diff --git a/CLAUDE.md b/CLAUDE.md
index 6a7885a..53472e0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,9 +4,9 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this is
 
-**BearDrive** is the product name; **`bdrive`** is its CLI binary (file conventions use the full name: `.beardrive`, `.beardriveignore`, `~/.beardrive`, `BEARDRIVE_HOME`). BearDrive is a Go CLI that mounts any folder as a synced volume: contents sync across devices through cloud object storage (S3, GCS, S3-compatible, or a plain directory), with per-file change history and offline support. No server — devices converge through append-only journals in a dumb object store.
+**BearDrive** is the product name; **`bdrive`** is its CLI binary (file conventions use the full name: `.bdrive`, `.bdriveignore`, `~/.bdrive`, `BDRIVE_HOME`). BearDrive is a Go CLI that mounts any folder as a synced volume: contents sync across devices through cloud object storage (S3, GCS, S3-compatible, or a plain directory), with per-file change history and offline support. No server required — devices converge through append-only journals in a dumb object store; an optional `bdrive web` server can front the store as a sync hub for storage-blind client devices.
 
-The repo ships one binary: `cmd/bdrive` — the CLI, the sync daemon, and the read-only web viewer (`bdrive web`).
+The repo ships one binary: `cmd/bdrive` — the CLI, the sync daemon, and the web server (`bdrive web`: viewer, uploads, multi-project sync hub).
 
 ## Commands
 
@@ -20,14 +20,14 @@ go build -o bdrive ./cmd/bdrive                  # build the binary (gitignored
 
 There is no Makefile, linter config, or CI config in-repo. Releases run `goreleaser release` on a tagged commit (see `.goreleaser.yaml`); the version is injected via `-ldflags "-X main.version=..."` into `cmd/bdrive/main.go`.
 
-When testing the CLI manually, set `BEARDRIVE_HOME=/some/tmp/dir` to relocate all beardrive state (device identity, mount registry, volume stores) away from the real `~/.beardrive`.
+When testing the CLI manually, set `BDRIVE_HOME=/some/tmp/dir` to relocate all beardrive state (device identity, mount registry, volume stores) away from the real `~/.bdrive`.
 
 ## Architecture
 
 Data flows in two hops; the local volume store is the pivot:
 
 ```
-working folder  ←scan/materialize→  volume store (~/.beardrive/volumes/<vol>)  ←push/pull→  object store
+working folder  ←scan/materialize→  volume store (~/.bdrive/volumes/<vol>)  ←push/pull→  object store
  (real files)                       blobs/ + journal/ + state + sync                  s3:// gs:// file://
 ```
 
@@ -35,13 +35,13 @@ Package roles (`internal/`):
 
 - **`journal`** — the core data model. Every change is an `Op` (`put`/`delete`) in a per-device append-only JSONL log. `Less` defines the total order `(lamport, time, device, seq)`; `Replay` folds all ops into the volume state, last-writer-wins per path. Everything else is machinery around this.
 - **`store`** — a volume's local on-disk state: content-addressed blob store (`blobs/<aa>/<sha256>`), per-device journal copies, the per-mount materialization cache (`state-<mountID>.json`, size+mtime fingerprints for cheap change detection), sync state (lamport clock + push cursor), and the exclusive flock that serializes cycles.
-- **`remote`** — the `Backend` interface (Put/Get/List/Exists) with `file://`, `s3://`, `gs://` implementations. Remote layout: `blobs/<sha256>` + `journal/<device>.jsonl` under the URL prefix.
-- **`syncer`** — the heart: `Session.Cycle()` runs one pass: scan → commit local ops → pull peer journals → preserve conflict copies → materialize merged state → push blobs + own journal. Read the package doc comment in `syncer.go` first. `ignore.go` holds the path filter (`.beardriveignore` rules + the `.beardrive` include list), applied symmetrically in scan and materialize; a newly filtered path is dropped from the cache *without* a delete op so opting out locally never deletes remotely.
+- **`remote`** — the `Backend` interface (Put/Get/List/Exists) with `file://`, `s3://`, `gs://`, and `https://` implementations (`https://` syncs through a `bdrive web` server's `/api/store` API — the client device holds no storage credentials). `PutSigner` is the optional presign capability (S3/GCS). Remote layout: `blobs/<sha256>` + `journal/<device>.jsonl` under the URL prefix.
+- **`syncer`** — the heart: `Session.Cycle()` runs one pass: scan → commit local ops → pull peer journals → preserve conflict copies → materialize merged state → push blobs + own journal. Read the package doc comment in `syncer.go` first. `ignore.go` holds the path filter (`.bdriveignore` rules + the `.bdrive` include list), applied symmetrically in scan and materialize; a newly filtered path is dropped from the cache *without* a delete op so opting out locally never deletes remotely.
 - **`daemon`** — per-mount background loop (detached process, pidfile `daemon-<mountID>.pid` and log `daemon-<mountID>.log` in the volume dir). Scans every `--scan-interval` (3s), talks to the remote every `--remote-interval` (10s) or immediately after local edits. Re-reads `mounts.json` each tick to pick up `bdrive remote set` / `umnt --forget` without restart.
-- **`config`** — global state under `$BEARDRIVE_HOME` (default `~/.beardrive`): device identity (`device.json`), mount registry (`mounts.json`), `MountID()` (sha256 of the folder path — one volume can be mounted at several folders, and everything folder-specific is keyed by it). Also the per-folder `.beardrive` project file (`project.go`): volume/remote/include settings that live in the mounted folder itself, win over the registry (`EffectiveMount`), and are never synced.
-- **`webapp`** — the `bdrive web` server: a `Source` interface with two implementations — `DirSource` (serves a local folder straight from disk; the default when no remote is given) and `RemoteSource` (reads journals straight from the remote, no local store, folds them into a file tree with per-file provenance). Renders markdown (goldmark + Obsidian `[[wikilinks]]`), streams/downloads content. Frontend is dependency-free vanilla JS embedded via `go:embed static`.
+- **`config`** — global state under `$BDRIVE_HOME` (default `~/.bdrive`): device identity (`device.json`), mount registry (`mounts.json`), `MountID()` (sha256 of the folder path — one volume can be mounted at several folders, and everything folder-specific is keyed by it). Also the per-folder `.bdrive` project file (`project.go`): volume/remote/include settings that live in the mounted folder itself, win over the registry (`EffectiveMount`), and are never synced.
+- **`webapp`** — the `bdrive web` server, in two modes. Single-volume: `Source` is a `DirSource` (plain folder from disk) or `RemoteSource` (folds journals into a file tree with per-file provenance). Hub: `Root` + `Projects` host many projects on one storage root, each under `<root>/<project-id>/` via `remote.Prefixed`; `ProjectDB` (`projects.go`) is a file-backed registry (JSON, loaded at open, rewritten atomically per change) with create-or-join-by-name semantics. Renders markdown (goldmark + Obsidian `[[wikilinks]]`). With `--upload` it accepts writes: browser uploads (`upload.go` — direct-to-storage via presigned URLs when the backend implements `remote.PutSigner`, relayed otherwise; ops journaled under the server's own device) and the per-project `/api/p/<id>/store/*` proxy (`store.go`) that whole devices sync through — the `https://` remote backend (`remote/http.go`) is its client; journals are never presigned, only immutable blobs. Frontend is dependency-free vanilla JS embedded via `go:embed static`; it learns everything from `/api/config` (+ `/api/projects` in hub mode) and never sees storage info or credentials.
 
-`cmd/bdrive/` is a thin cobra CLI over these packages (`mnt`, `umnt`, `sync`, `status`, `log`, `remote`, `web`, `whoami`, `daemon`, `version`).
+`cmd/bdrive/` is a thin cobra CLI over these packages (`login`, `init`, `mnt`, `umnt`, `sync`, `status`, `log`, `remote`, `web`, `whoami`, `daemon`, `version`). `bdrive login <url>` verifies a hub and saves it as the device default (`settings.json`); `bdrive init` is the one-command project onboarding: creates-or-joins a project on the logged-in hub, writes `.bdrive` (remote `https://host/p/<project-id>`), seeds a starter `.bdriveignore`, and mounts via the shared `runMount`. `bdrive web -c config.json` configures the server from a file, explicit flags winning.
 
 ## Invariants — do not break these
 
@@ -50,7 +50,7 @@ Package roles (`internal/`):
 - **Scan happens before pull** in `Cycle`, so local edits are journaled (and content captured) before remote state can overwrite the working folder.
 - **Replay must stay deterministic.** Any change to `journal.Less` or `Replay` changes what every device converges to.
 - **Materialize never clobbers dirty files**: a file whose size/mtime differs from the state cache changed mid-cycle and is left for the next scan.
-- **All state files are written atomically** (temp file + rename, see `store.WriteFileAtomic`). Temp files are prefixed `.beardrive-tmp-` and ignored by the scanner.
+- **All state files are written atomically** (temp file + rename, see `store.WriteFileAtomic`). Temp files are prefixed `.bdrive-tmp-` and ignored by the scanner.
 - **`Cycle` runs under the volume flock** — the daemon and one-shot CLI commands (`bdrive sync`) coexist through it.
 - Errors during pull/push degrade to `Result.Offline` rather than failing the cycle; unreadable/vanished files during scan are skipped and retried next cycle. Follow this "never break sync, retry next cycle" posture.
 
@@ -60,7 +60,7 @@ The real coverage is the integration tests in `internal/syncer/syncer_test.go`:
 
 ## Claude Code plugin
 
-`plugin/` is a Claude Code plugin (skill + `/beardrive:mount` + `/beardrive:status` commands + turn-boundary sync hooks), published via the marketplace manifest at `.claude-plugin/marketplace.json` (`/plugin marketplace add runbear-io/beardrive`). The canonical skill lives at `plugin/skills/beardrive/SKILL.md`; `.claude/skills/beardrive` is a symlink to it. The hook script `plugin/scripts/beardrive-sync.sh` must stay a fast no-op for folders without a `.beardrive` file — it runs on every turn in every project.
+`plugin/` is a Claude Code plugin (skill + `/beardrive:mount` + `/beardrive:status` commands + turn-boundary sync hooks), published via the marketplace manifest at `.claude-plugin/marketplace.json` (`/plugin marketplace add runbear-io/beardrive`). The canonical skill lives at `plugin/skills/beardrive/SKILL.md`; `.claude/skills/beardrive` is a symlink to it. The hook script `plugin/scripts/beardrive-sync.sh` must stay a fast no-op for folders without a `.bdrive` file — it runs on every turn in every project.
 
 ## Docs to keep in sync
 
diff --git a/README.md b/README.md
index 7ad8552..5fd6cfd 100644
--- a/README.md
+++ b/README.md
@@ -45,9 +45,9 @@ $ bdrive mnt ./workspace --remote s3://my-bucket/workspace
   reachable again.
 - **Conflict-safe** — concurrent edits resolve deterministically
   (last-writer-wins), and the losing version is preserved as a
-  `name.beardrive-conflict-<device>-<time>` file. Nothing is silently dropped.
-- **Selective sync** — a gitignore-style `.beardriveignore` opts files out, and an
-  optional `include` list in the folder's `.beardrive` settings narrows sync to
+  `name.bdrive-conflict-<device>-<time>` file. Nothing is silently dropped.
+- **Selective sync** — a gitignore-style `.bdriveignore` opts files out, and an
+  optional `include` list in the folder's `.bdrive` settings narrows sync to
   chosen paths.
 - **macOS & Linux.**
 
@@ -97,6 +97,7 @@ beardrive uses each provider's standard credential chain — nothing beardrive-s
 | `s3://bucket/prefix` | `AWS_PROFILE`, `~/.aws/credentials`, env vars, IAM roles. S3-compatible stores via `AWS_ENDPOINT_URL`. |
 | `gs://bucket/prefix` | Application Default Credentials (`gcloud auth application-default login`) or `GOOGLE_APPLICATION_CREDENTIALS`. |
 | `file:///path` | none — any local or network-mounted directory |
+| `https://host:port/p/<id>` | none — syncs through a bdrive web hub; only the server holds storage credentials (see [The sync hub and `bdrive init`](#the-sync-hub-and-bdrive-init)) |
 
 ## Commands
 
@@ -108,7 +109,9 @@ beardrive uses each provider's standard credential chain — nothing beardrive-s
 | `bdrive status [folder]` | Mounts, daemon state, pending changes |
 | `bdrive log [folder] [-p path] [-n N]` | Change history: author, device, time, file |
 | `bdrive remote [folder]` / `bdrive remote set <folder> <url>` | Show / set the cloud remote |
-| `bdrive web [folder \| remote-url]` | Read-only web viewer (rendered markdown, downloads) |
+| `bdrive login <server-url>` | Set this device's bdrive web server (verified and remembered) |
+| `bdrive init [folder]` | One-command onboarding: join/create a project on the logged-in server, seed `.bdriveignore`, mount, start syncing |
+| `bdrive web [folder \| storage-root-url]` | Web server: viewer (rendered markdown, downloads), uploads, multi-project sync hub |
 | `bdrive whoami` | Device identity used in change tracking |
 
 ## Project files
@@ -116,47 +119,125 @@ beardrive uses each provider's standard credential chain — nothing beardrive-s
 Each mounted folder carries its own settings, so configuration travels with
 the project:
 
-- **`.beardrive`** — the folder's settings (JSON): `volume`, `remote`, and an
+- **`.bdrive`** — the folder's settings (JSON): `volume`, `remote`, and an
   optional `include` list. Written by `bdrive mnt`, safe to hand-edit (a running
   daemon picks changes up automatically). Never synced — remotes are
-  device-specific. Copy a folder containing `.beardrive` to another machine and
+  device-specific. Copy a folder containing `.bdrive` to another machine and
   plain `bdrive mnt <folder>` reuses its volume and remote.
-- **`.beardriveignore`** — gitignore-style opt-out list at the mount root. Syncs
+- **`.bdriveignore`** — gitignore-style opt-out list at the mount root. Syncs
   like a normal file, so every device shares the same rules. Supports `#`
   comments, `*`, `**`, `?`, trailing `/` for directories, leading `/` (or any
   `/`) for root-anchoring, and `!` to re-include.
 
 ```jsonc
-// .beardrive
+// .bdrive
 { "volume": "notes", "remote": "s3://my-bucket/notes", "include": ["docs/", "*.md"] }
 ```
 
 Opting out is non-destructive: when a pattern starts matching an
 already-synced file, the file stops syncing but is deleted nowhere.
 
-## Web viewer
+## Web server
 
-`bdrive web` serves a read-only website for a folder or a BearDrive remote —
-browse folders and files, read markdown rendered Obsidian-style (including
-`[[wikilinks]]`, task lists, and tables), and download any file.
+`bdrive web` serves a website — browse folders and files, read markdown
+rendered Obsidian-style (including `[[wikilinks]]`, task lists, and
+tables), download any file — and, pointed at a storage root, becomes a
+**multi-project sync hub**. It is read-only unless started with `--upload`.
 
 ```sh
-bdrive web                              # serve the current directory
-bdrive web ./notes                      # serve a folder from disk
-bdrive web s3://my-bucket/workspace     # serve a BearDrive remote
+bdrive web                              # serve the current directory (viewer)
+bdrive web ./notes                      # serve a folder from disk (viewer)
+bdrive web -c config.json               # everything from a config file
+bdrive web s3://my-bucket/root --upload # multi-project sync hub
 ```
 
-With no remote given it serves the folder straight from the local file
-system — on a BearDrive mount the daemon keeps those files fresh, so this is
-the simplest way to run it in production (and needs no cloud credentials
-on the serving machine). Pointing it at a remote instead reads the object
-store directly — no mount, daemon, or local beardrive state — and each file
-shows who changed it last, from which device, and when: the same
-provenance as `bdrive log`.
+With a folder it serves files straight from disk — on a BearDrive mount the
+daemon keeps them fresh, so this is the simplest read-only deployment (no
+cloud credentials on the serving machine). With a storage root URL it runs
+in hub mode, described below.
 
 Flags: `--addr` (default `:4173`), `--volume` (display name), `--refresh`
 (listing cache, default `10s`), `--dir` / `--remote` (explicit forms of
-the positional argument).
+the positional argument), `--upload` (allow client writes, off by default),
+`--upload-ttl` (presigned-URL lifetime, default `15m`), `--projects-db`
+(hub project registry file, default `$BDRIVE_HOME/projects.json`),
+`-c/--config` (read all of the above from a JSON file; explicit flags win):
+
+```jsonc
+// bdrive web -c config.json
+{
+  "remote": "s3://my-bucket/root",   // storage root (hub) — or "dir": "./folder" (viewer)
+  "addr": ":4173",
+  "upload": true,
+  "upload_ttl": "15m",
+  "refresh": "10s",
+  "projects_db": "/var/lib/bdrive/projects.json"
+}
+```
+
+### The sync hub and `bdrive init`
+
+In hub mode the server hosts many **projects** on one storage root — each
+project's data lives under its own prefix (`<root>/<project-id>/`), and a
+file-backed registry (`projects.json`, loaded at start, rewritten
+atomically on every change) maps project ids to names. Client devices sync
+whole folders through the hub without ever knowing where the storage is or
+holding any cloud credentials; the server device is the only one configured
+with the bucket.
+
+```sh
+# On the server device (knows the storage)
+bdrive web -c config.json
+
+# On each client device (knows only the server) — one command does it all:
+bdrive login https://drive.example.com:4173   # once per device
+cd ~/some-project && bdrive init              # once per project
+```
+
+`bdrive login` verifies the server and remembers it as the device default
+(`settings.json` under the bdrive home; run it with no argument to show the
+current server). `bdrive init` then, per project: creates-or-joins
+a project named after the folder (`--name <x>` for an explicit name,
+`--project <id>` to join by id), writes the folder's `.bdrive` (project id +
+server URL), seeds a starter `.bdriveignore` (node_modules, build dirs,
+caches, `.env*`) when none exists, and mounts the folder — the daemon starts
+syncing immediately: local changes are detected within seconds, and the
+Claude Code plugin syncs at every session step.
+
+Under the hood the `https://` remote speaks the hub's per-project
+`/api/p/<id>/store` API — journal reads/writes relay through the server,
+blob uploads go direct to the object store via the same short-lived
+presigned URLs browser uploads use (falling back to relaying when the
+backend can't presign). Client pushes and project creation require the
+server to run with `--upload`; against a read-only hub, clients still pull
+and their pushes wait (offline semantics) until allowed.
+
+The web UI lists the hub's projects in the sidebar; selecting one browses
+that project's files with full per-file provenance (who, which device,
+when — the same as `bdrive log`).
+
+### Uploads
+
+The browser client is deliberately storage-blind: it never sees the remote
+URL, bucket, or any credentials. On page load it fetches `/api/config` and
+follows whatever the server allows.
+
+With `--upload` set, the server decides per upload how the bytes travel:
+
+- **Direct** — for backends that can presign (S3 and S3-compatible stores;
+  GCS when the server runs with credentials that can sign, e.g. a service
+  account): the server mints a short-lived presigned `PUT` URL for the
+  content-addressed blob (`blobs/<sha256>`), the browser uploads straight
+  to the object store, then asks the server to commit. The commit verifies
+  the blob actually exists and appends a `put` op to the *server's own*
+  journal — the blobs-before-journal ordering and the one-writer-per-journal
+  invariant both hold. Expired URLs are refused by the store; the client
+  just re-runs init. Direct uploads to a bucket also need a CORS rule on
+  the bucket allowing `PUT` from the viewer's origin.
+- **Through the server** — `file://` remotes and plain-folder serving can't
+  presign, so the client sends content to the server, which stores it
+  (object store + journal, or straight to disk for a served folder, where
+  the daemon will pick it up like any local edit).
 
