diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..79b6c93
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,54 @@
+name: Quality Checks
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  trunk:
+    name: Trunk Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: trunk-io/trunk-action@v1
+
+  build:
+    name: Build & Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: worker-dist
+          path: dist/
+          retention-days: 1
+
+  terraform:
+    name: Terraform Validate
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: worker-dist
+          path: dist
+      - uses: opentofu/setup-opentofu@v1
+      - working-directory: terraform
+        run: tofu init -backend=false
+      - working-directory: terraform
+        run: tofu fmt -check
+      - working-directory: terraform
+        run: tofu validate
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 65f700f..8508a76 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -11,8 +14,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install dependencies
-        run: npm install
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - run: npm ci
 
       - name: Typecheck
         run: npm run typecheck
diff --git a/.gitignore b/.gitignore
index c4f826a..e587f01 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,13 @@
 node_modules/
 .wrangler/
-dist/
 *.local
+
+# Terraform
+terraform/.terraform/
+terraform/terraform.tfstate
+terraform/terraform.tfstate.backup
+terraform/terraform.tfvars
+# terraform/.terraform.lock.hcl is intentionally committed (provider version pinning)
+
+# Worker build output (generated by scripts/build.sh before tf apply)
+dist/
diff --git a/.trunk/.gitignore b/.trunk/.gitignore
new file mode 100644
index 0000000..15966d0
--- /dev/null
+++ b/.trunk/.gitignore
@@ -0,0 +1,9 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
+tmp
diff --git a/.trunk/configs/.markdownlint.yaml b/.trunk/configs/.markdownlint.yaml
new file mode 100644
index 0000000..b40ee9d
--- /dev/null
+++ b/.trunk/configs/.markdownlint.yaml
@@ -0,0 +1,2 @@
+# Prettier friendly markdownlint config (all formatting rules disabled)
+extends: markdownlint/style/prettier
diff --git a/.trunk/configs/.shellcheckrc b/.trunk/configs/.shellcheckrc
new file mode 100644
index 0000000..8c7b1ad
--- /dev/null
+++ b/.trunk/configs/.shellcheckrc
@@ -0,0 +1,7 @@
+enable=all
+source-path=SCRIPTDIR
+disable=SC2154
+
+# If you're having issues with shellcheck following source, disable the errors via:
+# disable=SC1090
+# disable=SC1091
diff --git a/.trunk/configs/.yamllint.yaml b/.trunk/configs/.yamllint.yaml
new file mode 100644
index 0000000..184e251
--- /dev/null
+++ b/.trunk/configs/.yamllint.yaml
@@ -0,0 +1,7 @@
+rules:
+  quoted-strings:
+    required: only-when-needed
+    extra-allowed: ["{|}"]
+  key-duplicates: {}
+  octal-values:
+    forbid-implicit-octal: true
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
new file mode 100644
index 0000000..9962fd8
--- /dev/null
+++ b/.trunk/trunk.yaml
@@ -0,0 +1,38 @@
+# This file controls the behavior of Trunk: https://docs.trunk.io/cli
+# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
+version: 0.1
+cli:
+  version: 1.25.0
+# Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
+plugins:
+  sources:
+    - id: trunk
+      ref: v1.7.4
+      uri: https://github.com/trunk-io/plugins
+# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
+runtimes:
+  enabled:
+    - go@1.21.0
+    - node@22.16.0
+    - python@3.10.8
+# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
+lint:
+  enabled:
+    - actionlint@1.7.8
+    - checkov@3.2.506
+    - git-diff-check
+    - markdownlint@0.47.0
+    - osv-scanner@2.2.4
+    - prettier@3.8.1
+    - shellcheck@0.11.0
+    - shfmt@3.6.0
+    - taplo@0.10.0
+    - tflint@0.61.0
+    - trufflehog@3.90.13
+    - yamllint@1.38.0
+actions:
+  enabled:
+    - trunk-announce
+    - trunk-check-pre-push
+    - trunk-fmt-pre-commit
+    - trunk-upgrade-available
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..13ef681
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,33 @@
+.PHONY: build tf-init tf-plan tf-apply tf-destroy deploy
+
+# Bundle the worker (required before tf-plan / tf-apply)
+build:
+	./scripts/build.sh
+
+# Init Terraform providers
+tf-init:
+	cd terraform && tofu init
+
+# Plan infra changes (builds first)
+tf-plan: build
+	cd terraform && \
+	  TF_VAR_publish_token="$$(pass obsidian-redirect/publish-token)" \
+	  CLOUDFLARE_API_TOKEN="$$(pass cloudflare/workers-api-token)" \
+	  tofu plan
+
+# Apply infra changes (builds first)
+tf-apply: build
+	cd terraform && \
+	  TF_VAR_publish_token="$$(pass obsidian-redirect/publish-token)" \
+	  CLOUDFLARE_API_TOKEN="$$(pass cloudflare/workers-api-token)" \
+	  tofu apply
+
+# Full deploy: build → apply
+deploy: tf-apply
+
+# Destroy all infra (use with care)
+tf-destroy:
+	cd terraform && \
+	  TF_VAR_publish_token="$$(pass obsidian-redirect/publish-token)" \
+	  CLOUDFLARE_API_TOKEN="$$(pass cloudflare/workers-api-token)" \
+	  tofu destroy
diff --git a/README.md b/README.md
index 1b3d9ad..b42c3a1 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,7 @@ Get your own instance running in ~5 minutes:
 1. **Fork** [gisk0/obsidian-redirect](https://github.com/gisk0/obsidian-redirect)
 
 2. **Configure your domain** — edit `wrangler.toml`:
+
    ```toml
    routes = [
      { pattern = "obs.yourdomain.com/*", zone_name = "yourdomain.com" }
@@ -16,6 +17,7 @@ Get your own instance running in ~5 minutes:
    ```
 
 3. **Deploy:**
+
    ```bash
    npm install
    npx wrangler login        # authenticate with Cloudflare
@@ -32,6 +34,7 @@ Get your own instance running in ~5 minutes:
 After the first manual deploy, pushes to `main` auto-deploy via GitHub Actions.
