: 4.11.4
+      hono: 4.12.34
 
   '@hookform/resolvers@5.4.0(react-hook-form@7.81.0(react@19.2.7))':
     dependencies:
@@ -19541,7 +19393,7 @@ snapshots:
       node-fetch: 2.7.0
       nopt: 8.1.0
       semver: 7.8.5
-      tar: 7.5.19
+      tar: 7.5.21
     transitivePeerDependencies:
       - encoding
       - supports-color
@@ -19800,31 +19652,6 @@ snapshots:
 
   '@orama/orama@3.1.18': {}
 
-  '@orbian/core@https://pkg.voidha.sh/orbian-core/fc444ba(effect@4.0.0-beta.100)':
-    dependencies:
-      '@orbian/sdk': https://pkg.voidha.sh/orbian-sdk/fc444ba(effect@4.0.0-beta.100)
-      effect: 4.0.0-beta.100
-
-  '@orbian/node@https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)':
-    dependencies:
-      '@effect-aws/client-s3': 2.0.0-beta.4(effect@4.0.0-beta.100)
-      '@effect/sql-pg': 4.0.0-beta.84(effect@4.0.0-beta.100)
-      '@orbian/core': https://pkg.voidha.sh/orbian-core/fc444ba(effect@4.0.0-beta.100)
-      '@orbian/sdk': https://pkg.voidha.sh/orbian-sdk/fc444ba(effect@4.0.0-beta.100)
-      effect: 4.0.0-beta.100
-      nodemailer: 9.0.3
-      playwright-core: 1.61.1
-    transitivePeerDependencies:
-      - pg-native
-
-  '@orbian/sdk@https://pkg.voidha.sh/orbian-sdk/fc444ba(effect@4.0.0-beta.100)':
-    dependencies:
-      effect: 4.0.0-beta.100
-
-  '@orbian/sdk@https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526(effect@4.0.0-beta.100)':
-    dependencies:
-      effect: 4.0.0-beta.100
-
   '@oxc-project/runtime@0.133.0': {}
 
   '@oxc-project/types@0.103.0': {}
@@ -20135,19 +19962,19 @@ snapshots:
       '@electric-sql/pglite': 0.3.15
       '@electric-sql/pglite-socket': 0.0.20(@electric-sql/pglite@0.3.15)
       '@electric-sql/pglite-tools': 0.2.20(@electric-sql/pglite@0.3.15)
-      '@hono/node-server': 1.19.9(hono@4.11.4)
+      '@hono/node-server': 2.0.10(hono@4.12.34)
       '@mrleebo/prisma-ast': 0.13.1
       '@prisma/get-platform': 7.2.0
       '@prisma/query-plan-executor': 7.2.0
       foreground-child: 3.3.1
       get-port-please: 3.2.0
-      hono: 4.11.4
+      hono: 4.12.34
       http-status-codes: 2.3.0
       pathe: 2.0.3
       proper-lockfile: 4.1.2
       remeda: 2.33.4
       std-env: 3.10.0
-      valibot: 1.2.0(typescript@6.0.3)
+      valibot: 1.4.2(typescript@6.0.3)
       zeptomatch: 2.1.0
     transitivePeerDependencies:
       - typescript
@@ -23021,7 +22848,7 @@ snapshots:
       '@alloc/quick-lru': 5.2.0
       '@tailwindcss/node': 4.3.2
       '@tailwindcss/oxide': 4.3.2
-      postcss: 8.5.18
+      postcss: 8.5.23
       tailwindcss: 4.3.2
 
   '@tailwindcss/vite@4.3.0(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))':
@@ -23784,6 +23611,10 @@ snapshots:
     dependencies:
       undici-types: 7.16.0
 
+  '@types/nodemailer@8.0.1':
+    dependencies:
+      '@types/node': 24.10.4
+
   '@types/offscreencanvas@2019.7.3': {}
 
   '@types/pg@8.20.0':
@@ -24150,14 +23981,6 @@ snapshots:
     optionalDependencies:
       vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
 
-  '@vitest/mocker@3.2.7(vite@7.3.5(@types/node@24.10.4)(tsx@4.21.0))':
-    dependencies:
-      '@vitest/spy': 3.2.7
-      estree-walker: 3.0.3
-      magic-string: 0.30.21
-    optionalDependencies:
-      vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
-
   '@vitest/pretty-format@3.2.7':
     dependencies:
       tinyrainbow: 2.0.0
@@ -24210,7 +24033,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 20.19.43
       esbuild: 0.25.12
@@ -24227,7 +24050,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 20.19.43
       esbuild: 0.28.1
@@ -24244,7 +24067,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 22.20.1
       esbuild: 0.28.1
@@ -24261,7 +24084,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 24.10.4
       esbuild: 0.25.12
@@ -24278,7 +24101,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 24.10.4
       esbuild: 0.28.1
@@ -24295,7 +24118,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 24.10.4
       esbuild: 0.28.1
@@ -24312,7 +24135,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 24.10.4
       esbuild: 0.28.1
@@ -24329,7 +24152,7 @@ snapshots:
       '@oxc-project/runtime': 0.133.0
       '@oxc-project/types': 0.133.0
       lightningcss: 1.32.0
-      postcss: 8.5.18
+      postcss: 8.5.23
     optionalDependencies:
       '@types/node': 24.10.4
       esbuild: 0.28.1
@@ -24444,6 +24267,48 @@ snapshots:
       - utf-8-validate
       - yaml
 
+  '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)':
+    dependencies:
+      '@standard-schema/spec': 1.1.0
+      '@types/chai': 5.2.3
+      '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3)
+      es-module-lexer: 1.7.0
+      obug: 2.1.3
+      pixelmatch: 7.2.0
+      pngjs: 7.0.0
+      sirv: 3.0.2
+      std-env: 4.2.0
+      tinybench: 2.9.0
+      tinyexec: 1.2.4
+      tinyglobby: 0.2.17
+      vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
+      ws: 8.21.0
+    optionalDependencies:
+      '@opentelemetry/api': 1.9.0
+      '@types/node': 20.19.43
+      jsdom: 26.1.0
+    transitivePeerDependencies:
+      - '@arethetypeswrong/core'
+      - '@tsdown/css'
+      - '@tsdown/exe'
+      - '@vitejs/devtools'
+      - bufferutil
+      - esbuild
+      - jiti
+      - less
+      - publint
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - terser
+      - tsx
+      - typescript
+      - unplugin-unused
+      - unrun
+      - utf-8-validate
+      - yaml
+
   '@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@22.20.1)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@5.8.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)':
     dependencies:
       '@standard-schema/spec': 1.1.0
@@ -24799,34 +24664,6 @@ snapshots:
 
   '@webgpu/types@0.1.71': {}
 
-  '@workos-inc/node@8.13.0':
-    dependencies:
-      eventemitter3: 5.0.4
-
-  '@workos-inc/node@9.2.0':
-    dependencies:
-      eventemitter3: 5.0.4
-
-  '@workos/authkit-session@0.5.2(@workos-inc/node@8.13.0)(typescript@6.0.3)':
-    dependencies:
-      '@workos-inc/node': 8.13.0
-      iron-webcrypto: 2.0.0
-      jose: 6.1.3
-      valibot: 1.4.2(typescript@6.0.3)
-    transitivePeerDependencies:
-      - typescript
-
-  '@workos/authkit-tanstack-react-start@0.8.2(@tanstack/react-router@1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@tanstack/react-start@1.168.10(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(rolldown@1.1.5)(rollup@4.59.0)(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)))(@workos-inc/node@8.13.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@6.0.3)':
-    dependencies:
-      '@tanstack/react-router': 1.170.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@tanstack/react-start': 1.168.10(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(rolldown@1.1.5)(rollup@4.59.0)(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))
-      '@workos/authkit-session': 0.5.2(@workos-inc/node@8.13.0)(typescript@6.0.3)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-    transitivePeerDependencies:
-      - '@workos-inc/node'
-      - typescript
-
   '@xmldom/xmldom@0.8.13': {}
 
   '@yuku-analyzer/binding-darwin-arm64@0.6.12':
@@ -24926,11 +24763,11 @@ snapshots:
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.4
+      fast-uri: 3.1.5
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
-  alchemy@2.0.0-beta.66(f09abdaaa75b5aa3c10f8f33d5a1d709):
+  alchemy@2.0.0-beta.66(02a466f039edb2b8425f2a7410b99d3a):
     dependencies:
       '@alchemy.run/node-utils': 0.0.5
       '@aws-sdk/credential-providers': 3.1081.0
@@ -24938,14 +24775,14 @@ snapshots:
       '@distilled.cloud/aws': 0.30.3(effect@4.0.0-beta.100)
       '@distilled.cloud/axiom': 0.30.3(effect@4.0.0-beta.100)
       '@distilled.cloud/cloudflare': 0.30.3(effect@4.0.0-beta.100)
-      '@distilled.cloud/cloudflare-rolldown-plugin': 0.15.0(rolldown@1.1.5)(workerd@1.20260722.1)
+      '@distilled.cloud/cloudflare-rolldown-plugin': 0.15.0(rolldown@1.1.5)(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(workerd@1.20260722.1)
       '@distilled.cloud/cloudflare-runtime': 0.15.0(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100)
-      '@distilled.cloud/cloudflare-vite-plugin': 0.15.0(@distilled.cloud/cloudflare-runtime@0.15.0(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100))(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100)(rolldown@1.1.5)(workerd@1.20260722.1)
+      '@distilled.cloud/cloudflare-vite-plugin': 0.15.0(@distilled.cloud/cloudflare-runtime@0.15.0(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100))(@distilled.cloud/cloudflare@0.30.3(effect@4.0.0-beta.100))(@effect/platform-bun@4.0.0-beta.100(effect@4.0.0-beta.100))(@effect/platform-node@4.0.0-beta.100(effect@4.0.0-beta.100)(ioredis@5.9.1))(effect@4.0.0-beta.100)(rolldown@1.1.5)(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(workerd@1.20260722.1)
       '@distilled.cloud/core': 0.30.3(effect@4.0.0-beta.100)
       '@distilled.cloud/neon': 0.30.3(effect@4.0.0-beta.100)
       '@distilled.cloud/planetscale': 0.30.3(effect@4.0.0-beta.100)
       '@effect/sql-d1': 4.0.0-beta.102(effect@4.0.0-beta.100)
-      '@effect/vitest': 4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3))(effect@4.0.0-beta.100)
+      '@effect/vitest': 4.0.0-beta.100(@voidzero-dev/vite-plus-test@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3))(effect@4.0.0-beta.100)
       '@libsql/client': 0.17.4
       '@octokit/rest': 22.0.1
       '@octokit/webhooks': 14.2.0
@@ -24970,7 +24807,7 @@ snapshots:
       picomatch: 4.0.5
       react: 19.2.7
       rolldown: 1.1.5
-      undici: 7.28.0
+      undici: 7.29.0
       yaml: 2.8.3
     optionalDependencies:
       '@effect/platform-bun': 4.0.0-beta.100(effect@4.0.0-beta.100)
@@ -24978,6 +24815,7 @@ snapshots:
       '@effect/sql-pg': 4.0.0-beta.100(effect@4.0.0-beta.100)
       drizzle-kit: 1.0.0-rc.4
       drizzle-orm: 1.0.0-rc.4(@cloudflare/workers-types@5.20260731.1)(@effect/sql-d1@4.0.0-beta.102(effect@4.0.0-beta.100))(@effect/sql-pg@4.0.0-beta.100(effect@4.0.0-beta.100))(@electric-sql/pglite@0.3.15)(@libsql/client@0.17.4)(@opentelemetry/api@1.9.0)(@sinclair/typebox@0.34.41)(@types/pg@8.20.0)(bun-types@1.3.14)(effect@4.0.0-beta.100)(mysql2@3.16.0)(pg@8.22.0)(sql.js@1.14.1)(typebox@1.1.38)(valibot@1.4.2(typescript@6.0.3))(zod@4.3.6)
+      vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
       ws: 8.21.0
     transitivePeerDependencies:
       - '@mongodb-js/zstd'
@@ -25478,7 +25316,7 @@ snapshots:
     dependencies:
       big-integer: 1.6.52
 
-  brace-expansion@5.0.8(patch_hash=ca2c07b933974ca774e3e37039d8c563bb28f04710ba4c7162a31a96faff77b9):
+  brace-expansion@5.0.9(patch_hash=f142ba995ebb0372d071486e30b1fb522c19e147dfe3674c8c7dcd9a04308337):
     dependencies:
       balanced-match: 4.0.4
 
@@ -25660,7 +25498,7 @@ snapshots:
       parse5: 7.3.0
       parse5-htmlparser2-tree-adapter: 7.1.0
       parse5-parser-stream: 7.1.2
-      undici: 7.28.0
+      undici: 7.29.0
       whatwg-mimetype: 4.0.0
 
   chevrotain@10.5.0:
@@ -25824,8 +25662,6 @@ snapshots:
 
   commander@13.1.0: {}
 
-  commander@14.0.2: {}
-
   commander@2.20.3: {}
 
   commander@4.1.1: {}
@@ -27618,7 +27454,7 @@ snapshots:
 
   fast-text-encoding@1.0.6: {}
 
-  fast-uri@3.1.4: {}
+  fast-uri@3.1.5: {}
 
   fast-wrap-ansi@0.2.2:
     dependencies:
@@ -27969,10 +27805,6 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
 
-  get-tsconfig@4.13.0:
-    dependencies:
-      resolve-pkg-maps: 1.0.0
-
   get-tsconfig@4.14.0:
     dependencies:
       resolve-pkg-maps: 1.0.0
@@ -28289,7 +28121,7 @@ snapshots:
 
   hls.js@1.6.16: {}
 
-  hono@4.11.4: {}
+  hono@4.12.34: {}
 
   hookable@6.1.1: {}
 
@@ -28516,10 +28348,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  iron-webcrypto@2.0.0:
-    dependencies:
-      uint8array-extras: 1.5.0
-
   is-absolute-url@4.0.1: {}
 
   is-alphabetical@2.0.1: {}
@@ -30347,7 +30175,7 @@ snapshots:
     dependencies:
       '@cspotcode/source-map-support': 0.8.1
       sharp: 0.35.2
-      undici: 7.28.0
+      undici: 7.29.0
       workerd: 1.20260722.1
       ws: 8.21.0
       youch: 4.1.0-beta.10
@@ -30357,15 +30185,15 @@ snapshots:
 
   minimatch@10.2.3:
     dependencies:
-      brace-expansion: 5.0.8(patch_hash=ca2c07b933974ca774e3e37039d8c563bb28f04710ba4c7162a31a96faff77b9)
+      brace-expansion: 5.0.9(patch_hash=f142ba995ebb0372d071486e30b1fb522c19e147dfe3674c8c7dcd9a04308337)
 
   minimatch@3.1.4:
     dependencies:
-      brace-expansion: 5.0.8(patch_hash=ca2c07b933974ca774e3e37039d8c563bb28f04710ba4c7162a31a96faff77b9)
+      brace-expansion: 5.0.9(patch_hash=f142ba995ebb0372d071486e30b1fb522c19e147dfe3674c8c7dcd9a04308337)
 
   minimatch@9.0.7:
     dependencies:
-      brace-expansion: 5.0.8(patch_hash=ca2c07b933974ca774e3e37039d8c563bb28f04710ba4c7162a31a96faff77b9)
+      brace-expansion: 5.0.9(patch_hash=f142ba995ebb0372d071486e30b1fb522c19e147dfe3674c8c7dcd9a04308337)
 
   minimist@1.2.8: {}
 
@@ -30793,7 +30621,7 @@ snapshots:
       '@oxfmt/binding-win32-x64-msvc': 0.52.0
       vite-plus: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
 
-  oxfmt@0.52.0(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3)):
+  oxfmt@0.52.0(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)):
     dependencies:
       tinypool: 2.1.0
     optionalDependencies:
@@ -30816,7 +30644,7 @@ snapshots:
       '@oxfmt/binding-win32-arm64-msvc': 0.52.0
       '@oxfmt/binding-win32-ia32-msvc': 0.52.0
       '@oxfmt/binding-win32-x64-msvc': 0.52.0
-      vite-plus: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3)
+      vite-plus: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
 
   oxfmt@0.52.0(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@22.20.1)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@5.8.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)):
     dependencies:
@@ -31049,7 +30877,7 @@ snapshots:
       oxlint-tsgolint: 0.23.0
       vite-plus: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
 
-  oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3)):
+  oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)):
     optionalDependencies:
       '@oxlint/binding-android-arm-eabi': 1.67.0
       '@oxlint/binding-android-arm64': 1.67.0
@@ -31071,7 +30899,7 @@ snapshots:
       '@oxlint/binding-win32-ia32-msvc': 1.67.0
       '@oxlint/binding-win32-x64-msvc': 1.67.0
       oxlint-tsgolint: 0.23.0
-      vite-plus: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3)
+      vite-plus: 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
 
   oxlint@1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@22.20.1)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@5.8.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)):
     optionalDependencies:
@@ -31341,8 +31169,6 @@ snapshots:
   pg-cloudflare@1.4.0:
     optional: true
 
-  pg-connection-string@2.12.0: {}
-
   pg-connection-string@2.14.0: {}
 
   pg-cursor@2.21.0(pg@8.22.0):
@@ -31494,20 +31320,15 @@ snapshots:
 
   possible-typed-array-names@1.1.0: {}
 
-  postcss-load-config@6.0.1(jiti@2.7.0)(tsx@4.21.0)(yaml@2.8.3):
+  postcss-load-config@6.0.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.21.0)(yaml@2.8.3):
     dependencies:
       lilconfig: 3.1.3
     optionalDependencies:
       jiti: 2.7.0
+      postcss: 8.5.23
       tsx: 4.21.0
       yaml: 2.8.3
 
-  postcss@8.5.18:
-    dependencies:
-      nanoid: 3.3.16
-      picocolors: 1.1.1
-      source-map-js: 1.2.1
-
   postcss@8.5.23:
     dependencies:
       nanoid: 3.3.16
@@ -33015,7 +32836,7 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  socket.io-parser@4.2.6:
+  socket.io-parser@4.2.7:
     dependencies:
       '@socket.io/component-emitter': 3.1.2
       debug: 4.4.3
@@ -33030,7 +32851,7 @@ snapshots:
       debug: 4.4.3
       engine.io: 6.6.9
       socket.io-adapter: 2.5.8
-      socket.io-parser: 4.2.6
+      socket.io-parser: 4.2.7
     transitivePeerDependencies:
       - bufferutil
       - supports-color
@@ -33403,14 +33224,6 @@ snapshots:
       readable-stream: 3.6.2
     optional: true
 
-  tar@7.5.19:
-    dependencies:
-      '@isaacs/fs-minipass': 4.0.1
-      chownr: 3.0.0
-      minipass: 7.1.3
-      minizlib: 3.1.0
-      yallist: 5.0.0
-
   tar@7.5.21:
     dependencies:
       '@isaacs/fs-minipass': 4.0.1
@@ -33680,7 +33493,7 @@ snapshots:
 
   tslib@2.8.1: {}
 
-  tsup@8.5.1(jiti@2.7.0)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3):
+  tsup@8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.21.0)(typescript@5.6.3)(yaml@2.8.3):
     dependencies:
       bundle-require: 5.1.0(esbuild@0.28.1)
       cac: 6.7.14
@@ -33691,7 +33504,7 @@ snapshots:
       fix-dts-default-cjs-exports: 1.0.1
       joycon: 3.1.1
       picocolors: 1.1.1
-      postcss-load-config: 6.0.1(jiti@2.7.0)(tsx@4.21.0)(yaml@2.8.3)
+      postcss-load-config: 6.0.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.21.0)(yaml@2.8.3)
       resolve-from: 5.0.0
       rollup: 4.59.0
       source-map: 0.7.6
@@ -33700,6 +33513,7 @@ snapshots:
       tinyglobby: 0.2.15
       tree-kill: 1.2.2
     optionalDependencies:
+      postcss: 8.5.23
       typescript: 5.6.3
     transitivePeerDependencies:
       - jiti
@@ -33710,7 +33524,7 @@ snapshots:
   tsx@4.21.0:
     dependencies:
       esbuild: 0.27.2
-      get-tsconfig: 4.13.0
+      get-tsconfig: 4.14.0
     optionalDependencies:
       fsevents: 2.3.3
 
@@ -33815,62 +33629,6 @@ snapshots:
 
   uint8array-extras@1.5.0: {}
 
-  ultracite@5.0.39(@types/debug@4.1.12)(@types/node@24.10.4)(jiti@2.7.0)(jsdom@26.1.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3):
-    dependencies:
-      '@clack/prompts': 0.11.0
-      commander: 14.0.2
-      deepmerge: 4.3.1
-      jsonc-parser: 3.3.1
-      vitest: 3.2.7(@types/debug@4.1.12)(@types/node@24.10.4)(jiti@2.7.0)(jsdom@26.1.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
-    transitivePeerDependencies:
-      - '@edge-runtime/vm'
-      - '@types/debug'
-      - '@types/node'
-      - '@vitest/browser'
-      - '@vitest/ui'
-      - happy-dom
-      - jiti
-      - jsdom
-      - less
-      - lightningcss
-      - msw
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - tsx
-      - yaml
-
-  ultracite@5.0.39(@types/debug@4.1.12)(@types/node@24.10.4)(jsdom@26.1.0)(tsx@4.21.0):
-    dependencies:
-      '@clack/prompts': 0.11.0
-      commander: 14.0.2
-      deepmerge: 4.3.1
-      jsonc-parser: 3.3.1
-      vitest: 3.2.7(@types/debug@4.1.12)(@types/node@24.10.4)(jsdom@26.1.0)(tsx@4.21.0)
-    transitivePeerDependencies:
-      - '@edge-runtime/vm'
-      - '@types/debug'
-      - '@types/node'
-      - '@vitest/browser'
-      - '@vitest/ui'
-      - happy-dom
-      - jiti
-      - jsdom
-      - less
-      - lightningcss
-      - msw
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - tsx
-      - yaml
-
   unbox-primitive@1.1.0:
     dependencies:
       call-bound: 1.0.4
@@ -33897,9 +33655,9 @@ snapshots:
 
   undici-types@7.16.0: {}
 
-  undici@6.27.0: {}
+  undici@6.28.0: {}
 
-  undici@7.28.0: {}
+  undici@7.29.0: {}
 
   undici@8.9.0: {}
 
@@ -34105,10 +33863,6 @@ snapshots:
       '@types/istanbul-lib-coverage': 2.0.6
       convert-source-map: 2.0.0
 
-  valibot@1.2.0(typescript@6.0.3):
-    optionalDependencies:
-      typescript: 6.0.3
-
   valibot@1.4.2(typescript@6.0.3):
     optionalDependencies:
       typescript: 6.0.3
@@ -34220,27 +33974,6 @@ snapshots:
       - tsx
       - yaml
 
-  vite-node@3.2.4(@types/node@24.10.4)(tsx@4.21.0):
-    dependencies:
-      cac: 6.7.14
-      debug: 4.4.3
-      es-module-lexer: 1.7.0
-      pathe: 2.0.3
-      vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
-    transitivePeerDependencies:
-      - '@types/node'
-      - jiti
-      - less
-      - lightningcss
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - tsx
-      - yaml
-
   vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(@vitest/ui@4.1.0(@voidzero-dev/vite-plus-test@0.1.24))(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3):
     dependencies:
       '@oxc-project/types': 0.133.0
@@ -34391,14 +34124,14 @@ snapshots:
       - vite
       - yaml
 
-  vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3):
+  vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3):
     dependencies:
       '@oxc-project/types': 0.133.0
       '@oxlint/plugins': 1.61.0
       '@voidzero-dev/vite-plus-core': 0.1.24(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3)
-      '@voidzero-dev/vite-plus-test': 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(@vitest/ui@4.1.0(@voidzero-dev/vite-plus-test@0.1.24))(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@20.19.43)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
-      oxfmt: 0.52.0(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3))
-      oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(yaml@2.8.3))
+      '@voidzero-dev/vite-plus-test': 0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3)
+      oxfmt: 0.52.0(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3))
+      oxlint: 1.67.0(oxlint-tsgolint@0.23.0)(vite-plus@0.1.24(@opentelemetry/api@1.9.0)(@types/node@20.19.43)(esbuild@0.28.1)(jiti@2.7.0)(jsdom@26.1.0)(terser@5.44.1)(tsx@4.21.0)(typescript@6.0.3)(unrun@0.2.39(synckit@0.11.11))(vite@7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3))(yaml@2.8.3))
       oxlint-tsgolint: 0.23.0
     optionalDependencies:
       '@voidzero-dev/vite-plus-darwin-arm64': 0.1.24
@@ -34790,7 +34523,7 @@ snapshots:
       esbuild: 0.28.1
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.18
+      postcss: 8.5.23
       rollup: 4.59.0
       tinyglobby: 0.2.15
     optionalDependencies:
@@ -34807,7 +34540,7 @@ snapshots:
       esbuild: 0.28.1
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.18
+      postcss: 8.5.23
       rollup: 4.59.0
       tinyglobby: 0.2.15
     optionalDependencies:
@@ -34824,7 +34557,7 @@ snapshots:
       esbuild: 0.28.1
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.18
+      postcss: 8.5.23
       rollup: 4.59.0
       tinyglobby: 0.2.15
     optionalDependencies:
@@ -34969,49 +34702,6 @@ snapshots:
       - tsx
       - yaml
 
-  vitest@3.2.7(@types/debug@4.1.12)(@types/node@24.10.4)(jsdom@26.1.0)(tsx@4.21.0):
-    dependencies:
-      '@types/chai': 5.2.3
-      '@vitest/expect': 3.2.7
-      '@vitest/mocker': 3.2.7(vite@7.3.5(@types/node@24.10.4)(tsx@4.21.0))
-      '@vitest/pretty-format': 3.2.7
-      '@vitest/runner': 3.2.7
-      '@vitest/snapshot': 3.2.7
-      '@vitest/spy': 3.2.7
-      '@vitest/utils': 3.2.7
-      chai: 5.3.3
-      debug: 4.4.3
-      expect-type: 1.3.0
-      magic-string: 0.30.21
-      pathe: 2.0.3
-      picomatch: 4.0.4
-      std-env: 3.10.0
-      tinybench: 2.9.0
-      tinyexec: 0.3.2
-      tinyglobby: 0.2.15
-      tinypool: 1.1.1
-      tinyrainbow: 2.0.0
-      vite: 7.3.5(@types/node@24.10.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.44.1)(tsx@4.21.0)(yaml@2.8.3)
-      vite-node: 3.2.4(@types/node@24.10.4)(tsx@4.21.0)
-      why-is-node-running: 2.3.0
-    optionalDependencies:
-      '@types/debug': 4.1.12
-      '@types/node': 24.10.4
-      jsdom: 26.1.0
-    transitivePeerDependencies:
-      - jiti
-      - less
-      - lightningcss
-      - msw
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - tsx
-      - yaml
-
   vlq@0.2.3: {}
 
   vlq@1.0.1: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 4d66a435f..c228ef7c4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,7 +11,7 @@ ignoredBuiltDependencies:
   - node-liblzma
 patchedDependencies:
   "@earendil-works/pi-ai@0.80.7": patches/@earendil-works__pi-ai@0.80.7.patch
-  "brace-expansion@5.0.8": patches/brace-expansion@5.0.8.patch
+  "brace-expansion@5.0.9": patches/brace-expansion@5.0.9.patch
   fumadocs-openapi@11.2.2: patches/fumadocs-openapi@11.2.2.patch
 catalog:
   # Effect ecosystem (v4)
@@ -100,7 +100,8 @@ overrides:
   "@babel/core@<=7.29.0": 7.29.6
   "@esbuild-kit/core-utils>esbuild": 0.25.0
   "@expo/cli>tar": 7.5.21
-  "@expo/metro-config>postcss": 8.5.18
+  "@expo/metro-config>postcss": 8.5.23
+  "@hono/node-server@<2.0.10": 2.0.10
   "@isaacs/brace-expansion@<=5.0.0": 5.0.1
   "@tanstack/react-start@>=1.0.0 <1.167.30": 1.167.30
   "@tootallnate/once@<2.0.1": 2.0.1
@@ -108,12 +109,12 @@ overrides:
   "@srsholmes/vitest-react-native>esbuild": 0.28.1
   "ajv@<7": 6.14.0
   "ajv@>=7.0.0-alpha.0 <8.18.0": 8.18.0
-  "brace-expansion@<=5.0.7": 5.0.8
+  "brace-expansion@<=5.0.8": 5.0.9
   "bundle-require>esbuild": 0.28.1
   "defu@<=6.1.4": 6.1.7
   "drizzle-orm@<0.45.2": 0.45.2
   effect: 4.0.0-beta.100
-  "fast-uri@<=3.1.3": 3.1.4
+  "fast-uri@<=3.1.4": 3.1.5
   "fast-xml-parser@>=5.9.3 <5.10.1": 5.10.1
   "fdir>picomatch": 4.0.4
   "flatted@<=3.4.1": 3.4.2
@@ -121,7 +122,8 @@ overrides:
   h3-v2: npm:h3@2.0.1-rc.18
   "js-yaml@<3.15.0": 3.15.0
   "js-yaml@>=4.0.0 <4.3.0": 4.3.0
-  "postcss@>=8.0.0 <8.5.18": 8.5.18
+  "hono@>=4 <4.12.34": 4.12.34
+  "postcss@>=8.0.0 <8.5.23": 8.5.23
   kysely: 0.28.17
   "lodash@>=4.0.0 <=4.17.23": 4.18.0
   "minimatch@<3.1.4": 3.1.4
@@ -132,12 +134,14 @@ overrides:
   "picomatch@<2.3.2": 2.3.2
   "picomatch@>=3.0.0 <3.0.2": 3.0.2
   "picomatch@>=4.0.0 <4.0.4": 4.0.4
-  "postcss@<8.5.10": 8.5.10
   "rollup@>=4 <4.59.0": 4.59.0
   "shell-quote@>=1.1.0 <=1.8.3": 1.10.0
-  "tar@>=7 <7.5.11": 7.5.19
+  "socket.io-parser@<4.2.7": 4.2.7
+  "tar@>=7 <7.5.21": 7.5.21
   "tsup>esbuild": 0.28.1
-  "undici@>=6 <6.27.0": 6.27.0
+  "undici@>=6 <6.28.0": 6.28.0
+  "undici@>=7 <7.29.0": 7.29.0
+  "valibot@<1.4.2": 1.4.2
   "vite@>=7 <=7.3.4": 7.3.5
   "vite>esbuild": 0.28.1
   "vitest@>=3 <3.2.6": 3.2.7
diff --git a/scripts/check-platform-seam.mjs b/scripts/check-platform-seam.mjs
new file mode 100644
index 000000000..3c603a6cf
--- /dev/null
+++ b/scripts/check-platform-seam.mjs
@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+// Enforces the platform seam.
+//
+// Service packages under `packages/**` are portable: they depend on the
+// provider-neutral contracts in `@voidhash/platform` and never on a concrete
+// adapter. `@voidhash/platform-selfhost` is one such adapter, so importing it
+// from a package would pin portable code to the Node/PostgreSQL deployment and
+// break the Cloud composition that binds different implementations.
+//
+// Compositions choose adapters, so `apps/**` and `selfhost/**` may import it
+// freely. Tests are also allowed to bind a concrete adapter — that is how a
+// port is exercised against something real — but only as a devDependency, so
+// the adapter never reaches a package's runtime dependency graph.
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const adapter = "@voidhash/platform-selfhost";
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const tracked = execFileSync(
+  "git",
+  ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
+  {
+    cwd: repoRoot,
+    encoding: "utf8",
+  },
+)
+  .split("\0")
+  .filter((path) => path.length > 0 && existsSync(join(repoRoot, path)));
+
+const failures = [];
+const sourceLike = /\.[cm]?[jt]sx?$/;
+const isTestFile = (path) =>
+  path.split("/").includes("tests") ||
+  /\.test\.[cm]?[jt]sx?$/.test(path) ||
+  /(^|\/)vitest\./.test(path);
+const importsAdapter = new RegExp(`["']${adapter}(?:/[^"']*)?["']`);
+
+for (const path of tracked.filter(
+  (path) =>
+    path.startsWith("packages/") &&
+    sourceLike.test(path) &&
+    !isTestFile(path) &&
+    !path.includes("/node_modules/"),
+)) {
+  if (importsAdapter.test(readFileSync(join(repoRoot, path), "utf8"))) {
+    failures.push(`${path} imports ${adapter}; depend on @voidhash/platform instead`);
+  }
+}
+
+for (const path of tracked.filter(
+  (path) => path.startsWith("packages/") && path.endsWith("/package.json"),
+)) {
+  const manifest = JSON.parse(readFileSync(join(repoRoot, path), "utf8"));
+  if (manifest.dependencies?.[adapter]) {
+    failures.push(
+      `${path} lists ${adapter} as a runtime dependency; tests may use it as a devDependency`,
+    );
+  }
+}
+
+if (failures.length > 0) {
+  process.stderr.write("Platform seam check failed:\n\n");
+  for (const failure of failures) {
+    process.stderr.write(`- ${failure}\n`);
+  }
+  process.exit(1);
+}
+
+process.stdout.write(
+  `Platform seam OK — no package outside apps/ and selfhost/ binds ${adapter}.\n`,
+);
diff --git a/scripts/check-publication-boundary.mjs b/scripts/check-publication-boundary.mjs
index fdab45886..450ef8fa6 100644
--- a/scripts/check-publication-boundary.mjs
+++ b/scripts/check-publication-boundary.mjs
@@ -73,7 +73,7 @@ for (const path of tracked.filter(
 const forbiddenAdminPaths = [
   "packages/core/src/services/admin/",
   "packages/rpc/src/groups/admin/",
-  "apps/backend/src/rpc/groups/admin/",
+  "packages/backend/src/rpc/groups/admin/",
 ];
 for (const path of tracked) {
   if (forbiddenAdminPaths.some((prefix) => path.startsWith(prefix))) {
diff --git a/scripts/check-selfhost-runtime-boundary.mjs b/scripts/check-selfhost-runtime-boundary.mjs
index dc7289852..5d00ba502 100644
--- a/scripts/check-selfhost-runtime-boundary.mjs
+++ b/scripts/check-selfhost-runtime-boundary.mjs
@@ -9,15 +9,20 @@ const forbiddenPackages = new Set([
   "miniflare",
   "workerd",
   "wrangler",
-  "@orbian/alchemy",
-  "@orbian/cloudflare",
   "@distilled.cloud/cloudflare",
   "@distilled.cloud/cloudflare-rolldown-plugin",
   "@distilled.cloud/cloudflare-runtime",
   "@distilled.cloud/cloudflare-vite-plugin",
 ]);
 