 ## Claude Code plugin
 
@@ -170,7 +251,7 @@ Install beardrive support in Claude Code with two commands:
 The plugin sets up everything at once:
 
 - **`/beardrive:mount [folder] [remote]`** — one command that installs beardrive if
-  needed, mounts the folder (daemon + `.beardrive` config), and verifies the sync.
+  needed, mounts the folder (daemon + `.bdrive` config), and verifies the sync.
   `/beardrive:status` diagnoses problems.
 - **Turn-boundary sync hooks**, registered automatically: a blocking pull
   when you send a message (Claude always reads fresh files) and an async
@@ -185,7 +266,7 @@ The plugin sets up everything at once:
 
 ```
 working folder  ←materialize/scan→  local volume store  ←push/pull→  object store
- (real files)                       ~/.beardrive/volumes/<vol>              s3:// gs:// file://
+ (real files)                       ~/.bdrive/volumes/<vol>              s3:// gs:// file://
                                     ├─ blobs/   content-addressed (sha256)
                                     ├─ journal/ one append-only op log per device
                                     ├─ state.json  what's materialized
@@ -211,8 +292,8 @@ working folder  ←materialize/scan→  local volume store  ←push/pull→  obj
 ### What beardrive does not sync
 
 `.git` directories (per-file LWW would corrupt repositories), `.DS_Store`,
-the `.beardrive` settings file, its own temp files, and anything excluded by
-`.beardriveignore` or omitted from an `include` list. Empty directories are not
+the `.bdrive` settings file, its own temp files, and anything excluded by
+`.bdriveignore` or omitted from an `include` list. Empty directories are not
 tracked (like git).
 
 ## Roadmap
@@ -232,7 +313,7 @@ go test ./...
 
 The integration tests in `internal/syncer` simulate multiple devices syncing
 through a `file://` remote, including offline operation and concurrent-edit
-conflicts. Set `BEARDRIVE_HOME` to relocate all beardrive state (used heavily in tests).
+conflicts. Set `BDRIVE_HOME` to relocate all beardrive state (used heavily in tests).
 
 ## License
 
diff --git a/cmd/bdrive/cmds.go b/cmd/bdrive/cmds.go
index 7e23af1..441f3bd 100644
--- a/cmd/bdrive/cmds.go
+++ b/cmd/bdrive/cmds.go
@@ -76,7 +76,7 @@ func statusCmd() *cobra.Command {
 				}
 				first = false
 				if eff, _, found, err := config.EffectiveMount(folder); err == nil && found {
-					mi = eff // .beardrive project file wins over the registry
+					mi = eff // .bdrive project file wins over the registry
 				}
 				fmt.Printf("%s\n", folder)
 				fmt.Printf("  volume:   %s\n", mi.Volume)
@@ -194,7 +194,7 @@ func remoteCmd() *cobra.Command {
 	}
 	set := &cobra.Command{
 		Use:   "set <folder> <url>",
-		Short: "Set the remote (s3://bucket/prefix, gs://bucket/prefix, file:///path)",
+		Short: "Set the remote (s3://bucket/prefix, gs://bucket/prefix, file:///path, https://bdrive-server)",
 		Args:  cobra.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			folder, err := absFolder(args[:1])
@@ -203,8 +203,8 @@ func remoteCmd() *cobra.Command {
 			}
 			raw := args[1]
 			u, err := url.Parse(raw)
-			if err != nil || (u.Scheme != "s3" && u.Scheme != "gs" && u.Scheme != "file") {
-				return fmt.Errorf("invalid remote %q (want s3://bucket/prefix, gs://bucket/prefix, or file:///path)", raw)
+			if err != nil || (u.Scheme != "s3" && u.Scheme != "gs" && u.Scheme != "file" && u.Scheme != "http" && u.Scheme != "https") {
+				return fmt.Errorf("invalid remote %q (want s3://bucket/prefix, gs://bucket/prefix, file:///path, or https://bdrive-server)", raw)
 			}
 			mi, err := mustMount(folder)
 			if err != nil {
diff --git a/cmd/bdrive/helpers.go b/cmd/bdrive/helpers.go
index bf9d25a..eb1bd0e 100644
--- a/cmd/bdrive/helpers.go
+++ b/cmd/bdrive/helpers.go
@@ -20,8 +20,8 @@ func absFolder(args []string) (string, error) {
 	return filepath.Abs(arg)
 }
 
-// mustMount resolves a folder's settings: the .beardrive project file wins over
-// the global registry, so a folder that carries its own .beardrive works even
+// mustMount resolves a folder's settings: the .bdrive project file wins over
+// the global registry, so a folder that carries its own .bdrive works even
 // before it is registered on this device.
 func mustMount(folder string) (config.MountInfo, error) {
 	mi, _, found, err := config.EffectiveMount(folder)
@@ -92,7 +92,7 @@ func printCycle(res *syncer.Result) {
 	fmt.Printf("  local changes:  %d\n", res.LocalOps)
 	fmt.Printf("  pulled changes: %d\n", res.PulledOps)
 	if res.Conflicts > 0 {
-		fmt.Printf("  conflicts:      %d (preserved as *.beardrive-conflict-* files)\n", res.Conflicts)
+		fmt.Printf("  conflicts:      %d (preserved as *.bdrive-conflict-* files)\n", res.Conflicts)
 	}
 	fmt.Printf("  files updated:  %d\n", res.Materialized)
 	switch {
diff --git a/cmd/bdrive/init.go b/cmd/bdrive/init.go
new file mode 100644
index 0000000..2b07c3e
--- /dev/null
+++ b/cmd/bdrive/init.go
@@ -0,0 +1,255 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/runbear-io/beardrive/internal/config"
+)
+
+// starterIgnore is seeded into new projects so build artifacts and
+// dependency trees don't flood the sync. Users edit it freely; it syncs to
+// every device like a normal file.
+const starterIgnore = `# bdrive ignore rules (gitignore-style). This file syncs across devices.
+node_modules/
+dist/
+build/
+target/
+out/
+coverage/
+__pycache__/
+*.pyc
+.venv/
+venv/
+.next/
+.cache/
+.DS_Store
+*.log
+.env
+.env.*
+`
+
+// loginCmd points this device at a bdrive web server: verify it, remember it
+// as the device default. Every later `bdrive init` uses it.
+func loginCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "login [server-url]",
+		Short: "Set this device's bdrive web server",
+		Long: `Set the bdrive web server this device syncs through. The URL is verified
+and remembered (settings.json under the bdrive home); every later
+"bdrive init" uses it. With no argument, show the current server.`,
+		Example: `  bdrive login https://drive.example.com:4173
+  bdrive login                       # show the current server`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			settings, err := config.LoadSettings()
+			if err != nil {
+				return err
+			}
+			if len(args) == 0 {
+				if settings.Server == "" {
+					return fmt.Errorf("no server configured; run `bdrive login https://host:4173`")
+				}
+				fmt.Println(settings.Server)
+				return nil
+			}
+			raw := args[0]
+			u, err := url.Parse(raw)
+			if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+				return fmt.Errorf("invalid server URL %q (want https://host:port)", raw)
+			}
+			server := strings.TrimSuffix(raw, "/")
+			// Prove the URL actually points at a bdrive server before
+			// remembering it.
+			if err := checkServer(server); err != nil {
+				return fmt.Errorf("cannot reach bdrive server at %s: %w", server, err)
+			}
+			settings.Server = server
+			if err := config.SaveSettings(settings); err != nil {
+				return err
+			}
+			fmt.Printf("logged in to %s (default server for `bdrive init`)\n", server)
+			return nil
+		},
+	}
+}
+
+// initCmd is the one-command onboarding: join or create a project on the
+// logged-in server and start syncing this folder. The client device is
+// storage-blind — it learns everything from the server and never holds
+// bucket URLs or cloud credentials.
+func initCmd() *cobra.Command {
+	var projectID, projectName string
+	c := &cobra.Command{
+		Use:   "init [folder]",
+		Short: "Start syncing a project folder through your bdrive server",
+		Long: `Set up a folder to sync through this device's bdrive web server (set once
+with "bdrive login"), then mount it.
+
+Project resolution on the server:
+
+  - bare init          create-or-join a project named after the folder
+  - --project <id>     join an existing project by id
+  - --name <name>      create-or-join a project with an explicit name
+
+init writes the folder's .bdrive (project id + server), seeds a starter
+.bdriveignore if none exists, and mounts the folder — a background daemon
+starts syncing immediately.`,
+		Example: `  bdrive init                        # this folder, project named after it
+  bdrive init ./notes --name shared-notes
+  bdrive init --project p-7f3a2c91   # join an existing project`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			folder, err := absFolder(args)
+			if err != nil {
+				return err
+			}
+			if projectID != "" && projectName != "" {
+				return fmt.Errorf("--project and --name are mutually exclusive")
+			}
+
+			settings, err := config.LoadSettings()
+			if err != nil {
+				return err
+			}
+			server := settings.Server
+			if server == "" {
+				return fmt.Errorf("no server configured; run `bdrive login https://host:4173` first")
+			}
+
+			// Refuse to silently repoint a folder that already belongs
+			// somewhere else.
+			proj, hasProj, err := config.LoadProject(folder)
+			if err != nil {
+				return err
+			}
+			if hasProj && proj.Remote != "" && !strings.HasPrefix(proj.Remote, server+"/p/") {
+				return fmt.Errorf("%s already syncs with %s; use `bdrive remote set` to repoint it",
+					filepath.Join(folder, config.ProjectFile), proj.Remote)
+			}
+
+			// Resolve the project on the server.
+			var p serverProject
+			switch {
+			case projectID != "":
+				p, err = getProject(server, projectID)
+			default:
+				name := projectName
+				if name == "" {
+					name = filepath.Base(folder)
+				}
+				var created bool
+				p, created, err = createProject(server, name)
+				if err == nil && created {
+					fmt.Printf("created project %q (%s) on %s\n", p.Name, p.ID, server)
+				}
+			}
+			if err != nil {
+				return fmt.Errorf("cannot set up project on %s: %w", server, err)
+			}
+
+			if err := os.MkdirAll(folder, 0o755); err != nil {
+				return err
+			}
+			proj.Volume, proj.Remote = p.Name, server+"/p/"+p.ID
+			if err := config.SaveProject(folder, proj); err != nil {
+				return err
+			}
+			ignorePath := filepath.Join(folder, ".bdriveignore")
+			if _, err := os.Stat(ignorePath); os.IsNotExist(err) {
+				if err := os.WriteFile(ignorePath, []byte(starterIgnore), 0o644); err != nil {
+					return err
+				}
+				fmt.Printf("seeded %s (edit freely; it syncs like a normal file)\n", ignorePath)
+			}
+			fmt.Printf("initialized %s\n  server:  %s\n  project: %s (%s)\n", folder, server, p.Name, p.ID)
+
+			// Mount: initial cycle + background daemon. Same as `bdrive mnt`.
+			return runMount(cmd.Context(), folder, "", "", false, 3*time.Second, 10*time.Second)
+		},
+	}
+	c.Flags().StringVar(&projectID, "project", "", "join an existing project by id (p-xxxxxxxx)")
+	c.Flags().StringVar(&projectName, "name", "", "project name to create or join (default: folder name)")
+	return c
+}
+
+type serverProject struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+var initClient = &http.Client{Timeout: 10 * time.Second}
+
+// checkServer verifies the URL answers like a bdrive server.
+func checkServer(server string) error {
+	resp, err := initClient.Get(server + "/api/config")
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return httpBodyError(resp)
+	}
+	var cfg struct {
+		Mode string `json:"mode"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&cfg); err != nil || cfg.Mode == "" {
+		return fmt.Errorf("not a bdrive server (bad /api/config)")
+	}
+	if cfg.Mode != "hub" {
+		fmt.Println("note: this server serves a single folder (no projects); `bdrive init` needs a hub (a server started on a storage root)")
+	}
+	return nil
+}
+
+func httpBodyError(resp *http.Response) error {
+	msg, _ := io.ReadAll(io.LimitReader(resp.Body, 256))
+	return fmt.Errorf("%s: %s", resp.Status, strings.TrimSpace(string(msg)))
+}
+
+func getProject(server, id string) (serverProject, error) {
+	var p serverProject
+	resp, err := initClient.Get(server + "/api/projects/" + url.PathEscape(id))
+	if err != nil {
+		return p, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return p, httpBodyError(resp)
+	}
+	err = json.NewDecoder(resp.Body).Decode(&p)
+	return p, err
+}
+
+func createProject(server, name string) (serverProject, bool, error) {
+	body, err := json.Marshal(map[string]string{"name": name})
+	if err != nil {
+		return serverProject{}, false, err
+	}
+	resp, err := initClient.Post(server+"/api/projects", "application/json", bytes.NewReader(body))
+	if err != nil {
+		return serverProject{}, false, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return serverProject{}, false, httpBodyError(resp)
+	}
+	var out struct {
+		Project serverProject `json:"project"`
+		Created bool          `json:"created"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return serverProject{}, false, fmt.Errorf("not a bdrive server (bad response): %w", err)
+	}
+	return out.Project, out.Created, nil
+}
diff --git a/cmd/bdrive/main.go b/cmd/bdrive/main.go
index dad512b..6952ea0 100644
--- a/cmd/bdrive/main.go
+++ b/cmd/bdrive/main.go
@@ -30,6 +30,8 @@ everything keeps working offline; changes sync when the remote is reachable.`,
 		SilenceUsage: true,
 	}
 	root.AddCommand(
+		loginCmd(),
+		initCmd(),
 		mntCmd(),
 		umntCmd(),
 		syncCmd(),
diff --git a/cmd/bdrive/mount.go b/cmd/bdrive/mount.go
index ac29289..94ba915 100644
--- a/cmd/bdrive/mount.go
+++ b/cmd/bdrive/mount.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -37,97 +38,7 @@ daemon keeps the folder in sync until "bdrive umnt".`,
 			if err != nil {
 				return err
 			}
-			if err := os.MkdirAll(folder, 0o755); err != nil {
-				return err
-			}
-
-			// Settings resolution: flags win, then the folder's .beardrive file,
-			// then the global registry. The result is written back to both,
-			// so the project file travels with the folder and the registry
-			// knows which mounts are active on this device.
-			mounts, err := config.LoadMounts()
-			if err != nil {
-				return err
-			}
-			reg, registered := mounts[folder]
-			proj, _, err := config.LoadProject(folder)
-			if err != nil {
-				return err
-			}
-			effVolume := proj.Volume
-			if effVolume == "" && registered {
-				effVolume = reg.Volume
-			}
-			if volume != "" && effVolume != "" && volume != effVolume {
-				return fmt.Errorf("%s is already mounted as volume %q", folder, effVolume)
-			}
-			if volume != "" {
-				effVolume = volume
-			}
-			if effVolume == "" {
-				effVolume = filepath.Base(folder)
-			}
-			effRemote := remoteURL
-			if effRemote == "" {
-				effRemote = proj.Remote
-			}
-			if effRemote == "" && registered {
-				effRemote = reg.Remote
-			}
-			mi := config.MountInfo{Volume: effVolume, Remote: effRemote}
-			mounts[folder] = mi
-			if err := config.SaveMounts(mounts); err != nil {
-				return err
-			}
-			proj.Volume, proj.Remote = effVolume, effRemote
-			if err := config.SaveProject(folder, proj); err != nil {
-				return err
-			}
-			vdir, err := config.VolumeDir(mi.Volume)
-			if err != nil {
-				return err
-			}
-			if _, err := store.Open(vdir); err != nil {
-				return err
-			}
-
-			dev, err := config.LoadDevice()
-			if err != nil {
-				return err
-			}
-
-			// Initial cycle: import existing files, pull remote state.
-			sess, _, err := openSession(cmd.Context(), folder, true)
-			if err != nil {
-				return err
-			}
-			res, err := sess.Cycle(cmd.Context())
-			closeSession(sess)
-			if err != nil {
-				return err
-			}
-
-			fmt.Printf("mounted %s\n", folder)
-			fmt.Printf("  volume:  %s\n", mi.Volume)
-			if mi.Remote != "" {
-				fmt.Printf("  remote:  %s\n", mi.Remote)
-			} else {
-				fmt.Printf("  remote:  (none — local only; set one with `bdrive remote set %s <url>`)\n", folder)
-			}
-			fmt.Printf("  device:  %s (%s) as %s\n", dev.Name, dev.ID, dev.Author)
-			fmt.Printf("  config:  %s (volume/remote/include; add a .beardriveignore next to it to exclude paths)\n",
-				filepath.Join(folder, config.ProjectFile))
-			printCycle(res)
-
-			if foreground {
-				return daemon.Run(folder, scanInterval, remoteInterval)
-			}
-			pid, err := daemon.Start(folder, vdir, scanInterval, remoteInterval)
-			if err != nil {
-				return fmt.Errorf("start sync daemon: %w", err)
-			}
-			fmt.Printf("  daemon:  running (pid %d, scan %s, remote sync %s)\n", pid, scanInterval, remoteInterval)
-			return nil
+			return runMount(cmd.Context(), folder, remoteURL, volume, foreground, scanInterval, remoteInterval)
 		},
 	}
 	c.Flags().StringVarP(&remoteURL, "remote", "r", "", "remote to sync with (s3://bucket/prefix, gs://bucket/prefix, file:///path)")
@@ -138,6 +49,101 @@ daemon keeps the folder in sync until "bdrive umnt".`,
 	return c
 }
 
+// runMount mounts a folder: resolve settings, register the mount, run the
+// initial cycle, start the daemon. Shared by `bdrive mnt` and `bdrive init`.
+func runMount(ctx context.Context, folder, remoteURL, volume string, foreground bool, scanInterval, remoteInterval time.Duration) error {
+	if err := os.MkdirAll(folder, 0o755); err != nil {
+		return err
+	}
+
+	// Settings resolution: flags win, then the folder's .bdrive file,
+	// then the global registry. The result is written back to both,
+	// so the project file travels with the folder and the registry
+	// knows which mounts are active on this device.
+	mounts, err := config.LoadMounts()
+	if err != nil {
+		return err
+	}
+	reg, registered := mounts[folder]
+	proj, _, err := config.LoadProject(folder)
+	if err != nil {
+		return err
+	}
+	effVolume := proj.Volume
+	if effVolume == "" && registered {
+		effVolume = reg.Volume
+	}
+	if volume != "" && effVolume != "" && volume != effVolume {
+		return fmt.Errorf("%s is already mounted as volume %q", folder, effVolume)
+	}
+	if volume != "" {
+		effVolume = volume
+	}
+	if effVolume == "" {
+		effVolume = filepath.Base(folder)
+	}
+	effRemote := remoteURL
+	if effRemote == "" {
+		effRemote = proj.Remote
+	}
+	if effRemote == "" && registered {
+		effRemote = reg.Remote
+	}
+	mi := config.MountInfo{Volume: effVolume, Remote: effRemote}
+	mounts[folder] = mi
+	if err := config.SaveMounts(mounts); err != nil {
+		return err
+	}
+	proj.Volume, proj.Remote = effVolume, effRemote
+	if err := config.SaveProject(folder, proj); err != nil {
+		return err
+	}
+	vdir, err := config.VolumeDir(mi.Volume)
+	if err != nil {
+		return err
+	}
+	if _, err := store.Open(vdir); err != nil {
+		return err
+	}
+
+	dev, err := config.LoadDevice()
+	if err != nil {
+		return err
+	}
+
+	// Initial cycle: import existing files, pull remote state.
+	sess, _, err := openSession(ctx, folder, true)
+	if err != nil {
+		return err
+	}
+	res, err := sess.Cycle(ctx)
+	closeSession(sess)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("mounted %s\n", folder)
+	fmt.Printf("  volume:  %s\n", mi.Volume)
+	if mi.Remote != "" {
+		fmt.Printf("  remote:  %s\n", mi.Remote)
+	} else {
+		fmt.Printf("  remote:  (none — local only; set one with `bdrive remote set %s <url>`)\n", folder)
+	}
+	fmt.Printf("  device:  %s (%s) as %s\n", dev.Name, dev.ID, dev.Author)
+	fmt.Printf("  config:  %s (volume/remote/include; add a .bdriveignore next to it to exclude paths)\n",
+		filepath.Join(folder, config.ProjectFile))
+	printCycle(res)
+
+	if foreground {
+		return daemon.Run(folder, scanInterval, remoteInterval)
+	}
+	pid, err := daemon.Start(folder, vdir, scanInterval, remoteInterval)
+	if err != nil {
+		return fmt.Errorf("start sync daemon: %w", err)
+	}
+	fmt.Printf("  daemon:  running (pid %d, scan %s, remote sync %s)\n", pid, scanInterval, remoteInterval)
+	return nil
+}
 func umntCmd() *cobra.Command {
 	var forget bool
 	c := &cobra.Command{
@@ -148,7 +154,7 @@ func umntCmd() *cobra.Command {
 history is kept; "bdrive mnt" the folder again to resume syncing.
 
 With --forget the folder is also removed from the mount registry (local
-volume data under ~/.beardrive/volumes is still kept).`,
+volume data under ~/.bdrive/volumes is still kept).`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			folder, err := absFolder(args)
@@ -181,7 +187,7 @@ volume data under ~/.beardrive/volumes is still kept).`,
 				if err := config.SaveMounts(mounts); err != nil {
 					return err
 				}
-				fmt.Printf("forgot mount %s (volume %q kept under ~/.beardrive/volumes)\n", folder, mi.Volume)
+				fmt.Printf("forgot mount %s (volume %q kept under ~/.bdrive/volumes)\n", folder, mi.Volume)
 			}
 			return nil
 		},
diff --git a/cmd/bdrive/web.go b/cmd/bdrive/web.go
index 00966e3..4c20bde 100644
--- a/cmd/bdrive/web.go
+++ b/cmd/bdrive/web.go
@@ -1,6 +1,8 @@
 package main
 
 import (
+	"bytes"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -12,32 +14,111 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/runbear-io/beardrive/internal/config"
 	"github.com/runbear-io/beardrive/internal/remote"
 	"github.com/runbear-io/beardrive/internal/webapp"
 )
 
+// webConfig mirrors the web command's flags so a server can be configured
+// from a file (bdrive web -c config.json). Explicitly-passed flags win over
+// file values.
+type webConfig struct {
+	Remote     string `json:"remote,omitempty"`
+	Dir        string `json:"dir,omitempty"`
+	Addr       string `json:"addr,omitempty"`
+	Volume     string `json:"volume,omitempty"`
+	Refresh    string `json:"refresh,omitempty"` // duration, e.g. "10s"
+	Upload     *bool  `json:"upload,omitempty"`
+	UploadTTL  string `json:"upload_ttl,omitempty"`  // duration, e.g. "15m"
+	ProjectsDB string `json:"projects_db,omitempty"` // hub project registry path
+}
+
+func loadWebConfig(path string) (webConfig, error) {
+	var c webConfig
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return c, err
+	}
+	dec := json.NewDecoder(bytes.NewReader(data))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&c); err != nil {
+		return c, fmt.Errorf("parse %s: %w", path, err)
+	}
+	return c, nil
+}
+
 func webCmd() *cobra.Command {
 	var remoteURL, dir, volume string
-	var addr string
-	var refresh time.Duration
+	var addr, configPath, projectsDB string
+	var refresh, uploadTTL time.Duration
+	var upload bool
 	c := &cobra.Command{
-		Use:   "web [folder | remote-url]",
-		Short: "Serve a read-only web viewer for a folder or a remote",
-		Long: `Serve a read-only website: browse folders and files, read rendered
+		Use:   "web [folder | storage-root-url]",
+		Short: "Serve the bdrive web server: viewer, uploads, and sync hub",
+		Long: `Serve the bdrive web server: browse folders and files, read rendered
 markdown (Obsidian-style, including [[wikilinks]]), and download any file.
 
-Two sources:
+Two modes:
 
   - a local folder, served straight from disk (the default — on a mounted
-    folder the daemon keeps it fresh, so this is the simplest deployment);
-  - a BearDrive remote, read directly from the object store with per-file
-    provenance from the journals — no mount, daemon, or local state needed.`,
+    folder the daemon keeps it fresh, so this is the simplest viewer);
+  - a hub: point it at an object-storage root and it hosts many projects,
+    each stored under its own prefix, managed by a file-backed project
+    registry. Client devices run "bdrive login <this server>" once, then
+    "bdrive init" per project, and sync whole folders through it without
+    ever seeing the storage location or holding cloud credentials.
+
+The server is read-only unless --upload is set. With uploads on, content
+travels directly between clients and the object store through short-lived
+presigned URLs when the backend supports it (S3, GCS with signing
+credentials); otherwise it is relayed through this server.`,