 
 Add one GitHub secret: **`CF_API_TOKEN`**
+
 - Create at [Cloudflare → Profile → API Tokens](https://dash.cloudflare.com/profile/api-tokens)
 - Template: **Edit Cloudflare Workers**
 - Scope: Account → Workers Scripts → Edit
@@ -83,10 +86,10 @@ GET /health  →  200 "ok"
 - A **"Open in Obsidian →" button** — user-initiated taps pass WKWebView's security checks (iOS)
 - A **JS auto-redirect** — fires immediately on macOS/desktop browsers for zero-friction UX
 
-| Platform | Experience |
-|---|---|
-| **macOS** | Click link → browser flashes → Obsidian opens instantly |
-| **iOS** | Tap link → see "Open in Obsidian" page → tap button → Obsidian opens |
+| Platform  | Experience                                                           |
+| --------- | -------------------------------------------------------------------- |
+| **macOS** | Click link → browser flashes → Obsidian opens instantly              |
+| **iOS**   | Tap link → see "Open in Obsidian" page → tap button → Obsidian opens |
 
 The extra tap on iOS is unavoidable — it's a WKWebView security constraint. The button approach is the most reliable method available (Obsidian doesn't support Universal Links).
 
diff --git a/bun.lock b/bun.lock
index f175452..177be39 100644
--- a/bun.lock
+++ b/bun.lock
@@ -4,6 +4,9 @@
   "workspaces": {
     "": {
       "name": "obsidian-redirect",
+      "dependencies": {
+        "marked": "^17.0.3",
+      },
       "devDependencies": {
         "@cloudflare/workers-types": "^4.20250214.0",
         "typescript": "^5.7.3",
@@ -164,6 +167,8 @@
 
     "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
 
+    "marked": ["marked@17.0.3", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-jt1v2ObpyOKR8p4XaUJVk3YWRJ5n+i4+rjQopxvV32rSndTJXvIzuUdWWIy/1pFQMkQmvTXawzDNqOH/CUmx6A=="],
+
     "miniflare": ["miniflare@4.20260219.0", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "^0.34.5", "undici": "7.18.2", "workerd": "1.20260219.0", "ws": "8.18.0", "youch": "4.1.0-beta.10" }, "bin": { "miniflare": "bootstrap.js" } }, "sha512-EIb5wXbWUnnC60XU2aiFOPNd4fgTXzECkwRSOXZ1vdcY9WZaEE9rVf+h+Apw+WkOHRkp3Dr9/ZhQ5y1R+9iZ4Q=="],
 
     "path-to-regexp": ["path-to-regexp@6.3.0", "", {}, "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="],
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..15501cd
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,535 @@
+{
+  "name": "obsidian-redirect",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "obsidian-redirect",
+      "version": "0.1.0",
+      "dependencies": {
+        "marked": "^17.0.3"
+      },
+      "devDependencies": {
+        "@cloudflare/workers-types": "^4.20250214.0",
+        "typescript": "^5.7.3",
+        "wrangler": "^4.0.0"
+      }
+    },
+    "node_modules/@cloudflare/kv-asset-handler": {
+      "version": "0.4.2",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@cloudflare/unenv-preset": {
+      "version": "2.14.0",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "peerDependencies": {
+        "unenv": "2.0.0-rc.24",
+        "workerd": "^1.20260218.0"
+      },
+      "peerDependenciesMeta": {
+        "workerd": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@cloudflare/workerd-linux-64": {
+      "version": "1.20260219.0",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/@cloudflare/workers-types": {
+      "version": "4.20260228.0",
+      "dev": true,
+      "license": "MIT OR Apache-2.0"
+    },
+    "node_modules/@cspotcode/source-map-support": {
+      "version": "0.8.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "0.3.9"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.27.3",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/colour": {
+      "version": "1.0.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linux-x64": {
+      "version": "1.2.4",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-libvips-linuxmusl-x64": {
+      "version": "1.2.4",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "LGPL-3.0-or-later",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      }
+    },
+    "node_modules/@img/sharp-linux-x64": {