-const isForbidden = (name) => forbiddenPackages.has(name) || name.startsWith("@cloudflare/");
+// Types-only packages carry no runtime cloud coupling. `@cloudflare/workers-types`
+// reaches the prod tree as an optional peer of better-auth's kysely adapter and
+// contains nothing but declaration files.
+const allowedTypeOnlyPackages = new Set(["@cloudflare/workers-types"]);
+
+const isForbidden = (name) =>
+  !allowedTypeOnlyPackages.has(name) &&
+  (forbiddenPackages.has(name) || name.startsWith("@cloudflare/"));
 
 const readPackage = (packageDirectory, installed) => {
   const manifestPath = path.join(packageDirectory, "package.json");
@@ -88,7 +93,7 @@ if (requestedDeployment) {
         "--config.node-linker=isolated",
         "--config.block-exotic-subdeps=false",
         "--filter",
-        "@voidhash/selfhost-entry",
+        "@voidhash/backend-app",
         "deploy",
         "--prod",
         "--legacy",
diff --git a/scripts/check-test-tiers.mjs b/scripts/check-test-tiers.mjs
new file mode 100644
index 000000000..f08a16459
--- /dev/null
+++ b/scripts/check-test-tiers.mjs
@@ -0,0 +1,94 @@
+// Enforces the repository's test-tier layout.
+//
+//   *.integration.test.ts  needs the self-host stack; runs under `pnpm test:integration`
+//   *.test.ts              needs nothing; runs under `pnpm test`
+//
+// The rule this exists to protect: a test's tier follows from its filename, and
+// nothing else. Environment-flag gating (`FLAG === "1" ? describe : describe.skip`)
+// used to decide it instead, so a forgotten flag made a suite report success
+// without running — indistinguishable from a real pass. A test must either run
+// or fail loudly because its prerequisites are missing.
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+const skipDirectories = new Set(["node_modules", "dist", ".git", ".turbo", "build", ".next"]);
+
+const walk = (directory, found = []) => {
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (skipDirectories.has(entry.name)) continue;
+      walk(path.join(directory, entry.name), found);
+    } else if (entry.name.endsWith(".test.ts")) {
+      found.push(path.join(directory, entry.name));
+    }
+  }
+  return found;
+};
+
+const failures = [];
+const testFiles = walk(repoRoot);
+
+// A `describe.skip` bound to an environment variable is the gating pattern.
+// A literal `describe.skip("…")` on a specific case is an ordinary skipped
+// test and stays allowed.
+const gatingPattern = /process\.env\.[A-Z0-9_]+[^\n]*\?[^\n]*describe[^\n]*:\s*describe\.skip/;
+
+for (const file of testFiles) {
+  const relative = path.relative(repoRoot, file);
+  const source = fs.readFileSync(file, "utf8");
+
+  if (gatingPattern.test(source)) {
+    failures.push(
+      `${relative}: gates a suite on an environment variable. Name the file ` +
+        `*.integration.test.ts and let the integration tier provide its stack.`,
+    );
+  }
+
+  // Reading a connection setting *as a value* (`process.env.X ?? "…"`) means the
+  // file talks to the stack. Assigning or deleting one is how config-parsing
+  // unit tests set up their fixtures, and stays in the unit tier.
+  const isIntegration = file.endsWith(".integration.test.ts");
+  const usesStack =
+    /process\.env\.(DATABASE_|CLICKHOUSE_|PLATFORM_|SELFHOST_|S3_|MIMIC_)[A-Z0-9_]*\s*(\?\?|\|\|)/.test(
+      source,
+    );
+  if (!isIntegration && usesStack) {
+    failures.push(
+      `${relative}: reads stack connection settings but is not named ` +
+        `*.integration.test.ts, so it runs in the unit tier without a stack.`,
+    );
+  }
+}
+
+// Every package holding integration tests needs the config the runner invokes.
+const integrationDirectories = new Set(
+  testFiles
+    .filter((file) => file.endsWith(".integration.test.ts"))
+    .map((file) => {
+      let directory = path.dirname(file);
+      while (directory !== repoRoot && !fs.existsSync(path.join(directory, "package.json"))) {
+        directory = path.dirname(directory);
+      }
+      return directory;
+    }),
+);
+
+for (const directory of integrationDirectories) {
+  if (!fs.existsSync(path.join(directory, "vitest.integration.mts"))) {
+    failures.push(
+      `${path.relative(repoRoot, directory)}: has *.integration.test.ts files but no ` +
+        `vitest.integration.mts, so \`pnpm test:integration\` cannot run them.`,
+    );
+  }
+}
+
+if (failures.length > 0) {
+  console.error("Test-tier violations:\n");
+  for (const failure of failures) console.error(`  - ${failure}`);
+  process.exit(1);
+}
+
+console.log(`Test tiers OK (${testFiles.length} test files).`);
diff --git a/scripts/db-migrate-local.mjs b/scripts/db-migrate-local.mjs
index 27fbe1885..7f8ce2474 100644
--- a/scripts/db-migrate-local.mjs
+++ b/scripts/db-migrate-local.mjs
@@ -23,6 +23,11 @@
 // Connection is read from env with local-dev defaults:
 //   DATABASE_HOST=127.0.0.1 DATABASE_PORT=5432 DATABASE_NAME=voidhash
 //   DATABASE_USERNAME=voidhash DATABASE_PASSWORD=password
+// Each `DATABASE_DIRECT_*` override wins over its `DATABASE_*` counterpart, for
+// the same reason `getSelfhostMigrationDatabaseConfig` exists: when the app is
+// pointed at a sandboxed or proxied endpoint (a connection broker, a
+// Hyperdrive-style local socket), that hostname resolves only inside the
+// runtime serving requests, while this script needs a real TCP socket.
 // The Docker image (docker-compose.yml) creates `voidhash` as a superuser that
 // owns the `voidhash` database, so the app user has full DDL locally.
 
@@ -50,12 +55,15 @@ const isLocalHost = (host) => {
   return LOCAL_HOSTS.has(h) || h.endsWith(".localhost");
 };
 
+const direct = (name, fallback) =>
+  process.env[`DATABASE_DIRECT_${name}`] ?? process.env[`DATABASE_${name}`] ?? fallback;
+
 const config = {
-  host: process.env.DATABASE_HOST ?? "127.0.0.1",
-  port: Number.parseInt(process.env.DATABASE_PORT ?? "5432", 10),
-  database: process.env.DATABASE_NAME ?? "voidhash",
-  user: process.env.DATABASE_USERNAME ?? "voidhash",
-  password: process.env.DATABASE_PASSWORD ?? "password",
+  host: direct("HOST", "127.0.0.1"),
+  port: Number.parseInt(direct("PORT", "5432"), 10),
+  database: direct("NAME", "voidhash"),
+  user: direct("USERNAME", "voidhash"),
+  password: direct("PASSWORD", "password"),
 };
 
 const force = process.argv.includes("--force");
diff --git a/scripts/run-local-integration.mjs b/scripts/run-local-integration.mjs
new file mode 100644
index 000000000..90716e4a4
--- /dev/null
+++ b/scripts/run-local-integration.mjs
@@ -0,0 +1,288 @@
+// Runs every integration-capable suite against the local self-host stack.
+//
+//   node scripts/run-local-integration.mjs [suite ...]
+//
+// Reads `.env` at the repo root (falling back to `.env.example` defaults),
+// derives host-side connection settings from the stack's values (container
+// hostnames become 127.0.0.1 plus the published port), and runs the suites
+// sequentially. Sequential matters: the suites share one Postgres and one
+// ClickHouse, and parallel runs would race on schema setup.
+//
+// Suites read and write the deployment's application tables, but the clusters
+// they build get an isolated database of their own — see `resetPlatformDatabase`
+// below.
+//
+// The stack is the only prerequisite, and the runner starts it if it is down.
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+const parseEnvFile = (filePath) => {
+  const values = {};
+  if (!fs.existsSync(filePath)) return values;
+  for (const line of fs.readFileSync(filePath, "utf8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const separator = trimmed.indexOf("=");
+    if (separator === -1) continue;
+    values[trimmed.slice(0, separator)] = trimmed.slice(separator + 1);
+  }
+  return values;
+};
+
+const envFile = path.join(repoRoot, ".env");
+const envExample = path.join(repoRoot, ".env.example");
+
+// A first checkout has no `.env`, which is a setup step to forget rather than a
+// decision to make: the example holds the same defaults the suites assume.
+if (!fs.existsSync(envFile) && fs.existsSync(envExample)) {
+  fs.copyFileSync(envExample, envFile);
+  console.log("Created .env from .env.example.");
+}
+
+const stackEnv = parseEnvFile(envFile);
+const value = (key, fallback) => process.env[key] ?? stackEnv[key] ?? fallback;
+
+const databasePort = value("DATABASE_HOST_PORT", "5432");
+const databaseUsername = value("DATABASE_USERNAME", "voidhash");
+const databasePassword = value("DATABASE_PASSWORD", "password");
+const databaseName = value("DATABASE_NAME", "voidhash");
+const clickhousePort = value("CLICKHOUSE_HTTP_PORT", "8123");
+const minioPort = value("MINIO_API_PORT", "9000");
+const mailpitSmtpPort = value("MAILPIT_SMTP_PORT", "1025");
+const mailpitUiPort = value("MAILPIT_UI_PORT", "8025");
+const compilerPort = value("COMPILER_HOST_PORT", "5002");
+const chromiumExecutablePath = value(
+  "PLATFORM_SELFHOST_CHROMIUM_EXECUTABLE_PATH",
+  process.platform === "darwin"
+    ? "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+    : undefined,
+);
+
+// Several suites build their own single-node cluster, and a single-node cluster
+// claims *every* shard in the database it is built over. Sharing the running
+// deployment's database would make the two runners steal each other's messages,
+// which surfaces as `Could not find entity manager for address, retrying` in the
+// app log and as timeouts in the suite. Platform state therefore gets a database
+// of its own; application tables stay where the deployment keeps them.
+const platformDatabaseName = `${databaseName}_platform_test`;
+
+const testEnv = {
+  ...process.env,
+
+  SELFHOST_MODE: "local-evaluation",
+  DATABASE_HOST: "127.0.0.1",
+  DATABASE_PORT: databasePort,
+  DATABASE_USERNAME: databaseUsername,
+  DATABASE_PASSWORD: databasePassword,
+  DATABASE_NAME: databaseName,
+  DATABASE_SSL: "false",
+
+  // Only the name differs; host, port, and credentials fall back to DATABASE_*.
+  DATABASE_PLATFORM_NAME: platformDatabaseName,
+
+  // The stack's CLICKHOUSE_URL names the compose-internal hostname; tests run
+  // on the host and reach the published port instead.
+  CLICKHOUSE_URL: `http://127.0.0.1:${clickhousePort}`,
+  CLICKHOUSE_DATABASE: value("CLICKHOUSE_DATABASE", "voidhash"),
+  CLICKHOUSE_ADMIN_USERNAME: value("CLICKHOUSE_ADMIN_USERNAME", "voidhash_admin"),
+  CLICKHOUSE_ADMIN_PASSWORD: value("CLICKHOUSE_ADMIN_PASSWORD", "password"),
+  CLICKHOUSE_USERNAME: value("CLICKHOUSE_USERNAME", "voidhash_app"),
+  CLICKHOUSE_PASSWORD: value("CLICKHOUSE_PASSWORD", "password"),
+  CLICKHOUSE_RO_USERNAME: value("CLICKHOUSE_RO_USERNAME", "voidhash_ro"),
+  CLICKHOUSE_RO_PASSWORD: value("CLICKHOUSE_RO_PASSWORD", "password"),
+  CLICKHOUSE_ANALYTICS_QUERY_USERNAME: value(
+    "CLICKHOUSE_ANALYTICS_QUERY_USERNAME",
+    "voidhash_query",
+  ),
+  CLICKHOUSE_ANALYTICS_QUERY_PASSWORD: value("CLICKHOUSE_ANALYTICS_QUERY_PASSWORD", "password"),
+
+  ROOT_USERNAME: value("MIMIC_ROOT_USERNAME", "root"),
+  ROOT_PASSWORD: value("MIMIC_ROOT_PASSWORD", "password"),
+
+  SELFHOST_COMPILER_URL: `http://127.0.0.1:${compilerPort}`,
+
+  // The backend app suite's mimic tests dial Postgres under their own
+  // prefix, so they need the published port too.
+  SELFHOST_PG_HOST: "127.0.0.1",
+  SELFHOST_PG_PORT: databasePort,
+  SELFHOST_PG_DATABASE: databaseName,
+  SELFHOST_PG_USERNAME: databaseUsername,
+  SELFHOST_PG_PASSWORD: databasePassword,
+
+  // The platform adapter suites and the cluster entity hosts the backend and
+  // agent suites build all run over this connection, which is the isolated
+  // platform database rather than the deployment's.
+  PLATFORM_SELFHOST_PG_HOST: "127.0.0.1",
+  PLATFORM_SELFHOST_PG_PORT: databasePort,
+  PLATFORM_SELFHOST_PG_DATABASE: platformDatabaseName,
+  PLATFORM_SELFHOST_PG_USERNAME: databaseUsername,
+  PLATFORM_SELFHOST_PG_PASSWORD: databasePassword,
+
+  PLATFORM_SELFHOST_S3_ENDPOINT: `http://127.0.0.1:${minioPort}`,
+  PLATFORM_SELFHOST_S3_BUCKET: value("S3_PUBLIC_BUCKET", "voidhash-public"),
+  PLATFORM_SELFHOST_S3_REGION: value("S3_REGION", "us-east-1"),
+  PLATFORM_SELFHOST_S3_ACCESS_KEY_ID: value("S3_ACCESS_KEY_ID", "voidhash"),
+  PLATFORM_SELFHOST_S3_SECRET_ACCESS_KEY: value("S3_SECRET_ACCESS_KEY", "password"),
+
+  PLATFORM_SELFHOST_SMTP_HOST: "127.0.0.1",
+  PLATFORM_SELFHOST_SMTP_PORT: mailpitSmtpPort,
+  PLATFORM_SELFHOST_MAILPIT_API: `http://127.0.0.1:${mailpitUiPort}`,
+
+  ...(chromiumExecutablePath
+    ? { PLATFORM_SELFHOST_CHROMIUM_EXECUTABLE_PATH: chromiumExecutablePath }
+    : {}),
+};
+
+// Every suite runs `vitest.integration.mts`, which selects `*.integration.test.ts`
+// and nothing else. Unit files stay with `pnpm test`; no suite appears in both.
+const suites = [
+  { name: "platform", directory: "selfhost/platform" },
+  { name: "backend", directory: "apps/backend" },
+  { name: "core", directory: "packages/core" },
+  { name: "backend-smoke", directory: "packages/backend" },
+  { name: "agent", directory: "packages/agent" },
+  { name: "db", directory: "packages/db" },
+];
+
+const requested = process.argv.slice(2);
+const selected = requested.length
+  ? suites.filter((suite) => requested.includes(suite.name))
+  : suites;
+if (requested.length && selected.length !== requested.length) {
+  const known = new Set(suites.map((suite) => suite.name));
+  const unknown = requested.filter((name) => !known.has(name));
+  console.error(`Unknown suite(s): ${unknown.join(", ")}`);
+  console.error(`Known suites: ${suites.map((suite) => suite.name).join(", ")}`);
+  process.exit(1);
+}
+
+const composeArgs = [
+  "compose",
+  "-f",
+  "selfhost/docker-compose.yml",
+  "-f",
+  "selfhost/docker-compose.dev.yml",
+  // `--project-directory selfhost` keeps the image build context correct, which
+  // also moves Compose's implicit env-file lookup away from the repo root.
+  ...(fs.existsSync(envFile) ? ["--env-file", ".env"] : []),
+  "--profile",
+  "analytics",
+  "--project-directory",
+  "selfhost",
+];
+
+// `.env` is the deployment template, so it selects production mode. The stack
+// this runner manages is a loopback dev stack: force evaluation mode so a fresh
+// checkout does not boot containers that refuse to start on example secrets.
+const composeEnv = { ...process.env, SELFHOST_MODE: "local-evaluation" };
+
+const compose = (args, options = {}) =>
+  spawnSync("docker", [...composeArgs, ...args], {
+    cwd: repoRoot,
+    ...options,
+    env: { ...composeEnv, ...options.env },
+  });
+
+const prerequisiteBuild = spawnSync("pnpm", ["--filter", "@voidhash/paywalls", "build"], {
+  cwd: repoRoot,
+  env: process.env,
+  stdio: "inherit",
+});
+if (prerequisiteBuild.error || prerequisiteBuild.status !== 0) {
+  console.error("Failed to build integration test prerequisites.");
+  process.exit(1);
+}
+
+// The suites need the stack, so the runner provisions it rather than failing on
+// a forgotten `pnpm stack:up`. `compose up` is idempotent: already-healthy
+// services are left alone. A missing prerequisite must never look like a pass,
+// so anything unrecoverable here exits non-zero with the command to run.
+const ensureStackRunning = () => {
+  const probe = compose(["ps", "--format", "{{.Service}} {{.State}}"], {
+    encoding: "utf8",
+  });
+  if (probe.error || probe.status !== 0) {
+    console.error("Cannot reach Docker. Start Docker Desktop, then re-run.");
+    if (probe.stderr) console.error(String(probe.stderr).trim());
+    process.exit(1);
+  }
+
+  const running = String(probe.stdout)
+    .split("\n")
+    .filter((line) => line.trim().endsWith("running")).length;
+  if (running > 0) return;
+
+  console.log("Self-host stack is not running — starting it (first run builds images)…");
+  const up = compose(["up", "-d", "--build", "--wait"], { stdio: "inherit" });
+  if (up.status !== 0) {
+    console.error("\nFailed to start the self-host stack. Run `pnpm stack:up` to debug.");
+    process.exit(1);
+  }
+};
+
+ensureStackRunning();
+
+// Recreated rather than merely created: the isolated database holds nothing but
+// derived cluster state, and a run that crashed mid-suite can leave messages
+// addressed to entities nobody registers any more. Those are never discarded —
+// the storage read loop retries them forever and starves the runner — so every
+// run starts from an empty one. The tables are recreated by the layers that own
+// them on first build.
+const resetPlatformDatabase = async () => {
+  // `pg` is resolved from the package that declares it, because the repo root
+  // does not depend on it directly.
+  const require = createRequire(path.join(repoRoot, "packages/db/package.json"));
+  const { Client } = require("pg");
+  const client = new Client({
+    database: "postgres",
+    host: "127.0.0.1",
+    password: databasePassword,
+    port: Number(databasePort),
+    user: databaseUsername,
+  });
+  await client.connect();
+  try {
+    await client.query(
+      "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1",
+      [platformDatabaseName],
+    );
+    await client.query(`DROP DATABASE IF EXISTS "${platformDatabaseName}"`);
+    await client.query(`CREATE DATABASE "${platformDatabaseName}"`);
+  } finally {
+    await client.end();
+  }
+};
+
+try {
+  await resetPlatformDatabase();
+} catch (error) {
+  console.error(
+    `Cannot provision the isolated platform database "${platformDatabaseName}" on ` +
+      `127.0.0.1:${databasePort}.`,
+  );
+  console.error(String(error));
+  process.exit(1);
+}
+
+const vp = path.join(repoRoot, "node_modules", ".bin", "vp");
+const failures = [];
+for (const suite of selected) {
+  console.log(`\n━━━ ${suite.name} (${suite.directory}) ━━━`);
+  const result = spawnSync(vp, ["test", "run", "-c", "vitest.integration.mts"], {
+    cwd: path.join(repoRoot, suite.directory),
+    env: testEnv,
+    stdio: "inherit",
+  });
+  if (result.status !== 0) failures.push(suite.name);
+}
+
+if (failures.length > 0) {
+  console.error(`\nFailed suites: ${failures.join(", ")}`);
+  process.exit(1);
+}
+console.log("\nAll integration suites passed.");
diff --git a/scripts/set-orbian-source.mjs b/scripts/set-orbian-source.mjs
deleted file mode 100644
index addb1b533..000000000
--- a/scripts/set-orbian-source.mjs
+++ /dev/null
@@ -1,154 +0,0 @@
-/**
- * Switches Community packages between a sibling Orbian workspace for local
- * development and immutable pr-package artifacts for standalone distribution.
- */
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const workspaceFile = path.join(repositoryRoot, "pnpm-workspace.yaml");
-const lockFile = path.join(repositoryRoot, "pnpm-lock.yaml");
-const packageOrigin = (process.env.ORBIAN_PACKAGE_ORIGIN ?? "https://pkg.voidha.sh").replace(
-  /\/$/,
-  "",
-);
-const packageProjects = new Map([
-  ["@orbian/core", "orbian-core"],
-  ["@orbian/node", "orbian-node"],
-  ["@orbian/sdk", "orbian-sdk"],
-]);
-const workspacePackages = [
-  "../orbian/packages/core",
-  "../orbian/packages/node",
-  "../orbian/packages/sdk",
-];
-
-const mode = process.argv[2];
-if (mode !== "workspace" && !/^[0-9a-f]{40}$/.test(mode ?? "")) {
-  console.error("Usage: pnpm orbian:source <workspace|full-commit-sha>");
-  process.exit(1);
-}
-
-const packageFiles = [path.join(repositoryRoot, "package.json")];
-for (const group of ["apps", "packages", "libraries", "examples", "selfhost"]) {
-  const groupDirectory = path.join(repositoryRoot, group);
-  for (const entry of fs.readdirSync(groupDirectory, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    const packageFile = path.join(groupDirectory, entry.name, "package.json");
-    if (fs.existsSync(packageFile)) packageFiles.push(packageFile);
-  }
-}
-
-const packageUrl = (project) => `${packageOrigin}/${project}/${mode}`;
-
-if (mode !== "workspace") {
-  for (const project of packageProjects.values()) {
-    const response = await fetch(packageUrl(project));
-    if (!response.ok) {
-      throw new Error(`Orbian package ${project}@${mode} is unavailable: ${response.status}`);
-    }
-    await response.body?.cancel();
-  }
-} else {
-  for (const workspacePackage of workspacePackages) {
-    if (!fs.existsSync(path.resolve(repositoryRoot, workspacePackage, "package.json"))) {
-      throw new Error(`Orbian workspace package is unavailable: ${workspacePackage}`);
-    }
-  }
-}
-
-const mutableFiles = [...packageFiles, workspaceFile, lockFile];
-const originals = new Map(
-  mutableFiles.filter(fs.existsSync).map((file) => [file, fs.readFileSync(file, "utf8")]),
-);
-
-try {
-  for (const packageFile of packageFiles) {
-    const raw = fs.readFileSync(packageFile, "utf8");
-    const manifest = JSON.parse(raw);
-    let changed = false;
-    for (const field of [
-      "dependencies",
-      "devDependencies",
-      "optionalDependencies",
-      "peerDependencies",
-    ]) {
-      for (const [packageName, project] of packageProjects) {
-        if (!(packageName in (manifest[field] ?? {}))) continue;
-        manifest[field][packageName] = mode === "workspace" ? "workspace:*" : packageUrl(project);
-        changed = true;
-      }
-    }
-    if (changed) {
-      const indent = raw.match(/\n([ \t]+)"/)?.[1] ?? "  ";
-      fs.writeFileSync(packageFile, `${JSON.stringify(manifest, null, indent)}\n`);
-    }
-  }
-
-  const workspaceLines = fs
-    .readFileSync(workspaceFile, "utf8")
-    .split("\n")
-    .filter((line) => !workspacePackages.includes(line.trim().replace(/^- /, "")));
-  if (mode === "workspace") {
-    const packagesIndex = workspaceLines.findIndex((line) => line.trim() === "packages:");
-    workspaceLines.splice(
-      packagesIndex + 1,
-      0,
-      ...workspacePackages.map((workspacePackage) => `  - ${workspacePackage}`),
-    );
-  }
-  fs.writeFileSync(workspaceFile, workspaceLines.join("\n"));
-
-  execFileSync(
-    "corepack",
-    [
-      "pnpm@11.1.3",
-      "install",
-      "--lockfile-only",
-      "--ignore-scripts",
-      "--config.block-exotic-subdeps=false",
-    ],
-    { cwd: repositoryRoot, stdio: "inherit" },
-  );
-
-  const remainingWorkspaceReferences = packageFiles.flatMap((packageFile) => {
-    const manifest = JSON.parse(fs.readFileSync(packageFile, "utf8"));
-    return [
-      ...Object.entries(manifest.dependencies ?? {}),
-      ...Object.entries(manifest.devDependencies ?? {}),
-      ...Object.entries(manifest.optionalDependencies ?? {}),
-      ...Object.entries(manifest.peerDependencies ?? {}),
-    ].filter(
-      ([packageName, source]) =>
-        packageProjects.has(packageName) &&
-        (mode === "workspace" ? source !== "workspace:*" : source === "workspace:*"),
-    );
-  });
-  if (remainingWorkspaceReferences.length > 0) {
-    throw new Error("Orbian dependency source verification failed");
-  }
-  const updatedWorkspace = fs.readFileSync(workspaceFile, "utf8");
-  const updatedLock = fs.readFileSync(lockFile, "utf8");
-  if (
-    mode === "workspace"
-      ? workspacePackages.some((workspacePackage) => !updatedWorkspace.includes(workspacePackage))
-      : workspacePackages.some(
-          (workspacePackage) =>
-            updatedWorkspace.includes(workspacePackage) || updatedLock.includes(workspacePackage),
-        )
-  ) {
-    throw new Error("Orbian workspace boundary verification failed");
-  }
-
-  console.log(
-    mode === "workspace"
-      ? "Community packages now use the sibling Orbian workspace."
-      : `Community packages now use immutable Orbian artifacts from ${mode}.`,
-  );
-} catch (cause) {
-  for (const [file, contents] of originals) fs.writeFileSync(file, contents);
-  throw cause;
-}
diff --git a/scripts/sync-plugins.ts b/scripts/sync-plugins.ts
index 048967d07..406060aa3 100644
--- a/scripts/sync-plugins.ts
+++ b/scripts/sync-plugins.ts
@@ -2,7 +2,7 @@ import { readFile, writeFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { findSkill } from "../apps/backend/src/ai/skills/registry.ts";
+import { findSkill } from "../packages/backend/src/ai/skills/registry.ts";
 
 const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const skills = [
diff --git a/selfhost/.env.example b/selfhost/.env.example
deleted file mode 100644
index 9aebd8c96..000000000
--- a/selfhost/.env.example
+++ /dev/null
@@ -1,67 +0,0 @@
-SELFHOST_MODE=production
-DATABASE_USERNAME=voidhash
-DATABASE_PASSWORD=replace-with-a-random-password
-DATABASE_NAME=voidhash
-DATABASE_SSL=false
-# Optional analytics profile. Leave CLICKHOUSE_URL unset for the core stack.
-# CLICKHOUSE_URL=http://clickhouse:8123
-CLICKHOUSE_DATABASE=voidhash
-CLICKHOUSE_ADMIN_USERNAME=voidhash_admin
-CLICKHOUSE_ADMIN_PASSWORD=replace-with-a-random-password
-CLICKHOUSE_USERNAME=voidhash_app
-CLICKHOUSE_PASSWORD=replace-with-a-random-password
-CLICKHOUSE_RO_USERNAME=voidhash_ro
-CLICKHOUSE_RO_PASSWORD=replace-with-a-random-password
-CLICKHOUSE_ANALYTICS_QUERY_USERNAME=voidhash_query
-CLICKHOUSE_ANALYTICS_QUERY_PASSWORD=replace-with-a-random-password
-CLICKHOUSE_HTTP_PORT=8123
-MIMIC_ROOT_USERNAME=root
-MIMIC_ROOT_PASSWORD=replace-with-a-random-password
-PUBLIC_BASE_URL=http://localhost:5001
-PUBLIC_FILES_BASE_URL=http://localhost:5001
-MIMIC_CORS_ORIGINS=http://localhost:3000,http://localhost:3003
-MIMIC_DOCUMENT_IDLE_NOTIFY_DEBOUNCE_MS=15000
-MIMIC_PORT=5001
-WORKOS_API_KEY=sk_test_replace-me
-WORKOS_AUTHKIT_DOMAIN=https://your-subdomain.authkit.app
-WORKOS_CLIENT_ID=client_replace-me
-WORKOS_COOKIE_NAME=wos-session
-WORKOS_COOKIE_PASSWORD=replace-with-at-least-32-random-characters
-WORKOS_REDIRECT_URI=http://localhost:5001/api/auth/callback
-WORKOS_WEBHOOK_SECRET=whsec_replace-me
-# Durable agent model access. Configure at least one provider.
-OPENAI_API_KEY=
-ANTHROPIC_API_KEY=
-# OPENAI_BASE_URL=https://your-openai-compatible-host/v1
-# VOIDHASH_AGENT_MODEL_PROVIDER=openai
-# VOIDHASH_AGENT_MODEL_ID=gpt-5.4
-# VOIDHASH_AGENT_VISION_MODEL_PROVIDER=openai
-# VOIDHASH_AGENT_VISION_MODEL_ID=gpt-5.4
-# Required when Google Play RTDN is enabled. These must match the Pub/Sub push subscription.
-GOOGLE_PUBSUB_PUSH_AUDIENCE=
-GOOGLE_PUBSUB_PUSH_SERVICE_ACCOUNT_EMAIL=
-# Optional offline Enterprise activation; configure the token and issuer verification key together.
-VOIDHASH_LICENSE_KEY=
-VOIDHASH_LICENSE_PUBLIC_KEY=
-ENCRYPTION_KEY=
-APNS_DELIVERY_ENABLED=false
-EXCHANGE_RATE_API_KEY=
-S3_ACCESS_KEY_ID=voidhash
-S3_SECRET_ACCESS_KEY=replace-with-a-random-password
-S3_REGION=us-east-1
-S3_PUBLIC_BUCKET=voidhash-public
-S3_ARTIFACT_BUCKET=voidhash-artifacts
-MINIO_API_PORT=9000
-MINIO_CONSOLE_PORT=9001
-SMTP_HOST=mailpit
-SMTP_PORT=1025
-SMTP_SECURE=false
-SMTP_REQUIRE_TLS=false
-SMTP_USERNAME=
-SMTP_PASSWORD=
-SMTP_FROM_ADDRESS=noreply@voidhash.local
-SMTP_FROM_NAME=Voidhash
-SMTP_TLS_REJECT_UNAUTHORIZED=true
-SMTP_VERIFY_ON_START=true
-MAILPIT_SMTP_PORT=1025
-MAILPIT_UI_PORT=8025
diff --git a/selfhost/README.md b/selfhost/README.md
index 0ed1eec3e..b8a102cff 100644
--- a/selfhost/README.md
+++ b/selfhost/README.md
@@ -11,28 +11,103 @@ application services and platform contracts as the Cloudflare composition.
 ClickHouse OSS is an optional `analytics` profile; without it, capture still
 processes identity state in PostgreSQL and analytics reads return empty results.
 