 		Example: `  bdrive web                          # serve the current directory
   bdrive web ./notes                  # serve a folder
-  bdrive web s3://bucket/prefix       # serve a remote
-  bdrive web --remote gs://bucket/prefix --addr :8080`,
+  bdrive web -c config.json           # everything from a config file
+  bdrive web s3://bucket/root --upload  # multi-project sync hub`,
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
+			// Config file first; flags that were explicitly passed override
+			// its values.
+			if configPath != "" {
+				c, err := loadWebConfig(configPath)
+				if err != nil {
+					return err
+				}
+				set := cmd.Flags().Changed
+				if c.Remote != "" && !set("remote") {
+					remoteURL = c.Remote
+				}
+				if c.Dir != "" && !set("dir") {
+					dir = c.Dir
+				}
+				if c.Addr != "" && !set("addr") {
+					addr = c.Addr
+				}
+				if c.Volume != "" && !set("volume") {
+					volume = c.Volume
+				}
+				if c.Upload != nil && !set("upload") {
+					upload = *c.Upload
+				}
+				if c.Refresh != "" && !set("refresh") {
+					d, err := time.ParseDuration(c.Refresh)
+					if err != nil {
+						return fmt.Errorf("config refresh: %w", err)
+					}
+					refresh = d
+				}
+				if c.UploadTTL != "" && !set("upload-ttl") {
+					d, err := time.ParseDuration(c.UploadTTL)
+					if err != nil {
+						return fmt.Errorf("config upload_ttl: %w", err)
+					}
+					uploadTTL = d
+				}
+				if c.ProjectsDB != "" && !set("projects-db") {
+					projectsDB = c.ProjectsDB
+				}
+			}
 			// Positional argument: a URL selects remote mode, anything else
 			// is a folder. With nothing specified, serve the current dir.
 			if remoteURL == "" && dir == "" && len(args) > 0 {
@@ -54,9 +135,13 @@ Two sources:
 				dir = "."
 			}
 
-			var src webapp.Source
-			var display, name string
+			srv := &webapp.Server{
+				Refresh: refresh,
+				Upload:  webapp.UploadConfig{Enabled: upload, TTL: uploadTTL},
+			}
+			var display string
 			if dir != "" {
+				// Single-volume viewer over a plain folder.
 				abs, err := filepath.Abs(dir)
 				if err != nil {
 					return err
@@ -64,32 +149,46 @@ Two sources:
 				if fi, err := os.Stat(abs); err != nil || !fi.IsDir() {
 					return fmt.Errorf("%s is not a directory", abs)
 				}
-				src = &webapp.DirSource{Root: abs}
-				display, name = abs, filepath.Base(abs)
+				srv.Source = &webapp.DirSource{Root: abs}
+				srv.Volume = filepath.Base(abs)
+				display = abs
 			} else {
+				// Hub: many projects on one storage root.
 				be, err := remote.Open(cmd.Context(), remoteURL)
 				if err != nil {
 					return err
 				}
 				defer be.Close()
-				src = &webapp.RemoteSource{Backend: be}
-				display, name = remoteURL, volumeName(remoteURL)
+				if projectsDB == "" {
+					home, err := config.Home()
+					if err != nil {
+						return err
+					}
+					projectsDB = filepath.Join(home, "projects.json")
+				}
+				db, err := webapp.OpenProjectDB(projectsDB)
+				if err != nil {
+					return fmt.Errorf("open project registry: %w", err)
+				}
+				dev, err := config.LoadDevice()
+				if err != nil {
+					return fmt.Errorf("load device identity: %w", err)
+				}
+				srv.Root = be
+				srv.Projects = db
+				srv.Device = webapp.Identity{ID: dev.ID, Name: dev.Name, Author: dev.Author}
+				srv.Volume = volumeName(remoteURL)
+				display = remoteURL + " (projects: " + projectsDB + ")"
 			}
 			if volume != "" {
-				name = volume
-			}
-			srv := &webapp.Server{
-				Source:  src,
-				Remote:  display,
-				Volume:  name,
-				Refresh: refresh,
+				srv.Volume = volume
 			}
 
 			shown := addr
 			if strings.HasPrefix(shown, ":") {
 				shown = "localhost" + shown
 			}
-			fmt.Printf("serving %s\n  volume: %s\n  url:    http://%s\n", display, name, shown)
+			fmt.Printf("serving %s\n  volume: %s\n  url:    http://%s\n", display, srv.Volume, shown)
 			return http.ListenAndServe(addr, srv.Handler())
 		},
 	}
@@ -98,6 +197,10 @@ Two sources:
 	c.Flags().StringVar(&addr, "addr", ":4173", "address to listen on")
 	c.Flags().StringVarP(&volume, "volume", "v", "", "volume display name (default: folder or remote basename)")
 	c.Flags().DurationVar(&refresh, "refresh", 10*time.Second, "how long to cache the file listing")
+	c.Flags().BoolVar(&upload, "upload", false, "allow clients to upload files")
+	c.Flags().DurationVar(&uploadTTL, "upload-ttl", webapp.DefaultUploadTTL, "lifetime of presigned direct-upload URLs")
+	c.Flags().StringVarP(&configPath, "config", "c", "", "JSON config file; explicit flags override its values")
+	c.Flags().StringVar(&projectsDB, "projects-db", "", "hub project registry file (default: $BDRIVE_HOME/projects.json)")
 	return c
 }
 
diff --git a/internal/config/config.go b/internal/config/config.go
index a4d855e..daa57b4 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1,5 +1,5 @@
 // Package config manages beardrive's global state under the beardrive home directory
-// (default ~/.beardrive, overridable with $BEARDRIVE_HOME): the device identity and the
+// (default ~/.bdrive, overridable with $BDRIVE_HOME): the device identity and the
 // registry of mounted folders.
 package config
 
@@ -15,16 +15,16 @@ import (
 	"strings"
 )
 
-// Home returns the beardrive home directory ($BEARDRIVE_HOME or ~/.beardrive).
+// Home returns the beardrive home directory ($BDRIVE_HOME or ~/.bdrive).
 func Home() (string, error) {
-	if h := os.Getenv("BEARDRIVE_HOME"); h != "" {
+	if h := os.Getenv("BDRIVE_HOME"); h != "" {
 		return h, nil
 	}
 	uh, err := os.UserHomeDir()
 	if err != nil {
 		return "", err
 	}
-	return filepath.Join(uh, ".beardrive"), nil
+	return filepath.Join(uh, ".bdrive"), nil
 }
 
 // Device identifies this machine and its operator in journals.
@@ -160,7 +160,7 @@ func writeJSON(path string, v any) error {
 	if err != nil {
 		return err
 	}
-	tmp, err := os.CreateTemp(filepath.Dir(path), ".beardrive-tmp-*")
+	tmp, err := os.CreateTemp(filepath.Dir(path), ".bdrive-tmp-*")
 	if err != nil {
 		return err
 	}
diff --git a/internal/config/project.go b/internal/config/project.go
index 97894a2..ea21628 100644
--- a/internal/config/project.go
+++ b/internal/config/project.go
@@ -12,19 +12,19 @@ import (
 // volume/remote apply) but is never synced — remotes and credentials setups
 // are often device-specific, and syncing it would let one device silently
 // repoint another.
-const ProjectFile = ".beardrive"
+const ProjectFile = ".bdrive"
 
-// Project holds the settings stored in <folder>/.beardrive.
+// Project holds the settings stored in <folder>/.bdrive.
 type Project struct {
 	Volume string `json:"volume,omitempty"`
 	Remote string `json:"remote,omitempty"`
 	// Include optionally narrows what syncs: when non-empty, only paths
 	// matching one of these patterns (gitignore-style, same syntax as
-	// .beardriveignore) are scanned and materialized.
+	// .bdriveignore) are scanned and materialized.
 	Include []string `json:"include,omitempty"`
 }
 
-// LoadProject reads <folder>/.beardrive; ok is false if the file does not exist.
+// LoadProject reads <folder>/.bdrive; ok is false if the file does not exist.
 func LoadProject(folder string) (Project, bool, error) {
 	var p Project
 	data, err := os.ReadFile(filepath.Join(folder, ProjectFile))
@@ -40,14 +40,14 @@ func LoadProject(folder string) (Project, bool, error) {
 	return p, true, nil
 }
 
-// SaveProject writes <folder>/.beardrive.
+// SaveProject writes <folder>/.bdrive.
 func SaveProject(folder string, p Project) error {
 	return writeJSON(filepath.Join(folder, ProjectFile), p)
 }
 
 // EffectiveMount resolves a folder's mount settings: the project file wins
-// over the global registry, so hand-edits to .beardrive (or a folder copied with
-// its .beardrive) take effect without re-registering. Found reports whether the
+// over the global registry, so hand-edits to .bdrive (or a folder copied with
+// its .bdrive) take effect without re-registering. Found reports whether the
 // folder is known at all (registered or carrying a project file).
 func EffectiveMount(folder string) (mi MountInfo, proj Project, found bool, err error) {
 	mounts, err := LoadMounts()
diff --git a/internal/config/settings.go b/internal/config/settings.go
new file mode 100644
index 0000000..bda6b41
--- /dev/null
+++ b/internal/config/settings.go
@@ -0,0 +1,54 @@
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// Settings are device-wide defaults, stored at $BDRIVE_HOME/settings.json.
+type Settings struct {
+	// Server is the default bdrive web server for `bdrive init`.
+	Server string `json:"server,omitempty"`
+}
+
+func settingsPath() (string, error) {
+	home, err := Home()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, "settings.json"), nil
+}
+
+// LoadSettings reads the device settings; a missing file is zero settings.
+func LoadSettings() (Settings, error) {
+	var s Settings
+	path, err := settingsPath()
+	if err != nil {
+		return s, err
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return s, nil
+		}
+		return s, err
+	}
+	if err := json.Unmarshal(data, &s); err != nil {
+		return s, fmt.Errorf("parse %s: %w", path, err)
+	}
+	return s, nil
+}
+
+// SaveSettings persists the device settings.
+func SaveSettings(s Settings) error {
+	path, err := settingsPath()
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return err
+	}
+	return writeJSON(path, s)
+}
diff --git a/internal/daemon/daemon.go b/internal/daemon/daemon.go
index 6d21c68..7ed38ae 100644
--- a/internal/daemon/daemon.go
+++ b/internal/daemon/daemon.go
@@ -106,7 +106,7 @@ func Stop(volDir, mountID string) (bool, error) {
 	return true, nil
 }
 
-// overlayProject applies the folder's .beardrive settings on top of the registry
+// overlayProject applies the folder's .bdrive settings on top of the registry
 // entry; the project file wins so hand-edits take effect on the next tick.
 func overlayProject(folder string, mi config.MountInfo) config.MountInfo {
 	proj, ok, err := config.LoadProject(folder)
@@ -167,7 +167,7 @@ func Run(folder string, scanInterval, remoteInterval time.Duration) error {
 	var lastRemote time.Time
 
 	for {
-		// Pick up `bdrive remote set`, .beardrive edits, and `bdrive umnt --forget`
+		// Pick up `bdrive remote set`, .bdrive edits, and `bdrive umnt --forget`
 		// without restarting.
 		if m, err := config.LoadMounts(); err == nil {
 			cur, ok := m[folder]
diff --git a/internal/journal/journal.go b/internal/journal/journal.go
index 950083d..019af49 100644
--- a/internal/journal/journal.go
+++ b/internal/journal/journal.go
@@ -115,25 +115,34 @@ func ReadFile(path string) ([]Op, error) {
 	return Parse(data)
 }
 
+// Marshal encodes ops as JSONL, the journal wire format.
+func Marshal(ops []Op) ([]byte, error) {
+	var buf bytes.Buffer
+	for _, op := range ops {
+		b, err := json.Marshal(op)
+		if err != nil {
+			return nil, err
+		}
+		buf.Write(b)
+		buf.WriteByte('\n')
+	}
+	return buf.Bytes(), nil
+}
+
 // Append appends ops to a journal file as JSONL.
 func Append(path string, ops []Op) error {
 	if len(ops) == 0 {
 		return nil
 	}
-	var buf bytes.Buffer
-	for _, op := range ops {
-		b, err := json.Marshal(op)
-		if err != nil {
-			return err
-		}
-		buf.Write(b)
-		buf.WriteByte('\n')
+	data, err := Marshal(ops)
+	if err != nil {
+		return err
 	}
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
 	if err != nil {
 		return err
 	}
 	defer f.Close()
-	_, err = f.Write(buf.Bytes())
+	_, err = f.Write(data)
 	return err
 }
diff --git a/internal/remote/gcs.go b/internal/remote/gcs.go
index af04318..f9c606b 100644
--- a/internal/remote/gcs.go
+++ b/internal/remote/gcs.go
@@ -5,8 +5,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"path"
 	"strings"
+	"time"
 
 	gcs "cloud.google.com/go/storage"
 	"google.golang.org/api/iterator"
@@ -48,6 +50,23 @@ func (b *gcsBackend) Put(ctx context.Context, key string, r io.Reader, _ int64)
 	return w.Close()
 }
 
+// SignPut mints a V4 signed PUT URL. Signing needs credentials that can sign
+// bytes (a service account key, or iam.serviceAccounts.signBlob rights);
+// plain end-user ADC cannot, in which case callers fall back to uploading
+// through the server.
+func (b *gcsBackend) SignPut(_ context.Context, key string, _ int64, ttl time.Duration) (*SignedPut, error) {
+	expires := time.Now().Add(ttl)
+	u, err := b.bucket.SignedURL(b.key(key), &gcs.SignedURLOptions{
+		Scheme:  gcs.SigningSchemeV4,
+		Method:  http.MethodPut,
+		Expires: expires,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("sign gcs put: %w", err)
+	}
+	return &SignedPut{URL: u, Method: http.MethodPut, Expires: expires}, nil
+}
+
 func (b *gcsBackend) Get(ctx context.Context, key string) (io.ReadCloser, error) {
 	return b.bucket.Object(b.key(key)).NewReader(ctx)
 }
diff --git a/internal/remote/http.go b/internal/remote/http.go
new file mode 100644
index 0000000..f515788
--- /dev/null
+++ b/internal/remote/http.go
@@ -0,0 +1,216 @@
+package remote
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+	"time"
+)
+
+// httpBackend syncs one project through a bdrive web server instead of
+// talking to an object store. The client device is storage-blind: it only
+// knows the server URL and a project id (https://host:4173/p/<project-id>,
+// written by `bdrive init`); the storage location and credentials live on
+// the server. Blob uploads go directly to the object store through
+// short-lived presigned URLs when the server can mint them, and are relayed
+// through the server otherwise.
+//
+// The server exposes the project's store under /api/p/<id>/store/* (list,
+// object, exists, sign). Key layout and semantics are identical to any other
+// backend, so the whole sync machinery works unchanged.
+type httpBackend struct {
+	base    string // scheme://host[:port]
+	project string
+	hc      *http.Client
+}
+
+var projectPathRe = regexp.MustCompile(`^/p/(p-[0-9a-f]{8})/?$`)
+
+func newHTTPBackend(raw string) (*httpBackend, error) {
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" {
+		return nil, fmt.Errorf("server remote needs a URL like https://host:4173/p/<project-id>, got %q", raw)
+	}
+	m := projectPathRe.FindStringSubmatch(u.Path)
+	if m == nil {
+		return nil, fmt.Errorf("server remote %q has no project (want https://host:4173/p/<project-id>; run `bdrive init`)", raw)
+	}
+	base := (&url.URL{Scheme: u.Scheme, Host: u.Host}).String()
+	return &httpBackend{base: base, project: m[1], hc: &http.Client{Timeout: 5 * time.Minute}}, nil
+}
+
+func (b *httpBackend) endpoint(name string, q url.Values) string {
+	s := b.base + "/api/p/" + b.project + "/store/" + name
+	if len(q) > 0 {
+		s += "?" + q.Encode()
+	}
+	return s
+}
+
+// httpError turns a non-2xx response into an error carrying the server's
+// message.
+func httpError(resp *http.Response) error {
+	msg, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+	return fmt.Errorf("server: %s: %s", resp.Status, strings.TrimSpace(string(msg)))
+}
+
+func (b *httpBackend) List(ctx context.Context, prefix string) ([]Object, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+		b.endpoint("list", url.Values{"prefix": {prefix}}), nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := b.hc.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, httpError(resp)
+	}
+	var out struct {
+		Objects []Object `json:"objects"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return nil, err
+	}
+	return out.Objects, nil
+}
+
+func (b *httpBackend) Get(ctx context.Context, key string) (io.ReadCloser, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+		b.endpoint("object", url.Values{"key": {key}}), nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := b.hc.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		defer resp.Body.Close()
+		return nil, httpError(resp)
+	}
+	return resp.Body, nil
+}
+
+func (b *httpBackend) Exists(ctx context.Context, key string) (bool, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet,
+		b.endpoint("exists", url.Values{"key": {key}}), nil)
+	if err != nil {
+		return false, err
+	}
+	resp, err := b.hc.Do(req)
+	if err != nil {
+		return false, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return false, httpError(resp)
+	}
+	var out struct {
+		Exists bool `json:"exists"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return false, err
+	}
+	return out.Exists, nil
+}
+
+// Put asks the server how to upload this key first: "direct" carries a
+// presigned URL and the bytes bypass the server entirely; "server" relays
+// them through it. The reader is only consumed once the destination is known.
+func (b *httpBackend) Put(ctx context.Context, key string, r io.Reader, size int64) error {
+	plan, err := b.sign(ctx, key, size)
+	if err != nil {
+		return err
+	}
+	if plan.Mode == "direct" {
+		if plan.Exists {
+			return nil // content-addressed and already there
+		}
+		return b.putDirect(ctx, plan, r, size)
+	}
+	return b.putViaServer(ctx, key, r, size)
+}
+
+type putPlan struct {
+	Mode    string            `json:"mode"`
+	Exists  bool              `json:"exists"`
+	URL     string            `json:"url"`
+	Method  string            `json:"method"`
+	Headers map[string]string `json:"headers"`
+}
+
+func (b *httpBackend) sign(ctx context.Context, key string, size int64) (putPlan, error) {
+	var plan putPlan
+	body, err := json.Marshal(map[string]any{"key": key, "size": size})
+	if err != nil {
+		return plan, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, b.endpoint("sign", nil), bytes.NewReader(body))
+	if err != nil {
+		return plan, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := b.hc.Do(req)
+	if err != nil {
+		return plan, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return plan, httpError(resp)
+	}
+	err = json.NewDecoder(resp.Body).Decode(&plan)
+	return plan, err
+}
+
+func (b *httpBackend) putDirect(ctx context.Context, plan putPlan, r io.Reader, size int64) error {
+	method := plan.Method
+	if method == "" {
+		method = http.MethodPut
+	}
+	req, err := http.NewRequestWithContext(ctx, method, plan.URL, r)
+	if err != nil {
+		return err
+	}
+	req.ContentLength = size
+	for k, v := range plan.Headers {
+		req.Header.Set(k, v)
+	}
+	resp, err := b.hc.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("direct upload: %w", httpError(resp))
+	}
+	return nil
+}
+
+func (b *httpBackend) putViaServer(ctx context.Context, key string, r io.Reader, size int64) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut,
+		b.endpoint("object", url.Values{"key": {key}}), r)
+	if err != nil {
+		return err
+	}
+	req.ContentLength = size
+	resp, err := b.hc.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return httpError(resp)
+	}
+	return nil
+}
+
+func (b *httpBackend) Close() error { return nil }
diff --git a/internal/remote/local.go b/internal/remote/local.go
index ba55c97..db31d81 100644
--- a/internal/remote/local.go
+++ b/internal/remote/local.go
@@ -35,7 +35,7 @@ func (b *localBackend) Put(_ context.Context, key string, r io.Reader, _ int64)
 	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
 		return err
 	}
-	tmp, err := os.CreateTemp(filepath.Dir(dst), ".beardrive-tmp-*")
+	tmp, err := os.CreateTemp(filepath.Dir(dst), ".bdrive-tmp-*")
 	if err != nil {
 		return err
 	}
@@ -60,7 +60,7 @@ func (b *localBackend) List(_ context.Context, prefix string) ([]Object, error)
 		if err != nil || d.IsDir() {
 			return nil
 		}
-		if strings.HasPrefix(d.Name(), ".beardrive-tmp-") {
+		if strings.HasPrefix(d.Name(), ".bdrive-tmp-") {
 			return nil
 		}
 		rel, err := filepath.Rel(b.root, p)
diff --git a/internal/remote/prefixed.go b/internal/remote/prefixed.go
new file mode 100644
index 0000000..a64851b
--- /dev/null
+++ b/internal/remote/prefixed.go
@@ -0,0 +1,69 @@
+package remote
+
+import (
+	"context"
+	"io"
+	"strings"
+	"time"
+)
+
+// Prefixed namespaces a backend under prefix: every key is stored at
+// <prefix>/<key>. Used by the web server to host many projects in one
+// storage root. Closing the returned backend does not close the underlying
+// one (it is shared across prefixes).
+func Prefixed(be Backend, prefix string) Backend {
+	prefix = strings.Trim(prefix, "/")
+	p := &prefixed{be: be, prefix: prefix}
+	if signer, ok := be.(PutSigner); ok {
+		return &prefixedSigner{prefixed: p, signer: signer}
+	}
+	return p
+}
+
+type prefixed struct {
+	be     Backend
+	prefix string
+}
+
+func (p *prefixed) key(key string) string { return p.prefix + "/" + key }
+
+func (p *prefixed) Put(ctx context.Context, key string, r io.Reader, size int64) error {
+	return p.be.Put(ctx, p.key(key), r, size)
+}
+
+func (p *prefixed) Get(ctx context.Context, key string) (io.ReadCloser, error) {
+	return p.be.Get(ctx, p.key(key))
+}
+
+func (p *prefixed) Exists(ctx context.Context, key string) (bool, error) {
+	return p.be.Exists(ctx, p.key(key))
+}
+
+func (p *prefixed) List(ctx context.Context, prefix string) ([]Object, error) {
+	objs, err := p.be.List(ctx, p.key(prefix))
+	if err != nil {
+		return nil, err
+	}
+	strip := p.prefix + "/"
+	out := make([]Object, 0, len(objs))
+	for _, o := range objs {
+		if !strings.HasPrefix(o.Key, strip) {
+			continue
+		}
+		out = append(out, Object{Key: strings.TrimPrefix(o.Key, strip), Size: o.Size})
+	}
+	return out, nil
+}
+
+func (p *prefixed) Close() error { return nil }
+
+// prefixedSigner adds presigning when the underlying backend supports it, so
+// direct uploads keep working through the namespace.
+type prefixedSigner struct {
+	*prefixed
+	signer PutSigner
+}
+
+func (p *prefixedSigner) SignPut(ctx context.Context, key string, size int64, ttl time.Duration) (*SignedPut, error) {
+	return p.signer.SignPut(ctx, p.key(key), size, ttl)
+}
diff --git a/internal/remote/remote.go b/internal/remote/remote.go
index 621731c..4d68152 100644
--- a/internal/remote/remote.go
+++ b/internal/remote/remote.go
@@ -5,6 +5,8 @@
 //	file:///abs/path      local or network-drive directory (also used in tests)
 //	s3://bucket/prefix    Amazon S3 (or S3-compatible via AWS_ENDPOINT_URL)
 //	gs://bucket/prefix    Google Cloud Storage
+//	https://host:4173     a bdrive web server brokering one of the above —
+//	                      the device needs no storage credentials at all
 //
 // Remote layout: blobs/<sha256> for content, journal/<device>.jsonl for op
 // logs. Each device writes only its own journal, so there are no concurrent
@@ -17,6 +19,7 @@ import (
 	"io"
 	"net/url"
 	"strings"
+	"time"
 )
 
 type Object struct {
@@ -24,6 +27,23 @@ type Object struct {
 	Size int64
 }
 
+// SignedPut is a presigned direct-upload request: whoever holds the URL can
+// PUT that one object until Expires, without ever seeing storage credentials.
+type SignedPut struct {
+	URL     string            // upload here
+	Method  string            // always "PUT"
+	Headers map[string]string // headers that must be sent verbatim (they are signed)
+	Expires time.Time
+}
+
+// PutSigner is implemented by backends that can mint presigned upload URLs
+// so clients write to storage directly. Backends without that capability
+// (file://) simply don't implement it, and callers fall back to uploading
+// through the server.
+type PutSigner interface {
+	SignPut(ctx context.Context, key string, size int64, ttl time.Duration) (*SignedPut, error)
+}
+
 type Backend interface {
 	Put(ctx context.Context, key string, r io.Reader, size int64) error
 	Get(ctx context.Context, key string) (io.ReadCloser, error)
@@ -45,7 +65,9 @@ func Open(ctx context.Context, raw string) (Backend, error) {
 		return newS3(ctx, u.Host, strings.Trim(u.Path, "/"))