+      "version": "0.34.5",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linux-x64": "1.2.4"
+      }
+    },
+    "node_modules/@img/sharp-linuxmusl-x64": {
+      "version": "0.34.5",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-libvips-linuxmusl-x64": "1.2.4"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.9",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.0.3",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
+    "node_modules/@poppinss/colors": {
+      "version": "4.1.6",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "kleur": "^4.1.5"
+      }
+    },
+    "node_modules/@poppinss/dumper": {
+      "version": "0.6.5",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/colors": "^4.1.5",
+        "@sindresorhus/is": "^7.0.2",
+        "supports-color": "^10.0.0"
+      }
+    },
+    "node_modules/@poppinss/exception": {
+      "version": "1.2.3",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@sindresorhus/is": {
+      "version": "7.2.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/is?sponsor=1"
+      }
+    },
+    "node_modules/@speed-highlight/core": {
+      "version": "1.2.14",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
+    "node_modules/blake3-wasm": {
+      "version": "2.1.5",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cookie": {
+      "version": "1.1.1",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/error-stack-parser-es": {
+      "version": "1.0.5",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.27.3",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.27.3",
+        "@esbuild/android-arm": "0.27.3",
+        "@esbuild/android-arm64": "0.27.3",
+        "@esbuild/android-x64": "0.27.3",
+        "@esbuild/darwin-arm64": "0.27.3",
+        "@esbuild/darwin-x64": "0.27.3",
+        "@esbuild/freebsd-arm64": "0.27.3",
+        "@esbuild/freebsd-x64": "0.27.3",
+        "@esbuild/linux-arm": "0.27.3",
+        "@esbuild/linux-arm64": "0.27.3",
+        "@esbuild/linux-ia32": "0.27.3",
+        "@esbuild/linux-loong64": "0.27.3",
+        "@esbuild/linux-mips64el": "0.27.3",
+        "@esbuild/linux-ppc64": "0.27.3",
+        "@esbuild/linux-riscv64": "0.27.3",
+        "@esbuild/linux-s390x": "0.27.3",
+        "@esbuild/linux-x64": "0.27.3",
+        "@esbuild/netbsd-arm64": "0.27.3",
+        "@esbuild/netbsd-x64": "0.27.3",
+        "@esbuild/openbsd-arm64": "0.27.3",
+        "@esbuild/openbsd-x64": "0.27.3",
+        "@esbuild/openharmony-arm64": "0.27.3",
+        "@esbuild/sunos-x64": "0.27.3",
+        "@esbuild/win32-arm64": "0.27.3",
+        "@esbuild/win32-ia32": "0.27.3",
+        "@esbuild/win32-x64": "0.27.3"
+      }
+    },
+    "node_modules/kleur": {
+      "version": "4.1.5",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/marked": {
+      "version": "17.0.3",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/miniflare": {
+      "version": "4.20260219.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cspotcode/source-map-support": "0.8.1",
+        "sharp": "^0.34.5",
+        "undici": "7.18.2",
+        "workerd": "1.20260219.0",
+        "ws": "8.18.0",
+        "youch": "4.1.0-beta.10"
+      },
+      "bin": {
+        "miniflare": "bootstrap.js"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "6.3.0",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "7.7.4",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/sharp": {
+      "version": "0.34.5",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@img/colour": "^1.0.0",
+        "detect-libc": "^2.1.2",
+        "semver": "^7.7.3"
+      },
+      "engines": {
+        "node": "^18.17.0 || ^20.3.0 || >=21.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/libvips"
+      },
+      "optionalDependencies": {
+        "@img/sharp-darwin-arm64": "0.34.5",
+        "@img/sharp-darwin-x64": "0.34.5",
+        "@img/sharp-libvips-darwin-arm64": "1.2.4",
+        "@img/sharp-libvips-darwin-x64": "1.2.4",
+        "@img/sharp-libvips-linux-arm": "1.2.4",
+        "@img/sharp-libvips-linux-arm64": "1.2.4",