+## Local development
+
+The stack doubles as the default development environment. The dev overlay
+publishes Postgres and the compiler to the host so tests and tooling reach the
+same services the app uses:
+
+```sh
+pnpm verify                              # everything CI checks — run before pushing
+pnpm verify:quick                        # typecheck + unit tier, for tight loops
+```
+
+`pnpm verify` is the whole contract: boundary checks, typecheck, and the three
+test tiers. Nothing else needs remembering, and CI runs the same scripts —
+Repository CI runs `verify:quick`, and the Self-host Compose workflow runs the
+two stack-backed tiers.
+
+| Tier | Command | Selects | Needs the stack |
+| --- | --- | --- | --- |
+| Unit | `pnpm test` | `*.test.ts` | no |
+| Integration | `pnpm test:integration` | `*.integration.test.ts` | yes |
+| End-to-end | `pnpm test:e2e` | `selfhost/smoke.mts` | yes |
+
+A test's tier is decided by its filename alone — no environment flag gates a
+test, so a test either runs or its tier fails loudly. `pnpm test:integration`
+starts the stack if it is down and creates `.env` from `.env.example` on a
+first checkout, so there is no separate setup step to forget. It then reads
+`.env`, derives host-side connection settings (container hostnames become
+`127.0.0.1` plus the published port), and runs the suites one after another —
+they share one Postgres and one ClickHouse, so parallel runs would race on
+schema setup. Pass suite names to narrow the run, for example
+`pnpm test:integration platform backend`.
+
+Several suites build a durable cluster of their own to exercise it — the
+platform adapters, the backend workflow and queue compositions, and the agent
+session host. A single-node cluster claims *every* shard in the database it is
+built over, so a suite sharing the running app's database would steal the
+messages addressed to it and vice versa. `pnpm test:integration` therefore
+recreates a `<database>_platform_test` database before the suites start and
+points `DATABASE_PLATFORM_NAME` and the `PLATFORM_SELFHOST_PG_*` test
+connection at it. Application tables are untouched: a suite that asserts on
+app-visible state still reads and writes the deployment's database, over a
+second connection. Recreating rather than reusing the database also guarantees
+no run inherits the undeliverable messages described under
+[renaming or removing a cron job](#renaming-or-removing-a-cron-job).
+
+`pnpm stack:up` and `pnpm stack:down` manage the stack directly when you want
+it running outside a test run. `pnpm test:e2e:release` is the heavier
+release-grade smoke described below; it is gated on releases rather than
+included in `verify`.
+
+In the production compose file PostgreSQL stays unpublished and the compiler
+is reachable only on its internal network; only the dev overlay
+(`docker-compose.dev.yml`) exposes them.
+
 ## Start
 
-For an infrastructure and Mimic evaluation with local defaults:
+The whole stack, including the dashboard and its sign-in flow, runs with no
+configuration at all:
 
 ```sh
 docker compose -f selfhost/docker-compose.yml up --build --wait
 ```
 
-For the complete dashboard and backend auth flow, create a WorkOS staging
-environment, copy `selfhost/.env.example` to `selfhost/.env`, fill in its WorkOS
-credentials, replace every example password, and run the same command with
-`--env-file selfhost/.env`. Community Edition v1 intentionally uses BYO WorkOS;
-the placeholder defaults only keep the unauthenticated API, health checks, and
-Mimic operator path available for evaluation.
-
-The no-env quick start explicitly selects `SELFHOST_MODE=local-evaluation`
-inside Compose and is safe only on loopback. `selfhost/.env.example` selects
-`SELFHOST_MODE=production`; in that mode the migration and application refuse
-to start if database, object-store, Mimic, WorkOS, or enabled ClickHouse
-credentials are missing or still use known examples. Production mode also
-requires HTTPS public, file, Mimic, and WorkOS redirect URLs. Keep production
-mode enabled for every network-accessible deployment.
+Open `http://localhost:5001` and sign in as `root` with the password
+`voidhash`.
+
+## Authentication
+
+Voidhash self-host is **single-player**: it has exactly one account, the root
+user, whose credentials come from the environment. There is no sign-up, no
+invitation, and no way to create a second user.
+
+| Variable | Purpose |
+| --- | --- |
+| `VOIDHASH_ROOT_USERNAME` | Root login name. Evaluation default `root`. |
+| `VOIDHASH_ROOT_PASSWORD` | Root password. Evaluation default `voidhash`. |
+| `VOIDHASH_ROOT_EMAIL` | Root address. Defaults to `root@voidhash.local`. |
+| `VOIDHASH_AUTH_SECRET` | Signs session tokens. |
+
+Sign-in verifies the credentials in constant time and mints a signed token,
+carried in a `vh-session` cookie and accepted as an `Authorization: Bearer`
+token by the API. The user row is created on first use. Organizations,
+projects, paywalls, the designer, API keys, and the agent all work; single-user
+means one operator, not one organization. There is no SSO, no self-service
+password reset, and no external identity service to configure — rotating the
+password is an edit to your environment and a restart.
+
+Unlike the earlier development-only provider, this one is meant for real
+deployments. What production mode refuses is running it on the *documented
+evaluation defaults*: the no-env quick start selects
+`SELFHOST_MODE=local-evaluation` inside Compose and is safe only on loopback,
+because its root password and signing secret are public knowledge.
+`.env.example` selects `SELFHOST_MODE=production`; in that mode the migration
+and application refuse to start unless the root credentials, signing secret,
+database, object-store, Mimic, and enabled ClickHouse credentials are all real,
+and they require HTTPS public, file, and Mimic URLs. Keep production mode
+enabled for every network-accessible deployment.
 
 To enable durable analytics, start the optional profile and tell the application
 to use its private-network HTTP endpoint:
@@ -42,18 +117,17 @@ CLICKHOUSE_URL=http://clickhouse:8123 docker compose -f selfhost/docker-compose.
   --profile analytics up --build --wait
 ```
 
-When using `selfhost/.env`, keep the same `CLICKHOUSE_URL` shell override and add
-`--env-file selfhost/.env`. The migration entrypoint creates the analytics schema,
+When using `.env`, keep the same `CLICKHOUSE_URL` shell override and add
+`--env-file .env`. The migration entrypoint creates the analytics schema,
 a read-write ingest user, a tenant-filtered readonly user, and a hardened query
 user. Replace all ClickHouse example passwords before exposing the deployment.
 
 The dashboard and API share `http://localhost:5001`; both `GET /health` and
 `GET /api/health` report readiness, and the OpenAPI document is available at
-`/api/docs/openapi.json`. Set the same origin plus `/api/auth/callback` as the
-WorkOS redirect URI. MinIO exposes its S3 API at `http://localhost:9000`
+`/api/docs/openapi.json`. MinIO exposes its S3 API at `http://localhost:9000`
 and its console at `http://localhost:9001`. Local email is captured by Mailpit,
 whose inbox is at `http://localhost:8025`; configure the SMTP variables in
-`selfhost/.env` to use an external delivery service. The Node runtime verifies
+`.env` to use an external delivery service. The Node runtime verifies
 the configured SMTP transport at startup in Compose. PostgreSQL stays on the
 private Compose network and is not published to the host. With the analytics
 profile enabled, ClickHouse HTTP is available at `http://localhost:8123`.
@@ -64,7 +138,7 @@ runtime stays available when it is unset.
 ### Agent models
 
 Durable designer-agent sessions use your own OpenAI or Anthropic credentials.
-Set `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` in `selfhost/.env`; OpenAI is selected
+Set `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` in `.env`; OpenAI is selected
 when both are present. The default models are `gpt-5.4` and
 `claude-sonnet-4-6`, respectively. Override text and vision routing with
 `VOIDHASH_AGENT_MODEL_PROVIDER`, `VOIDHASH_AGENT_MODEL_ID`,
@@ -72,12 +146,92 @@ when both are present. The default models are `gpt-5.4` and
 `VOIDHASH_AGENT_VISION_MODEL_ID`. An OpenAI-compatible deployment can also set
 `OPENAI_BASE_URL` while keeping the provider id `openai`.
 
+### Platform composition
+
+`@voidhash/platform-selfhost` backs every platform primitive, and there is
+nothing to select: a self-host deployment has exactly one composition.
+
+Durable execution runs on Effect Cluster over Postgres, as a single-node
+cluster: queues become persisted queues, workflows become cluster workflow
+entities, cron slots become persisted cluster singletons, and durable entities
+run on the cluster entity host. Those tables are created on first boot and need
+no extra service.
+
+Platform state lives beside application data by default, which is the shape a
+deployment wants. `DATABASE_PLATFORM_HOST`, `DATABASE_PLATFORM_PORT`,
+`DATABASE_PLATFORM_NAME`, `DATABASE_PLATFORM_USERNAME`,
+`DATABASE_PLATFORM_PASSWORD`, and `DATABASE_PLATFORM_SSL` move it elsewhere;
+each falls back to its `DATABASE_*` counterpart, so setting only the name is
+enough to put it in another database on the same server. The reason it is
+separable at all is shard ownership: a single-node cluster claims every shard in
+its database, so two processes over one database steal each other's messages.
+Nothing about a deployment needs that, but a test process running beside a live
+deployment does — see the integration tier above.
+
+The remaining primitives are plain clients against the services the stack
+already runs: the typed key-value store, the mailer, the object store, and the
+screenshot renderer.
+
+#### Durable entity sessions
+
+Collaborative documents and agent sessions attach live WebSockets to a durable
+entity. A socket is held open by one process and cannot be serialized into a
+cluster message, so entity sessions are only reachable on the runner that owns
+the entity's shard. The single-runner topology this deployment ships owns every
+shard, which makes that condition true by construction; attaching a session to a
+shard this runner does not own fails loudly rather than silently dropping the
+socket from later broadcasts. Running several runners would need a socket
+gateway that fans broadcasts out to the process holding each connection — that
+is deliberately not built.
+
+Entity alarms live in `platform_entity_alarms`, indexed by scheduled time, and
+the entry process polls it to fire due alarms.
+
+**Upgrading from an earlier self-host build:** durable entity values moved off
+the `platform_entity_kv` table onto the shared Effect persistence key-value
+store. Existing rows in `platform_entity_kv` are *not* migrated and are no
+longer read; alarms in `platform_entity_alarms` carry over unchanged. In
+practice the affected state is per-document idle-notification bookkeeping and
+agent session transcripts written by the old Postgres entity host. Drop
+`platform_entity_kv` once you no longer need it for reference.
+
+#### Renaming or removing a cron job
+
+Every scheduled job is a cluster singleton addressed by its job name, and its
+due slots are durable messages in the `cluster_messages` table. A
+message addressed to a job name that no process registers has nowhere to go, and
+it is never discarded: the storage read loop retries it forever, logging
+
+```
+Could not find entity manager for address, retrying
+```
+
+in a tight loop. That loop does not just spin — it starves the rest of the
+cluster runner, so unrelated workflows and queue consumers stall until they time
+out. It is a stale-address problem, not a load problem: the symptom appears
+after a process exits with pending slots and the next process no longer
+registers those exact names.
+
+Renaming or deleting a scheduled job therefore needs a deliberate cleanup step.
+There is no automatic reconciliation — expiring messages by address would mean
+deleting rows the cluster runtime owns from outside it. Drain the undeliverable
+messages instead:
+
+```sql
+DELETE FROM cluster_messages WHERE entity_type = 'ClusterCron/<retired-job-name>';
+```
+
+Each job is its own entity type, so `entity_type LIKE 'ClusterCron/%'` clears
+every schedule at once when you do not know which name went stale. Do it while
+no runner is live. Slots are re-armed from the persisted cron state on the next
+boot, so nothing is lost beyond the missed occurrences.
+
 ### Google Play RTDN
 
 Google Play Real-time developer notifications must use an authenticated Pub/Sub
 push subscription. Configure its push authentication service account and token
 audience, then set `GOOGLE_PUBSUB_PUSH_SERVICE_ACCOUNT_EMAIL` and
-`GOOGLE_PUBSUB_PUSH_AUDIENCE` to those exact values in `selfhost/.env`. The push
+`GOOGLE_PUBSUB_PUSH_AUDIENCE` to those exact values in `.env`. The push
 endpoint is
 `/api/v1/webhook-endpoints/google-play-rtdn/{paymentProviderConfigurationId}`.
 The backend verifies Google's signature, issuer, expiration, audience, verified
@@ -90,7 +244,7 @@ closed with a retryable response.
 From a workspace checkout with dependencies installed:
 
 ```sh
-./node_modules/.bin/tsx selfhost/smoke.mts
+pnpm test:e2e
 ```
 
 The smoke test creates a database, collection, and document through the public
@@ -115,7 +269,7 @@ docker compose -f selfhost/docker-compose.yml --profile analytics \
   up -d clickhouse --wait
 CLICKHOUSE_URL=http://clickhouse:8123 docker compose -f selfhost/docker-compose.yml \
   --profile analytics up --build --wait
-./node_modules/.bin/tsx selfhost/release-smoke.mts
+pnpm test:e2e:release
 ```
 
 It creates an isolated project and paywall in PostgreSQL, provisions and edits
diff --git a/selfhost/docker-compose.dev.yml b/selfhost/docker-compose.dev.yml
new file mode 100644
index 000000000..c082c103c
--- /dev/null
+++ b/selfhost/docker-compose.dev.yml
@@ -0,0 +1,25 @@
+# Development overlay for the self-host stack.
+#
+# The production compose keeps Postgres unpublished and the compiler on an
+# internal-only network. Local development runs tests and tooling on the host
+# against the same stack, so this overlay publishes both:
+#
+#   docker compose -f selfhost/docker-compose.yml -f selfhost/docker-compose.dev.yml \
+#     --env-file .env --profile analytics up -d --build
+#
+# Host ports come from the repo-root `.env` (see `.env.example`); every default
+# matches what
+# the integration suites assume.
+services:
+  postgres:
+    ports:
+      - "${DATABASE_HOST_PORT:-5432}:5432"
+
+  compiler:
+    # The internal-only network blocks host port publishing, so the compiler
+    # also joins the default network in development.
+    networks:
+      - compiler
+      - default
+    ports:
+      - "${COMPILER_HOST_PORT:-5002}:5002"
diff --git a/selfhost/docker-compose.yml b/selfhost/docker-compose.yml
index 8747fa682..12c34dc17 100644
--- a/selfhost/docker-compose.yml
+++ b/selfhost/docker-compose.yml
@@ -1,10 +1,10 @@
 name: voidhash-selfhost
 
-x-entry-image: &entry-image
-  image: ${VOIDHASH_SELFHOST_IMAGE:-voidhash-selfhost-entry:local}
+x-backend-image: &backend-image
+  image: ${VOIDHASH_SELFHOST_IMAGE:-voidhash-selfhost:local}
   build:
     context: ..
-    dockerfile: selfhost/entry/Dockerfile
+    dockerfile: apps/backend/Dockerfile
 
 services:
   postgres:
@@ -103,7 +103,7 @@ services:
       retries: 30
 
   migrate:
-    <<: *entry-image
+    <<: *backend-image
     command: ["./node_modules/.bin/tsx", "src/migrate.ts"]
     environment: &database-environment
       SELFHOST_MODE: ${SELFHOST_MODE:-local-evaluation}
@@ -125,6 +125,23 @@ services:
       CLICKHOUSE_ANALYTICS_QUERY_PASSWORD: ${CLICKHOUSE_ANALYTICS_QUERY_PASSWORD:-password}
       ROOT_USERNAME: ${MIMIC_ROOT_USERNAME:-root}
       ROOT_PASSWORD: ${MIMIC_ROOT_PASSWORD:-password}
+      # The single root account. Defaults are the documented evaluation
+      # credentials, which production mode refuses.
+      VOIDHASH_ROOT_USERNAME: ${VOIDHASH_ROOT_USERNAME:-root}
+      VOIDHASH_ROOT_PASSWORD: ${VOIDHASH_ROOT_PASSWORD:-voidhash}
+      VOIDHASH_ROOT_EMAIL: ${VOIDHASH_ROOT_EMAIL:-root@voidhash.local}
+      VOIDHASH_AUTH_SECRET: ${VOIDHASH_AUTH_SECRET:-}
+      # `migrate` runs the same production security validation as `app`, so the
+      # settings that validation reads have to reach it too — otherwise a
+      # correctly configured production deployment fails before its first
+      # migration.
+      MIMIC_ROOT_PASSWORD: ${MIMIC_ROOT_PASSWORD:-password}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-password}
+      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:5001}
+      PUBLIC_FILES_BASE_URL: ${PUBLIC_FILES_BASE_URL:-http://localhost:5001}
+      MIMIC_PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:5001}
+      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
+      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
     depends_on:
       postgres:
         condition: service_healthy
@@ -133,7 +150,7 @@ services:
     restart: "no"
 
   compiler:
-    <<: *entry-image
+    <<: *backend-image
     command: ["./node_modules/.bin/tsx", "src/compiler/main.ts"]
     cap_drop:
       - ALL
@@ -164,7 +181,7 @@ services:
       retries: 30
 