 	case "gs":
 		return newGCS(ctx, u.Host, strings.Trim(u.Path, "/"))
+	case "http", "https":
+		return newHTTPBackend(raw)
 	default:
-		return nil, fmt.Errorf("unsupported remote scheme %q (supported: file://, s3://, gs://)", u.Scheme)
+		return nil, fmt.Errorf("unsupported remote scheme %q (supported: file://, s3://, gs://, https://)", u.Scheme)
 	}
 }
diff --git a/internal/remote/s3.go b/internal/remote/s3.go
index 275ca68..050c030 100644
--- a/internal/remote/s3.go
+++ b/internal/remote/s3.go
@@ -7,6 +7,7 @@ import (
 	"io"
 	"path"
 	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	awsconfig "github.com/aws/aws-sdk-go-v2/config"
@@ -51,6 +52,27 @@ func (b *s3Backend) Put(ctx context.Context, key string, r io.Reader, size int64
 	return err
 }
 
+// SignPut presigns a PUT of exactly size bytes to the given key. Presigning
+// is a local signature computation — no network round-trip, no credentials in
+// the result.
+func (b *s3Backend) SignPut(ctx context.Context, key string, size int64, ttl time.Duration) (*SignedPut, error) {
+	req, err := s3.NewPresignClient(b.client).PresignPutObject(ctx, &s3.PutObjectInput{
+		Bucket:        aws.String(b.bucket),
+		Key:           aws.String(b.key(key)),
+		ContentLength: aws.Int64(size),
+	}, s3.WithPresignExpires(ttl))
+	if err != nil {
+		return nil, fmt.Errorf("presign s3 put: %w", err)
+	}
+	headers := make(map[string]string)
+	for k, vs := range req.SignedHeader {
+		if len(vs) > 0 && !strings.EqualFold(k, "Host") {
+			headers[k] = vs[0]
+		}
+	}
+	return &SignedPut{URL: req.URL, Method: req.Method, Headers: headers, Expires: time.Now().Add(ttl)}, nil
+}
+
 func (b *s3Backend) Get(ctx context.Context, key string) (io.ReadCloser, error) {
 	out, err := b.client.GetObject(ctx, &s3.GetObjectInput{
 		Bucket: aws.String(b.bucket),
diff --git a/internal/remote/sign_test.go b/internal/remote/sign_test.go
new file mode 100644
index 0000000..75284c6
--- /dev/null
+++ b/internal/remote/sign_test.go
@@ -0,0 +1,77 @@
+package remote
+
+import (
+	"context"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+)
+
+// file:// must NOT be a PutSigner: a filesystem path presigned to a browser
+// is meaningless, so callers fall back to uploading through the server.
+func TestLocalBackendCannotSign(t *testing.T) {
+	be, err := Open(context.Background(), "file://"+t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer be.Close()
+	if _, ok := be.(PutSigner); ok {
+		t.Fatal("file:// backend must not implement PutSigner")
+	}
+}
+
+// Presigning is a local signature computation — no network needed — so it is
+// unit-testable with static fake credentials.
+func TestS3SignPut(t *testing.T) {
+	t.Setenv("AWS_ACCESS_KEY_ID", "AKIAFAKEFAKEFAKEFAKE")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "fakefakefakefakefakefakefakefakefakefake")
+	t.Setenv("AWS_SESSION_TOKEN", "")
+	t.Setenv("AWS_REGION", "us-east-1")
+	t.Setenv("AWS_PROFILE", "")
+	t.Setenv("AWS_ENDPOINT_URL", "")
+
+	be, err := Open(context.Background(), "s3://test-bucket/vol1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer be.Close()
+	signer, ok := be.(PutSigner)
+	if !ok {
+		t.Fatal("s3 backend must implement PutSigner")
+	}
+
+	ttl := 5 * time.Minute
+	sp, err := signer.SignPut(context.Background(), "blobs/abc123", 42, ttl)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sp.Method != "PUT" {
+		t.Fatalf("method = %q", sp.Method)
+	}
+	u, err := url.Parse(sp.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(u.Host, "test-bucket") || !strings.HasSuffix(u.Path, "/vol1/blobs/abc123") {
+		t.Fatalf("url = %s, want bucket + prefixed key", sp.URL)
+	}
+	q := u.Query()
+	if q.Get("X-Amz-Signature") == "" {
+		t.Fatalf("url not signed: %s", sp.URL)
+	}
+	if q.Get("X-Amz-Expires") != "300" {
+		t.Fatalf("expires = %s, want 300s", q.Get("X-Amz-Expires"))
+	}
+	// the URL must be self-contained: no secret key material leaks into it
+	if strings.Contains(sp.URL, "fakefakefake") {
+		t.Fatal("secret key leaked into signed URL")
+	}
+	if sp.Expires.Before(time.Now()) || sp.Expires.After(time.Now().Add(ttl+time.Minute)) {
+		t.Fatalf("expires = %v, want ~now+%v", sp.Expires, ttl)
+	}
+	// the signed content-length pins the upload to the declared size
+	if got := sp.Headers["Content-Length"]; got != "42" {
+		t.Fatalf("signed content-length = %q, want 42 (headers: %v)", got, sp.Headers)
+	}
+}
diff --git a/internal/store/store.go b/internal/store/store.go
index e67c4da..6d87951 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -241,7 +241,7 @@ func WriteJSONAtomic(path string, v any) error {
 
 // WriteFileAtomic writes data via a temp file in the same directory + rename.
 func WriteFileAtomic(path string, data []byte, mode os.FileMode) error {
-	tmp, err := os.CreateTemp(filepath.Dir(path), ".beardrive-tmp-*")
+	tmp, err := os.CreateTemp(filepath.Dir(path), ".bdrive-tmp-*")
 	if err != nil {
 		return err
 	}
diff --git a/internal/syncer/filter_sync_test.go b/internal/syncer/filter_sync_test.go
index 5de35b4..b3db72d 100644
--- a/internal/syncer/filter_sync_test.go
+++ b/internal/syncer/filter_sync_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 )
 
-// Multi-device behavior of .beardriveignore and the .beardrive include list.
+// Multi-device behavior of .bdriveignore and the .bdrive include list.
 
 func TestIgnoredFilesDoNotSync(t *testing.T) {
 	be := sharedRemote(t)
@@ -23,7 +23,7 @@ func TestIgnoredFilesDoNotSync(t *testing.T) {
 		t.Fatalf("notes.md = %q", got)
 	}
 	if got := read(t, b.Folder, IgnoreFile); got != "*.secret\n" {
-		t.Fatalf(".beardriveignore should sync like a normal file, got %q", got)
+		t.Fatalf(".bdriveignore should sync like a normal file, got %q", got)
 	}
 	if _, err := os.Stat(filepath.Join(b.Folder, "key.secret")); !os.IsNotExist(err) {
 		t.Fatal("ignored file must not reach other devices")
@@ -46,11 +46,11 @@ func TestNewlyIgnoredFileIsNotDeletedRemotely(t *testing.T) {
 	// op, so it stays on disk on every device.
 	write(t, a.Folder, IgnoreFile, "*.log\n")
 	res := cycle(t, a)
-	if res.LocalOps != 1 { // only the .beardriveignore put, no delete for debug.log
-		t.Fatalf("LocalOps = %d, want 1 (the .beardriveignore itself)", res.LocalOps)
+	if res.LocalOps != 1 { // only the .bdriveignore put, no delete for debug.log
+		t.Fatalf("LocalOps = %d, want 1 (the .bdriveignore itself)", res.LocalOps)
 	}
 	cycle(t, b)
-	cycle(t, b) // second cycle: filter from the pulled .beardriveignore is active
+	cycle(t, b) // second cycle: filter from the pulled .bdriveignore is active
 	if read(t, a.Folder, "debug.log") != "lines" || read(t, b.Folder, "debug.log") != "lines" {
 		t.Fatal("newly ignored file must remain on disk everywhere")
 	}
@@ -61,7 +61,7 @@ func TestIncludeListLimitsSync(t *testing.T) {
 	a := newDevice(t, "deva", be)
 	b := newDevice(t, "devb", be)
 
-	write(t, a.Folder, ".beardrive", `{"include": ["docs/"]}`)
+	write(t, a.Folder, ".bdrive", `{"include": ["docs/"]}`)
 	write(t, a.Folder, "docs/guide.md", "included")
 	write(t, a.Folder, "src/main.go", "excluded")
 	cycle(t, a)
@@ -70,7 +70,7 @@ func TestIncludeListLimitsSync(t *testing.T) {
 	if got := read(t, b.Folder, "docs/guide.md"); got != "included" {
 		t.Fatalf("docs/guide.md = %q", got)
 	}
-	for _, absent := range []string{"src/main.go", ".beardrive"} {
+	for _, absent := range []string{"src/main.go", ".bdrive"} {
 		if _, err := os.Stat(filepath.Join(b.Folder, absent)); !os.IsNotExist(err) {
 			t.Fatalf("%s must not sync", absent)
 		}
diff --git a/internal/syncer/http_remote_test.go b/internal/syncer/http_remote_test.go
new file mode 100644
index 0000000..babf8e8
--- /dev/null
+++ b/internal/syncer/http_remote_test.go
@@ -0,0 +1,110 @@
+package syncer
+
+import (
+	"context"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/runbear-io/beardrive/internal/remote"
+	"github.com/runbear-io/beardrive/internal/webapp"
+)
+
+// newHub spins up a bdrive web hub over a fresh storage root and returns the
+// test server plus one project.
+func newHub(t *testing.T, storage remote.Backend, upload bool) (*httptest.Server, webapp.Project) {
+	t.Helper()
+	db, err := webapp.OpenProjectDB(filepath.Join(t.TempDir(), "projects.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	p, _, err := db.GetOrCreate("vol")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := &webapp.Server{
+		Root: storage, Projects: db, Refresh: 0,
+		Upload: webapp.UploadConfig{Enabled: upload},
+	}
+	ts := httptest.NewServer(srv.Handler())
+	t.Cleanup(ts.Close)
+	return ts, p
+}
+
+// A device syncing through a bdrive web server (https:// remote) must
+// converge with a device talking to the object store directly: the server is
+// just a broker, not a different sync model.
+func TestSyncThroughWebServer(t *testing.T) {
+	storage := sharedRemote(t) // the object store only the server knows about
+	ts, p := newHub(t, storage, true)
+
+	viaServer, err := remote.Open(context.Background(), ts.URL+"/p/"+p.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer viaServer.Close()
+
+	a := newDevice(t, "deva", viaServer)                      // storage-blind client
+	b := newDevice(t, "devb", remote.Prefixed(storage, p.ID)) // direct-to-storage device
+
+	// client → server → storage → direct device
+	write(t, a.Folder, "notes/from-client.md", "hello via server")
+	cycle(t, a)
+	res := cycle(t, b)
+	if res.PulledOps != 1 || read(t, b.Folder, "notes/from-client.md") != "hello via server" {
+		t.Fatalf("b did not receive client's file: %+v", res)
+	}
+
+	// direct device → storage → server → client
+	time.Sleep(10 * time.Millisecond)
+	write(t, b.Folder, "notes/from-direct.md", "hello back")
+	write(t, b.Folder, "notes/from-client.md", "edited directly")
+	cycle(t, b)
+	cycle(t, a)
+	if read(t, a.Folder, "notes/from-direct.md") != "hello back" {
+		t.Fatal("client did not receive direct device's file")
+	}
+	if read(t, a.Folder, "notes/from-client.md") != "edited directly" {
+		t.Fatal("client did not receive the edit")
+	}
+
+	// deletes propagate through the server too
+	os.Remove(filepath.Join(a.Folder, "notes", "from-direct.md"))
+	cycle(t, a)
+	cycle(t, b)
+	if _, err := os.Stat(filepath.Join(b.Folder, "notes", "from-direct.md")); !os.IsNotExist(err) {
+		t.Fatal("delete via server did not propagate")
+	}
+}
+
+// With uploads disabled on the server, a client can still pull (read-only
+// follower) — its pushes degrade to offline instead of failing the cycle.
+func TestReadOnlyServerClientStillPulls(t *testing.T) {
+	storage := sharedRemote(t)
+	ts, p := newHub(t, storage, false) // read-only hub
+
+	viaServer, err := remote.Open(context.Background(), ts.URL+"/p/"+p.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer viaServer.Close()
+
+	b := newDevice(t, "devb", remote.Prefixed(storage, p.ID))
+	write(t, b.Folder, "shared.md", "server-side truth")
+	cycle(t, b)
+
+	a := newDevice(t, "deva", viaServer)
+	write(t, a.Folder, "local-only.md", "cannot push this")
+	res, err := a.Cycle(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !res.Offline {
+		t.Fatalf("push against read-only server should degrade to offline: %+v", res)
+	}
+	if read(t, a.Folder, "shared.md") != "server-side truth" {
+		t.Fatal("client should still pull from a read-only server")
+	}
+}
diff --git a/internal/syncer/ignore.go b/internal/syncer/ignore.go
index 3d018a0..5967873 100644
--- a/internal/syncer/ignore.go
+++ b/internal/syncer/ignore.go
@@ -8,9 +8,9 @@ import (
 )
 
 // IgnoreFile is the per-folder opt-out list at the mount root. It uses a
-// gitignore-style syntax and, unlike the .beardrive settings file, syncs like any
+// gitignore-style syntax and, unlike the .bdrive settings file, syncs like any
 // other file so every device shares the same rules.
-const IgnoreFile = ".beardriveignore"
+const IgnoreFile = ".bdriveignore"
 
 // Filter decides which paths sync. A path syncs when it is not ignored and,
 // if an include list is set, matches at least one include pattern.
@@ -31,8 +31,8 @@ type pattern struct {
 	negate bool
 }
 
-// loadFilter builds the filter for a folder from its .beardriveignore (if any)
-// plus the include list from the .beardrive settings file.
+// loadFilter builds the filter for a folder from its .bdriveignore (if any)
+// plus the include list from the .bdrive settings file.
 func loadFilter(folder string, include []string) (*Filter, error) {
 	f := &Filter{}
 	for _, line := range include {
diff --git a/internal/syncer/syncer.go b/internal/syncer/syncer.go
index ec6072c..6dd85ad 100644
--- a/internal/syncer/syncer.go
+++ b/internal/syncer/syncer.go
@@ -7,7 +7,7 @@
 // journal (and their content captured in the blob store) before any remote
 // state can overwrite the working folder. Concurrent edits resolve
 // deterministically last-writer-wins; the losing local version is preserved
-// as a "<name>.beardrive-conflict-<device>-<time>" file that syncs like any other.
+// as a "<name>.bdrive-conflict-<device>-<time>" file that syncs like any other.
 package syncer
 
 import (
@@ -60,13 +60,13 @@ func (r *Result) Activity() bool {
 	return r.LocalOps > 0 || r.PulledOps > 0 || r.Conflicts > 0 || r.Materialized > 0
 }
 
-// config.ProjectFile (.beardrive) never syncs: remotes are device-specific and
+// config.ProjectFile (.bdrive) never syncs: remotes are device-specific and
 // syncing it would let one device silently repoint another.
 var ignoreNames = map[string]bool{".DS_Store": true, config.ProjectFile: true}
-var ignoreDirs = map[string]bool{".git": true, ".beardrive": true}
+var ignoreDirs = map[string]bool{".git": true, ".bdrive": true}
 
 func ignoredFile(name string) bool {
-	return ignoreNames[name] || strings.HasPrefix(name, ".beardrive-tmp-")
+	return ignoreNames[name] || strings.HasPrefix(name, ".bdrive-tmp-")
 }
 
 // Cycle runs one full scan/sync/materialize pass under the volume lock.
@@ -392,7 +392,7 @@ func (s *Session) conflictCopies(myOps []journal.Op, pushed int64, pulled []jour
 }
 
 func conflictName(p, deviceName string, t time.Time) string {
-	return p + ".beardrive-conflict-" + sanitize(deviceName) + "-" + t.UTC().Format("20060102T150405Z")
+	return p + ".bdrive-conflict-" + sanitize(deviceName) + "-" + t.UTC().Format("20060102T150405Z")
 }
 
 func sanitize(s string) string {
@@ -477,7 +477,7 @@ func (s *Session) writeFile(abs string, want journal.FileState) error {
 		return err
 	}
 	defer src.Close()
-	tmp, err := os.CreateTemp(filepath.Dir(abs), ".beardrive-tmp-*")
+	tmp, err := os.CreateTemp(filepath.Dir(abs), ".bdrive-tmp-*")
 	if err != nil {
 		return err
 	}
diff --git a/internal/syncer/syncer_test.go b/internal/syncer/syncer_test.go
index fe9fde4..39e7459 100644
--- a/internal/syncer/syncer_test.go
+++ b/internal/syncer/syncer_test.go
@@ -185,7 +185,7 @@ func TestConcurrentEditConflictPreserved(t *testing.T) {
 			t.Fatal(err)
 		}
 		for _, e := range entries {
-			if strings.Contains(e.Name(), ".beardrive-conflict-") {
+			if strings.Contains(e.Name(), ".bdrive-conflict-") {
 				all[read(t, folder, e.Name())] = true
 			}
 		}
diff --git a/internal/webapp/dir.go b/internal/webapp/dir.go
index 35f2a7f..dcdd8f7 100644
--- a/internal/webapp/dir.go
+++ b/internal/webapp/dir.go
@@ -18,8 +18,8 @@ type DirSource struct {
 	Root string
 }
 
-var skipNames = map[string]bool{".DS_Store": true, ".beardrive": true}
-var skipDirs = map[string]bool{".git": true, ".beardrive": true}
+var skipNames = map[string]bool{".DS_Store": true, ".bdrive": true}
+var skipDirs = map[string]bool{".git": true, ".bdrive": true}
 
 func (d *DirSource) Files(_ context.Context) (map[string]FileInfo, error) {
 	files := make(map[string]FileInfo)
@@ -37,7 +37,7 @@ func (d *DirSource) Files(_ context.Context) (map[string]FileInfo, error) {
 			}
 			return nil
 		}
-		if !e.Type().IsRegular() || skipNames[e.Name()] || strings.HasPrefix(e.Name(), ".beardrive-tmp-") {
+		if !e.Type().IsRegular() || skipNames[e.Name()] || strings.HasPrefix(e.Name(), ".bdrive-tmp-") {
 			return nil
 		}
 		info, err := e.Info()
diff --git a/internal/webapp/dir_test.go b/internal/webapp/dir_test.go
index 32d5b4c..e7c59e5 100644
--- a/internal/webapp/dir_test.go
+++ b/internal/webapp/dir_test.go
@@ -21,7 +21,7 @@ func dirServer(t *testing.T, files map[string]string) http.Handler {
 			t.Fatal(err)
 		}
 	}
-	s := &Server{Source: &DirSource{Root: root}, Remote: root, Volume: "local", Refresh: 0}
+	s := &Server{Source: &DirSource{Root: root}, Volume: "local", Refresh: 0}
 	return s.Handler()
 }
 
@@ -29,7 +29,7 @@ func TestDirSourceServesFolder(t *testing.T) {
 	h := dirServer(t, map[string]string{
 		"README.md":     "# Local",
 		"notes/plan.md": "content",
-		".beardrive":    `{"volume":"x"}`, // settings file must be hidden
+		".bdrive":       `{"volume":"x"}`, // settings file must be hidden
 		".git/config":   "noise",          // .git must be skipped
 	})
 
diff --git a/internal/webapp/projects.go b/internal/webapp/projects.go
new file mode 100644
index 0000000..627501b
--- /dev/null
+++ b/internal/webapp/projects.go
@@ -0,0 +1,154 @@
+package webapp
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"sync"
+	"time"
+)
+
+// Project is one synced project hosted by this server. Its storage lives
+// under <root>/<id>/ in the object store; the id is permanent, the name is a
+// renameable label.
+type Project struct {
+	ID      string    `json:"id"`
+	Name    string    `json:"name"`
+	Created time.Time `json:"created"`
+}
+
+var projectIDRe = regexp.MustCompile(`^p-[0-9a-f]{8}$`)
+
+// ProjectDB is the server's project registry, persisted as a JSON file that
+// is loaded on open and rewritten atomically on every change.
+type ProjectDB struct {
+	path string
+
+	mu   sync.Mutex
+	byID map[string]Project
+}
+
+// OpenProjectDB loads the registry at path; a missing file is an empty
+// registry.
+func OpenProjectDB(path string) (*ProjectDB, error) {
+	db := &ProjectDB{path: path, byID: make(map[string]Project)}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return db, nil
+		}
+		return nil, err
+	}
+	var file struct {
+		Projects []Project `json:"projects"`
+	}
+	if err := json.Unmarshal(data, &file); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", path, err)
+	}
+	for _, p := range file.Projects {
+		db.byID[p.ID] = p
+	}
+	return db, nil
+}
+
+// save persists the registry. Callers hold mu.
+func (db *ProjectDB) save() error {
+	list := db.list()
+	data, err := json.MarshalIndent(struct {
+		Projects []Project `json:"projects"`
+	}{list}, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(db.path), 0o755); err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(filepath.Dir(db.path), ".bdrive-tmp-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if _, err := tmp.Write(append(data, '\n')); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), db.path)
+}
+
+// list returns projects sorted by name. Callers hold mu.
+func (db *ProjectDB) list() []Project {
+	out := make([]Project, 0, len(db.byID))
+	for _, p := range db.byID {
+		out = append(out, p)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+func (db *ProjectDB) List() []Project {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	return db.list()
+}
+
+func (db *ProjectDB) Get(id string) (Project, bool) {
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	p, ok := db.byID[id]
+	return p, ok
+}
+
+// GetOrCreate returns the project with the given name, creating it (with a
+// fresh id) if none exists. Names are matched exactly.
+func (db *ProjectDB) GetOrCreate(name string) (Project, bool, error) {
+	name = trimName(name)
+	if name == "" {
+		return Project{}, false, fmt.Errorf("project name must not be empty")
+	}
+	db.mu.Lock()
+	defer db.mu.Unlock()
+	for _, p := range db.byID {
+		if p.Name == name {
+			return p, false, nil
+		}
+	}
+	var buf [4]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		return Project{}, false, err
+	}
+	p := Project{ID: "p-" + hex.EncodeToString(buf[:]), Name: name, Created: time.Now().UTC()}
+	db.byID[p.ID] = p
+	if err := db.save(); err != nil {
+		delete(db.byID, p.ID)
+		return Project{}, false, err
+	}
+	return p, true, nil
+}
+
+func trimName(s string) string {
+	out := make([]rune, 0, len(s))
+	for _, r := range s {
+		if r == '\n' || r == '\r' || r == '\t' {
+			continue
+		}
+		out = append(out, r)
+	}
+	for len(out) > 0 && out[0] == ' ' {
+		out = out[1:]
+	}
+	for len(out) > 0 && out[len(out)-1] == ' ' {
+		out = out[:len(out)-1]
+	}
+	if len(out) > 128 {
+		out = out[:128]
+	}
+	return string(out)
+}
diff --git a/internal/webapp/server.go b/internal/webapp/server.go
index bf38aa9..e4404f9 100644
--- a/internal/webapp/server.go
+++ b/internal/webapp/server.go
@@ -1,7 +1,20 @@
-// Package webapp serves a read-only web view of a beardrive remote: the volume's
-// file tree reconstructed from the journals, rendered markdown, and file
-// downloads. It talks straight to the object store — no local volume state,
-// mount, or daemon is needed.
+// Package webapp serves the bdrive web server: a browsable web view of
+// synced files (file tree reconstructed from the journals, rendered
+// markdown, downloads), browser uploads, and — in hub mode — the sync API
+// that lets storage-blind client devices sync whole projects through this
+// server.
+//
+// Two modes:
+//
+//   - single-volume: Source is set (a DirSource for a plain folder, or a
+//     RemoteSource in tests); the classic viewer.
+//   - hub: Root + Projects are set; the server hosts many projects, each a
+//     volume stored under <root>/<project-id>/ in the object store, managed
+//     by a file-backed project registry.
+//
+// The client — browser or syncing device — is deliberately told nothing
+// about the storage: no remote URL, bucket, or credentials ever appear in an
+// API response.
 package webapp
 
 import (
@@ -28,26 +41,52 @@ import (
 //go:embed static
 var staticFiles embed.FS
 
-// Source supplies the file set and content the server renders. Two
-// implementations: RemoteSource (a beardrive remote, the normal mode) and
-// DirSource (a plain local folder, for debugging without any remote).
+// Source supplies the file set and content of one volume. Implementations:
+// RemoteSource (a beardrive remote) and DirSource (a plain local folder).
 type Source interface {
 	Files(ctx context.Context) (map[string]FileInfo, error)
 	Open(ctx context.Context, path string, fi FileInfo) (io.ReadCloser, error)
 }
 
-// Server renders one source as a website. File listings are cached for
-// Refresh between fetches; if the source becomes unreachable, the last good
-// snapshot keeps being served.
+// Server renders volumes as a website and, in hub mode, brokers sync for
+// client devices.
 type Server struct {
-	Source  Source
-	Remote  string // display only
-	Volume  string // display only
-	Refresh time.Duration
+	// Single-volume mode: serve exactly this source.
+	Source Source
+	Volume string // display only
 
-	mu   sync.Mutex
-	snap *snapshot
-	at   time.Time
+	// Hub mode (when Root is set): many projects on one storage root.
+	Root     remote.Backend
+	Projects *ProjectDB
+
+	// Device identifies this server in ops it journals for browser uploads.
+	Device  Identity
+	Refresh time.Duration
+	Upload  UploadConfig
+
+	volOnce sync.Once
+	vol     *volume
+
+	volsMu sync.Mutex
+	vols   map[string]*volume // hub mode: per-project, keyed by project id
+}
+
+// UploadConfig controls whether and how clients may write.
+type UploadConfig struct {
+	Enabled bool
+	// TTL bounds the lifetime of presigned direct-upload URLs.