+        "@img/sharp-libvips-linux-ppc64": "1.2.4",
+        "@img/sharp-libvips-linux-riscv64": "1.2.4",
+        "@img/sharp-libvips-linux-s390x": "1.2.4",
+        "@img/sharp-libvips-linux-x64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.2.4",
+        "@img/sharp-libvips-linuxmusl-x64": "1.2.4",
+        "@img/sharp-linux-arm": "0.34.5",
+        "@img/sharp-linux-arm64": "0.34.5",
+        "@img/sharp-linux-ppc64": "0.34.5",
+        "@img/sharp-linux-riscv64": "0.34.5",
+        "@img/sharp-linux-s390x": "0.34.5",
+        "@img/sharp-linux-x64": "0.34.5",
+        "@img/sharp-linuxmusl-arm64": "0.34.5",
+        "@img/sharp-linuxmusl-x64": "0.34.5",
+        "@img/sharp-wasm32": "0.34.5",
+        "@img/sharp-win32-arm64": "0.34.5",
+        "@img/sharp-win32-ia32": "0.34.5",
+        "@img/sharp-win32-x64": "0.34.5"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "10.2.2",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici": {
+      "version": "7.18.2",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
+    "node_modules/unenv": {
+      "version": "2.0.0-rc.24",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "pathe": "^2.0.3"
+      }
+    },
+    "node_modules/workerd": {
+      "version": "1.20260219.0",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "workerd": "bin/workerd"
+      },
+      "engines": {
+        "node": ">=16"
+      },
+      "optionalDependencies": {
+        "@cloudflare/workerd-darwin-64": "1.20260219.0",
+        "@cloudflare/workerd-darwin-arm64": "1.20260219.0",
+        "@cloudflare/workerd-linux-64": "1.20260219.0",
+        "@cloudflare/workerd-linux-arm64": "1.20260219.0",
+        "@cloudflare/workerd-windows-64": "1.20260219.0"
+      }
+    },
+    "node_modules/wrangler": {
+      "version": "4.67.0",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@cloudflare/kv-asset-handler": "0.4.2",
+        "@cloudflare/unenv-preset": "2.14.0",
+        "blake3-wasm": "2.1.5",
+        "esbuild": "0.27.3",
+        "miniflare": "4.20260219.0",
+        "path-to-regexp": "6.3.0",
+        "unenv": "2.0.0-rc.24",
+        "workerd": "1.20260219.0"
+      },
+      "bin": {
+        "wrangler": "bin/wrangler.js",
+        "wrangler2": "bin/wrangler.js"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.2"
+      },
+      "peerDependencies": {
+        "@cloudflare/workers-types": "^4.20260219.0"
+      },
+      "peerDependenciesMeta": {
+        "@cloudflare/workers-types": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.18.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/youch": {
+      "version": "4.1.0-beta.10",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/colors": "^4.1.5",
+        "@poppinss/dumper": "^0.6.4",
+        "@speed-highlight/core": "^1.2.7",
+        "cookie": "^1.0.2",
+        "youch-core": "^0.3.3"
+      }
+    },
+    "node_modules/youch-core": {
+      "version": "0.3.3",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/exception": "^1.2.2",
+        "error-stack-parser-es": "^1.0.5"
+      }
+    }
+  }
+}
diff --git a/package.json b/package.json
index 011e89b..870fd22 100644
--- a/package.json
+++ b/package.json
@@ -4,6 +4,7 @@
   "private": true,
   "scripts": {
     "dev": "wrangler dev",
+    "build": "wrangler deploy --dry-run --outdir=dist",
     "deploy": "wrangler deploy",
     "typecheck": "tsc --noEmit"
   },
@@ -11,5 +12,8 @@
     "@cloudflare/workers-types": "^4.20250214.0",
     "typescript": "^5.7.3",
     "wrangler": "^4.0.0"
+  },
+  "dependencies": {
+    "marked": "^17.0.3"
   }
 }
diff --git a/scripts/build.sh b/scripts/build.sh
new file mode 100755
index 0000000..2cdefbb
--- /dev/null
+++ b/scripts/build.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# scripts/build.sh — Bundle the worker for Terraform deployment
+#
+# Runs wrangler in dry-run mode to produce dist/index.js without deploying.
+# Terraform then picks up the bundle via content_file = "../dist/index.js".
+#
+# Usage: ./scripts/build.sh
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "${REPO_ROOT}"
+
+echo "Building worker bundle..."