   app:
-    <<: *entry-image
+    <<: *backend-image
     environment:
       <<: *database-environment
       PORT: 5001
@@ -180,13 +197,6 @@ services:
       S3_FORCE_PATH_STYLE: "true"
       S3_PUBLIC_BUCKET: ${S3_PUBLIC_BUCKET:-voidhash-public}
       S3_ARTIFACT_BUCKET: ${S3_ARTIFACT_BUCKET:-voidhash-artifacts}
-      WORKOS_API_KEY: ${WORKOS_API_KEY:-sk_test_selfhost_not_configured}
-      WORKOS_AUTHKIT_DOMAIN: ${WORKOS_AUTHKIT_DOMAIN:-}
-      WORKOS_CLIENT_ID: ${WORKOS_CLIENT_ID:-client_selfhost_not_configured}
-      WORKOS_COOKIE_NAME: ${WORKOS_COOKIE_NAME:-wos-session}
-      WORKOS_COOKIE_PASSWORD: ${WORKOS_COOKIE_PASSWORD:-selfhost-development-cookie-password-change-me}
-      WORKOS_REDIRECT_URI: ${WORKOS_REDIRECT_URI:-http://localhost:5001/api/auth/callback}
-      WORKOS_WEBHOOK_SECRET: ${WORKOS_WEBHOOK_SECRET:-whsec_selfhost_not_configured}
       OPENAI_API_KEY: ${OPENAI_API_KEY:-}
       ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
       OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
diff --git a/selfhost/entry/package.json b/selfhost/entry/package.json
deleted file mode 100644
index 7b24c4e33..000000000
--- a/selfhost/entry/package.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "name": "@voidhash/selfhost-entry",
-  "version": "0.0.1-alpha.1",
-  "private": true,
-  "license": "AGPL-3.0-only",
-  "type": "module",
-  "exports": {
-    ".": "./src/index.ts",
-    "./Backend": "./src/backend/Backend.ts",
-    "./CompilerClient": "./src/compiler/CompilerClient.ts",
-    "./MimicNode": "./src/mimic/MimicNode.ts",
-    "./PgControlStore": "./src/mimic/PgControlStore.ts"
-  },
-  "scripts": {
-    "migrate": "tsx src/migrate.ts",
-    "start": "tsx src/main.ts",
-    "start:compiler": "tsx src/compiler/main.ts",
-    "start:mimic": "tsx src/mimic/main.ts",
-    "typecheck": "tsc --noEmit",
-    "test": "vp test run -c vitest.mts"
-  },
-  "dependencies": {
-    "@effect/platform-node": "catalog:",
-    "@effect/sql-pg": "catalog:",
-    "@voidhash/agent": "workspace:*",
-    "@voidhash/api-contracts": "workspace:*",
-    "@voidhash/app-store-server-sdk": "workspace:*",
-    "@voidhash/backend": "workspace:*",
-    "@voidhash/clickhouse-db": "workspace:*",
-    "@voidhash/core": "workspace:*",
-    "@voidhash/db": "workspace:*",
-    "@voidhash/mimic-core": "workspace:*",
-    "@voidhash/mimic-db": "workspace:*",
-    "@voidhash/mimic-schema": "workspace:*",
-    "@voidhash/paywall-renderer-preact": "workspace:*",
-    "@voidhash/paywall-renderer-web-core": "workspace:*",
-    "@voidhash/paywalls": "workspace:*",
-    "@orbian/sdk": "https://pkg.voidha.sh/orbian-sdk/fc444bad5db7da1302f6fa0b1a9bd7cadd800526",
-    "@orbian/node": "https://pkg.voidha.sh/orbian-node/fc444bad5db7da1302f6fa0b1a9bd7cadd800526",
-    "effect": "catalog:",
-    "esbuild": "^0.25.10",
-    "jose": "catalog:",
-    "preact": "^10.25.4",
-    "react": "catalog:",
-    "react-dom": "catalog:",
-    "srvx": "0.11.15",
-    "tsx": "^4.19.3",
-    "ws": "^8.20.0"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.12",
-    "@types/ws": "^8.18.1",
-    "@voidhash/mimic-core": "workspace:*",
-    "@voidhash/tsconfig": "workspace:*",
-    "typescript": "catalog:",
-    "vite-plus": "catalog:"
-  }
-}
diff --git a/selfhost/entry/src/backend/AuthTokenVerifier.ts b/selfhost/entry/src/backend/AuthTokenVerifier.ts
deleted file mode 100644
index 6717d5fec..000000000
--- a/selfhost/entry/src/backend/AuthTokenVerifier.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-import {
-  AuthTokenVerifier,
-  JwtAuthError,
-  JwtAuthPayloadSchema,
-  type ValidatedJwt,
-} from "@voidhash/core/services/auth/AuthTokenVerifier";
-import { Workos } from "@voidhash/core/services/auth/Workos";
-import { Effect, Layer, Schema } from "effect";
-import { createRemoteJWKSet, jwtVerify } from "jose";
-
-const decodePayload = Schema.decodeUnknownEffect(JwtAuthPayloadSchema);
-
-/** WorkOS JWT verifier using jose's process-local remote JWKS cache. */
-export const WorkosAuthTokenVerifierLive: Layer.Layer<AuthTokenVerifier, never, Workos> =
-  Layer.effect(
-    AuthTokenVerifier,
-    Effect.gen(function* () {
-      const workos = yield* Workos;
-      const jwks = createRemoteJWKSet(new URL(workos.getJwksUrl()), {
-        cooldownDuration: 30_000,
-        cacheMaxAge: 5 * 60_000,
-      });
-      return AuthTokenVerifier.of({
-        validateToken: (token) =>
-          Effect.tryPromise({
-            try: () => jwtVerify(token, jwks),
-            catch: (cause) =>
-              new JwtAuthError({
-                cause,
-                detail: cause instanceof Error ? cause.message : String(cause),
-                message: "JWT validation failed",
-              }),
-          }).pipe(
-            Effect.flatMap(({ payload }) =>
-              decodePayload(payload).pipe(
-                Effect.mapError(
-                  (cause) =>
-                    new JwtAuthError({
-                      cause,
-                      detail: String(cause),
-                      message: "JWT claims are invalid",
-                    }),
-                ),
-              ),
-            ),
-            Effect.map(
-              (payload): ValidatedJwt => ({
-                payload,
-                provider: "workos",
-              }),
-            ),
-          ),
-      });
-    }),
-  );
diff --git a/selfhost/entry/src/backend/Background.ts b/selfhost/entry/src/backend/Background.ts
deleted file mode 100644
index 5a6046b77..000000000
--- a/selfhost/entry/src/backend/Background.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-import { ClickhouseWebClient } from "@voidhash/clickhouse-db/clickhouse-client-web";
-import { AnalyticsDispatchService } from "@voidhash/core/services/analyticsIngest/AnalyticsDispatchService";
-import { AnalyticsJanitorService } from "@voidhash/core/services/analyticsIngest/AnalyticsJanitorService";
-import { FxRateService } from "@voidhash/core/services/fxRates/FxRateService";
-import { APP_STORE_PARKED_SDK_TTL_DAYS } from "@voidhash/core/services/paymentProviders/appStore/payment-provider";
-import { AppStorePaymentProviderServiceQueries } from "@voidhash/core/services/paymentProviders/appStore/payment-provider-service-queries";
-import { PurchaseLedgerWorkerService } from "@voidhash/core/services/purchaseProcessing/PurchaseLedgerWorkerService";
-import { Db } from "@voidhash/db";
-import {
-  type CronJob,
-  CronScheduler,
-} from "@orbian/sdk/CronScheduler";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
-import { PgCronSchedulerLive } from "@orbian/node/CronScheduler";
-import { Context, Effect, Layer, Redacted } from "effect";
-
-import type { SelfhostRuntimeConfig } from "../config.ts";
-
-const dayMillis = 24 * 60 * 60 * 1000;
-
-const postgresConfig = (config: SelfhostRuntimeConfig) => ({
-  database: config.database.databaseName,
-  host: config.database.host,
-  password: Redacted.make(config.database.password),
-  port: config.database.port,
-  ...(config.database.ssl === undefined ? {} : { ssl: config.database.ssl }),
-  username: config.database.username,
-});
-
-/** Builds the persisted jobs enabled by the current self-host configuration. */
-export const makeSelfhostCronJobs = (
-  config: SelfhostRuntimeConfig,
-  clickhouse?: Layer.Layer<ClickhouseWebClient.ClickhouseWebClient>,
-) =>
-  Effect.gen(function* () {
-    const dispatch = yield* AnalyticsDispatchService;
-    const database = Db.layer(config.database);
-    const purchaseContext = yield* Layer.build(
-      PurchaseLedgerWorkerService.layer.pipe(
-        Layer.provide(Layer.succeed(AnalyticsDispatchService, dispatch)),
-        Layer.provide(database),
-      ),
-    );
-    const purchaseWorker = Context.get(purchaseContext, PurchaseLedgerWorkerService);
-    const appStoreContext = yield* Layer.build(
-      AppStorePaymentProviderServiceQueries.layer.pipe(Layer.provide(database)),
-    );
-    const appStoreQueries = Context.get(
-      appStoreContext,
-      AppStorePaymentProviderServiceQueries,
-    );
-    const jobs: Array<CronJob<PlatformRuntime | Db>> = [
-      {
-        expression: "* * * * *",
-        name: "purchase-ledger-drain",
-        run: () =>
-          purchaseWorker
-            .poll({ batchSize: 100, maxAttempts: 8, staleClaimSeconds: 5 * 60 })
-            .pipe(Effect.asVoid),
-      },
-      {
-        expression: "0 4 * * *",
-        name: "app-store-expire-parked-notifications",
-        run: ({ scheduledTime }) =>
-          appStoreQueries
-            .expireStaleParkedSdkConfirmationRows({
-              olderThan: new Date(
-                scheduledTime.getTime() - APP_STORE_PARKED_SDK_TTL_DAYS * dayMillis,
-              ),
-            })
-            .pipe(Effect.asVoid),
-      },
-    ];
-
-    const exchangeRateApiKey = process.env.EXCHANGE_RATE_API_KEY?.trim();
-    if (exchangeRateApiKey) {
-      const fxContext = yield* Layer.build(
-        FxRateService.layer({
-          apiKey: Effect.succeed(exchangeRateApiKey),
-          baseUrl: Effect.succeed(
-            process.env.EXCHANGE_RATE_API_BASE_URL?.trim() ||
-              "https://v6.exchangerate-api.com/v6",
-          ),
-        }).pipe(Layer.provide(database)),
-      );
-      const fxRates = Context.get(fxContext, FxRateService);
-      jobs.push({
-        expression: "0 5 * * *",
-        name: "fx-rate-sync",
-        run: () => fxRates.refreshLatest().pipe(Effect.asVoid),
-      });
-    }
-
-    if (clickhouse) {
-      const janitorContext = yield* Layer.build(
-        AnalyticsJanitorService.layer.pipe(Layer.provide(clickhouse)),
-      );
-      const janitor = Context.get(janitorContext, AnalyticsJanitorService);
-      jobs.push({
-        expression: "*/5 * * * *",
-        name: "analytics-janitor",
-        run: () =>
-          janitor.squash({ batchSize: 1000, safetyWindowSeconds: 120 }).pipe(Effect.asVoid),
-      });
-    }
-
-    return jobs;
-  });
-
-/** Runs every enabled persisted cron job until the enclosing scope closes. */
-export const runSelfhostCronJobs = (
-  config: SelfhostRuntimeConfig,
-  clickhouse?: Layer.Layer<ClickhouseWebClient.ClickhouseWebClient>,
-) =>
-  Effect.gen(function* () {
-    const schedulerContext = yield* Layer.build(PgCronSchedulerLive(postgresConfig(config)));
-    const scheduler = Context.get(schedulerContext, CronScheduler);
-    const jobs = yield* makeSelfhostCronJobs(config, clickhouse);
-    return yield* Effect.all(
-      jobs.map((job) => scheduler.run(job, { pollIntervalMillis: 1_000 })),
-      { concurrency: "unbounded" },
-    );
-  });
diff --git a/selfhost/entry/src/backend/IdentityCompletionWorkflow.ts b/selfhost/entry/src/backend/IdentityCompletionWorkflow.ts
deleted file mode 100644
index 0fdf72798..000000000
--- a/selfhost/entry/src/backend/IdentityCompletionWorkflow.ts
+++ /dev/null
@@ -1,195 +0,0 @@
-import {
-  Db,
-  PersonIdentityKind,
-  PersonIdentityMigrationJobStatus,
-  eq,
-  personIdentityMigrationJobs,
-  sql,
-} from "@voidhash/db";
-import {
-  type PersonIdentityEventV1,
-  type PersonSnapshotEventV1,
-  nextMappingVersion,
-} from "@voidhash/core/domain/person/Person";
-import { IdentityMutationService } from "@voidhash/core/services/personIdentity/IdentityMutationService";
-import { generateId } from "@voidhash/core/utils/generate-id";
-import { WorkflowRunner } from "@orbian/sdk/Workflow";
-import { Effect, Layer, Schema } from "effect";
-
-import { IdentifyDistinctIdCompletionDefinition } from "./WorkflowDefinitions.ts";
-
-/** Registers the Postgres-backed source-identity completion workflow. */
-export const registerIdentityCompletionWorkflow = (
-  runner: WorkflowRunner["Service"],
-  database: Layer.Layer<Db>,
-) =>
-  runner.register(
-    IdentifyDistinctIdCompletionDefinition,
-    (input, context) =>
-      Effect.gen(function* () {
-        const jobId = input.jobId;
-        const recordFailure = (message: string) =>
-          Effect.gen(function* () {
-            const db = yield* Db;
-            yield* db
-              .update(personIdentityMigrationJobs)
-              .set({
-                lastError: message,
-                status: PersonIdentityMigrationJobStatus.Failed,
-              })
-              .where(eq(personIdentityMigrationJobs.id, jobId));
-          }).pipe(
-            Effect.provide(database),
-            Effect.catchCause((cause) =>
-              Effect.logError("Failed to record identity completion failure", {
-                cause,
-                jobId,
-              }),
-            ),
-          );
-
-        yield* context.step({
-          name: `mark-in-progress-${jobId}`,
-          success: Schema.Void,
-          execute: Effect.gen(function* () {
-            const db = yield* Db;
-            yield* db
-              .update(personIdentityMigrationJobs)
-              .set({
-                attemptCount: sql`${personIdentityMigrationJobs.attemptCount} + 1`,
-                lastError: null,
-                status: PersonIdentityMigrationJobStatus.InProgress,
-              })
-              .where(eq(personIdentityMigrationJobs.id, jobId));
-          }).pipe(Effect.provide(database)),
-        });
-
-        yield* context.step({
-          name: `migrate-${jobId}`,
-          success: Schema.Void,
-          execute: Effect.gen(function* () {
-            const db = yield* Db;
-            const identityMutations = yield* IdentityMutationService;
-            yield* db.transaction((tx) =>
-              Effect.gen(function* () {
-                const eventTimestamp = new Date(input.eventTimestamp);
-                const personEvents: PersonSnapshotEventV1[] = [];
-                const mappingEvents: PersonIdentityEventV1[] = [];
-
-                yield* identityMutations.lockDistinctIdRows(tx, {
-                  distinctIds: [input.previousDistinctId, input.distinctId],
-                  projectId: input.projectId,
-                });
-
-                const targetPerson = yield* tx.query.persons.findFirst({
-                  where: { id: input.targetPersonId },
-                });
-                if (!targetPerson) {
-                  return yield* Effect.die(
-                    new Error(`Target person ${input.targetPersonId} does not exist`),
-                  );
-                }
-
-                const sourceMapping = yield* identityMutations.findDistinctIdMapping(tx, {
-                  distinctId: input.previousDistinctId,
-                  projectId: input.projectId,
-                });
-                const sourcePersonless = yield* identityMutations.findPersonlessIdentity(tx, {
-                  distinctId: input.previousDistinctId,
-                  projectId: input.projectId,
-                });
-
-                yield* identityMutations.lockPersonRows(tx, {
-                  personIds: [
-                    input.targetPersonId,
-                    ...(sourceMapping ? [sourceMapping.rawPerson.id] : []),
-                  ],
-                });
-
-                const sourceIsConflictingIdentified =
-                  sourceMapping &&
-                  sourceMapping.canonicalPerson.id !== input.targetPersonId &&
-                  sourceMapping.mapping.kind === PersonIdentityKind.Identified;
-
-                if (!sourceIsConflictingIdentified) {
-                  const hadHistoricalEvents = Boolean(
-                    (sourceMapping && sourceMapping.rawPerson.id !== input.targetPersonId) ||
-                    (sourcePersonless && !sourcePersonless.isMerged),
-                  );
-                  const mappingVersion = nextMappingVersion({
-                    existingVersion: sourceMapping?.mapping.version,
-                    hadHistoricalEvents,
-                  });
-
-                  if (
-                    sourceMapping &&
-                    sourceMapping.mapping.personId !== input.targetPersonId &&
-                    sourceMapping.mapping.kind === PersonIdentityKind.Anonymous
-                  ) {
-                    const archivedSource = yield* identityMutations.archivePerson(tx, {
-                      eventTimestamp,
-                      mergedIntoPersonId: input.targetPersonId,
-                      person: sourceMapping.rawPerson,
-                    });
-                    personEvents.push(
-                      yield* identityMutations.toPersonEvent(tx, { person: archivedSource }),
-                    );
-                  }
-
-                  if (
-                    !sourceMapping ||
-                    sourceMapping.mapping.personId !== input.targetPersonId ||
-                    sourceMapping.mapping.version !== mappingVersion
-                  ) {
-                    mappingEvents.push(
-                      yield* identityMutations.upsertPersonIdentity(tx, {
-                        changedAt: eventTimestamp,
-                        distinctId: input.previousDistinctId,
-                        identityId: sourceMapping?.mapping.id ?? generateId("personDistinctId"),
-                        personId: input.targetPersonId,
-                        projectId: input.projectId,
-                        version: mappingVersion,
-                      }),
-                    );
-                  }
-
-                  if (sourcePersonless && !sourcePersonless.isMerged) {
-                    yield* identityMutations.markPersonlessIdentityMerged(tx, {
-                      distinctId: input.previousDistinctId,
-                      projectId: input.projectId,
-                    });
-                  }
-                }
-
-                yield* tx
-                  .update(personIdentityMigrationJobs)
-                  .set({ mappingEvents, personEvents })
-                  .where(eq(personIdentityMigrationJobs.id, jobId));
-              }),
-            );
-          }).pipe(
-            Effect.provide(IdentityMutationService.layer),
-            Effect.provide(database),
-            Effect.tapCause((cause) =>
-              recordFailure(`Failed to migrate source identity: ${String(cause)}`),
-            ),
-          ),
-        });
-
-        yield* context.step({
-          name: `mark-succeeded-${jobId}`,
-          success: Schema.Void,
-          execute: Effect.gen(function* () {
-            const db = yield* Db;
-            yield* db
-              .update(personIdentityMigrationJobs)
-              .set({
-                completedAt: new Date(),
-                lastError: null,
-                status: PersonIdentityMigrationJobStatus.Succeeded,
-              })
-              .where(eq(personIdentityMigrationJobs.id, jobId));
-          }).pipe(Effect.provide(database)),
-        });
-      }),
-  );
diff --git a/selfhost/entry/src/backend/PaymentProviderWorkflows.ts b/selfhost/entry/src/backend/PaymentProviderWorkflows.ts
deleted file mode 100644
index a52dd4a72..000000000
--- a/selfhost/entry/src/backend/PaymentProviderWorkflows.ts
+++ /dev/null
@@ -1,117 +0,0 @@
-import { AppStoreWebhookHandlerService } from "@voidhash/core/services/paymentProviders/appStore/app-store-webhook-handler-service";
-import { AppStoreReconciliationService } from "@voidhash/core/services/paymentProviders/appStore/app-store-reconciliation-service";
-import { GooglePlayWebhookHandlerService } from "@voidhash/core/services/paymentProviders/googlePlay/webhook-handler-service";
-import { StripeWebhookHandlerService } from "@voidhash/core/services/paymentProviders/stripe/stripe-webhook-handler-service";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
-import { Db } from "@voidhash/db";
-import { WorkflowRunner } from "@orbian/sdk/Workflow";
-import { Effect, Layer, Schema } from "effect";
-
-import {
-  makeAppStoreReconciliationLive,
-  makeAppStoreReplayHandlerLive,
-  makeGooglePlayReplayHandlerLive,
-  makeStripeReplayHandlerLive,
-} from "./PaymentWorkflowLayers.ts";
-import {
-  AppStoreReconcileOriginalTransactionDefinition,
-  AppStoreReplayParkedNotificationsDefinition,
-  AppStoreReplayParkedSdkNotificationsDefinition,
-  GooglePlayReplayParkedNotificationsDefinition,
-  StripeReplayParkedNotificationsDefinition,
-} from "./WorkflowDefinitions.ts";
-
-/** Registers the durable self-host payment-provider replay and reconciliation jobs. */
-export const registerPaymentProviderWorkflows = (
-  runner: WorkflowRunner["Service"],
-  database: Layer.Layer<Db>,
-  completion: IdentifyDistinctIdCompletionWorkflow["Service"],
-) => {
-  const appStoreReplay = makeAppStoreReplayHandlerLive(database);
-  const appStoreReconciliation = makeAppStoreReconciliationLive(database);
-  const googlePlayReplay = makeGooglePlayReplayHandlerLive(database);
-  const stripeReplay = makeStripeReplayHandlerLive(database);
-  const provideCompletion = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-    effect.pipe(
-      Effect.provideService(IdentifyDistinctIdCompletionWorkflow, completion),
-    );
-
-  return Effect.all(
-    [
-      runner.register(
-        AppStoreReplayParkedNotificationsDefinition,
-        (input, context) =>
-          context.step({
-            name: `app-store-replay:${input.paymentProviderConfigurationId}:${input.providerProductKey}`,
-            success: Schema.Void,
-            execute: provideCompletion(
-              Effect.gen(function* () {
-                const handler = yield* AppStoreWebhookHandlerService;
-                yield* handler.replayParkedNotificationsForProductMapping(input);
-              }).pipe(Effect.provide(appStoreReplay)),
-            ),
-          }),
-      ),
-      runner.register(
-        AppStoreReplayParkedSdkNotificationsDefinition,
-        (input, context) =>
-          context.step({
-            name: `app-store-replay-sdk:${input.paymentProviderConfigurationId}:${input.originalTransactionId}`,
-            success: Schema.Void,
-            execute: provideCompletion(
-              Effect.gen(function* () {
-                const handler = yield* AppStoreWebhookHandlerService;
-                yield* handler.replayParkedNotificationsForSdkConfirmation(input);
-              }).pipe(Effect.provide(appStoreReplay)),
-            ),
-          }),
-      ),
-      runner.register(
-        AppStoreReconcileOriginalTransactionDefinition,
-        (input, context) =>
-          context.step({
-            name: `app-store-reconcile:${input.paymentProviderConfigurationId}:${input.originalTransactionId}:${input.reason}`,
-            success: Schema.Void,
-            execute: provideCompletion(
-              Effect.gen(function* () {
-                const reconciliation = yield* AppStoreReconciliationService;
-                yield* reconciliation.reconcileOriginalTransaction({
-                  ...input,
-                  triggeredAt: new Date(input.triggeredAt),
-                });
-              }).pipe(Effect.provide(appStoreReconciliation)),
-            ),
-          }),
-      ),
-      runner.register(
-        GooglePlayReplayParkedNotificationsDefinition,
-        (input, context) =>
-          context.step({
-            name: `google-play-replay:${input.paymentProviderConfigurationId}:${input.providerProductKey}`,
-            success: Schema.Void,
-            execute: provideCompletion(
-              Effect.gen(function* () {
-                const handler = yield* GooglePlayWebhookHandlerService;
-                yield* handler.replayParkedNotificationsForProductMapping(input);
-              }).pipe(Effect.provide(googlePlayReplay)),
-            ),
-          }),
-      ),
-      runner.register(
-        StripeReplayParkedNotificationsDefinition,
-        (input, context) =>
-          context.step({
-            name: `stripe-replay:${input.paymentProviderConfigurationId}:${input.providerProductKey}`,
-            success: Schema.Void,
-            execute: provideCompletion(
-              Effect.gen(function* () {
-                const handler = yield* StripeWebhookHandlerService;
-                yield* handler.replayParkedNotificationsForProductMapping(input);
-              }).pipe(Effect.provide(stripeReplay)),
-            ),
-          }),
-      ),
-    ],
-    { concurrency: "unbounded", discard: true },
-  );
-};
diff --git a/selfhost/entry/src/backend/PaymentWorkflowLayers.ts b/selfhost/entry/src/backend/PaymentWorkflowLayers.ts
deleted file mode 100644
index 06ccab2b2..000000000
--- a/selfhost/entry/src/backend/PaymentWorkflowLayers.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-import { AppStoreServerSdk } from "@voidhash/app-store-server-sdk";
-import {
-  IdentityProjectionPublisher,
-  PerkGrantService,
-  PersonIdentityService,
-  PurchaseProcessingService,
-} from "@voidhash/core/services";
-import { FxRateService } from "@voidhash/core/services/fxRates/FxRateService";
-import { AppStoreWebhookHandlerService } from "@voidhash/core/services/paymentProviders/appStore/app-store-webhook-handler-service";
-import { AppStorePaymentProvider } from "@voidhash/core/services/paymentProviders/appStore/payment-provider";
-import { AppStoreReconciliationService } from "@voidhash/core/services/paymentProviders/appStore/app-store-reconciliation-service";
-import { GooglePlayWebhookHandlerService } from "@voidhash/core/services/paymentProviders/googlePlay/webhook-handler-service";
-import { GooglePlayServerApi } from "@voidhash/core/services/paymentProviders/googlePlay/sdk-context";
-import { StripeWebhookHandlerService } from "@voidhash/core/services/paymentProviders/stripe/stripe-webhook-handler-service";
-import { PaymentConfigSecretCrypto } from "@voidhash/core/utils/crypto/PaymentConfigSecretCrypto";
-import { Db } from "@voidhash/db";
-import { Effect, Layer } from "effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-
-const fxRates = FxRateService.layer({
-  apiKey: Effect.sync(() => process.env.EXCHANGE_RATE_API_KEY ?? ""),
-  baseUrl: Effect.sync(
-    () => process.env.EXCHANGE_RATE_API_BASE_URL ?? "https://v6.exchangerate-api.com/v6",
-  ),
-});
-
-const purchaseProcessing = PurchaseProcessingService.layer.pipe(
-  Layer.provide(PerkGrantService.layer),
-);
-
-const personIdentity = PersonIdentityService.layer.pipe(
-  Layer.provide(IdentityProjectionPublisher.noop),
-);
-
-const paymentCrypto = PaymentConfigSecretCrypto.layer({
-  key: Effect.sync(() => process.env.ENCRYPTION_KEY ?? ""),
-});
-
-const appStoreRuntime = Layer.mergeAll(
-  AppStoreServerSdk.layer.pipe(Layer.provide(FetchHttpClient.layer)),
-  fxRates,
-  purchaseProcessing,
-  personIdentity,
-  paymentCrypto,
-);
-
-const googlePlayRuntime = Layer.mergeAll(
-  GooglePlayServerApi.layer.pipe(Layer.provide(FetchHttpClient.layer)),
-  fxRates,
-  purchaseProcessing,
-  personIdentity,
-  paymentCrypto,
-);
-
-const stripeRuntime = Layer.mergeAll(
-  FetchHttpClient.layer,
-  fxRates,
-  purchaseProcessing,
-  personIdentity,
-  paymentCrypto,
-);
-
-/** Builds the App Store parked-notification handler for a self-host database. */
-export const makeAppStoreReplayHandlerLive = (database: Layer.Layer<Db>) =>
-  AppStoreWebhookHandlerService.layer.pipe(
-    Layer.provide(appStoreRuntime),
-    Layer.provide(database),
-  );
-
-/** Builds the App Store reconciliation handler for a self-host database. */
-export const makeAppStoreReconciliationLive = (database: Layer.Layer<Db>) =>
-  AppStoreReconciliationService.layer.pipe(
-    Layer.provide(AppStorePaymentProvider.layer),
-    Layer.provide(appStoreRuntime),
-    Layer.provide(database),
-  );
-
-/** Builds the Google Play parked-notification handler for a self-host database. */
-export const makeGooglePlayReplayHandlerLive = (database: Layer.Layer<Db>) =>
-  GooglePlayWebhookHandlerService.layer.pipe(
-    Layer.provide(googlePlayRuntime),
-    Layer.provide(database),
-  );
-
-/** Builds the Stripe parked-notification handler for a self-host database. */
-export const makeStripeReplayHandlerLive = (database: Layer.Layer<Db>) =>
-  StripeWebhookHandlerService.layer.pipe(
-    Layer.provide(stripeRuntime),
-    Layer.provide(database),
-  );
diff --git a/selfhost/entry/src/backend/WebhookDeliveryWorkflow.ts b/selfhost/entry/src/backend/WebhookDeliveryWorkflow.ts
deleted file mode 100644
index acc041932..000000000
--- a/selfhost/entry/src/backend/WebhookDeliveryWorkflow.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-import {
-  WebhookDeliveryService,
-  nextWebhookDeliveryRetryTime,
-} from "@voidhash/core/services/webhookDispatch/WebhookDeliveryService";
-import { Db } from "@voidhash/db";
-import { WorkflowRunner } from "@orbian/sdk/Workflow";
-import { Effect, Layer, Schema } from "effect";
-
-import { DeliverWebhookDefinition } from "./WorkflowDefinitions.ts";
-
-const SendWebhookResultSchema = Schema.Struct({
-  durationMs: Schema.Number,
-  errorMessage: Schema.NullOr(Schema.String),
-  responseBody: Schema.NullOr(Schema.String),
-  statusCode: Schema.NullOr(Schema.Number),
-  succeeded: Schema.Boolean,
-});
-
-/** Registers durable webhook delivery with persisted retries and attempt state. */
-export const registerWebhookDeliveryWorkflow = (
-  runner: WorkflowRunner["Service"],
-  database: Layer.Layer<Db>,
-) =>
-  runner.register(
-    DeliverWebhookDefinition,
-    (input, context) =>
-      Effect.gen(function* () {
-        let attemptNumber = input.attemptNumber;
-
-        while (true) {
-          const attempt = { ...input, attemptNumber };
-          const result = yield* context.step({
-            name: `send-${input.deliveryId}-${attemptNumber}`,
-            success: SendWebhookResultSchema,
-            execute: Effect.gen(function* () {
-              const delivery = yield* WebhookDeliveryService;
-              return yield* delivery.send(attempt);
-            }).pipe(Effect.provide(WebhookDeliveryService.layer), Effect.provide(database)),
-          });
-
-          yield* context.step({
-            name: `record-attempt-${input.deliveryId}-${attemptNumber}`,
-            success: Schema.Void,
-            execute: Effect.gen(function* () {
-              const delivery = yield* WebhookDeliveryService;
-              yield* delivery.recordAttempt(attempt, result);
-            }).pipe(Effect.provide(WebhookDeliveryService.layer), Effect.provide(database)),
-          });
-
-          if (result.succeeded) {
-            yield* context.step({
-              name: `mark-succeeded-${input.deliveryId}-${attemptNumber}`,
-              success: Schema.Void,
-              execute: Effect.gen(function* () {
-                const delivery = yield* WebhookDeliveryService;
-                yield* delivery.markSucceeded(attempt);
-              }).pipe(Effect.provide(WebhookDeliveryService.layer), Effect.provide(database)),
-            });
-            return;
-          }
-
-          const nextAttemptNumber = attemptNumber + 1;
-          const retryTime = nextWebhookDeliveryRetryTime(nextAttemptNumber);
-
-          if (!retryTime) {
-            yield* context.step({
-              name: `mark-exhausted-${input.deliveryId}-${attemptNumber}`,
-              success: Schema.Void,
-              execute: Effect.gen(function* () {
-                const delivery = yield* WebhookDeliveryService;
-                yield* delivery.markExhausted(attempt);
-              }).pipe(Effect.provide(WebhookDeliveryService.layer), Effect.provide(database)),
-            });
-            return;
-          }
-
-          yield* context.step({
-            name: `mark-failed-${input.deliveryId}-${attemptNumber}`,
-            success: Schema.Void,
-            execute: Effect.gen(function* () {
-              const delivery = yield* WebhookDeliveryService;
-              yield* delivery.markFailed(attempt, retryTime);
-            }).pipe(Effect.provide(WebhookDeliveryService.layer), Effect.provide(database)),
-          });
-          yield* context.sleepUntil(
-            `retry-${input.deliveryId}-${nextAttemptNumber}`,
-            retryTime,
-          );
-          attemptNumber = nextAttemptNumber;
-        }
-      }),
-  );
diff --git a/selfhost/entry/src/backend/WorkflowDefinitions.ts b/selfhost/entry/src/backend/WorkflowDefinitions.ts
deleted file mode 100644
index 5109b0145..000000000
--- a/selfhost/entry/src/backend/WorkflowDefinitions.ts
+++ /dev/null
@@ -1,90 +0,0 @@
-import { defineWorkflow } from "@orbian/sdk/Workflow";
-import { Schema } from "effect";
-
-export const DeliverWebhookDefinition = defineWorkflow({
-  name: "selfhost-deliver-webhook",
-  payload: {
-    attemptNumber: Schema.Number,
-    deliveryId: Schema.String,
-    endpointId: Schema.String,
-    eventType: Schema.String,
-    payload: Schema.Unknown,
-    secret: Schema.String,
-    url: Schema.String,
-  },
-  success: Schema.Void,
-  idempotencyKey: ({ deliveryId }) => deliveryId,
-});
-
-export const IdentifyDistinctIdCompletionDefinition = defineWorkflow({
-  name: "selfhost-identify-distinct-id-completion",
-  payload: {
-    distinctId: Schema.String,
-    eventTimestamp: Schema.String,
-    jobId: Schema.String,
-    origin: Schema.Literals([1, 2, 3, 4, 5, 6, 7]),
-    previousDistinctId: Schema.String,
-    projectId: Schema.String,
-    requestedAt: Schema.String,
-    targetPersonId: Schema.String,
-  },
-  success: Schema.Void,
-  idempotencyKey: ({ jobId }) => jobId,
-});
-
-const replayPayload = {
-  paymentProviderConfigurationId: Schema.String,
-  paymentProviderProductId: Schema.String,
-  providerProductKey: Schema.String,
-};
-
-export const AppStoreReplayParkedNotificationsDefinition = defineWorkflow({
-  name: "selfhost-app-store-replay-parked-notifications",
-  payload: replayPayload,
-  success: Schema.Void,
-  idempotencyKey: ({ paymentProviderConfigurationId, paymentProviderProductId }) =>
-    `${paymentProviderConfigurationId}:${paymentProviderProductId}`,
-});
-
-export const AppStoreReplayParkedSdkNotificationsDefinition = defineWorkflow({
-  name: "selfhost-app-store-replay-parked-sdk-notifications",
-  payload: {
-    originalTransactionId: Schema.String,
-    paymentProviderConfigurationId: Schema.String,
-  },
-  success: Schema.Void,