+	TTL time.Duration
+}
+
+// DefaultUploadTTL is used when UploadConfig.TTL is unset: long enough for a
+// slow upload, short enough that a leaked URL goes stale quickly.
+const DefaultUploadTTL = 15 * time.Minute
+
+func (c UploadConfig) ttl() time.Duration {
+	if c.TTL > 0 {
+		return c.TTL
+	}
+	return DefaultUploadTTL
 }
 
 // FileInfo is the resolved state of one path: content identity (Blob doubles
@@ -60,35 +99,108 @@ type FileInfo struct {
 	Device string
 }
 
+// volume is one browsable/syncable file set: a source plus its snapshot
+// cache. File listings are cached for refresh between fetches; if the source
+// becomes unreachable, the last good snapshot keeps being served.
+type volume struct {
+	source  Source
+	refresh time.Duration
+
+	mu   sync.Mutex
+	snap *snapshot
+	at   time.Time
+}
+
 type snapshot struct {
 	files map[string]FileInfo
 }
 
-func (s *Server) snapshot(ctx context.Context) (*snapshot, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.snap != nil && time.Since(s.at) < s.Refresh {
-		return s.snap, nil
+func (v *volume) snapshot(ctx context.Context) (*snapshot, error) {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	if v.snap != nil && time.Since(v.at) < v.refresh {
+		return v.snap, nil
 	}
-	files, err := s.Source.Files(ctx)
+	files, err := v.source.Files(ctx)
 	if err != nil {
-		if s.snap != nil {
-			return s.snap, nil // serve stale rather than fail
+		if v.snap != nil {
+			return v.snap, nil // serve stale rather than fail
 		}
 		return nil, err
 	}
-	s.snap, s.at = &snapshot{files: files}, time.Now()
-	return s.snap, nil
+	v.snap, v.at = &snapshot{files: files}, time.Now()
+	return v.snap, nil
+}
+
+// invalidate forces the next snapshot to refetch, so an upload shows up in
+// the tree immediately instead of after refresh.
+func (v *volume) invalidate() {
+	v.mu.Lock()
+	v.at = time.Time{}
+	v.mu.Unlock()
+}
+
+func (v *volume) uploader() Uploader {
+	u, _ := v.source.(Uploader)
+	return u
+}
+
+// single returns the single-volume mode volume.
+func (s *Server) single() *volume {
+	s.volOnce.Do(func() {
+		s.vol = &volume{source: s.Source, refresh: s.Refresh}
+	})
+	return s.vol
+}
+
+// projectVolume resolves a project id to its volume, creating the (cached)
+// source over the project's storage prefix on first use.
+func (s *Server) projectVolume(id string) (*volume, error) {
+	if s.Root == nil || s.Projects == nil {
+		return nil, fmt.Errorf("this server does not host projects")
+	}
+	if !projectIDRe.MatchString(id) {
+		return nil, fmt.Errorf("invalid project id %q", id)
+	}
+	if _, ok := s.Projects.Get(id); !ok {
+		return nil, fmt.Errorf("no such project %q", id)
+	}
+	s.volsMu.Lock()
+	defer s.volsMu.Unlock()
+	if s.vols == nil {
+		s.vols = make(map[string]*volume)
+	}
+	v, ok := s.vols[id]
+	if !ok {
+		v = &volume{
+			source:  &RemoteSource{Backend: remote.Prefixed(s.Root, id), Device: s.Device},
+			refresh: s.Refresh,
+		}
+		s.vols[id] = v
+	}
+	return v, nil
 }
 
 // RemoteSource reads a beardrive remote: it fetches every journal and folds the
 // ops into the current volume state (same total order as journal.Replay,
-// but keeping author/device/time of the winning op per path).
+// but keeping author/device/time of the winning op per path). With Device set
+// it also accepts uploads, journaled under that identity.
 type RemoteSource struct {
 	Backend remote.Backend
+	// Device identifies this server in ops it journals for uploads. Required
+	// for uploads; irrelevant for reading.
+	Device Identity
+
+	upmu sync.Mutex // serializes read-modify-write of our own journal
 }
 
-func (r *RemoteSource) Files(ctx context.Context) (map[string]FileInfo, error) {
+// Identity is the device identity uploads are journaled under.
+type Identity struct {
+	ID, Name, Author string
+}
+
+// loadOps fetches and parses every journal on the remote.
+func (r *RemoteSource) loadOps(ctx context.Context) ([]journal.Op, error) {
 	objs, err := r.Backend.List(ctx, "journal/")
 	if err != nil {
 		return nil, fmt.Errorf("list journals: %w", err)
@@ -113,6 +225,14 @@ func (r *RemoteSource) Files(ctx context.Context) (map[string]FileInfo, error) {
 		}
 		all = append(all, ops...)
 	}
+	return all, nil
+}
+
+func (r *RemoteSource) Files(ctx context.Context) (map[string]FileInfo, error) {
+	all, err := r.loadOps(ctx)
+	if err != nil {
+		return nil, err
+	}
 	journal.Sort(all)
 	files := make(map[string]FileInfo)
 	for _, op := range all {
@@ -140,20 +260,124 @@ func (s *Server) Handler() http.Handler {
 		panic(err) // embedded FS; cannot fail at runtime
 	}
 	mux := http.NewServeMux()
-	mux.HandleFunc("GET /api/volume", s.handleVolume)
-	mux.HandleFunc("GET /api/tree", s.handleTree)
-	mux.HandleFunc("GET /api/file", s.handleFile)
-	mux.HandleFunc("GET /api/download", s.handleDownload)
-	mux.HandleFunc("GET /api/render", s.handleRender)
+
+	// Volume resolution per route family: fixed single volume, or by
+	// project id in hub mode. One handler implementation serves both.
+	single := func(h func(*volume, http.ResponseWriter, *http.Request)) http.HandlerFunc {
+		return func(w http.ResponseWriter, r *http.Request) {
+			if s.Source == nil {
+				http.Error(w, "this server hosts projects; use /api/p/<project-id>/...", http.StatusNotFound)
+				return
+			}
+			h(s.single(), w, r)
+		}
+	}
+	proj := func(h func(*volume, http.ResponseWriter, *http.Request)) http.HandlerFunc {
+		return func(w http.ResponseWriter, r *http.Request) {
+			v, err := s.projectVolume(r.PathValue("project"))
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusNotFound)
+				return
+			}
+			h(v, w, r)
+		}
+	}
+
+	mux.HandleFunc("GET /api/config", s.handleConfig)
+	mux.HandleFunc("GET /api/projects", s.handleProjectList)
+	mux.HandleFunc("POST /api/projects", s.handleProjectCreate)
+	mux.HandleFunc("GET /api/projects/{project}", s.handleProjectGet)
+
+	for prefix, resolve := range map[string]func(func(*volume, http.ResponseWriter, *http.Request)) http.HandlerFunc{
+		"/api/":             single,
+		"/api/p/{project}/": proj,
+	} {
+		mux.HandleFunc("GET "+prefix+"tree", resolve(s.handleTree))
+		mux.HandleFunc("GET "+prefix+"file", resolve(s.handleFile))
+		mux.HandleFunc("GET "+prefix+"download", resolve(s.handleDownload))
+		mux.HandleFunc("GET "+prefix+"render", resolve(s.handleRender))
+		mux.HandleFunc("POST "+prefix+"upload/init", resolve(s.handleUploadInit))
+		mux.HandleFunc("PUT "+prefix+"upload/content", resolve(s.handleUploadContent))
+		mux.HandleFunc("POST "+prefix+"upload/commit", resolve(s.handleUploadCommit))
+	}
+
+	// The sync (store) API only exists per project: hub mode is what
+	// storage-blind devices sync through.
+	mux.HandleFunc("GET /api/p/{project}/store/list", proj(s.handleStoreList))
+	mux.HandleFunc("GET /api/p/{project}/store/object", proj(s.handleStoreGet))
+	mux.HandleFunc("GET /api/p/{project}/store/exists", proj(s.handleStoreExists))
+	mux.HandleFunc("POST /api/p/{project}/store/sign", proj(s.handleStoreSign))
+	mux.HandleFunc("PUT /api/p/{project}/store/object", proj(s.handleStorePut))
+
 	mux.Handle("GET /", http.FileServerFS(static))
 	return mux
 }
 
-func (s *Server) handleVolume(w http.ResponseWriter, r *http.Request) {
-	writeJSON(w, map[string]string{"volume": s.Volume, "remote": s.Remote})
+// handleConfig tells the client how this server is configured. Deliberately
+// nothing about the storage backend.
+func (s *Server) handleConfig(w http.ResponseWriter, r *http.Request) {
+	mode := "volume"
+	if s.Root != nil {
+		mode = "hub"
+	}
+	writeJSON(w, map[string]any{
+		"mode":   mode,
+		"volume": s.Volume,
+		"upload": map[string]any{
+			"enabled": s.Upload.Enabled,
+		},
+	})
 }
 
-// Node is one entry of the file tree returned by /api/tree.
+func (s *Server) handleProjectList(w http.ResponseWriter, r *http.Request) {
+	if s.Projects == nil {
+		http.Error(w, "this server does not host projects", http.StatusNotFound)
+		return
+	}
+	writeJSON(w, map[string]any{"projects": s.Projects.List()})
+}
+
+func (s *Server) handleProjectGet(w http.ResponseWriter, r *http.Request) {
+	if s.Projects == nil {
+		http.Error(w, "this server does not host projects", http.StatusNotFound)
+		return
+	}
+	p, ok := s.Projects.Get(r.PathValue("project"))
+	if !ok {
+		http.Error(w, "no such project", http.StatusNotFound)
+		return
+	}
+	writeJSON(w, p)
+}
+
+// handleProjectCreate creates a project by name, or returns the existing one
+// with that name (create-or-join). Creating is a write, so it follows the
+// upload setting.
+func (s *Server) handleProjectCreate(w http.ResponseWriter, r *http.Request) {
+	if s.Projects == nil {
+		http.Error(w, "this server does not host projects", http.StatusNotFound)
+		return
+	}
+	if !s.Upload.Enabled {
+		http.Error(w, "this server is read-only; projects cannot be created", http.StatusForbidden)
+		return
+	}
+	var req struct {
+		Name string `json:"name"`
+	}
+	if err := json.NewDecoder(io.LimitReader(r.Body, 1<<16)).Decode(&req); err != nil {
+		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+	p, created, err := s.Projects.GetOrCreate(req.Name)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	writeJSON(w, map[string]any{"project": p, "created": created})
+}
+
+// Node is one entry of the file tree returned by the tree endpoint.
 type Node struct {
 	Name     string    `json:"name"`
 	Path     string    `json:"path"`
@@ -165,8 +389,8 @@ type Node struct {
 	Children []*Node   `json:"children,omitempty"`
 }
 
-func (s *Server) handleTree(w http.ResponseWriter, r *http.Request) {
-	snap, err := s.snapshot(r.Context())
+func (s *Server) handleTree(v *volume, w http.ResponseWriter, r *http.Request) {
+	snap, err := v.snapshot(r.Context())
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusBadGateway)
 		return
@@ -215,13 +439,13 @@ func sortTree(n *Node) {
 	}
 }
 
-// lookup resolves ?path= against the current snapshot.
-func (s *Server) lookup(r *http.Request) (string, FileInfo, int, error) {
+// lookup resolves ?path= against the volume's current snapshot.
+func lookup(v *volume, r *http.Request) (string, FileInfo, int, error) {
 	p := r.URL.Query().Get("path")
 	if p == "" {
 		return "", FileInfo{}, http.StatusBadRequest, fmt.Errorf("missing ?path=")
 	}
-	snap, err := s.snapshot(r.Context())
+	snap, err := v.snapshot(r.Context())
 	if err != nil {
 		return "", FileInfo{}, http.StatusBadGateway, err
 	}
@@ -232,8 +456,8 @@ func (s *Server) lookup(r *http.Request) (string, FileInfo, int, error) {
 	return p, fi, 0, nil
 }
 
-func (s *Server) serveBlob(w http.ResponseWriter, r *http.Request, attach bool) {
-	p, fi, code, err := s.lookup(r)
+func serveBlob(v *volume, w http.ResponseWriter, r *http.Request, attach bool) {
+	p, fi, code, err := lookup(v, r)
 	if err != nil {
 		http.Error(w, err.Error(), code)
 		return
@@ -243,7 +467,7 @@ func (s *Server) serveBlob(w http.ResponseWriter, r *http.Request, attach bool)
 		w.WriteHeader(http.StatusNotModified)
 		return
 	}
-	rc, err := s.Source.Open(r.Context(), p, fi)
+	rc, err := v.source.Open(r.Context(), p, fi)
 	if err != nil {
 		http.Error(w, fmt.Sprintf("fetch content: %v", err), http.StatusBadGateway)
 		return
@@ -258,21 +482,21 @@ func (s *Server) serveBlob(w http.ResponseWriter, r *http.Request, attach bool)
 	io.Copy(w, rc)
 }
 
-func (s *Server) handleFile(w http.ResponseWriter, r *http.Request) {
-	s.serveBlob(w, r, false)
+func (s *Server) handleFile(v *volume, w http.ResponseWriter, r *http.Request) {
+	serveBlob(v, w, r, false)
 }
 
-func (s *Server) handleDownload(w http.ResponseWriter, r *http.Request) {
-	s.serveBlob(w, r, true)
+func (s *Server) handleDownload(v *volume, w http.ResponseWriter, r *http.Request) {
+	serveBlob(v, w, r, true)
 }
 
-func (s *Server) handleRender(w http.ResponseWriter, r *http.Request) {
-	p, fi, code, err := s.lookup(r)
+func (s *Server) handleRender(v *volume, w http.ResponseWriter, r *http.Request) {
+	p, fi, code, err := lookup(v, r)
 	if err != nil {
 		http.Error(w, err.Error(), code)
 		return
 	}
-	rc, err := s.Source.Open(r.Context(), p, fi)
+	rc, err := v.source.Open(r.Context(), p, fi)
 	if err != nil {
 		http.Error(w, fmt.Sprintf("fetch content: %v", err), http.StatusBadGateway)
 		return
diff --git a/internal/webapp/server_test.go b/internal/webapp/server_test.go
index 9d21698..32bdcdf 100644
--- a/internal/webapp/server_test.go
+++ b/internal/webapp/server_test.go
@@ -28,7 +28,13 @@ type fakeRemote struct {
 
 func newFakeRemote(t *testing.T) *fakeRemote {
 	t.Helper()
-	dir := t.TempDir()
+	return newFakeRemoteAt(t, t.TempDir())
+}
+
+// newFakeRemoteAt builds the remote layout at a specific directory (e.g. a
+// project prefix inside a hub's storage root).
+func newFakeRemoteAt(t *testing.T, dir string) *fakeRemote {
+	t.Helper()
 	for _, d := range []string{"journal", "blobs"} {
 		if err := os.MkdirAll(filepath.Join(dir, d), 0o755); err != nil {
 			t.Fatal(err)
@@ -74,7 +80,7 @@ func (f *fakeRemote) server() *Server {
 		f.t.Fatal(err)
 	}
 	f.t.Cleanup(func() { be.Close() })
-	return &Server{Source: &RemoteSource{Backend: be}, Remote: "file://" + f.dir, Volume: "testvol", Refresh: 0}
+	return &Server{Source: &RemoteSource{Backend: be}, Volume: "testvol", Refresh: 0}
 }
 
 func get(t *testing.T, h http.Handler, url string) *httptest.ResponseRecorder {
diff --git a/internal/webapp/static/app.js b/internal/webapp/static/app.js
index 009ab24..7e13da2 100644
--- a/internal/webapp/static/app.js
+++ b/internal/webapp/static/app.js
@@ -10,7 +10,15 @@ const MD_EXT = /\.(md|markdown)$/i;
 const IMG_EXT = /\.(png|jpe?g|gif|svg|webp|ico|bmp|avif)$/i;
 const TEXT_EXT = /\.(txt|log|json|ya?ml|toml|csv|go|py|js|ts|jsx|tsx|sh|bash|zsh|rb|rs|c|h|cpp|java|kt|swift|sql|html|css|xml|ini|conf|env|mod|sum|jsonl)$/i;
 
-const fileURL = (p) => "api/file?path=" + encodeURIComponent(p);
+/* The client is storage-blind: where files live and how uploads reach
+   storage is the server's business, learned from /api/config. A hub server
+   hosts many projects; volume-scoped calls go under api/p/<project-id>/. */
+let serverConfig = { mode: "volume", upload: { enabled: false } };
+let projects = [];
+let currentProject = null; // hub mode: the selected project
+let apiBase = "api/";      // volume-scoped endpoint prefix
+
+const fileURL = (p) => apiBase + "file?path=" + encodeURIComponent(p);
 
 async function getJSON(url) {
   const r = await fetch(url);
@@ -21,22 +29,87 @@ async function getJSON(url) {
 /* ---- boot ---- */
 async function boot() {
   try {
-    const v = await getJSON("api/volume");
-    $("vault-name").textContent = v.volume || "BearDrive";
-    $("vault-remote").textContent = v.remote || "";
-    document.title = (v.volume || "beardrive") + " — BearDrive";
+    serverConfig = await getJSON("api/config");
   } catch { /* non-fatal */ }
-  await refreshTree();
-  const p = decodeURIComponent(location.hash.slice(1));
-  if (p) openFile(p);
+  document.title = (serverConfig.volume || "beardrive") + " — BearDrive";
+  if (serverConfig.mode === "hub") {
+    await loadProjects();
+    const { project, path } = parseHash();
+    const proj = projects.find((x) => x.id === project) || projects[0];
+    if (proj) selectProject(proj, path);
+    else $("vault-name").textContent = serverConfig.volume || "BearDrive";
+    setInterval(loadProjects, 30000); // pick up new projects
+  } else {
+    $("vault-name").textContent = serverConfig.volume || "BearDrive";
+    initUpload();
+    await refreshTree();
+    const { path } = parseHash();
+    if (path) openFile(path);
+  }
   setInterval(refreshTree, 15000); // pick up synced changes
 }
 
+/* ---- hub: projects ---- */
+async function loadProjects() {
+  let out;
+  try {
+    out = await getJSON("api/projects");
+  } catch { return; }
+  projects = out.projects || [];
+  const nav = $("projects");
+  nav.hidden = false;
+  nav.innerHTML = "";
+  const ul = document.createElement("ul");
+  for (const p of projects) {
+    const li = document.createElement("li");
+    const row = document.createElement("div");
+    row.className = "row" + (currentProject && currentProject.id === p.id ? " active" : "");
+    row.textContent = p.name;
+    row.title = p.id;
+    row.onclick = () => selectProject(p, null);
+    li.appendChild(row);
+    ul.appendChild(li);
+  }
+  nav.appendChild(ul);
+}
+
+function selectProject(p, path) {
+  currentProject = p;
+  apiBase = "api/p/" + p.id + "/";
+  $("vault-name").textContent = p.name;
+  document.title = p.name + " — BearDrive";
+  currentPath = null;
+  $("crumb").textContent = "";
+  $("meta").textContent = "";
+  $("download").hidden = true;
+  $("content").innerHTML = `<div class="empty">Select a file from the sidebar</div>`;
+  loadProjects(); // refresh active highlight
+  initUpload();
+  refreshTree().then(() => { if (path) openFile(path); });
+  if (!path) location.hash = p.id;
+}
+
+/* Hash routing: "#<path>" in volume mode, "#<project-id>/<path>" in hub mode. */
+function parseHash() {
+  const h = decodeURIComponent(location.hash.slice(1));
+  if (serverConfig.mode !== "hub") return { path: h };
+  const slash = h.indexOf("/");
+  if (slash === -1) return { project: h, path: "" };
+  return { project: h.slice(0, slash), path: h.slice(slash + 1) };
+}
+
+function setHash(path) {
+  location.hash = serverConfig.mode === "hub" && currentProject
+    ? currentProject.id + "/" + encodeURIComponent(path)
+    : encodeURIComponent(path);
+}
+
 /* ---- tree ---- */
 async function refreshTree() {
+  if (serverConfig.mode === "hub" && !currentProject) return;
   let root;
   try {
-    root = await getJSON("api/tree");
+    root = await getJSON(apiBase + "tree");
   } catch { return; } // keep the last good tree
   flatFiles = [];
   const nav = $("tree");
@@ -88,18 +161,18 @@ function markActive() {
 /* ---- file pane ---- */
 async function openFile(p) {
   currentPath = p;
-  location.hash = encodeURIComponent(p);
+  setHash(p);
   markActive();
   $("crumb").textContent = p.split("/").join(" / ");
   const dl = $("download");
-  dl.href = "api/download?path=" + encodeURIComponent(p);
+  dl.href = apiBase + "download?path=" + encodeURIComponent(p);
   dl.hidden = false;
   const content = $("content");
   content.innerHTML = "";
   $("meta").textContent = "";
   try {
     if (MD_EXT.test(p)) {
-      const doc = await getJSON("api/render?path=" + encodeURIComponent(p));
+      const doc = await getJSON(apiBase + "render?path=" + encodeURIComponent(p));
       content.innerHTML = doc.html;
       fixLinks(content, p);
       showMeta(doc);
@@ -180,9 +253,123 @@ function join(dir, rel) {
   return out.join("/");
 }
 
+/* ---- upload ----
+   The client asks the server how to upload (upload/init): "direct" hands
+   back a short-lived presigned URL and the bytes go straight to the object
+   store; "server" means relay the bytes through the bdrive server. */
+function initUpload() {
+  const btn = $("upload-btn");
+  const enabled = serverConfig.upload && serverConfig.upload.enabled &&
+    (serverConfig.mode !== "hub" || currentProject);
+  if (!enabled) { btn.hidden = true; return; }
+  btn.hidden = false;
+  const input = $("upload-input");
+  btn.onclick = () => input.click();
+  input.onchange = async () => {
+    const file = input.files[0];
+    input.value = "";
+    if (!file) return;
+    const dir = currentPath && currentPath.includes("/")
+      ? currentPath.slice(0, currentPath.lastIndexOf("/")) : "";
+    const dest = dir ? dir + "/" + file.name : file.name;
+    const status = $("meta");
+    try {
+      status.textContent = `Uploading ${dest}…`;
+      await uploadFile(dest, file);
+      status.textContent = `Uploaded ${dest}`;
+      await refreshTree();
+      openFile(dest);
+    } catch (err) {
+      status.textContent = "Upload failed: " + err.message;
+    }
+  };
+}
+
+async function uploadFile(dest, file) {
+  const buf = await file.arrayBuffer();
+  const sha = await sha256Hex(buf);
+  const post = async (url, body) => {
+    const r = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+    if (!r.ok) throw new Error(await r.text());
+    return r.json();
+  };
+  const req = { path: dest, sha256: sha, size: file.size };
+  const plan = await post(apiBase + "upload/init", req);
+  if (plan.mode === "direct") {
+    if (!plan.exists) { // identical content already in the store? skip the PUT
+      const r = await fetch(plan.url, { method: plan.method || "PUT", headers: plan.headers || {}, body: buf });
+      if (!r.ok) throw new Error("storage upload failed: " + r.status);
+    }
+    await post(apiBase + "upload/commit", req);
+  } else {
+    const r = await fetch(apiBase + "upload/content?path=" + encodeURIComponent(dest), {
+      method: "PUT", body: buf,
+    });
+    if (!r.ok) throw new Error(await r.text());
+  }
+}
+
+async function sha256Hex(buf) {
+  if (crypto.subtle) {
+    const d = await crypto.subtle.digest("SHA-256", buf);
+    return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  return sha256Fallback(new Uint8Array(buf)); // plain-http origins have no crypto.subtle
+}
+
+/* Minimal SHA-256 (FIPS 180-4) for non-secure contexts. */
+function sha256Fallback(bytes) {
+  const K = new Uint32Array([
+    0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+    0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+    0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+    0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+    0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+    0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+    0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+    0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2]);
+  const H = new Uint32Array([
+    0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]);
+  const rr = (x, n) => (x >>> n) | (x << (32 - n));
+  const len = bytes.length;
+  const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);
+  padded.set(bytes);
+  padded[len] = 0x80;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, Math.floor((len * 8) / 0x100000000));
+  dv.setUint32(padded.length - 4, (len * 8) >>> 0);
+  const w = new Uint32Array(64);
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = dv.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rr(w[i-15],7) ^ rr(w[i-15],18) ^ (w[i-15] >>> 3);
+      const s1 = rr(w[i-2],17) ^ rr(w[i-2],19) ^ (w[i-2] >>> 10);
+      w[i] = (w[i-16] + s0 + w[i-7] + s1) >>> 0;
+    }
+    let [a,b,c,d,e,f,g,h] = H;
+    for (let i = 0; i < 64; i++) {
+      const S1 = rr(e,6) ^ rr(e,11) ^ rr(e,25);
+      const t1 = (h + S1 + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;
+      const S0 = rr(a,2) ^ rr(a,13) ^ rr(a,22);
+      const t2 = (S0 + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+      h=g; g=f; f=e; e=(d+t1)>>>0; d=c; c=b; b=a; a=(t1+t2)>>>0;
+    }
+    H[0]+=a; H[1]+=b; H[2]+=c; H[3]+=d; H[4]+=e; H[5]+=f; H[6]+=g; H[7]+=h;
+  }
+  return [...H].map((x) => (x >>> 0).toString(16).padStart(8, "0")).join("");
+}
+
 window.addEventListener("hashchange", () => {
-  const p = decodeURIComponent(location.hash.slice(1));
-  if (p && p !== currentPath) openFile(p);
+  const { project, path } = parseHash();
+  if (serverConfig.mode === "hub" && project && (!currentProject || currentProject.id !== project)) {
+    const proj = projects.find((x) => x.id === project);
+    if (proj) { selectProject(proj, path); return; }
+  }
+  if (path && path !== currentPath) openFile(path);
 });
 
 boot();