+bun run wrangler deploy --dry-run --outdir=dist 2>&1
+
+if [[ ! -f dist/index.js ]]; then
+	echo "Error: dist/index.js not found after build" >&2
+	exit 1
+fi
+
+size="$(du -sh dist/index.js | cut -f1)"
+echo "✅ Built: dist/index.js (${size})"
diff --git a/src/index.ts b/src/index.ts
index 77c4ab0..ce8c4bf 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,4 +1,281 @@
-const HTML = (obsidianUrl: string) => `<!DOCTYPE html>
+import { marked } from "marked";
+
+export interface Env {
+  PUBLISHED_NOTES: KVNamespace;
+  PUBLISH_TOKEN: string;
+}
+
+interface NoteRecord {
+  title: string;
+  markdown: string;
+  publishedAt: string;
+  updatedAt: string;
+}
+
+interface NoteMetaEntry {
+  slug: string;
+  title: string;
+  publishedAt: string;
+  updatedAt: string;
+}
+
+// ─── Constants ────────────────────────────────────────────────────────────────
+
+const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
+const MAX_MARKDOWN_SIZE = 512 * 1024; // 512 KB
+const MAX_TITLE_SIZE = 1024; // 1 KB
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+const META_INDEX_KEY = "_meta:index";
+
+// ─── CSS ──────────────────────────────────────────────────────────────────────
+
+const CSS = `
+  *, *::before, *::after { box-sizing: border-box; }
+  html { font-size: 18px; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Georgia, serif;
+    background: #fafaf9;
+    color: #1c1c1c;
+    max-width: 720px;
+    margin: 0 auto;
+    padding: 2rem 1.5rem 4rem;
+    line-height: 1.75;
+  }
+  header { margin-bottom: 2.5rem; border-bottom: 1px solid #e5e5e5; padding-bottom: 1.5rem; }
+  header h1 { font-size: 2rem; font-weight: 700; margin: 0 0 0.4rem; line-height: 1.25; }
+  header .meta { color: #6b6b6b; font-size: 0.875rem; }
+  article h1, article h2, article h3, article h4, article h5, article h6 {
+    margin: 1.8rem 0 0.6rem; font-weight: 600; line-height: 1.3;
+  }
+  article h1 { font-size: 1.75rem; }
+  article h2 { font-size: 1.4rem; }
+  article h3 { font-size: 1.15rem; }
+  article p { margin: 0 0 1rem; }
+  article a { color: #7c3aed; text-decoration: underline; }
+  article a:hover { color: #6d28d9; }
+  article ul, article ol { margin: 0 0 1rem 1.5rem; }
+  article li { margin-bottom: 0.25rem; }
+  article blockquote {
+    border-left: 4px solid #d4d4d4;
+    margin: 1rem 0;
+    padding: 0.25rem 1rem;
+    color: #555;
+    font-style: italic;
+  }
+  article code {
+    background: #f0efe9;
+    padding: 0.15em 0.4em;
+    border-radius: 4px;
+    font-family: "SF Mono", "Fira Code", "Cascadia Code", monospace;
+    font-size: 0.875em;
+  }
+  article pre {
+    background: #1e1e2e;
+    color: #cdd6f4;
+    border-radius: 8px;
+    padding: 1.25rem;
+    overflow-x: auto;
+    margin: 1rem 0;
+  }
+  article pre code {
+    background: none;
+    padding: 0;
+    color: inherit;
+    font-size: 0.875rem;
+  }
+  article table {
+    border-collapse: collapse;
+    width: 100%;
+    margin: 1rem 0;
+    font-size: 0.9rem;
+  }
+  article th, article td {
+    border: 1px solid #e5e5e5;
+    padding: 0.5rem 0.75rem;
+    text-align: left;
+  }
+  article th { background: #f0efe9; font-weight: 600; }
+  article img { max-width: 100%; border-radius: 6px; }
+  article hr { border: none; border-top: 1px solid #e5e5e5; margin: 2rem 0; }
+  footer {
+    margin-top: 3rem;
+    padding-top: 1.5rem;
+    border-top: 1px solid #e5e5e5;
+    text-align: center;
+    color: #9ca3af;
+    font-size: 0.8rem;
+  }
+  @media (max-width: 600px) {
+    body { padding: 1.25rem 1rem 3rem; }
+    header h1 { font-size: 1.5rem; }
+  }
+`;
+
+// ─── HTML Sanitizer (allowlist-based) ─────────────────────────────────────────
+
+/** Allowed tags and their permitted attributes. Everything else is stripped. */
+const ALLOWED_TAGS: Record<string, Set<string>> = {
+  // Block
+  h1: new Set(),
+  h2: new Set(),
+  h3: new Set(),
+  h4: new Set(),
+  h5: new Set(),
+  h6: new Set(),
+  p: new Set(),
+  blockquote: new Set(),
+  pre: new Set(),
+  hr: new Set(),
+  br: new Set(),
+  div: new Set(),
+  // Inline
+  a: new Set(["href", "title", "rel"]),
+  strong: new Set(),
+  b: new Set(),
+  em: new Set(),
+  i: new Set(),
+  code: new Set(["class"]),
+  del: new Set(),
+  s: new Set(),
+  mark: new Set(),
+  sub: new Set(),
+  sup: new Set(),
+  span: new Set(),
+  // Lists
+  ul: new Set(),
+  ol: new Set(["start"]),
+  li: new Set(),
+  // Tables
+  table: new Set(),
+  thead: new Set(),
+  tbody: new Set(),
+  tr: new Set(),
+  th: new Set(["align"]),
+  td: new Set(["align"]),
+  // Media
+  img: new Set(["src", "alt", "title", "width", "height"]),
+  // Definition lists
+  dl: new Set(),
+  dt: new Set(),
+  dd: new Set(),
+};
+
+/** Attributes whose values must be checked for safe URL schemes. */
+const URL_ATTRS = new Set(["href", "src"]);
+const SAFE_URL_RE = /^(?:https?:\/\/|mailto:|#|\/)/i;
+
+/**
+ * Allowlist-based HTML sanitizer for CF Workers (no DOM required).