-  idempotencyKey: ({ originalTransactionId, paymentProviderConfigurationId }) =>
-    `${paymentProviderConfigurationId}:${originalTransactionId}`,
-});
-
-export const AppStoreReconcileOriginalTransactionDefinition = defineWorkflow({
-  name: "selfhost-app-store-reconcile-original-transaction",
-  payload: {
-    originalTransactionId: Schema.String,
-    paymentProviderConfigurationId: Schema.String,
-    reason: Schema.Literals(["first_seen", "admin_repair", "install_backfill"]),
-    triggeredAt: Schema.String,
-  },
-  success: Schema.Void,
-  idempotencyKey: ({
-    originalTransactionId,
-    paymentProviderConfigurationId,
-    triggeredAt,
-  }) => `${paymentProviderConfigurationId}:${originalTransactionId}:${triggeredAt}`,
-});
-
-export const GooglePlayReplayParkedNotificationsDefinition = defineWorkflow({
-  name: "selfhost-google-play-replay-parked-notifications",
-  payload: replayPayload,
-  success: Schema.Void,
-  idempotencyKey: ({ paymentProviderConfigurationId, paymentProviderProductId }) =>
-    `${paymentProviderConfigurationId}:${paymentProviderProductId}`,
-});
-
-export const StripeReplayParkedNotificationsDefinition = defineWorkflow({
-  name: "selfhost-stripe-replay-parked-notifications",
-  payload: replayPayload,
-  success: Schema.Void,
-  idempotencyKey: ({ paymentProviderConfigurationId, paymentProviderProductId }) =>
-    `${paymentProviderConfigurationId}:${paymentProviderProductId}`,
-});
diff --git a/selfhost/entry/src/backend/WorkflowPorts.ts b/selfhost/entry/src/backend/WorkflowPorts.ts
deleted file mode 100644
index fbb850d83..000000000
--- a/selfhost/entry/src/backend/WorkflowPorts.ts
+++ /dev/null
@@ -1,197 +0,0 @@
-import { AppStoreReconcileOriginalTransactionWorkflow } from "@voidhash/core/services/paymentProviders/AppStoreReconcileOriginalTransactionWorkflow";
-import { AppStoreReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/AppStoreReplayParkedNotificationsWorkflow";
-import { AppStoreReplayParkedSdkNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/AppStoreReplayParkedSdkNotificationsWorkflow";
-import { GooglePlayReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/GooglePlayReplayParkedNotificationsWorkflow";
-import { StripeReplayParkedNotificationsWorkflow } from "@voidhash/core/services/paymentProviders/StripeReplayParkedNotificationsWorkflow";
-import { IdentifyDistinctIdCompletionWorkflow } from "@voidhash/core/services/personIdentity/IdentifyDistinctIdCompletionWorkflow";
-import { WebhookDeliveryWorkflow } from "@voidhash/core/services/webhookDispatch/WebhookDeliveryWorkflow";
-import { Db } from "@voidhash/db";
-import { PlatformRuntime } from "@orbian/sdk/PlatformRuntime";
-import { WorkflowRunner } from "@orbian/sdk/Workflow";
-import { NodePlatformRuntimeLive } from "@orbian/node/PlatformRuntime";
-import { PgWorkflowRunnerLive } from "@orbian/node/Workflow";
-import { Effect, Layer, Redacted } from "effect";
-
-import type { SelfhostRuntimeConfig } from "../config.ts";
-import { registerIdentityCompletionWorkflow } from "./IdentityCompletionWorkflow.ts";
-import { registerPaymentProviderWorkflows } from "./PaymentProviderWorkflows.ts";
-import { registerWebhookDeliveryWorkflow } from "./WebhookDeliveryWorkflow.ts";
-import {
-  AppStoreReconcileOriginalTransactionDefinition,
-  AppStoreReplayParkedNotificationsDefinition,
-  AppStoreReplayParkedSdkNotificationsDefinition,
-  DeliverWebhookDefinition,
-  GooglePlayReplayParkedNotificationsDefinition,
-  IdentifyDistinctIdCompletionDefinition,
-  StripeReplayParkedNotificationsDefinition,
-} from "./WorkflowDefinitions.ts";
-
-const logDispatchFailure = (workflowName: string) => (cause: unknown) =>
-  Effect.logError("Failed to dispatch self-host workflow", { cause, workflowName });
-
-const makeWorkflowPortsLive = Layer.mergeAll(
-  Layer.effect(
-    WebhookDeliveryWorkflow,
-    Effect.gen(function* () {
-      const runner = yield* WorkflowRunner;
-      const runtime = yield* PlatformRuntime;
-      return {
-        dispatch: (input: Parameters<WebhookDeliveryWorkflow["Service"]["dispatch"]>[0]) =>
-          runner.dispatch(DeliverWebhookDefinition, input).pipe(
-            Effect.provideService(PlatformRuntime, runtime),
-            Effect.tapError(logDispatchFailure(DeliverWebhookDefinition.name)),
-            Effect.orDie,
-            Effect.asVoid,
-          ),
-      };
-    }),
-  ),
-  Layer.effect(
-    IdentifyDistinctIdCompletionWorkflow,
-    Effect.gen(function* () {
-      const runner = yield* WorkflowRunner;
-      const runtime = yield* PlatformRuntime;
-      return {
-        dispatch: (
-          input: Parameters<IdentifyDistinctIdCompletionWorkflow["Service"]["dispatch"]>[0],
-        ) =>
-          runner.dispatch(IdentifyDistinctIdCompletionDefinition, input).pipe(
-            Effect.provideService(PlatformRuntime, runtime),
-            Effect.tapError(logDispatchFailure(IdentifyDistinctIdCompletionDefinition.name)),
-            Effect.orDie,
-            Effect.asVoid,
-          ),
-      };
-    }),
-  ),
-  Layer.effect(
-    AppStoreReplayParkedNotificationsWorkflow,
-    Effect.gen(function* () {
-      const runner = yield* WorkflowRunner;
-      const runtime = yield* PlatformRuntime;
-      return {
-        dispatch: (
-          input: Parameters<AppStoreReplayParkedNotificationsWorkflow["Service"]["dispatch"]>[0],
-        ) =>
-          runner.dispatch(AppStoreReplayParkedNotificationsDefinition, input).pipe(
-            Effect.provideService(PlatformRuntime, runtime),
-            Effect.tapError(
-              logDispatchFailure(AppStoreReplayParkedNotificationsDefinition.name),
-            ),
-            Effect.orDie,
-            Effect.asVoid,
-          ),
-      };
-    }),
-  ),
-  Layer.effect(
-    AppStoreReplayParkedSdkNotificationsWorkflow,
-    Effect.gen(function* () {
-      const runner = yield* WorkflowRunner;
-      const runtime = yield* PlatformRuntime;
-      return {
-        dispatch: (
-          input: Parameters<
-            AppStoreReplayParkedSdkNotificationsWorkflow["Service"]["dispatch"]
-          >[0],
-        ) =>
-          runner.dispatch(AppStoreReplayParkedSdkNotificationsDefinition, input).pipe(
-            Effect.provideService(PlatformRuntime, runtime),
-            Effect.tapError(
-              logDispatchFailure(AppStoreReplayParkedSdkNotificationsDefinition.name),
-            ),
-            Effect.orDie,
-            Effect.asVoid,
-          ),
-      };
-    }),
-  ),
-  Layer.effect(
-    AppStoreReconcileOriginalTransactionWorkflow,
-    Effect.gen(function* () {
-      const runner = yield* WorkflowRunner;
-      const runtime = yield* PlatformRuntime;
-      return {
-        dispatch: (
-          input: Parameters<
-            AppStoreReconcileOriginalTransactionWorkflow["Service"]["dispatch"]
-          >[0],
-        ) =>
-          runner.dispatch(AppStoreReconcileOriginalTransactionDefinition, input).pipe(
-            Effect.provideService(PlatformRuntime, runtime),
-            Effect.tapError(
-              logDispatchFailure(AppStoreReconcileOriginalTransactionDefinition.name),
-            ),
-            Effect.orDie,
-            Effect.asVoid,
-          ),
-      };
-    }),
-  ),
-  Layer.effect(
-    GooglePlayReplayParkedNotificationsWorkflow,
-    Effect.gen(function* () {
-      const runner = yield* WorkflowRunner;
-      const runtime = yield* PlatformRuntime;
-      return {
-        dispatch: (
-          input: Parameters<
-            GooglePlayReplayParkedNotificationsWorkflow["Service"]["dispatch"]
-          >[0],
-        ) =>
-          runner.dispatch(GooglePlayReplayParkedNotificationsDefinition, input).pipe(
-            Effect.provideService(PlatformRuntime, runtime),
-            Effect.tapError(
-              logDispatchFailure(GooglePlayReplayParkedNotificationsDefinition.name),
-            ),
-            Effect.orDie,
-            Effect.asVoid,
-          ),
-      };
-    }),
-  ),
-  Layer.effect(
-    StripeReplayParkedNotificationsWorkflow,
-    Effect.gen(function* () {
-      const runner = yield* WorkflowRunner;
-      const runtime = yield* PlatformRuntime;
-      return {
-        dispatch: (
-          input: Parameters<StripeReplayParkedNotificationsWorkflow["Service"]["dispatch"]>[0],
-        ) =>
-          runner.dispatch(StripeReplayParkedNotificationsDefinition, input).pipe(
-            Effect.provideService(PlatformRuntime, runtime),
-            Effect.tapError(logDispatchFailure(StripeReplayParkedNotificationsDefinition.name)),
-            Effect.orDie,
-            Effect.asVoid,
-          ),
-      };
-    }),
-  ),
-);
-
-/** Builds the workflow runner and every asynchronous backend dispatch port. */
-export const makeSelfhostWorkflowRuntimeLive = (config: SelfhostRuntimeConfig) => {
-  const workflowRunner = PgWorkflowRunnerLive({
-    database: config.database.databaseName,
-    host: config.database.host,
-    password: Redacted.make(config.database.password),
-    port: config.database.port,
-    ...(config.database.ssl === undefined ? {} : { ssl: config.database.ssl }),
-    username: config.database.username,
-  });
-  const runtime = Layer.merge(workflowRunner, NodePlatformRuntimeLive);
-  const ports = makeWorkflowPortsLive.pipe(Layer.provide(runtime));
-  return Layer.merge(runtime, ports);
-};
-
-/** Registers every workflow handler before the HTTP server begins accepting requests. */
-export const registerSelfhostWorkflows = (config: SelfhostRuntimeConfig) =>
-  Effect.gen(function* () {
-    const runner = yield* WorkflowRunner;
-    const completion = yield* IdentifyDistinctIdCompletionWorkflow;
-    const database = Db.layer(config.database);
-    yield* registerIdentityCompletionWorkflow(runner, database);
-    yield* registerWebhookDeliveryWorkflow(runner, database);
-    yield* registerPaymentProviderWorkflows(runner, database, completion);
-  });
diff --git a/selfhost/entry/src/backend/Workos.ts b/selfhost/entry/src/backend/Workos.ts
deleted file mode 100644
index fd5fb014a..000000000
--- a/selfhost/entry/src/backend/Workos.ts
+++ /dev/null
@@ -1,76 +0,0 @@
-import { Workos } from "@voidhash/core/services/auth/Workos";
-import {
-  WorkosOrgPort,
-  WorkosOrgPortError,
-} from "@voidhash/core/services/organizations/WorkosOrgPort";
-import { Effect, Layer } from "effect";
-
-const mapError = (error: { readonly cause?: unknown; readonly message: string }) =>
-  new WorkosOrgPortError({ cause: String(error.cause), message: error.message });
-
-const membership = (value: {
-  readonly id: string;
-  readonly organizationId: string;
-  readonly role: string | { readonly slug?: string } | null;
-  readonly userId: string;
-}) => ({
-  id: value.id,
-  organizationId: value.organizationId,
-  role: typeof value.role === "string" ? value.role : (value.role?.slug ?? null),
-  userId: value.userId,
-});
-
-const organization = (value: {
-  readonly externalId: string | null;
-  readonly id: string;
-  readonly name: string;
-}) => ({ externalId: value.externalId, id: value.id, name: value.name });
-
-/** WorkOS-backed organization-management port for BYO WorkOS credentials. */
-export const WorkosOrgPortLive: Layer.Layer<WorkosOrgPort, never, Workos> = Layer.effect(
-  WorkosOrgPort,
-  Effect.gen(function* () {
-    const workos = yield* Workos;
-    return {
-      createMembership: (input) =>
-        workos.createOrganizationMembership(input).pipe(
-          Effect.map(membership),
-          Effect.mapError(mapError),
-        ),
-      createOrganization: (input) =>
-        workos.createOrganization(input).pipe(
-          Effect.map(organization),
-          Effect.mapError(mapError),
-        ),
-      deleteMembership: (id) =>
-        workos.deleteOrganizationMembership(id).pipe(Effect.mapError(mapError)),
-      deleteOrganization: (id) => workos.deleteOrganization(id).pipe(Effect.mapError(mapError)),
-      findUserByEmail: (email) => workos.findUserByEmail(email).pipe(Effect.mapError(mapError)),
-      getOrganization: (id) =>
-        workos.getOrganization(id).pipe(
-          Effect.map(organization),
-          Effect.mapError(mapError),
-        ),
-      getOrganizationByExternalId: (externalId) =>
-        workos.getOrganizationByExternalId(externalId).pipe(
-          Effect.map((value) => (value === null ? null : organization(value))),
-          Effect.mapError(mapError),
-        ),
-      listMembershipsForUser: (userId) =>
-        workos.listOrganizationMembershipsForUser(userId).pipe(
-          Effect.map((values) => values.map(membership)),
-          Effect.mapError(mapError),
-        ),
-      updateMembershipRole: (id, input) =>
-        workos.updateOrganizationMembership(id, input).pipe(
-          Effect.map(membership),
-          Effect.mapError(mapError),
-        ),
-      updateOrganization: (input) =>
-        workos.updateOrganization(input).pipe(
-          Effect.map(organization),
-          Effect.mapError(mapError),
-        ),
-    };
-  }),
-);
diff --git a/selfhost/entry/src/index.ts b/selfhost/entry/src/index.ts
deleted file mode 100644
index 4abf14ba3..000000000
--- a/selfhost/entry/src/index.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-export { WorkosAuthTokenVerifierLive } from "./backend/AuthTokenVerifier.ts";
-export { makeBackendInfrastructureLive, makeSelfhostWorkosLive } from "./backend/Backend.ts";
-export { makeBackendMimicHostLive } from "./backend/MimicHost.ts";
-export {
-  makeSelfhostWorkflowRuntimeLive,
-  registerSelfhostWorkflows,
-} from "./backend/WorkflowPorts.ts";
-export { getSelfhostDatabaseConfig, getSelfhostRuntimeConfig } from "./config.ts";
-export { getMimicNodeConfig } from "./mimic/config.ts";
-export { makeMimicNodeHostLive, type MimicNodeConfig } from "./mimic/MimicNode.ts";
-export { installMimicNodeWebSocketServer } from "./mimic/MimicNodeWebSocket.ts";
-export { makePgControlStore, PgControlStoreLive } from "./mimic/PgControlStore.ts";
diff --git a/selfhost/entry/src/migrate.ts b/selfhost/entry/src/migrate.ts
deleted file mode 100644
index 2ef712035..000000000
--- a/selfhost/entry/src/migrate.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import { NodeRuntime } from "@effect/platform-node";
-import { runAppDatabaseMigrations } from "@voidhash/db/migrations";
-import { Effect, Layer } from "effect";
-
-import { migrateSelfhostClickhouse } from "./backend/Clickhouse.ts";
-import {
-  getSelfhostClickhouseConfig,
-  getSelfhostDatabaseConfig,
-  validateSelfhostSecurityConfig,
-} from "./config.ts";
-import { getMimicNodeConfig } from "./mimic/config.ts";
-import { makeMimicNodeHostLive } from "./mimic/MimicNode.ts";
-
-NodeRuntime.runMain(
-  Effect.scoped(
-    Effect.gen(function* () {
-      validateSelfhostSecurityConfig();
-      const result = yield* runAppDatabaseMigrations(getSelfhostDatabaseConfig());
-      yield* Layer.build(makeMimicNodeHostLive(getMimicNodeConfig()));
-      yield* migrateSelfhostClickhouse(getSelfhostClickhouseConfig());
-      yield* Effect.logInfo("Self-host database migrations are ready", {
-        applied: result.applied.length,
-        skipped: result.skipped,
-      });
-    }),
-  ) as never,
-);
diff --git a/selfhost/entry/src/mimic/config.ts b/selfhost/entry/src/mimic/config.ts
deleted file mode 100644
index b9e414b18..000000000
--- a/selfhost/entry/src/mimic/config.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { makePgDocumentConfig } from "@voidhash/mimic-db/core/pg-store";
-import type { PgDurableEntityConfig } from "@orbian/node/DurableEntity";
-import { Redacted } from "effect";
-
-import type { MimicNodeConfig } from "./MimicNode.ts";
-
-const numberFromEnv = (name: string, fallback: number): number => {
-  const value = process.env[name]?.trim();
-  if (!value) return fallback;
-  const parsed = Number(value);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new Error(`${name} must be a positive integer`);
-  }
-  return parsed;
-};
-
-/** Reads the self-host mimic database configuration from environment variables. */
-export const getMimicNodeConfig = (): MimicNodeConfig => {
-  const host = process.env.DATABASE_HOST?.trim() || "127.0.0.1";
-  const port = numberFromEnv("DATABASE_PORT", 5432);
-  const database = process.env.DATABASE_NAME?.trim() || "voidhash";
-  const username = process.env.DATABASE_USERNAME?.trim() || "voidhash";
-  const passwordValue = process.env.DATABASE_PASSWORD ?? "password";
-  const password = Redacted.make(passwordValue);
-  const databaseConfig: PgDurableEntityConfig = {
-    host,
-    port,
-    database,
-    username,
-    password,
-  };
-  const documents = makePgDocumentConfig({
-    host,
-    port,
-    database,
-    username,
-    password: passwordValue,
-  });
-  return { database: databaseConfig, documents };
-};
diff --git a/selfhost/entry/tests/Background.integration.test.ts b/selfhost/entry/tests/Background.integration.test.ts
deleted file mode 100644
index 489084de1..000000000
--- a/selfhost/entry/tests/Background.integration.test.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import { Db, sql } from "@voidhash/db";
-import { Effect } from "effect";
-import { describe, expect, it } from "vitest";
-
-import { makeSelfhostAnalyticsRuntimeLive } from "../src/backend/Analytics.ts";
-import { runSelfhostCronJobs } from "../src/backend/Background.ts";
-import { getSelfhostRuntimeConfig } from "../src/config.ts";
-
-const describePg = process.env.SELFHOST_PG_TEST === "1" ? describe : describe.skip;
-const requiredJobNames = [
-  "app-store-expire-parked-notifications",
-  "purchase-ledger-drain",
-] as const;
-
-describePg("self-host scheduled jobs", () => {
-  it("registers persistent schedule state for the required background jobs", async () => {
-    const config = getSelfhostRuntimeConfig();
-    const database = Db.layer(config.database);
-    let names: ReadonlyArray<string> = [];
-
-    try {
-      names = await Effect.runPromise(
-        Effect.scoped(
-          Effect.gen(function* () {
-            const db = yield* Db;
-            yield* Effect.forkScoped(runSelfhostCronJobs(config));
-            const deadline = Date.now() + 10_000;
-            while (Date.now() < deadline) {
-              const rows = yield* db
-                .execute(sql`
-                  SELECT job_name AS "jobName"
-                  FROM platform_cron_state
-                  WHERE job_name IN (
-                    'app-store-expire-parked-notifications',
-                    'purchase-ledger-drain'
-                  )
-                  ORDER BY job_name
-                `)
-                .pipe(Effect.catch(() => Effect.succeed([])));
-              const registered = rows.map((row) => String(row.jobName));
-              if (registered.length === requiredJobNames.length) return registered;
-              yield* Effect.sleep("25 millis");
-            }
-            return [];
-          }).pipe(
-            Effect.provide(database),
-            Effect.provide(makeSelfhostAnalyticsRuntimeLive(config)),
-          ),
-        ),
-      );
-    } finally {
-      await Effect.runPromise(
-        Effect.gen(function* () {
-          const db = yield* Db;
-          yield* db.execute(sql`
-            DELETE FROM platform_cron_state
-            WHERE job_name IN (
-              'app-store-expire-parked-notifications',
-              'purchase-ledger-drain'
-            )
-          `);
-        }).pipe(Effect.provide(database)),
-      );
-    }
-
-    expect(names).toEqual(requiredJobNames);
-  });
-});
diff --git a/selfhost/entry/vitest.mts b/selfhost/entry/vitest.mts
deleted file mode 100644
index e3ed6a26b..000000000
--- a/selfhost/entry/vitest.mts
+++ /dev/null
@@ -1,10 +0,0 @@
-import { defineConfig } from "vite-plus";
-
-export default defineConfig({
-  test: {
-    environment: "node",
-    include: ["./tests/**/*.test.ts"],
-    exclude: ["./node_modules/**"],
-    reporters: ["verbose"],
-  },
-});
diff --git a/selfhost/platform/package.json b/selfhost/platform/package.json
new file mode 100644
index 000000000..ee326bf91
--- /dev/null
+++ b/selfhost/platform/package.json
@@ -0,0 +1,49 @@
+{
+  "name": "@voidhash/platform-selfhost",
+  "version": "0.0.1-alpha.1",
+  "private": true,
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/voidhashcom/voidhash",
+    "directory": "selfhost/platform"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./ClusterDurableEntity": "./src/ClusterDurableEntity.ts",
+    "./CronScheduler": "./src/CronScheduler.ts",
+    "./EntityAlarmStore": "./src/EntityAlarmStore.ts",
+    "./KeyValueStore": "./src/KeyValueStore.ts",
+    "./Mailer": "./src/Mailer.ts",
+    "./MemoryDurableEntity": "./src/MemoryDurableEntity.ts",
+    "./NodeDurableEntitySession": "./src/NodeDurableEntitySession.ts",
+    "./ObjectStore": "./src/ObjectStore.ts",
+    "./PlatformRuntime": "./src/PlatformRuntime.ts",
+    "./Postgres": "./src/Postgres.ts",
+    "./Queue": "./src/Queue.ts",
+    "./Screenshot": "./src/Screenshot.ts",
+    "./Topology": "./src/Topology.ts",
+    "./Workflow": "./src/Workflow.ts"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vp test run -c vitest.mts",
+    "test:integration": "vp test run -c vitest.integration.mts"
+  },
+  "dependencies": {
+    "@effect-aws/client-s3": "catalog:",
+    "@effect/sql-pg": "catalog:",
+    "@voidhash/platform": "workspace:*",
+    "effect": "catalog:",
+    "nodemailer": "catalog:",
+    "playwright-core": "catalog:"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.12",
+    "@types/nodemailer": "catalog:",
+    "@voidhash/tsconfig": "workspace:*",
+    "typescript": "catalog:",
+    "vite-plus": "catalog:"
+  }
+}
diff --git a/selfhost/platform/src/ClusterDurableEntity.ts b/selfhost/platform/src/ClusterDurableEntity.ts
new file mode 100644
index 000000000..0721ee2f6
--- /dev/null
+++ b/selfhost/platform/src/ClusterDurableEntity.ts
@@ -0,0 +1,249 @@
+import {
+  DurableEntityAlarmControl,
+  type DurableEntityAddress,
+  type DurableEntityContext,
+  DurableEntityHost,
+  type DurableEntityHostShape,
+  type DurableEntitySession,
+} from "@voidhash/platform/DurableEntity";
+import { Duration, Effect, Layer, Semaphore } from "effect";
+import { EntityId, Sharding } from "effect/unstable/cluster";
+import { KeyValueStore } from "effect/unstable/persistence";
+
+import {
+  DurableEntityAlarmStore,
+  type DurableEntityAlarmStoreShape,
+  PgEntityAlarmStoreLive,
+} from "./EntityAlarmStore.ts";
+import { PgPlatformClientLive, type PgPlatformConfig } from "./Postgres.ts";
+import { SingleNodeClusterLive } from "./Topology.ts";
+
+const entityKey = (address: DurableEntityAddress): string => `${address.type}\u0000${address.id}`;
+
+const valueKey = (address: DurableEntityAddress, key: string): string =>
+  `voidhash/platform-selfhost/entity/${address.type}/${address.id}/kv/${key}`;
+
+interface LocalEntityState {
+  readonly lock: Semaphore.Semaphore;
+  /**
+   * Sessions are process-local by nature: a WebSocket is held open by one
+   * process, so it is never restored from persistent storage.
+   */
+  readonly sessions: Map<string, DurableEntitySession>;
+  /** Turns currently running or queued for this address. */
+  turns: number;
+}
+
+/** Tuning for the cluster entity host's locality gate. */
+export interface ClusterDurableEntityOptions {
+  /**
+   * How long `sessions.attach` waits for this runner to acquire the entity's
+   * shard before it dies. Shards are assigned by a background loop, so a socket
+   * that upgrades moments after boot is early, not misplaced.
+   */
+  readonly attachOwnershipTimeout?: Duration.Input;
+}
+
+const ownershipPollIntervalMillis = 25;
+
+/**
+ * Durable entity host backed by Effect Cluster.
+ *
+ * Sharding decides which runner owns an entity, a per-address semaphore
+ * serializes that runner's turns, entity values live in the persistence
+ * key-value store, and alarms live in an indexed store a scheduler can poll.
+ * Sessions never enter the cluster mailbox — a socket cannot be serialized —
+ * so they are only reachable on the runner that owns the entity's shard.
+ */
+export const makeClusterDurableEntityHost = (
+  sharding: Sharding.Sharding["Service"],
+  store: KeyValueStore.KeyValueStore,
+  alarms: DurableEntityAlarmStoreShape,
+  options?: ClusterDurableEntityOptions,
+): DurableEntityHostShape => {
+  const states = new Map<string, LocalEntityState>();
+
+  const stateFor = (address: DurableEntityAddress): LocalEntityState => {
+    const key = entityKey(address);
+    let state = states.get(key);
+    if (!state) {
+      state = { lock: Semaphore.makeUnsafe(1), sessions: new Map(), turns: 0 };
+      states.set(key, state);
+    }
+    return state;
+  };
+
+  // TODO: every entity is placed in the "default" shard group. A deployment
+  // that puts entity types in their own groups has to thread the group through
+  // the address before this check means anything for it.
+  const isOwned = (address: DurableEntityAddress): boolean =>
+    sharding.hasShardId(sharding.getShardId(EntityId.make(address.id), "default"));
+
+  /**
+   * Records when this runner does not own the entity's shard.
+   *
+   * The contract hands the host a closure, which cannot be forwarded to
+   * another runner, so the host cannot reroute a misplaced call. Single-runner
+   * topologies own every shard and never trip this; multi-runner deployments
+   * must route entity work by address before calling in, and this leaves a
+   * trace when they have not.
+   */
+  const warnIfNotOwned = (address: DurableEntityAddress) =>
+    Effect.suspend(() =>
+      isOwned(address)
+        ? Effect.void
+        : Effect.logDebug("durable entity is not assigned to this runner", {
+            entityType: address.type,
+            entityId: address.id,
+          }),
+    );
+
+  const attachOwnershipTimeoutMillis = Duration.toMillis(
+    options?.attachOwnershipTimeout ?? Duration.seconds(5),
+  );
+
+  /**
+   * Refuses to attach a socket to an entity this runner does not own.
+   *
+   * Reads stay total because a stale registry is harmless, but a silently
+   * misplaced attach is not: every later broadcast would skip the socket and
+   * the client would look connected while receiving nothing.
+   *
+   * Shard assignment is computed by a background loop that has not run yet when
+   * the process has just booted, so ownership is polled for a bounded window
+   * before the attach is declared misplaced.
+   */
+  const requireOwnedForAttach = (address: DurableEntityAddress) => {
+    const poll = (remainingMillis: number): Effect.Effect<void> =>
+      Effect.suspend(() => {
+        if (isOwned(address)) return Effect.void;
+        if (remainingMillis <= 0) {
+          return Effect.die(
+            new Error(
+              `Cannot attach a session to durable entity ${address.type}/${address.id}: this runner did not acquire its shard within ${attachOwnershipTimeoutMillis}ms`,
+            ),
+          );
+        }
+        return Effect.sleep(Duration.millis(ownershipPollIntervalMillis)).pipe(
+          Effect.andThen(poll(remainingMillis - ownershipPollIntervalMillis)),
+        );
+      });
+    return poll(attachOwnershipTimeoutMillis);
+  };
+
+  const readValue = (key: string) =>
+    store.get(key).pipe(
+      Effect.map((raw) => {
+        if (raw === undefined) return undefined;
+        try {
+          return JSON.parse(raw) as unknown;
+        } catch {
+          return undefined;
+        }
+      }),
+      Effect.orDie,
+    );
+
+  /**
+   * Drops the process-local record for an address once nothing references it.
+   *
+   * Without this, one entry per address ever touched would live for the
+   * lifetime of the process — an unbounded leak on a host that addresses
+   * entities by document or session id.
+   */
+  const releaseState = (address: DurableEntityAddress, state: LocalEntityState) =>
+    Effect.sync(() => {
+      state.turns -= 1;
+      const key = entityKey(address);
+      if (state.turns === 0 && state.sessions.size === 0 && states.get(key) === state) {
+        states.delete(key);
+      }
+    });
+
+  return DurableEntityHost.of({
+    run: (address, operation) =>
+      Effect.suspend(() => {
+        const state = stateFor(address);
+        state.turns += 1;
+        const context: DurableEntityContext = {
+          address,
+          keyValue: {
+            get: (key) => readValue(valueKey(address, key)),
+            put: (key, value) =>
+              store.set(valueKey(address, key), JSON.stringify(value ?? null)).pipe(Effect.orDie),
+            delete: (key) => store.remove(valueKey(address, key)).pipe(Effect.orDie),
+          },
+          alarm: {
+            get: alarms.get(address),
+            set: (scheduledTime) => alarms.set(address, scheduledTime),
+            delete: alarms.delete(address),
+          },
+          sessions: {
+            get: (sessionId) => Effect.sync(() => state.sessions.get(sessionId)),
+            list: Effect.sync(() => [...state.sessions.values()]),
+            attach: (session) =>
+              requireOwnedForAttach(address).pipe(
+                Effect.andThen(Effect.sync(() => void state.sessions.set(session.id, session))),
+              ),
+            remove: (sessionId) => Effect.sync(() => void state.sessions.delete(sessionId)),
+          },
+        };
+        return warnIfNotOwned(address).pipe(
+          Effect.andThen(state.lock.withPermit(Effect.suspend(() => operation(context)))),
+          Effect.ensuring(releaseState(address, state)),
+        );
+      }),
+  });
+};
+
+/** Cluster-backed durable entity host layer. */
+export const ClusterDurableEntityHostLive: Layer.Layer<
+  DurableEntityHost,
+  never,
+  Sharding.Sharding | KeyValueStore.KeyValueStore | DurableEntityAlarmStore
+> = Layer.effect(
+  DurableEntityHost,
+  Effect.gen(function* () {
+    const sharding = yield* Sharding.Sharding;
+    const store = yield* KeyValueStore.KeyValueStore;
+    const alarms = yield* DurableEntityAlarmStore;
+    return makeClusterDurableEntityHost(sharding, store, alarms);
+  }),
+);
+
+/**
+ * Alarm control plane for the cluster host: the scheduler that fires entity
+ * alarms polls this for the addresses whose scheduled time has passed.
+ */
+export const ClusterDurableEntityControlLive: Layer.Layer<
+  DurableEntityAlarmControl,
+  never,
+  DurableEntityAlarmStore
+> = Layer.effect(
+  DurableEntityAlarmControl,
+  Effect.gen(function* () {
+    const alarms = yield* DurableEntityAlarmStore;
+    return DurableEntityAlarmControl.of({ listDueAlarms: alarms.listDue });
+  }),
+);
+
+/**
+ * Self-contained cluster entity host over Postgres, including its own
+ * single-node topology.
+ *
+ * A process that also runs cluster queues, workflows, or cron jobs must build
+ * one topology and share it with this host instead, because two runners in one
+ * process compete for the same shard leases. This factory is for compositions
+ * that host nothing but entities — and for tests.
+ */
+export const PgClusterDurableEntityLive = (
+  config: PgPlatformConfig,
+): Layer.Layer<DurableEntityHost | DurableEntityAlarmControl> => {
+  const sql = PgPlatformClientLive(config).pipe(Layer.orDie);
+  return Layer.mergeAll(ClusterDurableEntityHostLive, ClusterDurableEntityControlLive).pipe(
+    Layer.provide(PgEntityAlarmStoreLive),
+    Layer.provide(KeyValueStore.layerSql().pipe(Layer.orDie)),
+    Layer.provide(SingleNodeClusterLive({ runnerStorage: "memory" }).pipe(Layer.orDie)),
+    Layer.provide(sql),
+  );
+};
diff --git a/selfhost/platform/src/CronScheduler.ts b/selfhost/platform/src/CronScheduler.ts
new file mode 100644
index 000000000..c6ae48aa5
--- /dev/null
+++ b/selfhost/platform/src/CronScheduler.ts
@@ -0,0 +1,187 @@
+import {
+  type CronJob,
+  type CronRunOptions,
+  CronScheduler,
+  CronSchedulerError,
+  type CronSchedulerShape,
+} from "@voidhash/platform/CronScheduler";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { Cause, Cron, Effect, Layer, Result, Semaphore } from "effect";
+import { ClusterCron, Sharding } from "effect/unstable/cluster";
+import { KeyValueStore } from "effect/unstable/persistence";
+
+interface SlotState {
+  readonly lastScheduledAtMs: number | undefined;
+  readonly nextScheduledAtMs: number;
+}
+
+const schedulerError = (jobName: string, operation: string, cause: unknown) =>
+  new CronSchedulerError({ jobName, operation, cause: String(cause) });
+
+const parseCron = (job: CronJob<never>) => {
+  const parsed = Cron.parse(job.expression, job.timeZone);
+  return Result.isSuccess(parsed)
+    ? Effect.succeed(parsed.success)
+    : Effect.fail(schedulerError(job.name, "parse", parsed.failure.message));
+};
+
+const stateKey = (jobName: string): string => `voidhash/platform-selfhost/cron/${jobName}`;
+
+const decodeState = (raw: string | undefined): SlotState | undefined => {
+  if (raw === undefined) return undefined;
+  try {
+    const parsed = JSON.parse(raw) as Partial<SlotState>;
+    return typeof parsed.nextScheduledAtMs === "number"
+      ? {
+          lastScheduledAtMs:
+            typeof parsed.lastScheduledAtMs === "number" ? parsed.lastScheduledAtMs : undefined,
+          nextScheduledAtMs: parsed.nextScheduledAtMs,
+        }
+      : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Claims and runs at most one due slot.
+ *
+ * Slot bookkeeping lives in the persistence key-value store, and a local
+ * semaphore serializes concurrent ticks for one job inside this process.
+ * Cluster-wide exactly-once execution is the job of the `run` operation, which
+ * delegates to `ClusterCron`; `tick` is the single-shot affordance used by
+ * tests and by runtimes that drive schedules from an external trigger.
+ */
+const makeTick =
+  (store: KeyValueStore.KeyValueStore, locks: Map<string, Semaphore.Semaphore>) =>
+  <R>(
+    job: CronJob<R>,
+    inputNow?: Date,
+  ): Effect.Effect<boolean, CronSchedulerError, PlatformRuntime | R> => {
+    const lockFor = (name: string): Semaphore.Semaphore => {
+      let lock = locks.get(name);