diff --git a/internal/webapp/static/index.html b/internal/webapp/static/index.html
index 848cffe..d547c6c 100644
--- a/internal/webapp/static/index.html
+++ b/internal/webapp/static/index.html
@@ -11,14 +11,16 @@
 <aside id="sidebar">
   <header id="vault">
     <span id="vault-name">…</span>
-    <span id="vault-remote"></span>
   </header>
+  <nav id="projects" aria-label="Projects" hidden></nav>
   <nav id="tree" aria-label="Files"></nav>
 </aside>
 <main id="main">
   <header id="topbar">
     <span id="crumb"></span>
     <span id="meta"></span>
+    <button id="upload-btn" class="btn" hidden>Upload</button>
+    <input id="upload-input" type="file" hidden>
     <a id="download" class="btn" hidden download>Download</a>
   </header>
   <article id="content" class="markdown">
diff --git a/internal/webapp/static/style.css b/internal/webapp/static/style.css
index 43e0b1c..ed82109 100644
--- a/internal/webapp/static/style.css
+++ b/internal/webapp/static/style.css
@@ -37,14 +37,33 @@ body {
   border-bottom: 1px solid var(--border);
 }
 #vault-name { display: block; font-weight: 600; font-size: 14px; }
-#vault-remote {
-  display: block;
-  font-size: 11px;
-  color: var(--text-faint);
+#upload-btn {
+  border: none;
+  cursor: pointer;
+  font: inherit;
+  font-size: 12.5px;
+}
+#projects {
+  flex: none;
+  max-height: 30%;
+  overflow-y: auto;
+  padding: 8px 6px;
+  font-size: 13.5px;
+  border-bottom: 1px solid var(--border);
+}
+#projects ul { list-style: none; margin: 0; padding-left: 4px; }
+#projects .row {
+  padding: 3px 8px;
+  border-radius: 5px;
+  cursor: pointer;
+  color: var(--text-dim);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
 }
+#projects .row::before { content: "▣ "; color: var(--text-faint); }
+#projects .row:hover { background: var(--bg-hover); color: var(--text); }
+#projects .row.active { background: var(--bg-active); color: var(--accent); }
 #tree { flex: 1; overflow-y: auto; padding: 8px 6px 24px; font-size: 13.5px; }
 #tree ul { list-style: none; margin: 0; padding-left: 14px; }
 #tree > ul { padding-left: 4px; }
diff --git a/internal/webapp/store.go b/internal/webapp/store.go
new file mode 100644
index 0000000..49b0f1a
--- /dev/null
+++ b/internal/webapp/store.go
@@ -0,0 +1,174 @@
+package webapp
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/runbear-io/beardrive/internal/remote"
+)
+
+// The store API (/api/store/*) lets other devices sync through this server
+// instead of talking to the object store themselves: the server is the only
+// machine that knows where the storage is or holds credentials. It exposes
+// the same key space every backend uses (blobs/<sha256>, journal/<dev>.jsonl)
+// so the regular sync machinery works unchanged over it.
+//
+// Reads are always allowed (this is the same data the viewer serves). Writes
+// follow the server's upload setting and go direct-to-storage via presigned
+// URLs when the backend can sign, exactly like browser uploads.
+
+var (
+	blobKeyRe    = regexp.MustCompile(`^blobs/[0-9a-f]{64}$`)
+	journalKeyRe = regexp.MustCompile(`^journal/[A-Za-z0-9._-]+\.jsonl$`)
+)
+
+func validStoreKey(key string) bool {
+	return blobKeyRe.MatchString(key) || journalKeyRe.MatchString(key)
+}
+
+// storeSource returns the volume's RemoteSource; only real beardrive
+// remotes have a store to expose.
+func storeSource(v *volume, w http.ResponseWriter) *RemoteSource {
+	rs, ok := v.source.(*RemoteSource)
+	if !ok {
+		http.Error(w, "this server does not front a beardrive remote", http.StatusNotFound)
+		return nil
+	}
+	return rs
+}
+
+func (s *Server) storeKey(w http.ResponseWriter, r *http.Request) (string, bool) {
+	key := r.URL.Query().Get("key")
+	if !validStoreKey(key) {
+		http.Error(w, fmt.Sprintf("invalid store key %q", key), http.StatusBadRequest)
+		return "", false
+	}
+	return key, true
+}
+
+func (s *Server) handleStoreList(v *volume, w http.ResponseWriter, r *http.Request) {
+	rs := storeSource(v, w)
+	if rs == nil {
+		return
+	}
+	prefix := r.URL.Query().Get("prefix")
+	if prefix != "" && prefix != "journal/" && prefix != "blobs/" &&
+		!strings.HasPrefix(prefix, "journal/") && !strings.HasPrefix(prefix, "blobs/") {
+		http.Error(w, fmt.Sprintf("invalid prefix %q", prefix), http.StatusBadRequest)
+		return
+	}
+	objs, err := rs.Backend.List(r.Context(), prefix)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadGateway)
+		return
+	}
+	writeJSON(w, map[string]any{"objects": objs})
+}
+
+func (s *Server) handleStoreGet(v *volume, w http.ResponseWriter, r *http.Request) {
+	rs := storeSource(v, w)
+	if rs == nil {
+		return
+	}
+	key, ok := s.storeKey(w, r)
+	if !ok {
+		return
+	}
+	rc, err := rs.Backend.Get(r.Context(), key)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusNotFound)
+		return
+	}
+	defer rc.Close()
+	w.Header().Set("Content-Type", "application/octet-stream")
+	io.Copy(w, rc)
+}
+
+func (s *Server) handleStoreExists(v *volume, w http.ResponseWriter, r *http.Request) {
+	rs := storeSource(v, w)
+	if rs == nil {
+		return
+	}
+	key, ok := s.storeKey(w, r)
+	if !ok {
+		return
+	}
+	exists, err := rs.Backend.Exists(r.Context(), key)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadGateway)
+		return
+	}
+	writeJSON(w, map[string]any{"exists": exists})
+}
+
+// handleStoreSign answers how a client should upload a key: a presigned
+// direct-to-storage URL when the backend can sign, through the server
+// otherwise — same contract as browser uploads.
+func (s *Server) handleStoreSign(v *volume, w http.ResponseWriter, r *http.Request) {
+	rs := storeSource(v, w)
+	if rs == nil {
+		return
+	}
+	if !s.Upload.Enabled {
+		http.Error(w, "uploads are disabled on this server", http.StatusForbidden)
+		return
+	}
+	var req struct {
+		Key  string `json:"key"`
+		Size int64  `json:"size"`
+	}
+	if err := json.NewDecoder(io.LimitReader(r.Body, 1<<20)).Decode(&req); err != nil {
+		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+	if !validStoreKey(req.Key) || req.Size < 0 {
+		http.Error(w, fmt.Sprintf("invalid store key %q", req.Key), http.StatusBadRequest)
+		return
+	}
+	// Only blobs are presigned. They are content-addressed and immutable, so
+	// a leaked URL can at worst re-upload identical bytes. Journals are
+	// mutable state and always flow through the server.
+	if strings.HasPrefix(req.Key, "blobs/") {
+		if exists, err := rs.Backend.Exists(r.Context(), req.Key); err == nil && exists {
+			writeJSON(w, map[string]any{"mode": "direct", "exists": true})
+			return
+		}
+		if signer, ok := rs.Backend.(remote.PutSigner); ok {
+			if signed, err := signer.SignPut(r.Context(), req.Key, req.Size, s.Upload.ttl()); err == nil {
+				writeJSON(w, map[string]any{
+					"mode": "direct", "url": signed.URL, "method": signed.Method,
+					"headers": signed.Headers, "expires": signed.Expires.UTC(),
+				})
+				return
+			}
+		}
+	}
+	writeJSON(w, map[string]any{"mode": "server"})
+}
+
+func (s *Server) handleStorePut(v *volume, w http.ResponseWriter, r *http.Request) {
+	rs := storeSource(v, w)
+	if rs == nil {
+		return
+	}
+	if !s.Upload.Enabled {
+		http.Error(w, "uploads are disabled on this server", http.StatusForbidden)
+		return
+	}
+	key, ok := s.storeKey(w, r)
+	if !ok {
+		return
+	}
+	if err := rs.Backend.Put(r.Context(), key, r.Body, r.ContentLength); err != nil {
+		http.Error(w, fmt.Sprintf("store: %v", err), http.StatusBadGateway)
+		return
+	}
+	if strings.HasPrefix(key, "journal/") {
+		v.invalidate() // new ops should show in the viewer immediately
+	}
+	writeJSON(w, map[string]any{"ok": true})
+}
diff --git a/internal/webapp/store_test.go b/internal/webapp/store_test.go
new file mode 100644
index 0000000..5ecc480
--- /dev/null
+++ b/internal/webapp/store_test.go
@@ -0,0 +1,318 @@
+package webapp
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/runbear-io/beardrive/internal/remote"
+)
+
+// newHub builds a hub server over a fresh storage root with one project.
+func newHub(t *testing.T, upload bool, wrap func(remote.Backend) remote.Backend) (*Server, Project, string) {
+	t.Helper()
+	root := t.TempDir()
+	be, err := remote.Open(context.Background(), "file://"+root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { be.Close() })
+	if wrap != nil {
+		be = wrap(be)
+	}
+	db, err := OpenProjectDB(filepath.Join(t.TempDir(), "projects.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	p, _, err := db.GetOrCreate("proj")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := &Server{
+		Root: be, Projects: db, Device: webDevice,
+		Refresh: 0, Upload: UploadConfig{Enabled: upload},
+	}
+	return srv, p, root
+}
+
+func TestProjectAPI(t *testing.T) {
+	srv, seeded, _ := newHub(t, true, nil)
+	h := srv.Handler()
+
+	// create-or-join by name: new name creates, same name joins
+	rec := do(t, h, "POST", "/api/projects", map[string]string{"name": "my-app"})
+	if rec.Code != 200 {
+		t.Fatalf("create: %d %s", rec.Code, rec.Body)
+	}
+	var out struct {
+		Project Project `json:"project"`
+		Created bool    `json:"created"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if !out.Created || out.Project.Name != "my-app" || !strings.HasPrefix(out.Project.ID, "p-") {
+		t.Fatalf("create = %+v", out)
+	}
+	id := out.Project.ID
+
+	rec = do(t, h, "POST", "/api/projects", map[string]string{"name": "my-app"})
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if out.Created || out.Project.ID != id {
+		t.Fatalf("re-create = %+v, want join of %s", out, id)
+	}
+
+	// list has both projects; get by id resolves
+	rec = do(t, h, "GET", "/api/projects", nil)
+	var list struct {
+		Projects []Project `json:"projects"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil {
+		t.Fatal(err)
+	}
+	if len(list.Projects) != 2 {
+		t.Fatalf("projects = %+v, want 2", list.Projects)
+	}
+	if rec := do(t, h, "GET", "/api/projects/"+seeded.ID, nil); rec.Code != 200 {
+		t.Fatalf("get project: %d", rec.Code)
+	}
+	if rec := do(t, h, "GET", "/api/projects/p-00000000", nil); rec.Code != 404 {
+		t.Fatalf("get missing project: %d, want 404", rec.Code)
+	}
+
+	// hub config declares hub mode and never names storage
+	rec = do(t, h, "GET", "/api/config", nil)
+	if !strings.Contains(rec.Body.String(), `"hub"`) || strings.Contains(rec.Body.String(), "file://") {
+		t.Fatalf("config = %s", rec.Body)
+	}
+
+	// empty name is rejected
+	if rec := do(t, h, "POST", "/api/projects", map[string]string{"name": "  "}); rec.Code != http.StatusBadRequest {
+		t.Fatalf("empty name: %d, want 400", rec.Code)
+	}
+}
+
+func TestProjectCreateGatedByUpload(t *testing.T) {
+	srv, _, _ := newHub(t, false, nil) // read-only hub
+	h := srv.Handler()
+	if rec := do(t, h, "POST", "/api/projects", map[string]string{"name": "x"}); rec.Code != http.StatusForbidden {
+		t.Fatalf("create on read-only hub: %d, want 403", rec.Code)
+	}
+	// reads still work
+	if rec := do(t, h, "GET", "/api/projects", nil); rec.Code != 200 {
+		t.Fatalf("list on read-only hub: %d", rec.Code)
+	}
+}
+
+func TestProjectDBPersists(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "projects.json")
+	db, err := OpenProjectDB(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	p1, created, err := db.GetOrCreate("alpha")
+	if err != nil || !created {
+		t.Fatalf("create: %+v %v %v", p1, created, err)
+	}
+	// a fresh open (server restart) sees the same project
+	db2, err := OpenProjectDB(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok := db2.Get(p1.ID)
+	if !ok || got.Name != "alpha" {
+		t.Fatalf("reload = %+v %v", got, ok)
+	}
+	p2, created, err := db2.GetOrCreate("alpha")
+	if err != nil || created || p2.ID != p1.ID {
+		t.Fatalf("get-or-create after reload = %+v %v %v", p2, created, err)
+	}
+}
+
+func TestStoreAPIReads(t *testing.T) {
+	srv, p, root := newHub(t, false, nil) // reads work even on read-only hubs
+	f := newFakeRemoteAt(t, filepath.Join(root, p.ID))
+	f.put("deva", "readme.md", "hello")
+	h := srv.Handler()
+	base := "/api/p/" + p.ID + "/store/"
+
+	rec := do(t, h, "GET", base+"list?prefix=journal/", nil)
+	if rec.Code != 200 {
+		t.Fatalf("list: %d %s", rec.Code, rec.Body)
+	}
+	var list struct {
+		Objects []remote.Object `json:"objects"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil {
+		t.Fatal(err)
+	}
+	if len(list.Objects) != 1 || list.Objects[0].Key != "journal/deva.jsonl" {
+		t.Fatalf("objects = %+v", list.Objects)
+	}
+
+	rec = do(t, h, "GET", base+"object?key=journal/deva.jsonl", nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), `"readme.md"`) {
+		t.Fatalf("get journal: %d %s", rec.Code, rec.Body)
+	}
+	blobKey := "blobs/" + shaOf("hello")
+	rec = do(t, h, "GET", base+"exists?key="+blobKey, nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "true") {
+		t.Fatalf("exists: %d %s", rec.Code, rec.Body)
+	}
+	rec = do(t, h, "GET", base+"object?key="+blobKey, nil)
+	if rec.Code != 200 || rec.Body.String() != "hello" {
+		t.Fatalf("get blob: %d %q", rec.Code, rec.Body)
+	}
+
+	// the viewer works per project too
+	rec = do(t, h, "GET", "/api/p/"+p.ID+"/file?path=readme.md", nil)
+	if rec.Code != 200 || rec.Body.String() != "hello" {
+		t.Fatalf("viewer file: %d %q", rec.Code, rec.Body)
+	}
+	// unknown project 404s
+	if rec := do(t, h, "GET", "/api/p/p-00000000/store/list?prefix=journal/", nil); rec.Code != 404 {
+		t.Fatalf("unknown project: %d, want 404", rec.Code)
+	}
+}
+
+func TestStoreAPIKeyValidation(t *testing.T) {
+	srv, p, _ := newHub(t, true, nil)
+	h := srv.Handler()
+	base := "/api/p/" + p.ID + "/store/"
+	bad := []string{
+		"", "x", "blobs/short", "blobs/../../etc/passwd",
+		"journal/../device.json", "journal/a/b.jsonl", "journal/dev.txt",
+		"blobs/" + strings.Repeat("G", 64), // non-hex
+	}
+	for _, key := range bad {
+		if rec := do(t, h, "GET", base+"object?key="+key, nil); rec.Code != http.StatusBadRequest {
+			t.Errorf("get %q: %d, want 400", key, rec.Code)
+		}
+		if rec := do(t, h, "PUT", base+"object?key="+key, []byte("x")); rec.Code != http.StatusBadRequest {
+			t.Errorf("put %q: %d, want 400", key, rec.Code)
+		}
+	}
+	if rec := do(t, h, "GET", base+"list?prefix=../", nil); rec.Code != http.StatusBadRequest {
+		t.Errorf("list bad prefix: %d, want 400", rec.Code)
+	}
+}
+
+func TestStoreAPIWriteGating(t *testing.T) {
+	srv, p, _ := newHub(t, false, nil)
+	h := srv.Handler()
+	base := "/api/p/" + p.ID + "/store/"
+	key := "blobs/" + shaOf("x")
+	if rec := do(t, h, "PUT", base+"object?key="+key, []byte("x")); rec.Code != http.StatusForbidden {
+		t.Fatalf("put with uploads off: %d, want 403", rec.Code)
+	}
+	if rec := do(t, h, "POST", base+"sign", map[string]any{"key": key, "size": 1}); rec.Code != http.StatusForbidden {
+		t.Fatalf("sign with uploads off: %d, want 403", rec.Code)
+	}
+}
+
+func TestSingleVolumeServerHostsNoProjects(t *testing.T) {
+	srv := &Server{Source: &DirSource{Root: t.TempDir()}, Volume: "local",
+		Upload: UploadConfig{Enabled: true}}
+	h := srv.Handler()
+	if rec := do(t, h, "GET", "/api/projects", nil); rec.Code != http.StatusNotFound {
+		t.Fatalf("projects on single server: %d, want 404", rec.Code)
+	}
+	if rec := do(t, h, "GET", "/api/p/p-00000000/tree", nil); rec.Code != http.StatusNotFound {
+		t.Fatalf("project tree on single server: %d, want 404", rec.Code)
+	}
+}
+
+// Journals must never be presigned — they are mutable state, only blobs are
+// immutable — so sign answers "server" for them even on a signing backend.
+// Presigning must survive the project-prefix wrapper.
+func TestStoreSignJournalAlwaysViaServer(t *testing.T) {
+	var sb *signingBackend
+	srv, p, _ := newHub(t, true, func(be remote.Backend) remote.Backend {
+		sb = &signingBackend{Backend: be}
+		return sb
+	})
+	h := srv.Handler()
+	base := "/api/p/" + p.ID + "/store/"
+
+	rec := do(t, h, "POST", base+"sign", map[string]any{"key": "journal/dev1.jsonl", "size": 10})
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), `"server"`) {
+		t.Fatalf("sign journal: %d %s, want server mode", rec.Code, rec.Body)
+	}
+	blobKey := "blobs/" + shaOf("z")
+	rec = do(t, h, "POST", base+"sign", map[string]any{"key": blobKey, "size": 1})
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), `"direct"`) {
+		t.Fatalf("sign blob: %d %s, want direct mode", rec.Code, rec.Body)
+	}
+	// the presigned key is namespaced under the project prefix
+	if len(sb.signed) != 1 || sb.signed[0] != p.ID+"/"+blobKey {
+		t.Fatalf("signed keys = %v, want [%s/%s]", sb.signed, p.ID, blobKey)
+	}
+}
+
+// The full client path: an https:// remote backend (remote.Open on the
+// server's /p/<id> URL) doing List/Get/Exists/Put against a live hub, and
+// projects staying isolated from each other.
+func TestHTTPBackendThroughServer(t *testing.T) {
+	srv, p, root := newHub(t, true, nil)
+	f := newFakeRemoteAt(t, filepath.Join(root, p.ID))
+	f.put("deva", "seed.md", "seeded")
+	other, _, err := srv.Projects.GetOrCreate("other")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	be, err := remote.Open(context.Background(), ts.URL+"/p/"+p.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer be.Close()
+
+	objs, err := be.List(context.Background(), "journal/")
+	if err != nil || len(objs) != 1 {
+		t.Fatalf("list = %v, %v", objs, err)
+	}
+	ok, err := be.Exists(context.Background(), "blobs/"+shaOf("seeded"))
+	if err != nil || !ok {
+		t.Fatalf("exists = %v, %v", ok, err)
+	}
+
+	// push a blob + read it back like a syncing device would
+	content := "pushed through server"
+	blobKey := "blobs/" + shaOf(content)
+	if err := be.Put(context.Background(), blobKey, strings.NewReader(content), int64(len(content))); err != nil {
+		t.Fatal(err)
+	}
+	rc, err := be.Get(context.Background(), blobKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, _ := io.ReadAll(rc)
+	rc.Close()
+	if string(got) != content {
+		t.Fatalf("roundtrip = %q", got)
+	}
+
+	// project isolation: the other project sees none of it
+	beOther, err := remote.Open(context.Background(), ts.URL+"/p/"+other.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer beOther.Close()
+	objs, err = beOther.List(context.Background(), "journal/")
+	if err != nil || len(objs) != 0 {
+		t.Fatalf("other project journals = %v, %v; want none", objs, err)
+	}
+	ok, err = beOther.Exists(context.Background(), blobKey)
+	if err != nil || ok {
+		t.Fatalf("other project sees foreign blob: %v %v", ok, err)
+	}
+}
diff --git a/internal/webapp/upload.go b/internal/webapp/upload.go
new file mode 100644
index 0000000..755c54a
--- /dev/null
+++ b/internal/webapp/upload.go
@@ -0,0 +1,323 @@
+package webapp
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/runbear-io/beardrive/internal/journal"
+	"github.com/runbear-io/beardrive/internal/remote"
+)
+
+// Uploads run in two modes, chosen by the server per request so the client
+// never needs to know what the storage is:
+//
+//	direct: POST /api/upload/init returns a presigned, expiring URL; the
+//	        client PUTs the content straight to the object store (blob first,
+//	        keyed by its sha256), then POST /api/upload/commit journals it.
+//	        Storage credentials never leave the server.
+//	server: the backend can't presign (file://, plain folders); the client
+//	        PUTs the content to /api/upload/content and the server stores it.
+//
+// The blobs-before-journal invariant holds in both modes: commit refuses to
+// journal an op whose blob is not already in the store.
+
+// Uploader is implemented by sources that accept writes through the server.
+type Uploader interface {
+	Upload(ctx context.Context, path string, r io.Reader, size int64) error
+}
+
+// DirectUploader is additionally implemented by sources whose storage can
+// accept presigned direct uploads.
+type DirectUploader interface {
+	Uploader
+	SignBlobPut(ctx context.Context, blob string, size int64, ttl time.Duration) (*remote.SignedPut, error)
+	HasBlob(ctx context.Context, blob string) (bool, error)
+	Commit(ctx context.Context, path, blob string, size int64) error
+}
+
+// ---- RemoteSource: writes go to the object store + our own journal ----
+
+// SignBlobPut presigns a direct upload of the blob, if the backend can sign.
+func (r *RemoteSource) SignBlobPut(ctx context.Context, blob string, size int64, ttl time.Duration) (*remote.SignedPut, error) {
+	signer, ok := r.Backend.(remote.PutSigner)
+	if !ok {
+		return nil, fmt.Errorf("backend cannot presign uploads")
+	}
+	return signer.SignPut(ctx, "blobs/"+blob, size, ttl)
+}
+
+func (r *RemoteSource) HasBlob(ctx context.Context, blob string) (bool, error) {
+	return r.Backend.Exists(ctx, "blobs/"+blob)
+}
+
+// Upload stores content through the server: spool to disk while hashing,
+// push the blob, then journal the op.
+func (r *RemoteSource) Upload(ctx context.Context, p string, src io.Reader, _ int64) error {
+	tmp, err := os.CreateTemp("", ".bdrive-tmp-upload-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	defer tmp.Close()
+	h := sha256.New()
+	size, err := io.Copy(tmp, io.TeeReader(src, h))
+	if err != nil {
+		return err
+	}
+	blob := hex.EncodeToString(h.Sum(nil))
+	if _, err := tmp.Seek(0, io.SeekStart); err != nil {
+		return err
+	}
+	// Blob before journal, always.
+	if err := r.Backend.Put(ctx, "blobs/"+blob, tmp, size); err != nil {
+		return fmt.Errorf("push blob: %w", err)
+	}
+	return r.Commit(ctx, p, blob, size)
+}
+
+// Commit appends a put op for path→blob to this server's own journal. It
+// refuses if the blob is not in the store yet (a peer must never see an op
+// whose content is missing). Only this server writes this journal key, so
+// the read-modify-write below has a single writer; upmu serializes it across
+// concurrent requests.
+func (r *RemoteSource) Commit(ctx context.Context, p, blob string, size int64) error {
+	if r.Device.ID == "" {
+		return fmt.Errorf("no device identity configured for uploads")
+	}
+	ok, err := r.HasBlob(ctx, blob)
+	if err != nil {
+		return fmt.Errorf("check blob: %w", err)
+	}
+	if !ok {
+		return errBlobMissing
+	}
+
+	r.upmu.Lock()
+	defer r.upmu.Unlock()
+
+	all, err := r.loadOps(ctx)
+	if err != nil {
+		return err
+	}
+	var maxLamport, mySeq int64
+	for _, op := range all {
+		maxLamport = max(maxLamport, op.Lamport)
+		if op.Device == r.Device.ID {
+			mySeq = max(mySeq, op.Seq)
+		}
+	}
+	op := journal.Op{
+		Seq: mySeq + 1, Lamport: maxLamport + 1, Time: time.Now().UTC(),
+		Device: r.Device.ID, DeviceName: r.Device.Name, Author: r.Device.Author,
+		Kind: journal.KindPut, Path: p, Blob: blob, Size: size, Mode: 0o644,
+	}
+
+	// Read-modify-write of our own journal. A transient read error must fail
+	// the commit — treating it as "no journal yet" would rewrite the key
+	// without our earlier ops.
+	key := "journal/" + r.Device.ID + ".jsonl"
+	var existing []byte
+	if exists, err := r.Backend.Exists(ctx, key); err != nil {
+		return fmt.Errorf("check journal: %w", err)
+	} else if exists {
+		rc, err := r.Backend.Get(ctx, key)
+		if err != nil {
+			return fmt.Errorf("fetch journal: %w", err)
+		}
+		existing, err = io.ReadAll(rc)
+		rc.Close()
+		if err != nil {
+			return err
+		}
+	}
+	line, err := journal.Marshal([]journal.Op{op})
+	if err != nil {
+		return err
+	}
+	data := append(existing, line...)
+	return r.Backend.Put(ctx, key, strings.NewReader(string(data)), int64(len(data)))
+}
+
+var errBlobMissing = fmt.Errorf("content not uploaded yet")
+
+// ---- DirSource: writes land straight in the folder ----
+
+// Upload writes the file atomically under Root. There is no journal here;
+// on a mounted folder the daemon scans, journals, and syncs it like any
+// local edit.