+ * Parses tags with a regex, keeps only allowed tags/attributes, and ensures
+ * URL attributes use safe schemes (http, https, mailto, fragment, relative).
+ */
+function sanitizeHtml(html: string): string {
+  return html.replace(
+    /<\/?([a-zA-Z][a-zA-Z0-9]*)\b([^>]*)\/?>|<!--[\s\S]*?-->/g,
+    (match, tagName?: string, attrStr?: string) => {
+      // Strip HTML comments
+      if (match.startsWith("<!--")) return "";
+      if (!tagName) return "";
+
+      const tag = tagName.toLowerCase();
+      const allowedAttrs = ALLOWED_TAGS[tag];
+
+      // Tag not in allowlist → strip it entirely
+      if (!allowedAttrs) return "";
+
+      // Closing tag
+      if (match.startsWith("</")) return `</${tag}>`;
+
+      // Opening tag — filter attributes through allowlist
+      const attrs: string[] = [];
+      const attrRe = /([a-zA-Z_][\w-]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|(\S+))/g;
+      let m: RegExpExecArray | null;
+      while ((m = attrRe.exec(attrStr ?? "")) !== null) {
+        const name = m[1].toLowerCase();
+        const value = m[2] ?? m[3] ?? m[4] ?? "";
+        if (!allowedAttrs.has(name)) continue;
+        if (URL_ATTRS.has(name) && !SAFE_URL_RE.test(value.trim())) continue;
+        attrs.push(`${name}="${escAttr(value)}"`);
+      }
+
+      const selfClosing = tag === "br" || tag === "hr" || tag === "img";
+      const attrString = attrs.length > 0 ? " " + attrs.join(" ") : "";
+      return selfClosing ? `<${tag}${attrString} />` : `<${tag}${attrString}>`;
+    },
+  );
+}
+
+/** Escape a string for use inside an HTML attribute value. */
+function escAttr(s: string): string {
+  return s
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
+// ─── HTML Templates ────────────────────────────────────────────────────────────
+
+function escHtml(s: string): string {
+  return s
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function notePage(title: string, dateStr: string, body: string): string {
+  const date = new Date(dateStr).toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+  });
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escHtml(title)}</title>
+  <style>${CSS}</style>
+</head>
+<body>
+  <header>
+    <h1>${escHtml(title)}</h1>
+    <div class="meta">Published ${date}</div>
+  </header>
+  <article>${body}</article>
+  <footer>Shared via Giskard 🔮</footer>
+</body>
+</html>`;
+}
+
+function page404(): string {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Not Found</title>
+  <style>${CSS}
+    .center { text-align: center; padding: 4rem 0; }
+    .center h1 { font-size: 4rem; margin-bottom: 0.5rem; color: #d4d4d4; }
+    .center p { color: #6b6b6b; }
+  </style>
+</head>
+<body>
+  <div class="center">
+    <h1>404</h1>
+    <p>This note doesn't exist or hasn't been published.</p>
+  </div>
+  <footer>Shared via Giskard 🔮</footer>
+</body>
+</html>`;
+}
+
+// ─── Obsidian Redirect (original) ─────────────────────────────────────────────
+
+const obsidianRedirectPage = (obsidianUrl: string) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="utf-8">
@@ -29,42 +306,245 @@ const HTML = (obsidianUrl: string) => `<!DOCTYPE html>
   <p>Tap the button if Obsidian doesn't open automatically.</p>
   <a href="${obsidianUrl}">Open in Obsidian →</a>
   <script>
-    // Works in real browsers (macOS desktop); often blocked in Telegram WKWebView.
-    // Button above is the reliable fallback for iOS.