+      if (!lock) {
+        lock = Semaphore.makeUnsafe(1);
+        locks.set(name, lock);
+      }
+      return lock;
+    };
+
+    return PlatformRuntime.pipe(
+      Effect.andThen(parseCron(job as unknown as CronJob<never>)),
+      Effect.flatMap((cron) =>
+        lockFor(job.name).withPermit(
+          Effect.gen(function* () {
+            const now = inputNow?.getTime() ?? Date.now();
+            const key = stateKey(job.name);
+            const stored = yield* store
+              .get(key)
+              .pipe(Effect.mapError((cause) => schedulerError(job.name, "claim", cause)));
+            const state = decodeState(stored);
+
+            // First sight of a job arms it for its next occurrence: a fresh
+            // deployment must not immediately fire every schedule it has never
+            // run before.
+            if (state === undefined) {
+              const armed: SlotState = {
+                lastScheduledAtMs: undefined,
+                nextScheduledAtMs: Cron.next(cron, new Date(now)).getTime(),
+              };
+              yield* store
+                .set(key, JSON.stringify(armed))
+                .pipe(Effect.mapError((cause) => schedulerError(job.name, "claim", cause)));
+              return false;
+            }
+
+            if (state.nextScheduledAtMs > now) return false;
+
+            const scheduledTime = state.nextScheduledAtMs;
+            const nextScheduledAtMs = Cron.next(cron, new Date(scheduledTime)).getTime();
+
+            yield* job
+              .run({ scheduledTime: new Date(scheduledTime), catchUp: scheduledTime < now })
+              .pipe(
+                Effect.catchCause((cause) =>
+                  Effect.fail(schedulerError(job.name, "run", Cause.pretty(cause))),
+                ),
+              );
+
+            yield* store
+              .set(
+                key,
+                JSON.stringify({
+                  lastScheduledAtMs: scheduledTime,
+                  nextScheduledAtMs,
+                } satisfies SlotState),
+              )
+              .pipe(Effect.mapError((cause) => schedulerError(job.name, "complete", cause)));
+
+            return true;
+          }),
+        ),
+      ),
+    ) as Effect.Effect<boolean, CronSchedulerError, PlatformRuntime | R>;
+  };
+
+/**
+ * Runs a schedule until interrupted, using `ClusterCron` so exactly one runner
+ * in the cluster executes each slot even when several are alive.
+ *
+ * Each job becomes its own entity type, `ClusterCron/<name>`, and its due slots
+ * are durable rows in `cluster_messages`. A row addressed to a job no process
+ * registers is never discarded: the storage read loop retries it in a tight
+ * loop ("Could not find entity manager for address, retrying") and starves the
+ * runner, stalling unrelated workflows and queue consumers. Renaming or
+ * removing a job therefore requires draining its messages by hand — see
+ * "Renaming or removing a cron job" in selfhost/README.md.
+ */
+const makeRun =
+  (sharding: Sharding.Sharding["Service"]) =>
+  <R>(
+    job: CronJob<R>,
+    _options?: CronRunOptions,
+  ): Effect.Effect<never, CronSchedulerError, PlatformRuntime | R> =>
+    PlatformRuntime.pipe(
+      Effect.andThen(parseCron(job as unknown as CronJob<never>)),
+      Effect.flatMap((cron) =>
+        Layer.launch(
+          ClusterCron.make({
+            name: job.name,
+            cron,
+            execute: Effect.suspend(() =>
+              job.run({ scheduledTime: new Date(), catchUp: false }),
+            ).pipe(
+              Effect.catchCause((cause) =>
+                Effect.logError("scheduled job failed", {
+                  jobName: job.name,
+                  cause: Cause.pretty(cause),
+                }),
+              ),
+            ),
+          }),
+        ).pipe(Effect.provideService(Sharding.Sharding, sharding)),
+      ),
+    ) as Effect.Effect<never, CronSchedulerError, PlatformRuntime | R>;
+
+const makeScheduler = (
+  store: KeyValueStore.KeyValueStore,
+  sharding: Sharding.Sharding["Service"],
+): CronSchedulerShape =>
+  ({
+    tick: makeTick(store, new Map<string, Semaphore.Semaphore>()),
+    run: makeRun(sharding),
+  }) as CronSchedulerShape;
+
+/** Cluster-backed cron scheduler with durable slot state. */
+export const ClusterCronSchedulerLive: Layer.Layer<
+  CronScheduler,
+  never,
+  Sharding.Sharding | KeyValueStore.KeyValueStore
+> = Layer.effect(
+  CronScheduler,
+  Effect.gen(function* () {
+    const store = yield* KeyValueStore.KeyValueStore;
+    const sharding = yield* Sharding.Sharding;
+    return makeScheduler(store, sharding);
+  }),
+);
diff --git a/selfhost/platform/src/EntityAlarmStore.ts b/selfhost/platform/src/EntityAlarmStore.ts
new file mode 100644
index 000000000..93aebe3eb
--- /dev/null
+++ b/selfhost/platform/src/EntityAlarmStore.ts
@@ -0,0 +1,138 @@
+import type {
+  DueDurableEntityAlarm,
+  DurableEntityAddress,
+} from "@voidhash/platform/DurableEntity";
+import { Context, Effect, Layer } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+/**
+ * Storage for entity alarms that can also be *enumerated*.
+ *
+ * Effect's persistence key-value store has no key enumeration, so an alarm
+ * written there can never be found again by a scheduler. Alarms therefore get
+ * their own indexed store, kept separate from entity values.
+ */
+export interface DurableEntityAlarmStoreShape {
+  readonly get: (address: DurableEntityAddress) => Effect.Effect<number | undefined>;
+  readonly set: (address: DurableEntityAddress, scheduledTime: number) => Effect.Effect<void>;
+  readonly delete: (address: DurableEntityAddress) => Effect.Effect<void>;
+  readonly listDue: (
+    now: number,
+    limit: number,
+  ) => Effect.Effect<ReadonlyArray<DueDurableEntityAlarm>>;
+}
+
+/** Indexed alarm storage shared by the entity host and its control plane. */
+export class DurableEntityAlarmStore extends Context.Service<
+  DurableEntityAlarmStore,
+  DurableEntityAlarmStoreShape
+>()("@voidhash/platform-selfhost/DurableEntityAlarmStore") {}
+
+interface AlarmRow {
+  readonly type: string;
+  readonly id: string;
+  readonly scheduledTime: number | string;
+}
+
+const ensureTable = (sql: SqlClient.SqlClient) =>
+  sql.withTransaction(
+    Effect.gen(function* () {
+      // PostgreSQL's IF NOT EXISTS DDL can still race in its catalog, so host
+      // processes serialize this tiny bootstrap migration with an advisory lock.
+      yield* sql`SELECT pg_advisory_xact_lock(hashtext('voidhash_platform_entity_alarm_schema_v1'))`;
+      yield* sql`
+        CREATE TABLE IF NOT EXISTS platform_entity_alarms (
+          entity_type TEXT NOT NULL,
+          entity_id TEXT NOT NULL,
+          scheduled_time BIGINT NOT NULL,
+          PRIMARY KEY (entity_type, entity_id)
+        )
+      `;
+      yield* sql`
+        CREATE INDEX IF NOT EXISTS platform_entity_alarms_due_idx
+        ON platform_entity_alarms (scheduled_time)
+      `;
+    }),
+  );
+
+const makeSqlStore = (sql: SqlClient.SqlClient): DurableEntityAlarmStoreShape => ({
+  get: (address) =>
+    sql<AlarmRow>`
+      SELECT entity_type AS "type", entity_id AS "id", scheduled_time AS "scheduledTime"
+      FROM platform_entity_alarms
+      WHERE entity_type = ${address.type} AND entity_id = ${address.id}
+    `.pipe(
+      Effect.map((rows) => (rows[0] ? Number(rows[0].scheduledTime) : undefined)),
+      Effect.orDie,
+    ),
+  set: (address, scheduledTime) =>
+    sql`
+      INSERT INTO platform_entity_alarms (entity_type, entity_id, scheduled_time)
+      VALUES (${address.type}, ${address.id}, ${scheduledTime})
+      ON CONFLICT (entity_type, entity_id)
+      DO UPDATE SET scheduled_time = EXCLUDED.scheduled_time
+    `.pipe(Effect.asVoid, Effect.orDie),
+  delete: (address) =>
+    sql`
+      DELETE FROM platform_entity_alarms
+      WHERE entity_type = ${address.type} AND entity_id = ${address.id}
+    `.pipe(Effect.asVoid, Effect.orDie),
+  listDue: (now, limit) =>
+    sql<AlarmRow>`
+      SELECT entity_type AS "type", entity_id AS "id", scheduled_time AS "scheduledTime"
+      FROM platform_entity_alarms
+      WHERE scheduled_time <= ${now}
+      ORDER BY scheduled_time ASC, entity_type ASC, entity_id ASC
+      LIMIT ${Math.max(0, Math.floor(limit))}
+    `.pipe(
+      Effect.map((rows) =>
+        rows.map((row) => ({
+          address: { type: row.type, id: row.id },
+          scheduledTime: Number(row.scheduledTime),
+        })),
+      ),
+      Effect.orDie,
+    ),
+});
+
+/**
+ * Postgres alarm index. The table is created on first build, so a deployment
+ * needs no separate migration step for it.
+ */
+export const PgEntityAlarmStoreLive: Layer.Layer<
+  DurableEntityAlarmStore,
+  never,
+  SqlClient.SqlClient
+> = Layer.effect(
+  DurableEntityAlarmStore,
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* ensureTable(sql);
+    return makeSqlStore(sql);
+  }),
+).pipe(Layer.orDie);
+
+/** Builds a process-local alarm index for tests and ephemeral development. */
+export const makeMemoryEntityAlarmStore = (): DurableEntityAlarmStoreShape => {
+  const alarms = new Map<string, DueDurableEntityAlarm>();
+  const key = (address: DurableEntityAddress): string => `${address.type}\u0000${address.id}`;
+  return {
+    get: (address) => Effect.sync(() => alarms.get(key(address))?.scheduledTime),
+    set: (address, scheduledTime) =>
+      Effect.sync(() => void alarms.set(key(address), { address, scheduledTime })),
+    delete: (address) => Effect.sync(() => void alarms.delete(key(address))),
+    listDue: (now, limit) =>
+      Effect.sync(() =>
+        [...alarms.values()]
+          .filter((alarm) => alarm.scheduledTime <= now)
+          .sort((left, right) => left.scheduledTime - right.scheduledTime)
+          .slice(0, Math.max(0, Math.floor(limit))),
+      ),
+  };
+};
+
+/** In-memory alarm index layer. State does not survive the process. */
+export const MemoryEntityAlarmStoreLive: Layer.Layer<DurableEntityAlarmStore> = Layer.sync(
+  DurableEntityAlarmStore,
+  makeMemoryEntityAlarmStore,
+);
diff --git a/selfhost/platform/src/KeyValueStore.ts b/selfhost/platform/src/KeyValueStore.ts
new file mode 100644
index 000000000..af3f3d367
--- /dev/null
+++ b/selfhost/platform/src/KeyValueStore.ts
@@ -0,0 +1,252 @@
+import {
+  type KeyValuePutOptions,
+  KeyValueStore,
+  KeyValueStoreError,
+  type KeyValueStoreShape,
+} from "@voidhash/platform/KeyValueStore";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { Effect, Layer, Option, SchemaParser } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+
+import { PgPlatformClientLive, type PgPlatformConfig } from "./Postgres.ts";
+
+interface ValueRow {
+  readonly value: unknown;
+}
+
+interface KeyRow {
+  readonly key: string;
+}
+
+const ensureTable = (sql: SqlClient.SqlClient) =>
+  sql.withTransaction(
+    Effect.gen(function* () {
+      yield* sql`SELECT pg_advisory_xact_lock(hashtext('voidhash_platform_kv_schema_v1'))`;
+      yield* sql`
+        CREATE TABLE IF NOT EXISTS platform_key_value (
+          namespace TEXT NOT NULL,
+          key TEXT NOT NULL,
+          value_json JSONB NOT NULL,
+          expires_at_ms BIGINT,
+          updated_at_ms BIGINT NOT NULL,
+          PRIMARY KEY (namespace, key)
+        )
+      `;
+      yield* sql`
+        CREATE INDEX IF NOT EXISTS platform_key_value_expiry_idx
+        ON platform_key_value (expires_at_ms)
+        WHERE expires_at_ms IS NOT NULL
+      `;
+    }),
+  );
+
+const expiry = (now: number, options: KeyValuePutOptions | undefined): number | null => {
+  const ttl = options?.ttlMillis;
+  return typeof ttl === "number" && Number.isFinite(ttl) && ttl > 0
+    ? now + Math.floor(ttl)
+    : null;
+};
+
+const encodeJson = (value: unknown): Effect.Effect<string, unknown> =>
+  Effect.try({
+    try: () => {
+      const encoded = JSON.stringify(value);
+      if (encoded === undefined) {
+        throw new TypeError("Key-value entries must be JSON-serializable");
+      }
+      return encoded;
+    },
+    catch: (cause) => cause,
+  });
+
+const storeError = (namespace: string, operation: string, cause: unknown) =>
+  new KeyValueStoreError({ namespace, operation, cause: String(cause) });
+
+const makeStore = (sql: SqlClient.SqlClient): KeyValueStoreShape => ({
+  get: (namespace, key, schema) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(
+        Effect.suspend(() => {
+          const now = Date.now();
+          return sql<ValueRow>`
+            SELECT value_json AS "value"
+            FROM platform_key_value
+            WHERE namespace = ${namespace}
+              AND key = ${key}
+              AND (expires_at_ms IS NULL OR expires_at_ms > ${now})
+          `;
+        }),
+      ),
+      Effect.flatMap((rows) =>
+        rows[0]
+          ? SchemaParser.decodeUnknownEffect(schema)(rows[0].value).pipe(Effect.map(Option.some))
+          : Effect.succeedNone,
+      ),
+      Effect.mapError((cause) => storeError(namespace, "get", cause)),
+    ),
+  put: (namespace, key, value, schema, options) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(SchemaParser.encodeUnknownEffect(schema)(value)),
+      Effect.flatMap(encodeJson),
+      Effect.flatMap((encoded) => {
+        const now = Date.now();
+        const expiresAt = expiry(now, options);
+        return sql`
+          INSERT INTO platform_key_value (
+            namespace, key, value_json, expires_at_ms, updated_at_ms
+          ) VALUES (
+            ${namespace}, ${key}, ${encoded}::jsonb, ${expiresAt}, ${now}
+          )
+          ON CONFLICT (namespace, key)
+          DO UPDATE SET value_json = EXCLUDED.value_json,
+                        expires_at_ms = EXCLUDED.expires_at_ms,
+                        updated_at_ms = EXCLUDED.updated_at_ms
+        `;
+      }),
+      Effect.asVoid,
+      Effect.mapError((cause) => storeError(namespace, "put", cause)),
+    ),
+  putMany: (namespace, entries, schema, options) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(
+        Effect.forEach(entries, ({ key, value }) =>
+          SchemaParser.encodeUnknownEffect(schema)(value).pipe(
+            Effect.flatMap(encodeJson),
+            Effect.map((encoded) => ({ key, encoded })),
+          ),
+        ),
+      ),
+      Effect.flatMap((encodedEntries) => {
+        const now = Date.now();
+        const expiresAt = expiry(now, options);
+        return sql.withTransaction(
+          Effect.forEach(
+            encodedEntries,
+            ({ key, encoded }) =>
+              sql`
+                INSERT INTO platform_key_value (
+                  namespace, key, value_json, expires_at_ms, updated_at_ms
+                ) VALUES (
+                  ${namespace}, ${key}, ${encoded}::jsonb, ${expiresAt}, ${now}
+                )
+                ON CONFLICT (namespace, key)
+                DO UPDATE SET value_json = EXCLUDED.value_json,
+                              expires_at_ms = EXCLUDED.expires_at_ms,
+                              updated_at_ms = EXCLUDED.updated_at_ms
+              `,
+            { discard: true },
+          ),
+        );
+      }),
+      Effect.mapError((cause) => storeError(namespace, "putMany", cause)),
+    ),
+  existingKeys: (namespace, keys) => {
+    if (keys.length === 0) return Effect.succeed(new Set<string>());
+    return PlatformRuntime.pipe(
+      Effect.andThen(
+        Effect.suspend(() => {
+          const now = Date.now();
+          return sql<KeyRow>`
+            SELECT key
+            FROM platform_key_value
+            WHERE namespace = ${namespace}
+              AND ${sql.in("key", keys)}
+              AND (expires_at_ms IS NULL OR expires_at_ms > ${now})
+          `;
+        }),
+      ),
+      Effect.map((rows) => new Set(rows.map(({ key }) => key))),
+      Effect.mapError((cause) => storeError(namespace, "existingKeys", cause)),
+    );
+  },
+  delete: (namespace, key) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(sql`DELETE FROM platform_key_value WHERE namespace = ${namespace} AND key = ${key}`),
+      Effect.asVoid,
+      Effect.mapError((cause) => storeError(namespace, "delete", cause)),
+    ),
+  deleteMany: (namespace, keys) => {
+    if (keys.length === 0) return Effect.void;
+    return PlatformRuntime.pipe(
+      Effect.andThen(
+        sql`
+          DELETE FROM platform_key_value
+          WHERE namespace = ${namespace} AND ${sql.in("key", keys)}
+        `,
+      ),
+      Effect.asVoid,
+      Effect.mapError((cause) => storeError(namespace, "deleteMany", cause)),
+    );
+  },
+  increment: (namespace, key, options) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(
+        Effect.suspend(() => {
+          const now = Date.now();
+          const expiresAt = expiry(now, options);
+          return sql<ValueRow>`
+            INSERT INTO platform_key_value (
+              namespace, key, value_json, expires_at_ms, updated_at_ms
+            ) VALUES (
+              ${namespace}, ${key}, '1'::jsonb, ${expiresAt}, ${now}
+            )
+            ON CONFLICT (namespace, key)
+            DO UPDATE SET
+              value_json = to_jsonb(
+                CASE
+                  WHEN platform_key_value.expires_at_ms IS NOT NULL
+                    AND platform_key_value.expires_at_ms <= ${now}
+                    THEN 1
+                  WHEN jsonb_typeof(platform_key_value.value_json) = 'number'
+                    THEN (platform_key_value.value_json #>> '{}')::BIGINT + 1
+                  ELSE 1
+                END
+              ),
+              expires_at_ms = EXCLUDED.expires_at_ms,
+              updated_at_ms = EXCLUDED.updated_at_ms
+            RETURNING value_json AS "value"
+          `;
+        }),
+      ),
+      Effect.map((rows) => Number(rows[0]?.value ?? 0)),
+      Effect.mapError((cause) => storeError(namespace, "increment", cause)),
+    ),
+  pruneExpired: (limit) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(
+        Effect.suspend(() => {
+          const now = Date.now();
+          const rowLimit = Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 0;
+          return sql<KeyRow>`
+            WITH expired AS (
+              SELECT namespace, key
+              FROM platform_key_value
+              WHERE expires_at_ms IS NOT NULL AND expires_at_ms <= ${now}
+              ORDER BY expires_at_ms ASC
+              LIMIT ${rowLimit}
+              FOR UPDATE SKIP LOCKED
+            )
+            DELETE FROM platform_key_value AS value
+            USING expired
+            WHERE value.namespace = expired.namespace AND value.key = expired.key
+            RETURNING value.key
+          `;
+        }),
+      ),
+      Effect.map((rows) => rows.length),
+      Effect.mapError((cause) => storeError("*", "pruneExpired", cause)),
+    ),
+});
+
+/** Postgres-backed typed key-value store with TTL and atomic counters. */
+export const PgKeyValueStoreLive = (
+  config: PgPlatformConfig,
+): Layer.Layer<KeyValueStore> =>
+  Layer.effect(
+    KeyValueStore,
+    Effect.gen(function* () {
+      const sql = yield* SqlClient.SqlClient;
+      yield* ensureTable(sql);
+      return makeStore(sql);
+    }),
+  ).pipe(Layer.provide(PgPlatformClientLive(config)), Layer.orDie);
diff --git a/selfhost/platform/src/Mailer.ts b/selfhost/platform/src/Mailer.ts
new file mode 100644
index 000000000..d47999046
--- /dev/null
+++ b/selfhost/platform/src/Mailer.ts
@@ -0,0 +1,144 @@
+import {
+  type MailAddress,
+  type MailDeliveryResult,
+  Mailer,
+  MailerError,
+  type MailerShape,
+  type MailMessage,
+} from "@voidhash/platform/Mailer";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { Effect, Layer, Redacted } from "effect";
+import nodemailer, { type Transporter } from "nodemailer";
+
+/** SMTP connection, authentication, and sender defaults. */
+export interface SmtpMailerConfig {
+  readonly host: string;
+  readonly port: number;
+  readonly secure?: boolean;
+  readonly requireTls?: boolean;
+  readonly username?: string;
+  readonly password?: Redacted.Redacted<string>;
+  readonly defaultFrom?: MailAddress;
+  readonly connectionTimeoutMillis?: number;
+  readonly greetingTimeoutMillis?: number;
+  readonly tlsRejectUnauthorized?: boolean;
+  readonly verifyOnStart?: boolean;
+}
+
+const mailerError = (operation: string, cause: unknown) =>
+  new MailerError({ operation, cause: String(cause) });
+
+const mailbox = ({ address, name }: MailAddress) => ({ address, name });
+
+const resultAddress = (value: unknown): string => {
+  if (typeof value === "string") return value;
+  if (typeof value === "object" && value !== null && "address" in value) {
+    const address = (value as { readonly address?: unknown }).address;
+    if (typeof address === "string") return address;
+  }
+  return String(value);
+};
+
+const validateMessage = (
+  config: SmtpMailerConfig,
+  message: MailMessage,
+): Effect.Effect<MailAddress, MailerError> => {
+  const from = message.from ?? config.defaultFrom;
+  if (!from) return Effect.fail(mailerError("validate", "sender is required"));
+  if (message.to.length === 0) {
+    return Effect.fail(mailerError("validate", "at least one recipient is required"));
+  }
+  if (message.text === undefined && message.html === undefined) {
+    return Effect.fail(mailerError("validate", "text or html content is required"));
+  }
+  return Effect.succeed(from);
+};
+
+const send = (
+  transporter: Transporter,
+  config: SmtpMailerConfig,
+  message: MailMessage,
+): Effect.Effect<MailDeliveryResult, MailerError, PlatformRuntime> =>
+  PlatformRuntime.pipe(
+    Effect.andThen(validateMessage(config, message)),
+    Effect.flatMap((from) =>
+      Effect.tryPromise({
+        try: () =>
+          transporter.sendMail({
+            from: mailbox(from),
+            to: message.to.map(mailbox),
+            cc: message.cc?.map(mailbox),
+            bcc: message.bcc?.map(mailbox),
+            replyTo: message.replyTo ? mailbox(message.replyTo) : undefined,
+            subject: message.subject,
+            text: message.text,
+            html: message.html,
+            headers: message.headers,
+          }),
+        catch: (cause) => mailerError("send", cause),
+      }),
+    ),
+    Effect.map((info) => ({
+      messageId: info.messageId,
+      accepted: (info.accepted as ReadonlyArray<unknown>).map(resultAddress),
+      rejected: (info.rejected as ReadonlyArray<unknown>).map(resultAddress),
+    })),
+  );
+
+const makeMailer = (
+  transporter: Transporter,
+  config: SmtpMailerConfig,
+): MailerShape => ({
+  send: (message) => send(transporter, config, message),
+});
+
+const makeTransporter = (
+  config: SmtpMailerConfig,
+): Effect.Effect<Transporter, MailerError> => {
+  if ((config.username === undefined) !== (config.password === undefined)) {
+    return Effect.fail(
+      mailerError("configure", "SMTP username and password must be provided together"),
+    );
+  }
+  return Effect.succeed(
+    nodemailer.createTransport({
+      host: config.host,
+      port: config.port,
+      secure: config.secure ?? false,
+      requireTLS: config.requireTls ?? false,
+      auth:
+        config.username && config.password
+          ? {
+              user: config.username,
+              pass: Redacted.value(config.password),
+            }
+          : undefined,
+      connectionTimeout: config.connectionTimeoutMillis ?? 10_000,
+      greetingTimeout: config.greetingTimeoutMillis ?? 10_000,
+      tls: {
+        rejectUnauthorized: config.tlsRejectUnauthorized ?? true,
+      },
+    }),
+  );
+};
+
+/** SMTP-backed mailer with optional authenticated TLS and startup verification. */
+export const SmtpMailerLive = (
+  config: SmtpMailerConfig,
+): Layer.Layer<Mailer, MailerError> =>
+  Layer.effect(
+    Mailer,
+    Effect.acquireRelease(
+      makeTransporter(config).pipe(
+        Effect.tap((transporter) =>
+          config.verifyOnStart
+            ? Effect.tryPromise({
+                try: () => transporter.verify(),
+                catch: (cause) => mailerError("verify", cause),
+              }).pipe(Effect.asVoid)
+            : Effect.void,
+        ),
+      ),
+      (transporter) => Effect.sync(() => transporter.close()),
+    ).pipe(Effect.map((transporter) => makeMailer(transporter, config))),
+  );
diff --git a/selfhost/platform/src/MemoryDurableEntity.ts b/selfhost/platform/src/MemoryDurableEntity.ts
new file mode 100644
index 000000000..4868b20c8
--- /dev/null
+++ b/selfhost/platform/src/MemoryDurableEntity.ts
@@ -0,0 +1,109 @@
+import {
+  DurableEntityAlarmControl,
+  type DurableEntityAlarmControlShape,
+  type DurableEntityAddress,
+  type DurableEntityContext,
+  DurableEntityHost,
+  type DurableEntityHostShape,
+  type DurableEntitySession,
+} from "@voidhash/platform/DurableEntity";
+import { Context, Effect, Layer, Semaphore } from "effect";
+
+interface MemoryEntityState {
+  readonly address: DurableEntityAddress;
+  readonly lock: Semaphore.Semaphore;
+  readonly values: Map<string, unknown>;
+  readonly sessions: Map<string, DurableEntitySession>;
+  alarm: number | undefined;
+}
+
+const entityKey = (type: string, id: string): string => `${type}\u0000${id}`;
+
+/** An in-memory entity host paired with the control plane over its alarms. */
+export interface MemoryDurableEntity {
+  readonly host: DurableEntityHostShape;
+  readonly control: DurableEntityAlarmControlShape;
+}
+
+/**
+ * Builds an isolated in-memory durable entity host and its alarm control
+ * plane. Operations for one address are FIFO-serialized; different addresses
+ * may run concurrently.
+ */
+export const makeMemoryDurableEntity = (): MemoryDurableEntity => {
+  const states = new Map<string, MemoryEntityState>();
+
+  const stateFor = (address: DurableEntityAddress): MemoryEntityState => {
+    const key = entityKey(address.type, address.id);
+    let state = states.get(key);
+    if (!state) {
+      state = {
+        address,
+        lock: Semaphore.makeUnsafe(1),
+        values: new Map(),
+        sessions: new Map(),
+        alarm: undefined,
+      };
+      states.set(key, state);
+    }
+    return state;
+  };
+
+  const host = DurableEntityHost.of({
+    run: (address, operation) =>
+      Effect.suspend(() => {
+        const state = stateFor(address);
+        const context: DurableEntityContext = {
+          address,
+          keyValue: {
+            get: (key) => Effect.sync(() => state.values.get(key)),
+            put: (key, value) => Effect.sync(() => void state.values.set(key, value)),
+            delete: (key) => Effect.sync(() => void state.values.delete(key)),
+          },
+          alarm: {
+            get: Effect.sync(() => state.alarm),
+            set: (scheduledTime) => Effect.sync(() => void (state.alarm = scheduledTime)),
+            delete: Effect.sync(() => void (state.alarm = undefined)),
+          },
+          sessions: {
+            get: (sessionId) => Effect.sync(() => state.sessions.get(sessionId)),
+            list: Effect.sync(() => [...state.sessions.values()]),
+            attach: (session) =>
+              Effect.sync(() => void state.sessions.set(session.id, session)),
+            remove: (sessionId) => Effect.sync(() => void state.sessions.delete(sessionId)),
+          },
+        };
+        return state.lock.withPermit(Effect.suspend(() => operation(context)));
+      }),
+  });
+
+  const control = DurableEntityAlarmControl.of({
+    listDueAlarms: (now, limit) =>
+      Effect.sync(() =>
+        [...states.values()]
+          .flatMap((state) =>
+            state.alarm !== undefined && state.alarm <= now
+              ? [{ address: state.address, scheduledTime: state.alarm }]
+              : [],
+          )
+          .sort((left, right) => left.scheduledTime - right.scheduledTime)
+          .slice(0, Math.max(0, Math.floor(limit))),
+      ),
+  });
+
+  return { host, control };
+};
+
+/** Builds an isolated in-memory durable entity host. */
+export const makeMemoryDurableEntityHost = (): DurableEntityHostShape =>
+  makeMemoryDurableEntity().host;
+
+/** In-memory entity host layer for tests and ephemeral local development. */
+export const MemoryDurableEntityHostLive: Layer.Layer<
+  DurableEntityHost | DurableEntityAlarmControl
+> = Layer.syncContext(() => {
+  const memory = makeMemoryDurableEntity();
+  return Context.make(DurableEntityHost, memory.host).pipe(
+    Context.add(DurableEntityAlarmControl, memory.control),
+  );
+});
diff --git a/selfhost/platform/src/NodeDurableEntitySession.ts b/selfhost/platform/src/NodeDurableEntitySession.ts
new file mode 100644
index 000000000..5a2493ea4
--- /dev/null
+++ b/selfhost/platform/src/NodeDurableEntitySession.ts
@@ -0,0 +1,36 @@
+import type { DurableEntitySession } from "@voidhash/platform/DurableEntity";
+import { Effect } from "effect";
+
+/** Minimal server-side WebSocket surface needed by the entity session adapter. */
+export interface NodeWebSocketLike {
+  readonly send: (message: string | Uint8Array) => unknown;
+  readonly close: (code?: number, reason?: string) => unknown;
+}
+
+/**
+ * Wraps a Node WebSocket connection as a runtime-neutral durable entity
+ * session. Attachments remain in memory for the connection lifetime.
+ */
+export const makeNodeDurableEntitySession = (
+  id: string,
+  socket: NodeWebSocketLike,
+  initialAttachment?: unknown,
+): DurableEntitySession => {
+  let attachment = initialAttachment;
+  return {
+    id,
+    send: (message) =>
+      Effect.sync(() => {
+        socket.send(message);
+      }),
+    close: (code, reason) =>
+      Effect.sync(() => {
+        socket.close(code, reason);
+      }),
+    getAttachment: Effect.sync(() => attachment),
+    setAttachment: (nextAttachment) =>
+      Effect.sync(() => {
+        attachment = nextAttachment;
+      }),
+  };
+};
diff --git a/selfhost/platform/src/ObjectStore.ts b/selfhost/platform/src/ObjectStore.ts
new file mode 100644
index 000000000..104db594a
--- /dev/null
+++ b/selfhost/platform/src/ObjectStore.ts
@@ -0,0 +1,142 @@
+import { S3 } from "@effect-aws/client-s3";
+import {
+  ObjectStore,
+  ObjectStoreError,
+  type ObjectStoreShape,
+} from "@voidhash/platform/ObjectStore";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { Effect, Layer, Option, Redacted } from "effect";
+
+/** S3-compatible connection and bucket parameters. */
+export interface S3ObjectStoreConfig {
+  readonly bucketName: string;
+  readonly region: string;
+  readonly endpoint?: string;
+  readonly accessKeyId: string;
+  readonly secretAccessKey: Redacted.Redacted<string>;
+  readonly forcePathStyle?: boolean;
+}
+
+const storeError = (
+  config: S3ObjectStoreConfig,
+  key: string,
+  operation: string,
+  cause: unknown,
+) =>
+  new ObjectStoreError({
+    bucketName: config.bucketName,
+    key,
+    operation,
+    cause: String(cause),
+  });
+
+const isNotFound = (error: unknown): boolean => {
+  if (typeof error !== "object" || error === null) return false;
+  const tagged = error as { readonly _tag?: unknown };
+  return tagged._tag === "NoSuchKey" || tagged._tag === "NotFound";
+};
+
+const makeStore = (
+  config: S3ObjectStoreConfig,
+  client: S3.Type,
+): ObjectStoreShape => ({
+  bucketName: config.bucketName,
+  put: ({ key, body, contentType, cacheControl }) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(
+        client.putObject({
+          Bucket: config.bucketName,
+          Key: key,
+          Body: body,
+          ContentType: contentType,
+          CacheControl: cacheControl,
+        }),
+      ),
+      Effect.asVoid,
+      Effect.mapError((cause) => storeError(config, key, "put", cause)),
+    ),
+  get: (key) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(client.getObject({ Bucket: config.bucketName, Key: key })),
+      Effect.flatMap((output) => {
+        const stream = output.Body;
+        if (!stream) {
+          return Effect.fail(storeError(config, key, "get", "response body is missing"));
+        }
+        return Effect.tryPromise({
+          try: () => stream.transformToByteArray(),
+          catch: (cause) => storeError(config, key, "get", cause),
+        }).pipe(
+          Effect.map((body) =>
+            Option.some({
+              body,
+              contentType: output.ContentType ?? null,
+              etag: output.ETag ?? null,
+              size: output.ContentLength ?? body.byteLength,
+            }),
+          ),
+        );
+      }),
+      Effect.catch((cause) =>
+        isNotFound(cause)
+          ? Effect.succeedNone
+          : Effect.fail(
+              cause instanceof ObjectStoreError
+                ? cause
+                : storeError(config, key, "get", cause),
+            ),
+      ),
+    ),
+  head: (key) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(client.headObject({ Bucket: config.bucketName, Key: key })),
+      Effect.map((output) =>
+        Option.some({
+          contentType: output.ContentType ?? null,
+          etag: output.ETag ?? null,
+          size: output.ContentLength ?? 0,
+        }),
+      ),
+      Effect.catch((cause) =>
+        isNotFound(cause)
+          ? Effect.succeedNone
+          : Effect.fail(storeError(config, key, "head", cause)),
+      ),
+    ),
+  delete: (key) =>
+    PlatformRuntime.pipe(
+      Effect.andThen(client.deleteObject({ Bucket: config.bucketName, Key: key })),
+      Effect.asVoid,
+      Effect.mapError((cause) => storeError(config, key, "delete", cause)),
+    ),
+});
+
+/** S3-compatible object store layer for AWS S3, MinIO, Garage, or R2. */
+export const S3ObjectStoreLive = (
+  config: S3ObjectStoreConfig,
+): Layer.Layer<ObjectStore> =>
+  Layer.effect(
+    ObjectStore,
+    Effect.map(S3, (client) => makeStore(config, client)),
+  ).pipe(
+    Layer.provide(
+      S3.layer({
+        region: config.region,
+        endpoint: config.endpoint,
+        forcePathStyle: config.forcePathStyle ?? config.endpoint !== undefined,
+        // AWS SDK v3 enables CRC32 checksums by default. Some S3-compatible