+func (d *DirSource) Upload(_ context.Context, p string, src io.Reader, _ int64) error {
+	dst := filepath.Join(d.Root, filepath.FromSlash(p))
+	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(filepath.Dir(dst), ".bdrive-tmp-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if _, err := io.Copy(tmp, src); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), dst)
+}
+
+// ---- HTTP handlers ----
+
+var blobRe = regexp.MustCompile(`^[0-9a-f]{64}$`)
+
+// cleanUploadPath validates a client-supplied destination path and returns
+// its normalized form.
+func cleanUploadPath(p string) (string, error) {
+	if p == "" || strings.HasPrefix(p, "/") || strings.HasSuffix(p, "/") {
+		return "", fmt.Errorf("invalid path %q", p)
+	}
+	cl := path.Clean(p)
+	if cl != p || cl == "." || cl == ".." || strings.HasPrefix(cl, "../") {
+		return "", fmt.Errorf("invalid path %q", p)
+	}
+	base := path.Base(cl)
+	if base == ".bdrive" || strings.HasPrefix(base, ".bdrive-tmp-") {
+		return "", fmt.Errorf("reserved name %q", base)
+	}
+	return cl, nil
+}
+
+// gateUpload enforces the server's upload setting and returns the volume's
+// writable source, failing the request if uploads are off or the source is
+// read-only.
+func (s *Server) gateUpload(v *volume, w http.ResponseWriter) Uploader {
+	if !s.Upload.Enabled {
+		http.Error(w, "uploads are disabled on this server", http.StatusForbidden)
+		return nil
+	}
+	up := v.uploader()
+	if up == nil {
+		http.Error(w, "this source is read-only", http.StatusForbidden)
+	}
+	return up
+}
+
+type uploadReq struct {
+	Path   string `json:"path"`
+	SHA256 string `json:"sha256"`
+	Size   int64  `json:"size"`
+}
+
+func (s *Server) decodeUpload(w http.ResponseWriter, r *http.Request, needBlob bool) (uploadReq, bool) {
+	var req uploadReq
+	if err := json.NewDecoder(io.LimitReader(r.Body, 1<<20)).Decode(&req); err != nil {
+		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		return req, false
+	}
+	p, err := cleanUploadPath(req.Path)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return req, false
+	}
+	req.Path = p
+	if req.Size < 0 {
+		http.Error(w, "invalid size", http.StatusBadRequest)
+		return req, false
+	}
+	if needBlob && !blobRe.MatchString(req.SHA256) {
+		http.Error(w, "sha256 must be 64 lowercase hex chars", http.StatusBadRequest)
+		return req, false
+	}
+	return req, true
+}
+
+// handleUploadInit tells the client how to upload this content: a presigned
+// direct URL when the storage supports it, otherwise through the server.
+func (s *Server) handleUploadInit(v *volume, w http.ResponseWriter, r *http.Request) {
+	up := s.gateUpload(v, w)
+	if up == nil {
+		return
+	}
+	req, ok := s.decodeUpload(w, r, true)
+	if !ok {
+		return
+	}
+	if direct, isDirect := up.(DirectUploader); isDirect {
+		if exists, err := direct.HasBlob(r.Context(), req.SHA256); err == nil && exists {
+			// Content already in the store (same file elsewhere, or a retry):
+			// skip the upload, go straight to commit.
+			writeJSON(w, map[string]any{"mode": "direct", "exists": true})
+			return
+		}
+		signed, err := direct.SignBlobPut(r.Context(), req.SHA256, req.Size, s.Upload.ttl())
+		if err == nil {
+			writeJSON(w, map[string]any{
+				"mode":    "direct",
+				"url":     signed.URL,
+				"method":  signed.Method,
+				"headers": signed.Headers,
+				"expires": signed.Expires.UTC(),
+			})
+			return
+		}
+		// Backend can't presign right now (e.g. credentials that can't
+		// sign): degrade to uploading through the server.
+	}
+	writeJSON(w, map[string]any{"mode": "server"})
+}
+
+// handleUploadContent receives content through the server (server mode).
+func (s *Server) handleUploadContent(v *volume, w http.ResponseWriter, r *http.Request) {
+	up := s.gateUpload(v, w)
+	if up == nil {
+		return
+	}
+	p, err := cleanUploadPath(r.URL.Query().Get("path"))
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+	if err := up.Upload(r.Context(), p, r.Body, r.ContentLength); err != nil {
+		http.Error(w, fmt.Sprintf("store: %v", err), http.StatusBadGateway)
+		return
+	}
+	v.invalidate()
+	writeJSON(w, map[string]any{"ok": true, "path": p})
+}
+
+// handleUploadCommit journals a direct upload after the blob is in the store.
+func (s *Server) handleUploadCommit(v *volume, w http.ResponseWriter, r *http.Request) {
+	up := s.gateUpload(v, w)
+	if up == nil {
+		return
+	}
+	direct, isDirect := up.(DirectUploader)
+	if !isDirect {
+		http.Error(w, "this source has no direct-upload commit", http.StatusBadRequest)
+		return
+	}
+	req, ok := s.decodeUpload(w, r, true)
+	if !ok {
+		return
+	}
+	if err := direct.Commit(r.Context(), req.Path, req.SHA256, req.Size); err != nil {
+		code := http.StatusBadGateway
+		if err == errBlobMissing {
+			code = http.StatusConflict
+		}
+		http.Error(w, fmt.Sprintf("commit: %v", err), code)
+		return
+	}
+	v.invalidate()
+	writeJSON(w, map[string]any{"ok": true, "path": req.Path})
+}
diff --git a/internal/webapp/upload_test.go b/internal/webapp/upload_test.go
new file mode 100644
index 0000000..b268c40
--- /dev/null
+++ b/internal/webapp/upload_test.go
@@ -0,0 +1,329 @@
+package webapp
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/runbear-io/beardrive/internal/journal"
+	"github.com/runbear-io/beardrive/internal/remote"
+)
+
+var webDevice = Identity{ID: "webdev", Name: "webhost", Author: "web@test"}
+
+// uploadServer returns an upload-enabled Server over the fake remote, with
+// the backend optionally wrapped (e.g. to add signing).
+func (f *fakeRemote) uploadServer(wrap func(remote.Backend) remote.Backend) *Server {
+	f.t.Helper()
+	be, err := remote.Open(context.Background(), "file://"+f.dir)
+	if err != nil {
+		f.t.Fatal(err)
+	}
+	f.t.Cleanup(func() { be.Close() })
+	if wrap != nil {
+		be = wrap(be)
+	}
+	return &Server{
+		Source: &RemoteSource{Backend: be, Device: webDevice},
+		Volume: "testvol", Refresh: 0,
+		Upload: UploadConfig{Enabled: true},
+	}
+}
+
+// signingBackend fakes an object store that can presign uploads.
+type signingBackend struct {
+	remote.Backend
+	signed []string // keys presigned so far
+}
+
+func (b *signingBackend) SignPut(_ context.Context, key string, size int64, ttl time.Duration) (*remote.SignedPut, error) {
+	b.signed = append(b.signed, key)
+	return &remote.SignedPut{
+		URL: "https://storage.example/" + key + "?sig=abc", Method: "PUT",
+		Headers: map[string]string{"Content-Length": fmt.Sprint(size)},
+		Expires: time.Now().Add(ttl),
+	}, nil
+}
+
+func do(t *testing.T, h http.Handler, method, url string, body any) *httptest.ResponseRecorder {
+	t.Helper()
+	var rd *bytes.Reader
+	switch b := body.(type) {
+	case nil:
+		rd = bytes.NewReader(nil)
+	case []byte:
+		rd = bytes.NewReader(b)
+	default:
+		data, err := json.Marshal(b)
+		if err != nil {
+			t.Fatal(err)
+		}
+		rd = bytes.NewReader(data)
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest(method, url, rd))
+	return rec
+}
+
+func shaOf(content string) string {
+	sum := sha256.Sum256([]byte(content))
+	return hex.EncodeToString(sum[:])
+}
+
+func initReq(path, content string) map[string]any {
+	return map[string]any{"path": path, "sha256": shaOf(content), "size": len(content)}
+}
+
+func TestConfigExposesNoStorageInfo(t *testing.T) {
+	f := newFakeRemote(t)
+	h := f.server().Handler()
+	rec := do(t, h, "GET", "/api/config", nil)
+	if rec.Code != 200 {
+		t.Fatalf("config: %d", rec.Code)
+	}
+	body := rec.Body.String()
+	if strings.Contains(body, f.dir) || strings.Contains(body, "file://") {
+		t.Fatalf("config leaks storage location: %s", body)
+	}
+	var cfg struct {
+		Volume string `json:"volume"`
+		Upload struct {
+			Enabled bool `json:"enabled"`
+		} `json:"upload"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &cfg); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Volume != "testvol" || cfg.Upload.Enabled {
+		t.Fatalf("config = %+v, want volume testvol, upload disabled", cfg)
+	}
+	// the old endpoint that used to expose the remote URL must be gone
+	if rec := do(t, h, "GET", "/api/volume", nil); rec.Code == 200 {
+		t.Fatalf("/api/volume should not exist, got %d", rec.Code)
+	}
+}
+
+func TestUploadDisabledByDefault(t *testing.T) {
+	f := newFakeRemote(t)
+	h := f.server().Handler() // read-only server
+	if rec := do(t, h, "POST", "/api/upload/init", initReq("a.md", "x")); rec.Code != http.StatusForbidden {
+		t.Fatalf("init on read-only server: %d, want 403", rec.Code)
+	}
+	if rec := do(t, h, "PUT", "/api/upload/content?path=a.md", []byte("x")); rec.Code != http.StatusForbidden {
+		t.Fatalf("content on read-only server: %d, want 403", rec.Code)
+	}
+	if rec := do(t, h, "POST", "/api/upload/commit", initReq("a.md", "x")); rec.Code != http.StatusForbidden {
+		t.Fatalf("commit on read-only server: %d, want 403", rec.Code)
+	}
+}
+
+// A file:// backend cannot presign, so the server must direct the client to
+// upload through it — and the upload must land as blob + journal op with the
+// server's device identity and a lamport past every existing op.
+func TestServerModeUpload(t *testing.T) {
+	f := newFakeRemote(t)
+	f.put("deva", "old.md", "existing") // pre-existing history from another device
+	srv := f.uploadServer(nil)
+	h := srv.Handler()
+
+	rec := do(t, h, "POST", "/api/upload/init", initReq("notes/new.md", "hello"))
+	if rec.Code != 200 {
+		t.Fatalf("init: %d %s", rec.Code, rec.Body)
+	}
+	var plan struct {
+		Mode string `json:"mode"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &plan); err != nil {
+		t.Fatal(err)
+	}
+	if plan.Mode != "server" {
+		t.Fatalf("mode = %q, want server (file backend cannot presign)", plan.Mode)
+	}
+
+	rec = do(t, h, "PUT", "/api/upload/content?path=notes/new.md", []byte("hello"))
+	if rec.Code != 200 {
+		t.Fatalf("content: %d %s", rec.Code, rec.Body)
+	}
+
+	// visible immediately (snapshot invalidated), served back intact
+	if rec := do(t, h, "GET", "/api/file?path=notes/new.md", nil); rec.Code != 200 || rec.Body.String() != "hello" {
+		t.Fatalf("file after upload: %d %q", rec.Code, rec.Body)
+	}
+
+	// blob is content-addressed in the store
+	if _, err := os.Stat(filepath.Join(f.dir, "blobs", shaOf("hello"))); err != nil {
+		t.Fatalf("blob not in store: %v", err)
+	}
+	// journaled under the server's own device, never anyone else's
+	ops, err := journal.ReadFile(filepath.Join(f.dir, "journal", webDevice.ID+".jsonl"))
+	if err != nil || len(ops) != 1 {
+		t.Fatalf("web journal ops = %v, %v", ops, err)
+	}
+	op := ops[0]
+	if op.Device != webDevice.ID || op.Author != webDevice.Author || op.Seq != 1 {
+		t.Fatalf("op identity = %+v", op)
+	}
+	if op.Lamport <= 1 { // deva's put had lamport 1; ours must sort after it
+		t.Fatalf("lamport = %d, want > 1", op.Lamport)
+	}
+	if op.Kind != journal.KindPut || op.Path != "notes/new.md" || op.Blob != shaOf("hello") || op.Size != 5 {
+		t.Fatalf("op = %+v", op)
+	}
+}
+
+func TestDirectModeUpload(t *testing.T) {
+	f := newFakeRemote(t)
+	var sb *signingBackend
+	srv := f.uploadServer(func(be remote.Backend) remote.Backend {
+		sb = &signingBackend{Backend: be}
+		return sb
+	})
+	h := srv.Handler()
+	content := "direct content"
+	req := initReq("docs/d.md", content)
+
+	rec := do(t, h, "POST", "/api/upload/init", req)
+	if rec.Code != 200 {
+		t.Fatalf("init: %d %s", rec.Code, rec.Body)
+	}
+	var plan struct {
+		Mode, URL, Method string
+		Exists            bool
+		Expires           time.Time
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &plan); err != nil {
+		t.Fatal(err)
+	}
+	if plan.Mode != "direct" || plan.Exists {
+		t.Fatalf("plan = %+v, want fresh direct upload", plan)
+	}
+	wantKey := "blobs/" + shaOf(content)
+	if !strings.Contains(plan.URL, wantKey) || plan.Method != "PUT" {
+		t.Fatalf("plan = %+v, want presigned PUT of %s", plan, wantKey)
+	}
+	if plan.Expires.IsZero() || plan.Expires.After(time.Now().Add(DefaultUploadTTL+time.Minute)) {
+		t.Fatalf("expires = %v, want bounded by ttl", plan.Expires)
+	}
+	if len(sb.signed) != 1 || sb.signed[0] != wantKey {
+		t.Fatalf("signed keys = %v", sb.signed)
+	}
+
+	// committing before the blob arrived must be refused: a journal op must
+	// never point at missing content
+	if rec := do(t, h, "POST", "/api/upload/commit", req); rec.Code != http.StatusConflict {
+		t.Fatalf("commit without blob: %d %s, want 409", rec.Code, rec.Body)
+	}
+
+	// simulate the client's direct PUT to storage
+	if err := os.WriteFile(filepath.Join(f.dir, "blobs", shaOf(content)), []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if rec := do(t, h, "POST", "/api/upload/commit", req); rec.Code != 200 {
+		t.Fatalf("commit: %d %s", rec.Code, rec.Body)
+	}
+	if rec := do(t, h, "GET", "/api/file?path=docs/d.md", nil); rec.Code != 200 || rec.Body.String() != content {
+		t.Fatalf("file after direct upload: %d %q", rec.Code, rec.Body)
+	}
+
+	// re-uploading identical content: init should say it's already there
+	rec = do(t, h, "POST", "/api/upload/init", initReq("copy.md", content))
+	var again struct {
+		Mode   string
+		Exists bool
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &again); err != nil {
+		t.Fatal(err)
+	}
+	if again.Mode != "direct" || !again.Exists {
+		t.Fatalf("re-init = %+v, want direct+exists", again)
+	}
+}
+
+func TestUploadPathValidation(t *testing.T) {
+	f := newFakeRemote(t)
+	h := f.uploadServer(nil).Handler()
+	for _, bad := range []string{"", "/abs.md", "../escape.md", "a/../../b", "dir/", ".bdrive", "x/.bdrive-tmp-1"} {
+		body := map[string]any{"path": bad, "sha256": shaOf("x"), "size": 1}
+		if rec := do(t, h, "POST", "/api/upload/init", body); rec.Code != http.StatusBadRequest {
+			t.Errorf("init path %q: %d, want 400", bad, rec.Code)
+		}
+		if rec := do(t, h, "PUT", "/api/upload/content?path="+bad, []byte("x")); rec.Code != http.StatusBadRequest {
+			t.Errorf("content path %q: %d, want 400", bad, rec.Code)
+		}
+	}
+	// bad sha256 values
+	for _, sha := range []string{"", "xyz", strings.Repeat("A", 64)} {
+		body := map[string]any{"path": "ok.md", "sha256": sha, "size": 1}
+		if rec := do(t, h, "POST", "/api/upload/init", body); rec.Code != http.StatusBadRequest {
+			t.Errorf("init sha %q: %d, want 400", sha, rec.Code)
+		}
+	}
+}
+
+func TestDirSourceUpload(t *testing.T) {
+	root := t.TempDir()
+	srv := &Server{
+		Source: &DirSource{Root: root}, Volume: "local", Refresh: 0,
+		Upload: UploadConfig{Enabled: true},
+	}
+	h := srv.Handler()
+
+	// a plain folder cannot presign either → server mode
+	rec := do(t, h, "POST", "/api/upload/init", initReq("sub/note.md", "hi"))
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), `"server"`) {
+		t.Fatalf("init: %d %s, want server mode", rec.Code, rec.Body)
+	}
+	if rec := do(t, h, "PUT", "/api/upload/content?path=sub/note.md", []byte("hi")); rec.Code != 200 {
+		t.Fatalf("content: %d %s", rec.Code, rec.Body)
+	}
+	data, err := os.ReadFile(filepath.Join(root, "sub", "note.md"))
+	if err != nil || string(data) != "hi" {
+		t.Fatalf("file on disk = %q, %v", data, err)
+	}
+	// direct-mode commit makes no sense for a plain folder
+	if rec := do(t, h, "POST", "/api/upload/commit", initReq("sub/note.md", "hi")); rec.Code != http.StatusBadRequest {
+		t.Fatalf("commit on dir source: %d, want 400", rec.Code)
+	}
+	// upload config advertises enabled
+	rec = do(t, h, "GET", "/api/config", nil)
+	if !strings.Contains(rec.Body.String(), `"enabled":true`) {
+		t.Fatalf("config = %s, want upload enabled", rec.Body)
+	}
+}
+
+// Uploads from two requests racing must serialize on the journal: both ops
+// survive with distinct seqs.
+func TestConcurrentCommits(t *testing.T) {
+	f := newFakeRemote(t)
+	h := f.uploadServer(nil).Handler()
+	done := make(chan int, 2)
+	for i := 0; i < 2; i++ {
+		go func(i int) {
+			content := fmt.Sprintf("body-%d", i)
+			rec := do(t, h, "PUT", fmt.Sprintf("/api/upload/content?path=f%d.md", i), []byte(content))
+			done <- rec.Code
+		}(i)
+	}
+	for i := 0; i < 2; i++ {
+		if code := <-done; code != 200 {
+			t.Fatalf("concurrent upload: %d", code)
+		}
+	}
+	ops, err := journal.ReadFile(filepath.Join(f.dir, "journal", webDevice.ID+".jsonl"))
+	if err != nil || len(ops) != 2 {
+		t.Fatalf("ops = %v, %v; want 2", ops, err)
+	}
+	if ops[0].Seq == ops[1].Seq || ops[0].Lamport == ops[1].Lamport {
+		t.Fatalf("seq/lamport must be distinct: %+v %+v", ops[0], ops[1])
+	}
+}
diff --git a/plugin/commands/mount.md b/plugin/commands/mount.md
index 5b966cc..ec63a47 100644
--- a/plugin/commands/mount.md
+++ b/plugin/commands/mount.md
@@ -1,5 +1,5 @@
 ---
-description: Mount a folder as a synced beardrive volume — one command sets up the sync daemon, the .beardrive project config, and (via this plugin's hooks) automatic sync at every turn boundary
+description: Mount a folder as a synced beardrive volume — one command sets up the sync daemon, the .bdrive project config, and (via this plugin's hooks) automatic sync at every turn boundary
 argument-hint: [folder] [remote e.g. s3://bucket/prefix]
 ---
 
@@ -9,7 +9,7 @@ Follow these steps:
 
 1. **Check the bdrive CLI is installed**: run `command -v bdrive`. If missing, offer to install it (`brew install runbear-io/tap/beardrive`, or `go install github.com/runbear-io/beardrive/cmd/bdrive@latest`) and wait for the user's choice before installing.
 
-2. **Determine the folder**: first argument if given, otherwise the current directory. If the folder already contains a `.beardrive` file, the volume and remote are already configured — just run `bdrive mnt <folder>` and skip step 3.
+2. **Determine the folder**: first argument if given, otherwise the current directory. If the folder already contains a `.bdrive` file, the volume and remote are already configured — just run `bdrive mnt <folder>` and skip step 3.
 
 3. **Determine the remote**: second argument if given. If not given, ask the user which backend they want:
    - `s3://bucket/prefix` — Amazon S3 or any S3-compatible store (R2/MinIO via `AWS_ENDPOINT_URL`)
@@ -17,12 +17,12 @@ Follow these steps:
    - `file:///abs/path` — a plain shared directory (NAS, external drive)
    - none — local-only for now (`bdrive remote set` can add one later)
 
-4. **Mount**: run `bdrive mnt <folder> [--remote <url>]`. This registers the background sync daemon and writes the folder's settings to `<folder>/.beardrive`.
+4. **Mount**: run `bdrive mnt <folder> [--remote <url>]`. This registers the background sync daemon and writes the folder's settings to `<folder>/.bdrive`.
 
 5. **Verify**: run `bdrive status <folder>` and show the result. If the remote errored, consult the beardrive skill's troubleshooting table (credentials are the usual cause).
 
 6. **Tell the user what's now active** (briefly):
    - the daemon syncs continuously (every few seconds);
    - this plugin's hooks also sync at every turn boundary — a blocking pull when they send a message, an async push when the turn ends — so Claude always works on fresh files;
-   - `.beardriveignore` in the folder root excludes files (gitignore-style); an `"include"` list in `.beardrive` narrows what syncs;
+   - `.bdriveignore` in the folder root excludes files (gitignore-style); an `"include"` list in `.bdrive` narrows what syncs;
    - `bdrive log` shows who changed what, `bdrive umnt` stops syncing.
diff --git a/plugin/scripts/beardrive-sync.sh b/plugin/scripts/beardrive-sync.sh
index e73e558..c8d6d1d 100755
--- a/plugin/scripts/beardrive-sync.sh
+++ b/plugin/scripts/beardrive-sync.sh
@@ -1,10 +1,10 @@
 #!/bin/sh
-# Sync the current project if it is a beardrive mount (has a .beardrive settings file).
+# Sync the current project if it is a beardrive mount (has a .bdrive settings file).
 # Fast no-op otherwise, so this hook is safe on every turn in every project.
 #
 # Runs blocking on UserPromptSubmit (fresh files before Claude reads them)
 # and async on Stop (push edits out without delaying the turn).
 cd "${CLAUDE_PROJECT_DIR:-.}" || exit 0
-[ -f .beardrive ] || exit 0
+[ -f .bdrive ] || exit 0
 command -v bdrive >/dev/null 2>&1 || exit 0
 bdrive sync . >/dev/null 2>&1 || true
diff --git a/plugin/skills/beardrive/SKILL.md b/plugin/skills/beardrive/SKILL.md
index af7b25c..5dc34b7 100644
--- a/plugin/skills/beardrive/SKILL.md
+++ b/plugin/skills/beardrive/SKILL.md
@@ -23,7 +23,9 @@ Use this skill whenever the user is working with the `bdrive` CLI: mounting, unm
 | Change history | `bdrive log [<folder>] [-p path] [-n N]` |
 | Show / set remote | `bdrive remote [<folder>]` · `bdrive remote set <folder> <url>` |
 | This device's identity | `bdrive whoami` |
-| Web viewer (read-only, rendered markdown) | `bdrive web [<folder> \| <remote-url>]` (serves cwd by default, `--addr :4173`) |
+| Point this device at a hub (once per device) | `bdrive login https://host:4173` — verifies the server, saves it as the device default (`$BDRIVE_HOME/settings.json`); bare `bdrive login` shows the current server |
+| One-command project onboarding (storage-blind client) | `bdrive init [<folder>]` — needs a prior `bdrive login`; creates-or-joins a hub project named after the folder (`--name <x>` explicit, `--project <id>` join by id), writes `.bdrive`, seeds a starter `.bdriveignore`, mounts, starts the daemon. No separate `mnt` needed. |
+| Web server: viewer + multi-project sync hub (read-only unless `--upload`) | `bdrive web [<folder> \| <storage-root-url>]` (serves cwd by default, `--addr :4173`; `-c config.json` reads remote/addr/upload/projects_db settings from a file, explicit flags win; a storage root URL makes it a hub hosting many projects at `<root>/<project-id>/`, registry in `--projects-db` file, default `$BDRIVE_HOME/projects.json`; `--upload` lets browsers add files, client devices push, and projects be created — direct to storage via expiring presigned URLs on S3/GCS, relayed through the server for `file://`; `--upload-ttl 15m`; clients never see the remote URL or credentials) |
 
 `<folder>` is created if missing. Omitting it on `sync`/`status`/`log` defaults to the current working directory.
 
@@ -31,11 +33,11 @@ Use this skill whenever the user is working with the `bdrive` CLI: mounting, unm
 
 Two files at the mount root control a folder's sync behavior:
 
-- **`.beardrive`** — the folder's settings (JSON): `volume`, `remote`, and optional `include`. Written by `bdrive mnt` / `bdrive remote set`; safe to hand-edit (a running daemon picks changes up on its next tick). It is **never synced** — remotes are device-specific — and it travels with the folder: copy a folder containing `.beardrive` to a new machine and plain `bdrive mnt <folder>` reuses its volume and remote.
-- **`.beardriveignore`** — opt-out list, gitignore-style. **Syncs like a normal file**, so all devices share the same rules. Syntax subset: `#` comments, `*` within a segment, `**` across segments, `?`, trailing `/` for directories-only, a `/` elsewhere anchors to the mount root, `!` re-includes.
+- **`.bdrive`** — the folder's settings (JSON): `volume`, `remote`, and optional `include`. Written by `bdrive mnt` / `bdrive remote set`; safe to hand-edit (a running daemon picks changes up on its next tick). It is **never synced** — remotes are device-specific — and it travels with the folder: copy a folder containing `.bdrive` to a new machine and plain `bdrive mnt <folder>` reuses its volume and remote.
+- **`.bdriveignore`** — opt-out list, gitignore-style. **Syncs like a normal file**, so all devices share the same rules. Syntax subset: `#` comments, `*` within a segment, `**` across segments, `?`, trailing `/` for directories-only, a `/` elsewhere anchors to the mount root, `!` re-includes.
 