     try { window.location.href = ${JSON.stringify(obsidianUrl)}; } catch (e) {}
   </script>
 </body>
 </html>`;
 
+// ─── API Helpers ──────────────────────────────────────────────────────────────
+
+function unauthorized(): Response {
+  return new Response(JSON.stringify({ error: "Unauthorized" }), {
+    status: 401,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function json(
+  data: unknown,
+  status = 200,
+  extraHeaders?: Record<string, string>,
+): Response {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json", ...extraHeaders },
+  });
+}
+
+/** Constant-time string comparison to prevent timing attacks. */
+function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) {
+    // Compare b against itself to keep constant time, then return false
+    const dummy = new TextEncoder().encode(b);
+    crypto.subtle.timingSafeEqual(dummy, dummy);
+    return false;
+  }
+  const encodedA = new TextEncoder().encode(a);
+  const encodedB = new TextEncoder().encode(b);
+  return crypto.subtle.timingSafeEqual(encodedA, encodedB);
+}
+
+function checkToken(req: Request, env: Env): boolean {
+  const token = req.headers.get("X-Publish-Token") ?? "";
+  return timingSafeEqual(token, env.PUBLISH_TOKEN);
+}
+
+function isValidSlug(slug: string): boolean {
+  return slug.length > 0 && slug.length <= 128 && SLUG_RE.test(slug);
+}
+
+// ─── Metadata Index Helpers ───────────────────────────────────────────────────
+
+async function getMetaIndex(env: Env): Promise<NoteMetaEntry[]> {
+  const raw = await env.PUBLISHED_NOTES.get(META_INDEX_KEY);
+  if (!raw) return [];
+  return JSON.parse(raw) as NoteMetaEntry[];
+}
+
+async function putMetaIndex(env: Env, entries: NoteMetaEntry[]): Promise<void> {
+  await env.PUBLISHED_NOTES.put(META_INDEX_KEY, JSON.stringify(entries));
+}
+
+// ─── Route Handlers ───────────────────────────────────────────────────────────
+
+async function handlePublicNote(slug: string, env: Env): Promise<Response> {
+  const raw = await env.PUBLISHED_NOTES.get(slug);
+  if (!raw) {
+    return new Response(page404(), {
+      status: 404,
+      headers: { "Content-Type": "text/html; charset=utf-8" },
+    });
+  }
+  const note: NoteRecord = JSON.parse(raw);
+  const rawHtml = await marked(note.markdown, { async: true });
+  const safeHtml = sanitizeHtml(rawHtml);
+  return new Response(notePage(note.title, note.publishedAt, safeHtml), {
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "public, max-age=300",
+    },
+  });
+}
+
+async function handlePutPublish(req: Request, env: Env): Promise<Response> {
+  if (!checkToken(req, env)) return unauthorized();
+
+  // Check body size via Content-Length header
+  const contentLength = req.headers.get("Content-Length");
+  if (contentLength && parseInt(contentLength, 10) > MAX_BODY_SIZE) {
+    return json({ error: "Request body too large (max 1MB)" }, 413);
+  }
+
+  // Parse JSON with error handling (#1 — blocker)
+  let body: { slug?: string; title?: string; markdown?: string };
+  try {
+    body = await req.json();
+  } catch {
+    return json({ error: "Invalid JSON" }, 400);
+  }
+
+  if (!body.slug || !body.title || !body.markdown) {
+    return json({ error: "slug, title, and markdown are required" }, 400);
+  }
+
+  // Validate field sizes after parsing (Content-Length is spoofable)
+  if (body.markdown.length > MAX_MARKDOWN_SIZE) {
+    return json({ error: "Markdown too large (max 512KB)" }, 413);
+  }
+  if (body.title.length > MAX_TITLE_SIZE) {
+    return json({ error: "Title too large (max 1KB)" }, 413);
+  }
+
+  // Validate slug (#3 — warning)
+  if (!isValidSlug(body.slug)) {
+    return json(
+      {
+        error:
+          "Invalid slug: only lowercase letters, numbers, and hyphens allowed (a-z0-9-), max 128 chars",
+      },
+      400,
+    );
+  }
+
+  const existing = await env.PUBLISHED_NOTES.get(body.slug);
+  const now = new Date().toISOString();
+  const record: NoteRecord = {
+    title: body.title,
+    markdown: body.markdown,
+    publishedAt: existing
+      ? (JSON.parse(existing) as NoteRecord).publishedAt
+      : now,
+    updatedAt: now,
+  };
+  await env.PUBLISHED_NOTES.put(body.slug, JSON.stringify(record));
+
+  // Update metadata index (#5 — N+1 fix)
+  const meta = await getMetaIndex(env);
+  const idx = meta.findIndex((e) => e.slug === body.slug);
+  const entry: NoteMetaEntry = {
+    slug: body.slug!,
+    title: body.title!,
+    publishedAt: record.publishedAt,
+    updatedAt: now,
+  };
+  if (idx >= 0) {
+    meta[idx] = entry;
+  } else {
+    meta.push(entry);
+  }
+  await putMetaIndex(env, meta);
+
+  return json({ ok: true, slug: body.slug, url: `/s/${body.slug}` });