+        // stores reject those optional headers, so custom endpoints use the
+        // compatibility mode while native AWS S3 retains its stronger default.
+        ...(config.endpoint === undefined
+          ? {}
+          : {
+              requestChecksumCalculation: "WHEN_REQUIRED" as const,
+              responseChecksumValidation: "WHEN_REQUIRED" as const,
+            }),
+        credentials: {
+          accessKeyId: config.accessKeyId,
+          secretAccessKey: Redacted.value(config.secretAccessKey),
+        },
+      }),
+    ),
+  );
diff --git a/selfhost/platform/src/PlatformRuntime.ts b/selfhost/platform/src/PlatformRuntime.ts
new file mode 100644
index 000000000..1ffa97432
--- /dev/null
+++ b/selfhost/platform/src/PlatformRuntime.ts
@@ -0,0 +1,13 @@
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { Layer } from "effect";
+
+/**
+ * Marks effects as running inside a configured self-host runtime.
+ *
+ * The marker carries no capabilities; it exists so application code cannot
+ * reach a platform primitive without a composition root having installed one.
+ */
+export const SelfhostPlatformRuntimeLive: Layer.Layer<PlatformRuntime> = Layer.succeed(
+  PlatformRuntime,
+  PlatformRuntime.of({}),
+);
diff --git a/selfhost/platform/src/Postgres.ts b/selfhost/platform/src/Postgres.ts
new file mode 100644
index 000000000..daacb7bc1
--- /dev/null
+++ b/selfhost/platform/src/Postgres.ts
@@ -0,0 +1,24 @@
+import * as PgClient from "@effect/sql-pg/PgClient";
+import type { Redacted } from "effect";
+import type { ConnectionOptions } from "node:tls";
+
+/** Postgres connection parameters shared by single-node platform adapters. */
+export interface PgPlatformConfig {
+  readonly host: string;
+  readonly port: number;
+  readonly database: string;
+  readonly username: string;
+  readonly password: Redacted.Redacted<string>;
+  readonly ssl?: boolean | ConnectionOptions;
+}
+
+/** Builds a Postgres client layer for a single-node platform adapter. */
+export const PgPlatformClientLive = (config: PgPlatformConfig) =>
+  PgClient.layer({
+    host: config.host,
+    port: config.port,
+    database: config.database,
+    username: config.username,
+    password: config.password,
+    ssl: config.ssl,
+  });
diff --git a/selfhost/platform/src/Queue.ts b/selfhost/platform/src/Queue.ts
new file mode 100644
index 000000000..24364c96b
--- /dev/null
+++ b/selfhost/platform/src/Queue.ts
@@ -0,0 +1,292 @@
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import {
+  QueueConsumerError,
+  type QueueConsumerOptions,
+  QueueDriver,
+  type QueueDriverShape,
+  QueueProducerError,
+  type QueueProducer,
+} from "@voidhash/platform/Queue";
+import { Cause, Duration, Effect, Layer, Schema, SchemaParser } from "effect";
+import { PersistedQueue } from "effect/unstable/persistence";
+
+/**
+ * Messages are persisted as JSON text rather than as the caller's schema.
+ *
+ * Decoding inside the queue would surface a malformed payload as a take
+ * failure, which the store would then retry forever. Owning the decode step
+ * lets a poison message be acknowledged and logged, matching the contract's
+ * at-least-once-with-bounded-retries guarantee.
+ */
+const transportSchema = Schema.String;
+
+type TransportQueue = PersistedQueue.PersistedQueue<string, never>;
+
+const defaultOptions = {
+  batchSize: 10,
+  maxRetries: 3,
+  retryDelayMillis: 1_000,
+  pollIntervalMillis: 250,
+} as const;
+
+const positiveInteger = (value: number | undefined, fallback: number): number =>
+  value === undefined || !Number.isFinite(value) || value <= 0 ? fallback : Math.floor(value);
+
+const nonNegativeInteger = (value: number | undefined, fallback: number): number =>
+  value === undefined || !Number.isFinite(value) || value < 0 ? fallback : Math.floor(value);
+
+const resolvedOptions = (options: QueueConsumerOptions | undefined) => ({
+  batchSize: positiveInteger(options?.batchSize, defaultOptions.batchSize),
+  maxRetries: nonNegativeInteger(options?.maxRetries, defaultOptions.maxRetries),
+  retryDelayMillis: nonNegativeInteger(options?.retryDelayMillis, defaultOptions.retryDelayMillis),
+  pollIntervalMillis: positiveInteger(options?.pollIntervalMillis, defaultOptions.pollIntervalMillis),
+  deadLetterQueue: options?.deadLetterQueue,
+});
+
+const producerError = (queueName: string, cause: unknown) =>
+  new QueueProducerError({ queueName, cause: String(cause) });
+
+const consumerError = (queueName: string, cause: unknown) =>
+  new QueueConsumerError({ queueName, cause: String(cause) });
+
+/**
+ * Signals that a handler failed and the message should go back to the store.
+ *
+ * The store decides ack-versus-retry from the take effect's outcome, so a
+ * retry has to surface as a failure. Tagging it keeps the driver from
+ * mistaking a genuine store or SQL failure for an ordinary retry.
+ */
+class HandlerRetry {
+  readonly _tag = "HandlerRetry";
+}
+
+const encodeJson = (value: unknown): Effect.Effect<string, unknown> =>
+  Effect.try({
+    try: () => {
+      const encoded = JSON.stringify(value);
+      if (encoded === undefined) throw new TypeError("Queue messages must be JSON-serializable");
+      return encoded;
+    },
+    catch: (cause) => cause,
+  });
+
+const makeQueueDriver = (
+  factory: PersistedQueue.PersistedQueueFactory["Service"],
+): QueueDriverShape => {
+  const queues = new Map<string, TransportQueue>();
+
+  /**
+   * Returns the one persisted queue instance for a logical name.
+   *
+   * Producers and consumers must share an instance: a backing store can attach
+   * per-instance state such as poll registrations, so handing out a fresh
+   * instance per call leaves published messages undelivered.
+   */
+  const queueFor = (queueName: string): Effect.Effect<TransportQueue> =>
+    Effect.suspend(() => {
+      const existing = queues.get(queueName);
+      if (existing) return Effect.succeed(existing);
+      return factory.make({ name: queueName, schema: transportSchema }).pipe(
+        Effect.tap((queue) => Effect.sync(() => void queues.set(queueName, queue as TransportQueue))),
+        Effect.orDie,
+      ) as unknown as Effect.Effect<TransportQueue>;
+    });
+
+  const producer = <A, I>(
+    queueName: string,
+    schema: Schema.Codec<A, I>,
+  ): QueueProducer<A> => {
+    const encode = SchemaParser.encodeUnknownEffect(schema);
+
+    const publishOne = (message: A) =>
+      Effect.gen(function* () {
+        const queue = yield* queueFor(queueName);
+        const encoded = yield* encode(message);
+        const body = yield* encodeJson(encoded);
+        yield* queue.offer(body);
+      });
+
+    return {
+      publish: (message) =>
+        PlatformRuntime.pipe(
+          Effect.andThen(publishOne(message)),
+          Effect.mapError((cause) => producerError(queueName, cause)),
+        ),
+      // The persisted store has no multi-offer primitive, so a batch is a
+      // sequence of offers. Publishing is idempotent per message, not atomic
+      // across the batch.
+      publishBatch: (messages) =>
+        PlatformRuntime.pipe(
+          Effect.andThen(Effect.forEach(messages, publishOne, { discard: true })),
+          Effect.mapError((cause) => producerError(queueName, cause)),
+        ),
+    };
+  };
+
+  /**
+   * Handles at most one message.
+   *
+   * The store decides ack-versus-retry from this effect's outcome: succeeding
+   * acknowledges, failing returns the message for another attempt. Poison
+   * payloads and exhausted retries therefore succeed on purpose, after being
+   * logged or routed to the dead-letter queue.
+   */
+  const handleOne = <A, I, R>(
+    queueName: string,
+    schema: Schema.Codec<A, I>,
+    handleBatch: (messages: ReadonlyArray<A>) => Effect.Effect<void, unknown, R>,
+    options: ReturnType<typeof resolvedOptions>,
+    claim: { claimed: boolean },
+  ) =>
+    Effect.gen(function* () {
+      const queue = yield* queueFor(queueName);
+      const decode = SchemaParser.decodeUnknownEffect(schema);
+
+      return yield* queue.take(
+        (body, metadata) =>
+          Effect.gen(function* () {
+            claim.claimed = true;
+            const parsed = yield* Effect.try({
+              try: () => JSON.parse(body) as unknown,
+              catch: (cause) => cause,
+            }).pipe(
+              Effect.matchEffect({
+                onFailure: () => Effect.succeedNone,
+                onSuccess: (value: unknown) => Effect.succeedSome(value),
+              }),
+            );
+
+            if (parsed._tag === "None") {
+              yield* Effect.logWarning("queue payload is not valid JSON; acking poison message", {
+                queueName,
+                messageId: metadata.id,
+              });
+              return;
+            }
+
+            const decoded = yield* decode(parsed.value).pipe(
+              Effect.matchCauseEffect({
+                onFailure: (cause) =>
+                  Effect.logWarning("queue payload decode failed; acking poison message", {
+                    queueName,
+                    messageId: metadata.id,
+                    cause: Cause.pretty(cause),
+                  }).pipe(Effect.as(undefined)),
+                onSuccess: (message) => Effect.succeed(message),
+              }),
+            );
+            if (decoded === undefined) return;
+
+            yield* handleBatch([decoded]).pipe(
+              Effect.catchCause((cause) =>
+                Effect.gen(function* () {
+                  // `attempts` counts prior failed deliveries, so it is 0 the
+                  // first time a message is handled: a queue configured with
+                  // zero retries dead-letters immediately.
+                  if (metadata.attempts < options.maxRetries) {
+                    // Hand the message back to the store for another attempt.
+                    yield* Effect.logDebug("queue handler failed; returning message", {
+                      queueName,
+                      messageId: metadata.id,
+                      cause: Cause.pretty(cause),
+                    });
+                    return yield* Effect.fail(new HandlerRetry());
+                  }
+                  yield* Effect.logWarning("queue message exhausted retries", {
+                    queueName,
+                    messageId: metadata.id,
+                    attempts: metadata.attempts,
+                    cause: Cause.pretty(cause),
+                  });
+                  if (options.deadLetterQueue) {
+                    const dlq = yield* queueFor(options.deadLetterQueue);
+                    yield* dlq.offer(body);
+                  }
+                }),
+              ),
+            );
+          }),
+        // Retry accounting is this driver's job, not the store's, so the store
+        // is told never to give up. The bound stays inside a 32-bit integer
+        // because SQL stores compare it against an INT column.
+        { maxAttempts: 2_000_000_000 },
+      );
+    });
+
+  const processBatch = <A, I, R>(
+    queueName: string,
+    schema: Schema.Codec<A, I>,
+    handleBatch: (messages: ReadonlyArray<A>) => Effect.Effect<void, unknown, R>,
+    inputOptions: QueueConsumerOptions | undefined,
+  ) => {
+    const options = resolvedOptions(inputOptions);
+    return PlatformRuntime.pipe(
+      Effect.andThen(Effect.sync(() => ({ claimed: false }))),
+      Effect.flatMap((claim) =>
+        // `take` waits for a message, but `processBatch` must report an empty
+        // queue instead of blocking, so the wait is bounded by the poll
+        // interval. Interrupting the wait releases no lock, since nothing was
+        // claimed yet.
+        Effect.scoped(handleOne(queueName, schema, handleBatch, options, claim)).pipe(
+          Effect.timeoutOption(Duration.millis(options.pollIntervalMillis)),
+          // A failing handler is ordinary queue behaviour, not a driver
+          // failure: the store has already recorded the attempt by the time the
+          // scope closes, so the claim is reported rather than raised. Catching
+          // outside the scope is what lets the store see the failure at all.
+          // Store and SQL failures are deliberately left to propagate.
+          Effect.catchIf(
+            (error): error is HandlerRetry =>
+              typeof error === "object" && error !== null && "_tag" in error &&
+              (error as { _tag?: unknown })._tag === "HandlerRetry",
+            () => Effect.void,
+          ),
+          Effect.map(() => (claim.claimed ? 1 : 0)),
+        ),
+      ),
+      Effect.mapError((cause) => consumerError(queueName, cause)),
+    );
+  };
+
+  return {
+    producer,
+    processBatch,
+    consumeBatch: (queueName, schema, handleBatch, options) => {
+      const resolved = resolvedOptions(options);
+      return Effect.forever(
+        Effect.suspend(() =>
+          Effect.scoped(
+            handleOne(queueName, schema, handleBatch, resolved, { claimed: false }),
+          ).pipe(
+            Effect.catchCause((cause) =>
+              Effect.logDebug("queue message returned for retry", {
+                queueName,
+                cause: Cause.pretty(cause),
+              }).pipe(Effect.andThen(Effect.sleep(Duration.millis(resolved.retryDelayMillis)))),
+            ),
+          ),
+        ),
+      );
+    },
+  } as QueueDriverShape;
+};
+
+/**
+ * Queue driver backed by Effect's persisted queue.
+ *
+ * Messages are delivered one at a time, so a consumer's batch always holds a
+ * single message; retries and dead-lettering are therefore per message rather
+ * than per batch.
+ *
+ * Note for SQL-backed stores: `processBatch` gives up after
+ * `pollIntervalMillis`, so that window must exceed the store's own poll
+ * interval, or a non-empty queue can look empty. The SQL store defaults to one
+ * second, which is longer than this driver's default claim window.
+ */
+export const ClusterQueueLive: Layer.Layer<
+  QueueDriver,
+  never,
+  PersistedQueue.PersistedQueueFactory
+> = Layer.effect(
+  QueueDriver,
+  Effect.map(PersistedQueue.PersistedQueueFactory, makeQueueDriver),
+);
diff --git a/selfhost/platform/src/Screenshot.ts b/selfhost/platform/src/Screenshot.ts
new file mode 100644
index 000000000..7e5be28f6
--- /dev/null
+++ b/selfhost/platform/src/Screenshot.ts
@@ -0,0 +1,143 @@
+import {
+  Screenshot,
+  ScreenshotError,
+  type ScreenshotOptions,
+  type ScreenshotShape,
+} from "@voidhash/platform/Screenshot";
+import { PlatformRuntime } from "@voidhash/platform/PlatformRuntime";
+import { Effect, Layer } from "effect";
+import { chromium, type Browser } from "playwright-core";
+
+/** Headless Chromium launch and resource limits. */
+export interface ChromiumScreenshotConfig {
+  readonly executablePath?: string;
+  readonly disableSandbox?: boolean;
+  readonly timeoutMillis?: number;
+  readonly maxWidth?: number;
+  readonly maxHeight?: number;
+  readonly maxDeviceScaleFactor?: number;
+  readonly maxHtmlBytes?: number;
+  readonly maxRenderedPixels?: number;
+}
+
+const screenshotError = (operation: string, cause: unknown) =>
+  new ScreenshotError({ operation, cause: String(cause) });
+
+const positiveInteger = (value: number, maximum: number): boolean =>
+  Number.isInteger(value) && value > 0 && value <= maximum;
+
+/** Validates screenshot memory and viewport budgets before Chromium is invoked. */
+export const validateChromiumScreenshotOptions = (
+  options: ScreenshotOptions,
+  config: ChromiumScreenshotConfig,
+): Effect.Effect<void, ScreenshotError> => {
+  const maxWidth = config.maxWidth ?? 4_096;
+  const maxHeight = config.maxHeight ?? 4_096;
+  const maxScale = config.maxDeviceScaleFactor ?? 4;
+  const maxHtmlBytes = config.maxHtmlBytes ?? 4 * 1_024 * 1_024;
+  const maxRenderedPixels = config.maxRenderedPixels ?? 16_777_216;
+  if (!positiveInteger(options.width, maxWidth)) {
+    return Effect.fail(screenshotError("validate", `width must be between 1 and ${maxWidth}`));
+  }
+  if (!positiveInteger(options.height, maxHeight)) {
+    return Effect.fail(screenshotError("validate", `height must be between 1 and ${maxHeight}`));
+  }
+  if (
+    !Number.isFinite(options.deviceScaleFactor) ||
+    options.deviceScaleFactor < 1 ||
+    options.deviceScaleFactor > maxScale
+  ) {
+    return Effect.fail(
+      screenshotError("validate", `deviceScaleFactor must be between 1 and ${maxScale}`),
+    );
+  }
+  if (new TextEncoder().encode(options.html).byteLength > maxHtmlBytes) {
+    return Effect.fail(screenshotError("validate", `html must be at most ${maxHtmlBytes} bytes`));
+  }
+  const renderedPixels =
+    options.width * options.height * options.deviceScaleFactor * options.deviceScaleFactor;
+  if (renderedPixels > maxRenderedPixels) {
+    return Effect.fail(
+      screenshotError("validate", `rendered image must be at most ${maxRenderedPixels} pixels`),
+    );
+  }
+  return Effect.void;
+};
+
+const render = (browser: Browser, config: ChromiumScreenshotConfig, options: ScreenshotOptions) =>
+  validateChromiumScreenshotOptions(options, config).pipe(
+    Effect.andThen(
+      Effect.acquireUseRelease(
+        Effect.tryPromise({
+          try: () =>
+            browser.newContext({
+              viewport: { width: Math.floor(options.width), height: Math.floor(options.height) },
+              deviceScaleFactor: options.deviceScaleFactor,
+              javaScriptEnabled: false,
+              serviceWorkers: "block",
+            }),
+          catch: (cause) => screenshotError("openContext", cause),
+        }),
+        (context) =>
+          Effect.tryPromise({
+            try: async () => {
+              await context.setOffline(true);
+              const page = await context.newPage();
+              await page.route("**/*", (route) => route.abort("blockedbyclient"));
+              await page.setContent(options.html, {
+                waitUntil: "load",
+                timeout: config.timeoutMillis ?? 15_000,
+              });
+              return new Uint8Array(
+                await page.screenshot({
+                  type: "png",
+                  fullPage: false,
+                  animations: "disabled",
+                  timeout: config.timeoutMillis ?? 15_000,
+                }),
+              );
+            },
+            catch: (cause) => screenshotError("render", cause),
+          }),
+        (context) =>
+          Effect.promise(() => context.close()).pipe(
+            Effect.catchCause((cause) =>
+              Effect.logWarning("failed to close screenshot browser context", {
+                cause: String(cause),
+              }),
+            ),
+          ),
+      ),
+    ),
+  );
+
+const makeRenderer = (browser: Browser, config: ChromiumScreenshotConfig): ScreenshotShape => ({
+  renderPng: (options) => PlatformRuntime.pipe(Effect.andThen(render(browser, config, options))),
+});
+
+/** Chromium-backed PNG screenshot layer with network and JavaScript disabled. */
+export const ChromiumScreenshotLive = (
+  config: ChromiumScreenshotConfig = {},
+): Layer.Layer<Screenshot, ScreenshotError> =>
+  Layer.effect(
+    Screenshot,
+    Effect.acquireRelease(
+      Effect.tryPromise({
+        try: () =>
+          chromium.launch({
+            executablePath: config.executablePath ?? process.env.CHROMIUM_EXECUTABLE_PATH,
+            headless: true,
+            args: ["--disable-dev-shm-usage", ...(config.disableSandbox ? ["--no-sandbox"] : [])],
+          }),
+        catch: (cause) => screenshotError("launch", cause),
+      }),
+      (browser) =>
+        Effect.promise(() => browser.close()).pipe(
+          Effect.catchCause((cause) =>
+            Effect.logWarning("failed to close screenshot browser", {
+              cause: String(cause),
+            }),
+          ),
+        ),
+    ).pipe(Effect.map((browser) => makeRenderer(browser, config))),
+  );
diff --git a/selfhost/platform/src/Topology.ts b/selfhost/platform/src/Topology.ts
new file mode 100644
index 000000000..82d15c7b4
--- /dev/null
+++ b/selfhost/platform/src/Topology.ts
@@ -0,0 +1,44 @@
+import type { Config, Layer } from "effect";
+import type { SqlClient } from "effect/unstable/sql";
+import {
+  MessageStorage,
+  type Runners,
+  type Sharding,
+  type ShardingConfig,
+  SingleRunner,
+  TestRunner,
+} from "effect/unstable/cluster";
+
+/**
+ * Cluster services every cluster-backed adapter needs in context.
+ *
+ * A topology decides how those services are backed: one process with durable
+ * SQL mailboxes, many processes over a network transport, or an ephemeral
+ * in-memory cluster for tests. Adapters never name a topology themselves, so a
+ * deployment can move between them without touching adapter code.
+ */
+export type ClusterTopology = Sharding.Sharding | Runners.Runners | MessageStorage.MessageStorage;
+
+/**
+ * Single-process cluster over the ambient SQL client.
+ *
+ * This is the default self-host topology: one runner owns every shard, while
+ * mailboxes, workflow state, and cron slots persist in SQL so nothing is lost
+ * across restarts.
+ */
+export const SingleNodeClusterLive = (options?: {
+  readonly shardingConfig?: Partial<ShardingConfig.ShardingConfig["Service"]>;
+  readonly runnerStorage?: "memory" | "sql";
+}): Layer.Layer<ClusterTopology, Config.ConfigError, SqlClient.SqlClient> =>
+  SingleRunner.layer({
+    shardingConfig: options?.shardingConfig,
+    runnerStorage: options?.runnerStorage ?? "sql",
+  });
+
+/**
+ * Fully in-memory cluster with no SQL dependency, for tests and ephemeral
+ * local development. State does not survive the process.
+ */
+export const TestClusterLive: Layer.Layer<
+  ClusterTopology | MessageStorage.MemoryDriver
+> = TestRunner.layer;
diff --git a/selfhost/platform/src/Workflow.ts b/selfhost/platform/src/Workflow.ts
new file mode 100644
index 000000000..e6c850e06
--- /dev/null
+++ b/selfhost/platform/src/Workflow.ts
@@ -0,0 +1,17 @@
+import * as EffectWorkflowRunner from "@voidhash/platform/EffectWorkflowRunner";
+import type { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
+import { Layer } from "effect";
+import { ClusterWorkflowEngine, type MessageStorage, type Sharding } from "effect/unstable/cluster";
+
+/**
+ * Durable workflow runner backed by Effect Cluster.
+ *
+ * Each workflow execution becomes a cluster entity keyed by its execution ID,
+ * so activities, durable clocks, and suspended runs persist in the cluster's
+ * message storage rather than in a bespoke engine.
+ */
+export const layer: Layer.Layer<
+  WorkflowRunner,
+  never,
+  Sharding.Sharding | MessageStorage.MessageStorage
+> = EffectWorkflowRunner.layer.pipe(Layer.provide(ClusterWorkflowEngine.layer));
diff --git a/selfhost/platform/src/index.ts b/selfhost/platform/src/index.ts
new file mode 100644
index 000000000..3c8fac3bf
--- /dev/null
+++ b/selfhost/platform/src/index.ts
@@ -0,0 +1,33 @@
+export {
+  ClusterDurableEntityControlLive,
+  ClusterDurableEntityHostLive,
+  makeClusterDurableEntityHost,
+  PgClusterDurableEntityLive,
+} from "./ClusterDurableEntity.ts";
+export { ClusterCronSchedulerLive } from "./CronScheduler.ts";
+export {
+  DurableEntityAlarmStore,
+  type DurableEntityAlarmStoreShape,
+  makeMemoryEntityAlarmStore,
+  MemoryEntityAlarmStoreLive,
+  PgEntityAlarmStoreLive,
+} from "./EntityAlarmStore.ts";
+export { PgKeyValueStoreLive } from "./KeyValueStore.ts";
+export { SmtpMailerLive, type SmtpMailerConfig } from "./Mailer.ts";
+export {
+  makeMemoryDurableEntity,
+  makeMemoryDurableEntityHost,
+  type MemoryDurableEntity,
+  MemoryDurableEntityHostLive,
+} from "./MemoryDurableEntity.ts";
+export {
+  makeNodeDurableEntitySession,
+  type NodeWebSocketLike,
+} from "./NodeDurableEntitySession.ts";
+export { S3ObjectStoreLive, type S3ObjectStoreConfig } from "./ObjectStore.ts";
+export { SelfhostPlatformRuntimeLive } from "./PlatformRuntime.ts";
+export { PgPlatformClientLive, type PgPlatformConfig } from "./Postgres.ts";
+export { ClusterQueueLive } from "./Queue.ts";
+export { ChromiumScreenshotLive, type ChromiumScreenshotConfig } from "./Screenshot.ts";
+export { type ClusterTopology, SingleNodeClusterLive, TestClusterLive } from "./Topology.ts";
+export * as ClusterWorkflowRunner from "./Workflow.ts";
diff --git a/selfhost/platform/tests/ChromiumScreenshot.integration.test.ts b/selfhost/platform/tests/ChromiumScreenshot.integration.test.ts
new file mode 100644
index 000000000..9ead71a9a
--- /dev/null
+++ b/selfhost/platform/tests/ChromiumScreenshot.integration.test.ts
@@ -0,0 +1,97 @@
+import { Screenshot, ScreenshotError } from "@voidhash/platform/Screenshot";
+import { Effect, Layer } from "effect";
+import { createServer } from "node:http";
+import { describe, expect, it } from "vitest";
+
+import { SelfhostPlatformRuntimeLive } from "../src/PlatformRuntime.ts";
+import { ChromiumScreenshotLive } from "../src/Screenshot.ts";
+
+const executablePath =
+  process.env.PLATFORM_SELFHOST_CHROMIUM_EXECUTABLE_PATH ??
+  (process.platform === "darwin"
+    ? "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+    : undefined);
+const screenshotLayer = () =>
+  Layer.merge(ChromiumScreenshotLive({ executablePath }), SelfhostPlatformRuntimeLive);
+
+const pngDimensions = (png: Uint8Array) => {
+  const view = new DataView(png.buffer, png.byteOffset, png.byteLength);
+  return { width: view.getUint32(16), height: view.getUint32(20) };
+};
+
+describe("Chromium screenshot renderer", () => {
+  it("renders a viewport PNG at the requested device scale", async () => {
+    const png = await Effect.runPromise(
+      Effect.gen(function* () {
+        const screenshot = yield* Screenshot;
+        return yield* screenshot.renderPng({
+          html: "<!doctype html><style>html,body{margin:0;background:#123456}</style>",
+          width: 160,
+          height: 90,
+          deviceScaleFactor: 2,
+        });
+      }).pipe(Effect.provide(screenshotLayer())),
+    );
+
+    expect(Array.from(png.subarray(0, 8))).toEqual([137, 80, 78, 71, 13, 10, 26, 10]);
+    expect(pngDimensions(png)).toEqual({ width: 320, height: 180 });
+  });
+
+  it("blocks resource loads and redirecting navigation before any network access", async () => {
+    let requestCount = 0;
+    const server = createServer((_request, response) => {
+      requestCount += 1;
+      response.writeHead(302, { location: "http://169.254.169.254/latest/meta-data/" });
+      response.end();
+    });
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", resolve);
+    });
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+      throw new Error("test server did not expose a TCP port");
+    }
+
+    try {
+      const url = `http://127.0.0.1:${address.port}/blocked.png`;
+      const png = await Effect.runPromise(
+        Effect.gen(function* () {
+          const screenshot = yield* Screenshot;
+          return yield* screenshot.renderPng({
+            html: `<!doctype html>
+              <meta http-equiv="refresh" content="0;url=${url}">
+              <style>@import url("${url}");</style>
+              <img src="${url}">
+              <iframe src="${url}"></iframe>
+              <script>fetch("${url}")</script>`,
+            width: 40,
+            height: 30,
+            deviceScaleFactor: 1,
+          });
+        }).pipe(Effect.provide(screenshotLayer())),
+      );
+
+      expect(pngDimensions(png)).toEqual({ width: 40, height: 30 });
+      expect(requestCount).toBe(0);
+    } finally {
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => (error ? reject(error) : resolve()));
+      });
+    }
+  });
+
+  it("validates viewport limits through the stable error channel", async () => {
+    const error = await Effect.runPromise(
+      Effect.gen(function* () {
+        const screenshot = yield* Screenshot;
+        return yield* screenshot
+          .renderPng({ html: "", width: 0, height: 30, deviceScaleFactor: 1 })
+          .pipe(Effect.flip);
+      }).pipe(Effect.provide(screenshotLayer())),
+    );
+
+    expect(error).toBeInstanceOf(ScreenshotError);
+    expect(error.operation).toBe("validate");
+  });
+});
diff --git a/selfhost/platform/tests/MemoryDurableEntity.test.ts b/selfhost/platform/tests/MemoryDurableEntity.test.ts
new file mode 100644
index 000000000..2626d585d
--- /dev/null
+++ b/selfhost/platform/tests/MemoryDurableEntity.test.ts
@@ -0,0 +1,73 @@
+import { makeDurableEntityAddress } from "@voidhash/platform/DurableEntity";
+import { Effect } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { makeMemoryDurableEntityHost } from "../src/MemoryDurableEntity.ts";
+
+describe("memory durable entity host", () => {
+  it("serializes one address while allowing different addresses to overlap", async () => {
+    const host = makeMemoryDurableEntityHost();
+    const first = makeDurableEntityAddress("document", "first");
+    const second = makeDurableEntityAddress("document", "second");
+    const events: string[] = [];
+
+    await Effect.runPromise(
+      Effect.all(
+        [
+          host.run(first, () =>
+            Effect.gen(function* () {
+              events.push("first:start");
+              yield* Effect.sleep("30 millis");
+              events.push("first:end");
+            }),
+          ),
+          host.run(first, () => Effect.sync(() => void events.push("first:next"))),
+          host.run(second, () =>
+            Effect.gen(function* () {
+              events.push("second:start");
+              yield* Effect.sleep("5 millis");
+              events.push("second:end");
+            }),
+          ),
+        ],
+        { concurrency: "unbounded" },
+      ),
+    );
+
+    expect(events.indexOf("second:end")).toBeLessThan(events.indexOf("first:end"));
+    expect(events.indexOf("first:end")).toBeLessThan(events.indexOf("first:next"));
+  });
+
+  it("retains entity-local KV, alarm, and session state", async () => {
+    const host = makeMemoryDurableEntityHost();
+    const address = makeDurableEntityAddress("document", "stateful");
+    const session = {
+      id: "session-1",
+      send: () => Effect.void,
+      close: () => Effect.void,
+      getAttachment: Effect.succeed(undefined),
+      setAttachment: () => Effect.void,
+    };
+
+    await Effect.runPromise(
+      host.run(address, (entity) =>
+        Effect.gen(function* () {
+          yield* entity.keyValue.put("value", { count: 1 });
+          yield* entity.alarm.set(1234);
+          yield* entity.sessions.attach(session);
+        }),
+      ),
+    );
+
+    const state = await Effect.runPromise(
+      host.run(address, (entity) =>
+        Effect.all({
+          value: entity.keyValue.get("value"),
+          alarm: entity.alarm.get,
+          sessions: entity.sessions.list,
+        }),
+      ),
+    );
+    expect(state).toEqual({ value: { count: 1 }, alarm: 1234, sessions: [session] });
+  });
+});
diff --git a/selfhost/platform/tests/MemoryDurableEntityConformance.test.ts b/selfhost/platform/tests/MemoryDurableEntityConformance.test.ts
new file mode 100644
index 000000000..f16ba10bd
--- /dev/null
+++ b/selfhost/platform/tests/MemoryDurableEntityConformance.test.ts
@@ -0,0 +1,11 @@
+import { durableEntityHostConformance } from "@voidhash/platform/conformance";
+
+import { MemoryDurableEntityHostLive } from "../src/MemoryDurableEntity.ts";
+
+// The shared suite is what keeps adapters interchangeable: the in-memory host
+// and the cluster host answer to exactly the same assertions.
+durableEntityHostConformance({
+  name: "memory",
+  layer: () => MemoryDurableEntityHostLive,
+  supportsAlarmDispatch: () => MemoryDurableEntityHostLive,
+});
diff --git a/selfhost/platform/tests/NodeDurableEntitySession.test.ts b/selfhost/platform/tests/NodeDurableEntitySession.test.ts
new file mode 100644
index 000000000..7d003317c
--- /dev/null
+++ b/selfhost/platform/tests/NodeDurableEntitySession.test.ts
@@ -0,0 +1,27 @@
+import { Effect } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { makeNodeDurableEntitySession } from "../src/NodeDurableEntitySession.ts";
+
+describe("Node durable entity session", () => {
+  it("forwards socket operations and keeps attachments", async () => {
+    const sent: Array<string | Uint8Array> = [];
+    const closed: Array<readonly [number | undefined, string | undefined]> = [];
+    const session = makeNodeDurableEntitySession(
+      "session-1",
+      {
+        send: (message) => void sent.push(message),
+        close: (code, reason) => void closed.push([code, reason]),
+      },
+      { authenticated: false },
+    );
+
+    await Effect.runPromise(session.send("hello"));
+    await Effect.runPromise(session.setAttachment({ authenticated: true }));
+    await Effect.runPromise(session.close(1000, "done"));
+
+    expect(sent).toEqual(["hello"]);
+    expect(await Effect.runPromise(session.getAttachment)).toEqual({ authenticated: true });
+    expect(closed).toEqual([[1000, "done"]]);
+  });
+});
diff --git a/selfhost/platform/tests/PgKeyValueStore.integration.test.ts b/selfhost/platform/tests/PgKeyValueStore.integration.test.ts
new file mode 100644
index 000000000..863132429
--- /dev/null
+++ b/selfhost/platform/tests/PgKeyValueStore.integration.test.ts
@@ -0,0 +1,142 @@
+import { KeyValueStore, KeyValueStoreError } from "@voidhash/platform/KeyValueStore";
+import { Effect, Layer, Option, Redacted, Schema } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { PgKeyValueStoreLive } from "../src/KeyValueStore.ts";
+import { SelfhostPlatformRuntimeLive } from "../src/PlatformRuntime.ts";
+import type { PgPlatformConfig } from "../src/Postgres.ts";
+
+const config: PgPlatformConfig = {
+  host: process.env.PLATFORM_SELFHOST_PG_HOST ?? "127.0.0.1",
+  port: Number(process.env.PLATFORM_SELFHOST_PG_PORT ?? "5432"),
+  database: process.env.PLATFORM_SELFHOST_PG_DATABASE ?? "voidhash",
+  username: process.env.PLATFORM_SELFHOST_PG_USERNAME ?? "voidhash",
+  password: Redacted.make(process.env.PLATFORM_SELFHOST_PG_PASSWORD ?? "password"),
+};
+
+const storeLayer = () => Layer.merge(PgKeyValueStoreLive(config), SelfhostPlatformRuntimeLive);