 ```jsonc
-// .beardrive
+// .bdrive
 {
   "volume": "agent-workspace",
   "remote": "s3://acme-beardrive/agent-workspace",
@@ -44,7 +46,7 @@ Two files at the mount root control a folder's sync behavior:
 ```
 
 ```gitignore
-# .beardriveignore
+# .bdriveignore
 *.log
 node_modules/
 build/
@@ -55,7 +57,7 @@ Selective-sync semantics — important when advising users:
 
 - A path syncs when it is **not ignored** and (if `include` is non-empty) **matches an include pattern**. Ignore beats include.
 - Adding a pattern for an already-synced file makes this device **stop tracking it without deleting it anywhere** — the file stays on disk locally and on every other device. Deleting it locally after that does not propagate either.
-- Because `.beardriveignore` syncs, adding a rule on one device applies it everywhere on the next cycle.
+- Because `.bdriveignore` syncs, adding a rule on one device applies it everywhere on the next cycle.
 
 ---
 
@@ -66,8 +68,8 @@ Selective-sync semantics — important when advising users:
 1. Pick a folder. New empty or with existing files — existing files are imported on the first cycle.
 2. Decide on a remote (optional at mount time; configurable later via `bdrive remote set`).
 3. Run `bdrive mnt`. beardrive:
-   - writes the folder's settings to `<folder>/.beardrive` and registers it in `~/.beardrive/mounts.json`,
-   - opens/creates the volume under `~/.beardrive/volumes/<volume>/`,
+   - writes the folder's settings to `<folder>/.bdrive` and registers it in `~/.bdrive/mounts.json`,
+   - opens/creates the volume under `~/.bdrive/volumes/<volume>/`,
    - runs an initial cycle (import locals; pull remote state if a remote is set),
    - starts a background daemon (unless `-f`).
 4. Verify with `bdrive status <folder>`.
@@ -94,8 +96,8 @@ The basename `agent-workspace` becomes the volume name on each device; they conv
 
 ### Unmount
 
-- `bdrive umnt <folder>` — stop the daemon. Files stay on disk; local volume store under `~/.beardrive/volumes/<volume>/` is kept. Re-mount any time to resume.
-- `bdrive umnt <folder> --forget` — also drop from the mount registry. Local volume data is still preserved; the user must `rm -rf ~/.beardrive/volumes/<volume>/` to reclaim disk.
+- `bdrive umnt <folder>` — stop the daemon. Files stay on disk; local volume store under `~/.bdrive/volumes/<volume>/` is kept. Re-mount any time to resume.
+- `bdrive umnt <folder> --forget` — also drop from the mount registry. Local volume data is still preserved; the user must `rm -rf ~/.bdrive/volumes/<volume>/` to reclaim disk.
 
 ### On-demand sync
 
@@ -125,7 +127,7 @@ bdrive umnt ./notes --forget
 
 ### What beardrive does not sync
 
-`.git` directories, `.DS_Store`, the `.beardrive` settings file, beardrive's own temp files, empty directories, and anything excluded by `.beardriveignore` or left out of an `include` list. Don't suggest mounting a folder where `.git` is the content the user expects synced — they want git, not beardrive.
+`.git` directories, `.DS_Store`, the `.bdrive` settings file, beardrive's own temp files, empty directories, and anything excluded by `.bdriveignore` or left out of an `include` list. Don't suggest mounting a folder where `.git` is the content the user expects synced — they want git, not beardrive.
 
 ---
 
@@ -140,6 +142,7 @@ beardrive uses each provider's standard credential chain — nothing beardrive-s
 | `s3://bucket/prefix` | Amazon S3, or any S3-compatible store via `AWS_ENDPOINT_URL` | `s3://acme-beardrive/agent-workspace` |
 | `gs://bucket/prefix` | Google Cloud Storage | `gs://acme-beardrive/agent-workspace` |
 | `file:///abs/path` | Plain directory (local, NAS, Dropbox folder, …) | `file:///Volumes/nas/beardrive/notes` |
+| `https://host:port/p/<project-id>` | One project on a `bdrive web` hub — the client holds **no storage credentials**; the server device owns the bucket config. Server must run with `--upload` for clients to push. Set up with `bdrive init` (never hand-write the `/p/<id>` URL) | `https://drive.example.com:4173/p/p-7f3a2c91` |
 
 `bdrive remote set` validates the scheme and rejects anything else. The prefix can be multi-segment (`s3://bucket/team/agent/workspace`); beardrive writes `blobs/` and `journal/` underneath it.
 
@@ -331,7 +334,7 @@ Answers:
 - "What did device Y do?" → `bdrive log <folder> -n 0` and filter by device name.
 - "Did my edit cross over?" → run `bdrive log` on the other device; the op appears once it has pulled the source device's journal.
 
-History is content-addressed — overwritten and deleted files are still in the log, with blobs retained under `~/.beardrive/volumes/<volume>/blobs/`.
+History is content-addressed — overwritten and deleted files are still in the log, with blobs retained under `~/.bdrive/volumes/<volume>/blobs/`.
 
 ### `bdrive whoami`
 
@@ -339,23 +342,23 @@ History is content-addressed — overwritten and deleted files are still in the
 device id:   d380dea58598
 device name: macbook
 author:      snow@runbear.io
-beardrive home:    /Users/snow/.beardrive
+beardrive home:    /Users/snow/.bdrive
 ```
 
-- **device id** — random 12-hex, generated on first run, persisted to `~/.beardrive/device.json`.
+- **device id** — random 12-hex, generated on first run, persisted to `~/.bdrive/device.json`.
 - **device name** — hostname (without `.local`).
 - **author** — `git config user.email` if present, else `$USER@<hostname>`.
 
-To change name/author, edit `~/.beardrive/device.json` and restart the daemon (`bdrive umnt`/`bdrive mnt`).
+To change name/author, edit `~/.bdrive/device.json` and restart the daemon (`bdrive umnt`/`bdrive mnt`).
 
 ### The per-mount daemon log
 
 ```sh
 # Volume contents (daemon pid + log files live here, one pair per mount)
-ls ~/.beardrive/volumes/<volume>/
+ls ~/.bdrive/volumes/<volume>/
 
 # Tail
-tail -F ~/.beardrive/volumes/<volume>/daemon-*.log
+tail -F ~/.bdrive/volumes/<volume>/daemon-*.log
 ```
 
 Useful when `pending` is stuck > 0, the daemon flips to `stopped` after a restart, or you changed credentials and want to confirm uptake.
@@ -366,14 +369,14 @@ Useful when `pending` is stuck > 0, the daemon flips to `stopped` after a restar
 2. `daemon: stopped` → `bdrive mnt <folder>` to restart it.
 3. `pending` stuck → `bdrive sync <folder>` and read the cycle output. Errors here point at the remote — see the cloud-storage troubleshooting table above.
 4. Sync succeeds but the other device doesn't see changes → `bdrive sync` on the other device + `bdrive log` to confirm the op crossed over.
-5. Daemon keeps dying → tail `~/.beardrive/volumes/<volume>/daemon-*.log` for the cause.
+5. Daemon keeps dying → tail `~/.bdrive/volumes/<volume>/daemon-*.log` for the cause.
 
 ---
 
 ## On-disk layout
 
 ```
-~/.beardrive/
+~/.bdrive/
 ├── device.json              # identity (bdrive whoami)
 ├── mounts.json              # mount registry (bdrive status)
 └── volumes/<volume>/
@@ -386,4 +389,4 @@ Useful when `pending` is stuck > 0, the daemon flips to `stopped` after a restar
 
 Don't suggest editing files under `volumes/` directly — beardrive owns them. `device.json` and `mounts.json` are safe to inspect; `mounts.json` is safe to hand-edit if a mount entry needs surgery, but prefer `bdrive umnt --forget` then `bdrive mnt`.
 
-Override the whole tree with `BEARDRIVE_HOME=/path` (used heavily in tests and ephemeral environments).
+Override the whole tree with `BDRIVE_HOME=/path` (used heavily in tests and ephemeral environments).