A backend that is yours from the first request.
One Cloudflare Worker in your own account, holding your records and your sign-in.
It is called the b3nd kit. A kit and not a library, because what you receive is a thing you deploy and a template you edit — nothing of ours stays in your dependency list.
You cannot install this today. Nothing on this page is downloadable yet. So the page is a ledger: every promise sits beside the thing that backs it, and the ones nothing backs say so.
Measured 2026-09-03
What the kit is
Not a plan we are pitching. It is what hoje.ai already runs, in production, for its own tenants, not yet packaged for anyone else. The right-hand column is where you check that.
- live
running in production today - being built
the pieces run; the thing that joins them does not - not yet
a sentence; nothing that does this runs yet
A node you run
Your records and your sign-in in one Worker, deployed into your Cloudflare account. SQLite in a Durable Object, on the free plan. No server to keep, and no third party holding what your users write.
It mints its own auth root at deploy. Nothing calls us, ever, including at sign-in.
being built
Both halves are in production here: the SQLite Durable Object that stores records, and the sign-in service that runs the OAuth exchange. The single Worker that composes them into one deployable is being built and is not finished.
The free plan named above is Cloudflare's own, and SQLite-backed Durable Objects are on it. What a node of yours costs at your volume is the next row, and it is not measured.
What it costs you
Your own Cloudflare account and a Google OAuth client of your own. There is no invoice from us and no third party in the path, because the only machine in the path is yours.
not yet
Not measured. The storage half runs here on Cloudflare's SQLite-backed Durable Objects, so the shape of the bill is real — but what a node of yours costs at your volume, nobody here has measured. What the kit itself costs is not decided, and this page will not guess at it.
Locked before it serves
A request carrying no valid signature is refused by the node itself, not by something parked in front of it. “Open” is not a state it ships in.
not yet
The verifying half is landed and frozen: Ed25519 over canonical strings, carried on X-B3nd-Signature and X-B3nd-Cert. The refusal path, and the browser-side signer that proves a request, are new build.
People, without a terminal
You invite by e-mail. They sign in. They reach their own records and nothing else; you reach everything. Removing someone is a delete, and it takes hold on their next request.
not yet
Session certificates over one-time browser device keys — the machinery this rides — are landed and running here. The three pieces that use them, the subtree a person gets, the invitation, and the page it is sent from, are all still sentences.
The same code, local and deployed
Build against a node on your laptop from the first minute. Change one address and the same code talks to the deployed one. You receive a deployable and a template, not a client library to keep in step with us.
not yet
The browser read path it extends is sixteen lines and already runs. The write path is the signer above, which does not exist yet. Nothing is written down that would build the template.
The way out is the way in
Your records are addressed relative to their own root, so moving them re-addresses nothing. Moving into hoje.ai points a catch-up at us; moving out points the same one back. We would rather be a choice you keep making.
being built
The catch-up is proven, as backup and restore, run by one operator against their own node. Across two accounts, under signatures, it has never been run. Relative addressing is in production in the direction that moves records in; the map that reads them back out is still hardcoded.
The path, from nothing
Five steps, in your account's own vocabulary. None of them is a command you can copy yet, and we would rather show you an empty road than a command that fails.
Deploy one Worker
Into your Cloudflare account. It creates its own SQLite Durable Object and mints its own auth root as it boots.
not yet
This is the first step that becomes real, and it is being built.
Sign in to your own node
Register a Google OAuth client of your own. Sign-in runs inside your Worker; there is no request to us in the path.
not yet
The sign-in it bundles is live in production here today. Bundling it into a node you own is the part that is not built.
You are the owner
Ownership is one row against your account, written as the node deploys. Not a key handed to you that you must never lose.
not yet
Written down as work, and not started.
Invite the first person
From a page, not a terminal. They sign in with their own account; they see their own records.
not yet
Written down as work, and not started.
Point an app at it
The same code you ran locally, one address changed. That is the whole move.
not yet
The read half of that code is sixteen lines and runs in a browser today. The rest is not written down as work at all.
The road ends before step one.
Every step above is a sentence today, and the first one that becomes a command is step 1. If you came here to start this afternoon, this is where you stop, and that is a real answer, which is more than most of this page's neighbours will give you.
What is running today
Not packaged for you. Running for us, in production, with live tenants on it. This is the whole reason to believe the rest of the page.
Sign-in
Pluggable OAuth, Google first, served by the node itself.
live
A real Google client, a deployed auth node, and people signing in through it every day.
Storage
SQLite in a Durable Object, the same durability backend a kit node would run.
live
In production, carrying live tenants, on the worker a kit node would deploy.
Proving who is asking
Short-lived certificates over a one-time browser key, minted and checked in production. Nothing to back up, nothing to lose. A lost device is a fresh sign-in.
live
Minted and checked here today. Enforcing them on every one of our own doors is the claim Locked before it serves above, and it reads not yet there.
Moving records whole
A catch-up that carries a node's records to another node the same operator runs, without re-addressing them.
live
Proven as backup and restore, by one operator against their own node. Running it across two accounts, under signatures, is the claim The way out is the way in above, and it reads being built there.
If this is for you
There is nothing to install, so there is nothing to sign up for. No list to join, no form, and no button that would do nothing if you pressed it. This page is a read, and it ends here.
not yet The page holds itself to its own rule: an action we cannot honour today does not get a control that looks like one.