+
+describe("Postgres key-value store", () => {
+  it("persists typed object and string values across layer restarts", async () => {
+    const namespace = `kv-persistence-${crypto.randomUUID()}`;
+    const profileSchema = Schema.Struct({ name: Schema.String, version: Schema.Number });
+
+    await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* KeyValueStore;
+        yield* store.put(
+          namespace,
+          "profile",
+          { name: "node", version: 1 },
+          profileSchema,
+        );
+        yield* store.put(namespace, "label", "node-string", Schema.String);
+      }).pipe(Effect.provide(storeLayer())),
+    );
+
+    const restored = await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* KeyValueStore;
+        const values = yield* Effect.all({
+          profile: store.get(namespace, "profile", profileSchema),
+          label: store.get(namespace, "label", Schema.String),
+        });
+        yield* store.deleteMany(namespace, ["profile", "label"]);
+        return values;
+      }).pipe(Effect.provide(storeLayer())),
+    );
+
+    expect(Option.getOrThrow(restored.profile)).toEqual({ name: "node", version: 1 });
+    expect(Option.getOrThrow(restored.label)).toBe("node-string");
+  });
+
+  it("supports bulk existence checks and expiry pruning", async () => {
+    const namespace = `kv-expiry-${crypto.randomUUID()}`;
+
+    const result = await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* KeyValueStore;
+        yield* store.putMany(
+          namespace,
+          [
+            { key: "one", value: 1 },
+            { key: "two", value: 2 },
+            { key: "three", value: 3 },
+          ],
+          Schema.Number,
+          // Long enough that the round trip to Postgres for `before` cannot
+          // outlive the entries. A tighter window makes the first assertion race
+          // its own setup and fail under the load of a full suite run.
+          { ttlMillis: 1_000 },
+        );
+        const before = yield* store.existingKeys(namespace, ["one", "two", "three", "missing"]);
+        yield* Effect.sleep("1500 millis");
+        const after = yield* store.existingKeys(namespace, ["one", "two", "three"]);
+        const pruned = yield* store.pruneExpired(10_000);
+        return { before, after, pruned };
+      }).pipe(Effect.provide(storeLayer())),
+    );
+
+    expect(result.before).toEqual(new Set(["one", "two", "three"]));
+    expect(result.after.size).toBe(0);
+    expect(result.pruned).toBeGreaterThanOrEqual(3);
+  });
+
+  it("increments counters atomically under concurrency", async () => {
+    const namespace = `kv-counter-${crypto.randomUUID()}`;
+    const key = "requests";
+
+    const result = await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* KeyValueStore;
+        const increments = yield* Effect.all(
+          Array.from({ length: 50 }, () => store.increment(namespace, key)),
+          { concurrency: "unbounded" },
+        );
+        const stored = yield* store.get(namespace, key, Schema.Number);
+        yield* store.delete(namespace, key);
+        return { increments, stored };
+      }).pipe(Effect.provide(storeLayer())),
+    );
+
+    expect([...result.increments].sort((left, right) => left - right)).toEqual(
+      Array.from({ length: 50 }, (_, index) => index + 1),
+    );
+    expect(Option.getOrThrow(result.stored)).toBe(50);
+  });
+
+  it("restarts an expired counter at one", async () => {
+    const namespace = `kv-counter-expiry-${crypto.randomUUID()}`;
+    const key = "events";
+
+    const values = await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* KeyValueStore;
+        const first = yield* store.increment(namespace, key, { ttlMillis: 20 });
+        yield* Effect.sleep("40 millis");
+        const reset = yield* store.increment(namespace, key, { ttlMillis: 20 });
+        yield* store.delete(namespace, key);
+        return { first, reset };
+      }).pipe(Effect.provide(storeLayer())),
+    );
+
+    expect(values).toEqual({ first: 1, reset: 1 });
+  });
+
+  it("maps schema mismatches to the stable store error", async () => {
+    const namespace = `kv-schema-${crypto.randomUUID()}`;
+
+    const error = await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* KeyValueStore;
+        yield* store.put(namespace, "value", "text", Schema.String);
+        const failure = yield* store.get(namespace, "value", Schema.Number).pipe(Effect.flip);
+        yield* store.delete(namespace, "value");
+        return failure;
+      }).pipe(Effect.provide(storeLayer())),
+    );
+
+    expect(error).toBeInstanceOf(KeyValueStoreError);
+    expect(error.operation).toBe("get");
+  });
+});
diff --git a/selfhost/platform/tests/S3ObjectStore.integration.test.ts b/selfhost/platform/tests/S3ObjectStore.integration.test.ts
new file mode 100644
index 000000000..989258018
--- /dev/null
+++ b/selfhost/platform/tests/S3ObjectStore.integration.test.ts
@@ -0,0 +1,82 @@
+import { ObjectStore, ObjectStoreError } from "@voidhash/platform/ObjectStore";
+import { Effect, Layer, Option, Redacted } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { S3ObjectStoreLive, type S3ObjectStoreConfig } from "../src/ObjectStore.ts";
+import { SelfhostPlatformRuntimeLive } from "../src/PlatformRuntime.ts";
+
+const config: S3ObjectStoreConfig = {
+  bucketName: process.env.PLATFORM_SELFHOST_S3_BUCKET ?? "voidhash-public",
+  region: process.env.PLATFORM_SELFHOST_S3_REGION ?? "us-east-1",
+  endpoint: process.env.PLATFORM_SELFHOST_S3_ENDPOINT ?? "http://127.0.0.1:9000",
+  accessKeyId: process.env.PLATFORM_SELFHOST_S3_ACCESS_KEY_ID ?? "voidhash",
+  secretAccessKey: Redacted.make(
+    process.env.PLATFORM_SELFHOST_S3_SECRET_ACCESS_KEY ?? "password",
+  ),
+  forcePathStyle: true,
+};
+
+const storeLayer = (input: S3ObjectStoreConfig = config) =>
+  Layer.merge(S3ObjectStoreLive(input), SelfhostPlatformRuntimeLive);
+
+describe("S3-compatible object store", () => {
+  it("writes, reads, heads, overwrites, and deletes objects", async () => {
+    const key = `tests/${crypto.randomUUID()}.txt`;
+    const initial = new TextEncoder().encode("first value");
+    const replacement = new TextEncoder().encode("replacement value");
+
+    const result = await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* ObjectStore;
+        const missing = yield* store.get(key);
+        yield* store.put({ key, body: initial, contentType: "text/plain" });
+        const stored = yield* store.get(key);
+        const head = yield* store.head(key);
+        yield* store.put({ key, body: replacement, contentType: "text/custom" });
+        const overwritten = yield* store.get(key);
+        yield* store.delete(key);
+        yield* store.delete(key);
+        const deleted = yield* store.head(key);
+        return { missing, stored, head, overwritten, deleted };
+      }).pipe(Effect.provide(storeLayer())),
+    );
+
+    expect(Option.isNone(result.missing)).toBe(true);
+    expect(Option.getOrThrow(result.stored)).toMatchObject({
+      body: initial,
+      contentType: "text/plain",
+      size: initial.byteLength,
+    });
+    expect(Option.getOrThrow(result.head)).toMatchObject({
+      contentType: "text/plain",
+      size: initial.byteLength,
+    });
+    expect(Option.getOrThrow(result.overwritten)).toMatchObject({
+      body: replacement,
+      contentType: "text/custom",
+      size: replacement.byteLength,
+    });
+    expect(Option.isNone(result.deleted)).toBe(true);
+  });
+
+  it("maps bucket failures to the stable object-store error", async () => {
+    const missingBucket = `${config.bucketName}-missing-${crypto.randomUUID()}`;
+    const error = await Effect.runPromise(
+      Effect.gen(function* () {
+        const store = yield* ObjectStore;
+        return yield* store.get("missing").pipe(Effect.flip);
+      }).pipe(
+        Effect.provide(
+          storeLayer({
+            ...config,
+            bucketName: missingBucket,
+          }),
+        ),
+      ),
+    );
+
+    expect(error).toBeInstanceOf(ObjectStoreError);
+    expect(error.bucketName).toBe(missingBucket);
+    expect(error.operation).toBe("get");
+  });
+});
diff --git a/selfhost/platform/tests/Screenshot.test.ts b/selfhost/platform/tests/Screenshot.test.ts
new file mode 100644
index 000000000..56a24f295
--- /dev/null
+++ b/selfhost/platform/tests/Screenshot.test.ts
@@ -0,0 +1,42 @@
+import { ScreenshotError } from "@voidhash/platform/Screenshot";
+import { Effect } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { validateChromiumScreenshotOptions } from "../src/Screenshot.ts";
+
+const normalScreenshot = {
+  deviceScaleFactor: 2,
+  height: 812,
+  html: "<!doctype html><p>Paywall</p>",
+  width: 375,
+};
+
+describe("Chromium screenshot budgets", () => {
+  it("accepts a normal phone-sized render", async () => {
+    await expect(
+      Effect.runPromise(validateChromiumScreenshotOptions(normalScreenshot, {})),
+    ).resolves.toBeUndefined();
+  });
+
+  it("rejects HTML over the configured byte budget", async () => {
+    const error = await Effect.runPromise(
+      validateChromiumScreenshotOptions(
+        { ...normalScreenshot, html: "12345" },
+        { maxHtmlBytes: 4 },
+      ).pipe(Effect.flip),
+    );
+    expect(error).toBeInstanceOf(ScreenshotError);
+    expect(error.operation).toBe("validate");
+  });
+
+  it("rejects a viewport and scale combination over the pixel budget", async () => {
+    const error = await Effect.runPromise(
+      validateChromiumScreenshotOptions(
+        { ...normalScreenshot, deviceScaleFactor: 4, height: 4_096, width: 4_096 },
+        {},
+      ).pipe(Effect.flip),
+    );
+    expect(error).toBeInstanceOf(ScreenshotError);
+    expect(error.operation).toBe("validate");
+  });
+});
diff --git a/selfhost/platform/tests/SingleNodePg.integration.test.ts b/selfhost/platform/tests/SingleNodePg.integration.test.ts
new file mode 100644
index 000000000..3587a5e88
--- /dev/null
+++ b/selfhost/platform/tests/SingleNodePg.integration.test.ts
@@ -0,0 +1,136 @@
+import * as PgClient from "@effect/sql-pg/PgClient";
+import { DurableEntityHost, makeDurableEntityAddress } from "@voidhash/platform/DurableEntity";
+import { QueueDriver } from "@voidhash/platform/Queue";
+import {
+  durableEntityHostConformance,
+  queueDriverConformance,
+  workflowRunnerConformance,
+} from "@voidhash/platform/conformance";
+import { Effect, Layer, Redacted, Schema } from "effect";
+import { KeyValueStore, PersistedQueue } from "effect/unstable/persistence";
+import { describe, expect, it } from "vitest";
+
+import {
+  ClusterDurableEntityControlLive,
+  ClusterDurableEntityHostLive,
+} from "../src/ClusterDurableEntity.ts";
+import { PgEntityAlarmStoreLive } from "../src/EntityAlarmStore.ts";
+import { SelfhostPlatformRuntimeLive } from "../src/PlatformRuntime.ts";
+import { ClusterQueueLive } from "../src/Queue.ts";
+import { SingleNodeClusterLive } from "../src/Topology.ts";
+import * as ClusterWorkflowRunner from "../src/Workflow.ts";
+
+/**
+ * Exercises the production self-host topology: one runner whose mailboxes,
+ * workflow state, queues, and entity state all live in Postgres.
+ */
+const SqlLive = PgClient.layer({
+  host: process.env.PLATFORM_SELFHOST_PG_HOST ?? "127.0.0.1",
+  port: Number(process.env.PLATFORM_SELFHOST_PG_PORT ?? "5432"),
+  database: process.env.PLATFORM_SELFHOST_PG_DATABASE ?? "voidhash",
+  username: process.env.PLATFORM_SELFHOST_PG_USERNAME ?? "voidhash",
+  password: Redacted.make(process.env.PLATFORM_SELFHOST_PG_PASSWORD ?? "password"),
+});
+
+// Runner storage stays in memory: a single runner owns every shard, so the
+// lease table would only add schema churn to the test database.
+const ClusterLive = SingleNodeClusterLive({ runnerStorage: "memory" }).pipe(
+  Layer.provide(SqlLive),
+  Layer.orDie,
+);
+
+const workflowLayer = () =>
+  ClusterWorkflowRunner.layer.pipe(
+    Layer.provide(ClusterLive),
+    Layer.merge(SelfhostPlatformRuntimeLive),
+  );
+
+const queueLayer = () =>
+  ClusterQueueLive.pipe(
+    Layer.provide(PersistedQueue.layer),
+    Layer.provide(
+      // The SQL store polls for new rows on an interval; it must be shorter
+      // than the driver's claim window or `processBatch` reports an empty
+      // queue that is not actually empty.
+      PersistedQueue.layerStoreSql({ pollInterval: "50 millis" }).pipe(
+        Layer.provide(SqlLive),
+        Layer.orDie,
+      ),
+    ),
+    Layer.merge(SelfhostPlatformRuntimeLive),
+  );
+
+const entityLayer = () =>
+  Layer.mergeAll(ClusterDurableEntityHostLive, ClusterDurableEntityControlLive).pipe(
+    Layer.provide(PgEntityAlarmStoreLive.pipe(Layer.provide(SqlLive), Layer.orDie)),
+    Layer.provide(KeyValueStore.layerSql().pipe(Layer.provide(SqlLive), Layer.orDie)),
+    Layer.provide(ClusterLive),
+  );
+
+workflowRunnerConformance({ name: "cluster/postgres", layer: workflowLayer });
+queueDriverConformance({ name: "cluster/postgres", layer: queueLayer });
+durableEntityHostConformance({
+  name: "cluster/postgres",
+  layer: entityLayer,
+  supportsAlarmDispatch: entityLayer,
+});
+
+describe("cluster/postgres durability", () => {
+  it("keeps entity state across independent host instances", async () => {
+    const address = makeDurableEntityAddress("durability", `run-${Date.now()}`);
+
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+          yield* host.run(address, (entity) => entity.keyValue.put("value", { survives: true }));
+        }).pipe(Effect.provide(entityLayer())),
+      ) as Effect.Effect<void>,
+    );
+
+    // A brand-new host, and therefore a brand-new in-process lock and
+    // session map, must still observe the persisted value.
+    const restored = await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+          return yield* host.run(address, (entity) => entity.keyValue.get("value"));
+        }).pipe(Effect.provide(entityLayer())),
+      ) as Effect.Effect<unknown>,
+    );
+
+    expect(restored).toEqual({ survives: true });
+  });
+
+  it("keeps queued messages across independent driver instances", async () => {
+    const Message = Schema.Struct({ id: Schema.String });
+    const queueName = `durability-${Date.now()}`;
+    const seen: Array<string> = [];
+
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          yield* driver.producer(queueName, Message).publish({ id: "persisted" });
+        }).pipe(Effect.provide(queueLayer())),
+      ) as Effect.Effect<void>,
+    );
+
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          yield* driver.processBatch(
+            queueName,
+            Message,
+            (messages: ReadonlyArray<typeof Message.Type>) =>
+              Effect.sync(() => void seen.push(...messages.map((m) => m.id))),
+            { pollIntervalMillis: 500 },
+          );
+        }).pipe(Effect.provide(queueLayer())),
+      ) as Effect.Effect<void>,
+    );
+
+    expect(seen).toEqual(["persisted"]);
+  });
+});
diff --git a/selfhost/platform/tests/SmtpMailer.integration.test.ts b/selfhost/platform/tests/SmtpMailer.integration.test.ts
new file mode 100644
index 000000000..2c407120f
--- /dev/null
+++ b/selfhost/platform/tests/SmtpMailer.integration.test.ts
@@ -0,0 +1,133 @@
+import { Mailer, MailerError } from "@voidhash/platform/Mailer";
+import { Effect, Layer } from "effect";
+import { describe, expect, it } from "vitest";
+
+import { SmtpMailerLive, type SmtpMailerConfig } from "../src/Mailer.ts";
+import { SelfhostPlatformRuntimeLive } from "../src/PlatformRuntime.ts";
+
+const config: SmtpMailerConfig = {
+  host: process.env.PLATFORM_SELFHOST_SMTP_HOST ?? "127.0.0.1",
+  port: Number(process.env.PLATFORM_SELFHOST_SMTP_PORT ?? "1025"),
+  defaultFrom: { address: "noreply@voidhash.local", name: "Voidhash" },
+  verifyOnStart: true,
+};
+
+const mailerLayer = (input: SmtpMailerConfig = config) =>
+  Layer.merge(SmtpMailerLive(input), SelfhostPlatformRuntimeLive);
+const mailpitApi = process.env.PLATFORM_SELFHOST_MAILPIT_API ?? "http://127.0.0.1:8025";
+
+interface MailpitMessageSummary {
+  readonly ID: string;
+  readonly Subject: string;
+}
+
+interface MailpitMessages {
+  readonly messages: ReadonlyArray<MailpitMessageSummary>;
+}
+
+interface MailpitMessage {
+  readonly From: { readonly Address: string };
+  readonly To: ReadonlyArray<{ readonly Address: string }>;
+  readonly ReplyTo: ReadonlyArray<{ readonly Address: string }>;
+  readonly Text: string;
+  readonly HTML: string;
+}
+
+describe("SMTP mailer", () => {
+  it("delivers structured text and HTML through SMTP", async () => {
+    const subject = `SMTP integration ${crypto.randomUUID()}`;
+    const delivery = await Effect.runPromise(
+      Effect.gen(function* () {
+        const mailer = yield* Mailer;
+        return yield* mailer.send({
+          to: [{ address: "person@example.com", name: "Example Person" }],
+          replyTo: { address: "support@voidhash.local", name: "Support" },
+          subject,
+          text: "Plain body",
+          html: "<strong>HTML body</strong>",
+          headers: { "X-Voidhash-Test": "smtp" },
+        });
+      }).pipe(Effect.provide(mailerLayer())),
+    );
+
+    expect(delivery.messageId).toBeTypeOf("string");
+    expect(delivery.accepted).toContain("person@example.com");
+    expect(delivery.rejected).toEqual([]);
+
+    const messagesResponse = await fetch(`${mailpitApi}/api/v1/messages`);
+    expect(messagesResponse.ok).toBe(true);
+    const messages = (await messagesResponse.json()) as MailpitMessages;
+    const messageId = messages.messages.find((message) => message.Subject === subject)?.ID;
+    expect(messageId).toBeTypeOf("string");
+
+    const [messageResponse, headersResponse] = await Promise.all([
+      fetch(`${mailpitApi}/api/v1/message/${messageId}`),
+      fetch(`${mailpitApi}/api/v1/message/${messageId}/headers`),
+    ]);
+    expect(messageResponse.ok).toBe(true);
+    expect(headersResponse.ok).toBe(true);
+
+    const message = (await messageResponse.json()) as MailpitMessage;
+    const headers = (await headersResponse.json()) as Record<string, ReadonlyArray<string>>;
+    expect(message.From.Address).toBe("noreply@voidhash.local");
+    expect(message.To.map(({ Address }) => Address)).toEqual(["person@example.com"]);
+    expect(message.ReplyTo.map(({ Address }) => Address)).toEqual(["support@voidhash.local"]);
+    expect(message.Text).toBe("Plain body");
+    expect(message.HTML).toBe("<strong>HTML body</strong>");
+    expect(headers["X-Voidhash-Test"]).toEqual(["smtp"]);
+  });
+
+  it("validates message content through the stable error channel", async () => {
+    const error = await Effect.runPromise(
+      Effect.gen(function* () {
+        const mailer = yield* Mailer;
+        return yield* mailer
+          .send({ to: [], subject: "invalid" })
+          .pipe(Effect.flip);
+      }).pipe(Effect.provide(mailerLayer({ ...config, verifyOnStart: false }))),
+    );
+
+    expect(error).toBeInstanceOf(MailerError);
+    expect(error.operation).toBe("validate");
+  });
+
+  it("maps SMTP connection failures during startup verification", async () => {
+    const error = await Effect.runPromise(
+      Effect.gen(function* () {
+        return yield* Mailer;
+      }).pipe(
+        Effect.provide(
+          mailerLayer({
+            ...config,
+            port: 1,
+            connectionTimeoutMillis: 200,
+          }),
+        ),
+        Effect.flip,
+      ),
+    );
+
+    expect(error).toBeInstanceOf(MailerError);
+    expect(error.operation).toBe("verify");
+  });
+
+  it("rejects incomplete SMTP authentication configuration", async () => {
+    const error = await Effect.runPromise(
+      Effect.gen(function* () {
+        return yield* Mailer;
+      }).pipe(
+        Effect.provide(
+          mailerLayer({
+            ...config,
+            username: "user",
+            password: undefined,
+          }),
+        ),
+        Effect.flip,
+      ),
+    );
+
+    expect(error).toBeInstanceOf(MailerError);
+    expect(error.operation).toBe("configure");
+  });
+});
diff --git a/selfhost/platform/tests/cluster.test.ts b/selfhost/platform/tests/cluster.test.ts
new file mode 100644
index 000000000..c09978ceb
--- /dev/null
+++ b/selfhost/platform/tests/cluster.test.ts
@@ -0,0 +1,191 @@
+import { DurableEntityHost, makeDurableEntityAddress } from "@voidhash/platform/DurableEntity";
+import { QueueDriver } from "@voidhash/platform/Queue";
+import * as Workflow from "@voidhash/platform/Workflow";
+import { WorkflowRunner } from "@voidhash/platform/WorkflowRunner";
+import { Effect, Layer, Schema } from "effect";
+import { KeyValueStore, PersistedQueue } from "effect/unstable/persistence";
+import { describe, expect, it } from "vitest";
+
+import { ClusterDurableEntityHostLive } from "../src/ClusterDurableEntity.ts";
+import { MemoryEntityAlarmStoreLive } from "../src/EntityAlarmStore.ts";
+import { SelfhostPlatformRuntimeLive } from "../src/PlatformRuntime.ts";
+import { ClusterQueueLive } from "../src/Queue.ts";
+import { TestClusterLive } from "../src/Topology.ts";
+import * as ClusterWorkflowRunner from "../src/Workflow.ts";
+
+const Message = Schema.Struct({ id: Schema.String });
+
+const queueLayer = ClusterQueueLive.pipe(
+  Layer.provide(PersistedQueue.layer),
+  Layer.provide(PersistedQueue.layerStoreMemory),
+  Layer.merge(SelfhostPlatformRuntimeLive),
+);
+
+const workflowLayer = ClusterWorkflowRunner.layer.pipe(
+  Layer.provide(TestClusterLive),
+  Layer.merge(SelfhostPlatformRuntimeLive),
+);
+
+const entityLayer = ClusterDurableEntityHostLive.pipe(
+  Layer.provide(MemoryEntityAlarmStoreLive),
+  Layer.provide(KeyValueStore.layerMemory),
+  Layer.provide(TestClusterLive),
+);
+
+describe("cluster queue driver", () => {
+  it("publishes a batch and delivers every message", async () => {
+    const seen: Array<string> = [];
+
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          yield* driver
+            .producer("batch", Message)
+            .publishBatch([{ id: "a" }, { id: "b" }, { id: "c" }]);
+
+          // The driver delivers one message per claim, so drain until empty.
+          yield* Effect.repeat(
+            driver.processBatch(
+              "batch",
+              Message,
+              (messages: ReadonlyArray<typeof Message.Type>) =>
+                Effect.sync(() => void seen.push(...messages.map((m) => m.id))),
+              { pollIntervalMillis: 50 },
+            ),
+            { until: (claimed: number) => claimed === 0 },
+          );
+        }).pipe(Effect.provide(queueLayer)),
+      ) as Effect.Effect<void>,
+    );
+
+    expect([...seen].sort()).toEqual(["a", "b", "c"]);
+  });
+
+  it("keeps separate queues isolated", async () => {
+    const seen: Array<string> = [];
+
+    await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const driver = yield* QueueDriver;
+          yield* driver.producer("left", Message).publish({ id: "left-1" });
+
+          const claimed = yield* driver.processBatch(
+            "right",
+            Message,
+            (messages: ReadonlyArray<typeof Message.Type>) =>
+              Effect.sync(() => void seen.push(...messages.map((m) => m.id))),
+            { pollIntervalMillis: 50 },
+          );
+          expect(claimed).toBe(0);
+        }).pipe(Effect.provide(queueLayer)),
+      ) as Effect.Effect<void>,
+    );
+
+    expect(seen).toEqual([]);
+  });
+});
+
+describe("cluster workflow runner", () => {
+  const Sleeper = Workflow.define({
+    name: "cluster-sleeper",
+    payload: { subject: Schema.String },
+    success: Schema.String,
+    idempotencyKey: (payload) => payload.subject,
+  });
+
+  it("resumes a workflow across a durable sleep", async () => {
+    const result = await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const runner = yield* WorkflowRunner;
+          yield* runner.register(
+            Sleeper,
+            (payload, context) =>
+              Effect.gen(function* () {
+                // Already in the past, so the durable clock resolves immediately
+                // instead of parking the execution.
+                yield* context.sleepUntil("wait", new Date(Date.now() - 1_000));
+                return `woke ${payload.subject}`;
+              }),
+            Layer.empty,
+          );
+          return yield* runner.execute(Sleeper, { subject: "up" });
+        }).pipe(Effect.provide(workflowLayer)),
+      ) as Effect.Effect<string>,
+    );
+
+    expect(result).toBe("woke up");
+  });
+
+  it("memoizes a durable step so a retried body does not repeat it", async () => {
+    let sideEffects = 0;
+
+    const Flaky = Workflow.define({
+      name: "cluster-flaky",
+      payload: { subject: Schema.String },
+      success: Schema.String,
+      idempotencyKey: (payload) => payload.subject,
+    });
+
+    const result = await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const runner = yield* WorkflowRunner;
+          yield* runner.register(
+            Flaky,
+            (payload, context) =>
+              Effect.gen(function* () {
+                const value = yield* context.step({
+                  name: "count",
+                  success: Schema.Number,
+                  execute: Effect.sync(() => ++sideEffects),
+                });
+                return `${payload.subject}:${value}`;
+              }),
+            Layer.empty,
+          );
+          // Executing the same idempotency key twice joins one execution.
+          yield* runner.execute(Flaky, { subject: "once" });
+          return yield* runner.execute(Flaky, { subject: "once" });
+        }).pipe(Effect.provide(workflowLayer)),
+      ) as Effect.Effect<string>,
+    );
+
+    expect(result).toBe("once:1");
+    expect(sideEffects).toBe(1);
+  });
+});
+
+describe("cluster durable entity host", () => {
+  it("serializes interleaved read-modify-write turns", async () => {
+    const address = makeDurableEntityAddress("counter", "shared");
+
+    const total = await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const host = yield* DurableEntityHost;
+
+          const increment = host.run(address, (entity) =>
+            Effect.gen(function* () {
+              const current = yield* entity.keyValue.get("count");
+              const next = (typeof current === "number" ? current : 0) + 1;
+              // Yield between read and write: without serialization the
+              // increments would clobber each other.
+              yield* Effect.sleep("1 millis");
+              yield* entity.keyValue.put("count", next);
+            }),
+          );
+
+          yield* Effect.all([increment, increment, increment, increment, increment], {
+            concurrency: "unbounded",
+          });
+          return yield* host.run(address, (entity) => entity.keyValue.get("count"));
+        }).pipe(Effect.provide(entityLayer)),
+      ) as Effect.Effect<unknown>,
+    );
+
+    expect(total).toBe(5);
+  });
+});
diff --git a/selfhost/platform/tests/conformance.test.ts b/selfhost/platform/tests/conformance.test.ts
new file mode 100644
index 000000000..b0a8c006e
--- /dev/null
+++ b/selfhost/platform/tests/conformance.test.ts
@@ -0,0 +1,95 @@
+import { DurableEntityHost } from "@voidhash/platform/DurableEntity";
+import * as MemoryWorkflowRunner from "@voidhash/platform/MemoryWorkflowRunner";
+import {
+  cronSchedulerConformance,
+  durableEntityHostConformance,
+  queueDriverConformance,
+  workflowRunnerConformance,
+} from "@voidhash/platform/conformance";
+import { Effect, Layer } from "effect";
+import { Sharding } from "effect/unstable/cluster";
+import { KeyValueStore, PersistedQueue } from "effect/unstable/persistence";
+
+import { ClusterCronSchedulerLive } from "../src/CronScheduler.ts";
+import {
+  ClusterDurableEntityControlLive,
+  ClusterDurableEntityHostLive,
+  makeClusterDurableEntityHost,
+} from "../src/ClusterDurableEntity.ts";
+import { DurableEntityAlarmStore, MemoryEntityAlarmStoreLive } from "../src/EntityAlarmStore.ts";
+import { SelfhostPlatformRuntimeLive } from "../src/PlatformRuntime.ts";
+import { ClusterQueueLive } from "../src/Queue.ts";
+import { TestClusterLive } from "../src/Topology.ts";
+import * as ClusterWorkflowRunner from "../src/Workflow.ts";
+
+/**
+ * Each suite builds its own cluster so state cannot leak between tests. The
+ * in-memory topology keeps the suite hermetic — no Postgres, no network.
+ */
+const queueLayer = () =>
+  ClusterQueueLive.pipe(
+    Layer.provide(PersistedQueue.layer),
+    Layer.provide(PersistedQueue.layerStoreMemory),
+    Layer.merge(SelfhostPlatformRuntimeLive),
+  );
+
+const cronLayer = () =>
+  ClusterCronSchedulerLive.pipe(
+    Layer.provide(KeyValueStore.layerMemory),
+    Layer.provide(TestClusterLive),
+    Layer.merge(SelfhostPlatformRuntimeLive),
+  );
+
+const entityLayer = () =>
+  Layer.mergeAll(ClusterDurableEntityHostLive, ClusterDurableEntityControlLive).pipe(
+    Layer.provide(MemoryEntityAlarmStoreLive),
+    Layer.provide(KeyValueStore.layerMemory),
+    Layer.provide(TestClusterLive),
+  );
+
+/**
+ * A host whose runner owns no shard at all. The cluster host reads ownership
+ * from `Sharding`, so overriding that one answer is enough to exercise the
+ * locality gate without standing up a second runner.
+ */
+const unownedEntityLayer = () =>
+  Layer.effect(
+    DurableEntityHost,
+    Effect.gen(function* () {
+      const sharding = yield* Sharding.Sharding;
+      const store = yield* KeyValueStore.KeyValueStore;
+      const alarms = yield* DurableEntityAlarmStore;
+      return makeClusterDurableEntityHost(
+        { ...sharding, hasShardId: () => false },
+        store,
+        alarms,
+        // Nothing will ever assign this shard, so there is no boot race to
+        // wait out.
+        { attachOwnershipTimeout: 0 },
+      );
+    }),
+  ).pipe(
+    Layer.provide(MemoryEntityAlarmStoreLive),
+    Layer.provide(KeyValueStore.layerMemory),
+    Layer.provide(TestClusterLive),
+  );
+
+const workflowLayer = () =>
+  ClusterWorkflowRunner.layer.pipe(
+    Layer.provide(TestClusterLive),
+    Layer.merge(SelfhostPlatformRuntimeLive),
+  );
+
+const memoryWorkflowLayer = () =>
+  MemoryWorkflowRunner.layer.pipe(Layer.merge(SelfhostPlatformRuntimeLive));
+
+queueDriverConformance({ name: "cluster", layer: queueLayer });
+cronSchedulerConformance({ name: "cluster", layer: cronLayer });
+durableEntityHostConformance({
+  name: "cluster",
+  layer: entityLayer,
+  supportsAlarmDispatch: entityLayer,
+  requiresShardLocality: unownedEntityLayer,
+});
+workflowRunnerConformance({ name: "cluster", layer: workflowLayer });
+workflowRunnerConformance({ name: "memory", layer: memoryWorkflowLayer });
diff --git a/selfhost/entry/tsconfig.json b/selfhost/platform/tsconfig.json
similarity index 100%
rename from selfhost/entry/tsconfig.json
rename to selfhost/platform/tsconfig.json
diff --git a/selfhost/platform/vitest.integration.mts b/selfhost/platform/vitest.integration.mts
new file mode 100644
index 000000000..462272a41
--- /dev/null
+++ b/selfhost/platform/vitest.integration.mts
@@ -0,0 +1,20 @@
+import { defineConfig } from "vite-plus";
+
+// Integration tier: runs against the provisioned self-host stack via
+// `pnpm test:integration`. Timeouts are generous because these tests wait on
+// real containers rather than fakes.
+//
+// Files run one at a time: the cluster conformance file claims every shard in
+// its database, so a file running beside it would take its messages.
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["./**/*.integration.test.ts"],
+    exclude: ["./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
+    fileParallelism: false,
+    hookTimeout: 300_000,
+    teardownTimeout: 300_000,
+    testTimeout: 120_000,
+  },
+});
diff --git a/selfhost/platform/vitest.mts b/selfhost/platform/vitest.mts
new file mode 100644
index 000000000..4d8eb60c4
--- /dev/null
+++ b/selfhost/platform/vitest.mts
@@ -0,0 +1,12 @@
+import { defineConfig } from "vite-plus";
+
+// Unit tier: every `*.test.ts` except the stack-backed integration files.
+// `scripts/check-test-tiers.mjs` enforces this split across the repository.
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["./**/*.test.ts"],
+    exclude: ["./**/*.integration.test.ts", "./node_modules/**", "./dist/**"],
+    reporters: ["verbose"],
+  },
+});
diff --git a/selfhost/release-smoke.mts b/selfhost/release-smoke.mts
index bcd46876c..5229714b4 100644
--- a/selfhost/release-smoke.mts
+++ b/selfhost/release-smoke.mts
@@ -396,9 +396,13 @@ try {
       DELETE FROM person WHERE project_id = ${quoteSql(projectId)};
       DELETE FROM paywall WHERE id = ${quoteSql(paywallId)};
       DELETE FROM project WHERE id = ${quoteSql(projectId)};
-      DELETE FROM platform_queue_messages
-      WHERE body_json -> 'envelope' ->> 'projectId' = ${quoteSql(projectId)}
-         OR body_json ->> 'documentId' = ${quoteSql(paywallId)};
+      -- The cluster queue driver hands the store a JSON string, which the store
+      -- then JSON-encodes into the element column, so the body is doubly
+      -- encoded: unwrap the outer JSON scalar with #>> '{}' before reading the
+      -- payload's fields.
+      DELETE FROM effect_queue
+      WHERE (element::jsonb #>> '{}')::jsonb -> 'envelope' ->> 'projectId' = ${quoteSql(projectId)}
+         OR (element::jsonb #>> '{}')::jsonb ->> 'documentId' = ${quoteSql(paywallId)};
     `);
   }
 }
diff --git a/sst-env.d.ts b/sst-env.d.ts
index eec65b9bd..cf5e5fbe5 100644
--- a/sst-env.d.ts
+++ b/sst-env.d.ts
@@ -2,7 +2,6 @@
 /* tslint:disable */
 /* eslint-disable */
 /* deno-fmt-ignore-file */
-/* biome-ignore-all lint: auto-generated */
 
 /// <reference path="../../sst-env.d.ts" />
 
diff --git a/turbo.json b/turbo.json
index 9f0a60ec7..b55819438 100644
--- a/turbo.json
+++ b/turbo.json
@@ -20,7 +20,6 @@
         "VOIDHASH_SECRET_KEY",
         "GITHUB_CLIENT_ID",
         "GITHUB_CLIENT_SECRET",
-        "WORKOS_AUTHKIT_DOMAIN",
         "AXIOM_TOKEN",
         "AXIOM_LOGS_DATASET",
         "AXIOM_LOG_LEVEL"