+}
+
+async function handleDeletePublish(
+  slug: string,
+  req: Request,
+  env: Env,
+): Promise<Response> {
+  if (!checkToken(req, env)) return unauthorized();
+
+  if (!isValidSlug(slug)) {
+    return json({ error: "Invalid slug" }, 400);
+  }
+
+  await env.PUBLISHED_NOTES.delete(slug);
+
+  // Update metadata index
+  const meta = await getMetaIndex(env);
+  const filtered = meta.filter((e) => e.slug !== slug);
+  await putMetaIndex(env, filtered);
+
+  return json({ ok: true, slug });
+}
+
+async function handleListPublished(req: Request, env: Env): Promise<Response> {
+  if (!checkToken(req, env)) return unauthorized();
+
+  // Single KV read from metadata index instead of N+1 (#5)
+  const meta = await getMetaIndex(env);
+  return json({ notes: meta });
+}
+
+// ─── Main Fetch ───────────────────────────────────────────────────────────────
+
 export default {
-  fetch(req: Request): Response {
+  async fetch(req: Request, env: Env): Promise<Response> {
     const url = new URL(req.url);
+    const { pathname } = url;
 
     // Health check
-    if (url.pathname === "/health") {
+    if (pathname === "/health") {
       return new Response("ok", { headers: { "Content-Type": "text/plain" } });
     }
 
-    let obsidianUrl: string;
-
-    // Passthrough mode: /open?vault=X&file=Y → obsidian://open?vault=X&file=Y
-    if (url.pathname === "/open") {
-      obsidianUrl = `obsidian://open${url.search}`;
-    } else {
-      // Shorthand mode: /<vault>/<file-path> → obsidian://open?vault=<vault>&file=<file-path>
-      const match = url.pathname.match(/^\/([^/]+)\/(.+)$/);
-      if (!match) {
-        return new Response(
-          "Usage: /VaultName/path%2Fto%2Ffile  or  /open?vault=X&file=Y",
-          { status: 400, headers: { "Content-Type": "text/plain" } }
-        );
-      }
-      const [, vault, file] = match;
-      obsidianUrl = `obsidian://open?vault=${encodeURIComponent(vault)}&file=${file}`;
+    // Public note view: GET /s/<slug> (slug validated in regex)
+    const shareMatch = pathname.match(/^\/s\/([a-z0-9-]+)$/);
+    if (shareMatch && req.method === "GET") {
+      return handlePublicNote(shareMatch[1], env);
     }
 
-    return new Response(HTML(obsidianUrl), {
-      headers: { "Content-Type": "text/html; charset=utf-8" },
-    });
+    // Management API
+    if (pathname === "/api/publish" && req.method === "PUT") {
+      return handlePutPublish(req, env);
+    }
+    const deleteMatch = pathname.match(/^\/api\/publish\/([a-z0-9-]+)$/);
+    if (deleteMatch && req.method === "DELETE") {
+      return handleDeletePublish(deleteMatch[1], req, env);
+    }
+    if (pathname === "/api/published" && req.method === "GET") {
+      return handleListPublished(req, env);
+    }
+
+    // Defensive: reject unmatched /api/ and /s/ paths (#10)
+    if (pathname.startsWith("/api/") || pathname.startsWith("/s/")) {
+      return new Response(page404(), {
+        status: 404,
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      });
+    }
+
+    // Obsidian redirect: /open?vault=X&file=Y
+    if (pathname === "/open") {
+      const obsidianUrl = `obsidian://open${url.search}`;
+      return new Response(obsidianRedirectPage(obsidianUrl), {
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      });
+    }
+
+    // Obsidian redirect: /VaultName/path%2Fto%2Ffile
+    const vaultMatch = pathname.match(/^\/([^/]+)\/(.+)$/);
+    if (vaultMatch) {
+      const [, vault, file] = vaultMatch;
+      const obsidianUrl = `obsidian://open?vault=${encodeURIComponent(vault)}&file=${file}`;
+      return new Response(obsidianRedirectPage(obsidianUrl), {
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      });
+    }
+
+    return new Response(
+      "Usage: /VaultName/path%2Fto%2Ffile  or  /open?vault=X&file=Y  or  /s/<slug>",
+      { status: 400, headers: { "Content-Type": "text/plain" } },
+    );
   },
 };
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
new file mode 100644
index 0000000..40ffa12
--- /dev/null
+++ b/terraform/.terraform.lock.hcl
@@ -0,0 +1,19 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/cloudflare/cloudflare" {
+  version     = "5.17.0"
+  constraints = "~> 5.17"
+  hashes = [
+    "h1:N6T9tubZNTnj4KhFwEuxA8zn0GNf/pc4HUsj8MXrfPw=",
+    "zh:33e24de8ecccb52b5588893cdfbd2b8942c86a8a855d32892d4be04b4ca8e064",
+    "zh:37bf1f79496650dbb7f6d6241ef54fbf3e1e6f0dbbc644806c0c78acfcdbc57c",
+    "zh:5c5f10424c93f0278cc8b497b3c942e1b17f114d87ed72aa21077e6f1f1e0379",
+    "zh:68bc559574f1a32d0497d22c15f9c07a26a04a0bff17a3f3776ee647e301d3d5",
+    "zh:90c1b92209c1f6435cb5c10a67d0e43b8730624124ce427fde3e529c1ec133aa",
+    "zh:9fdc1b8824ba004aad5bd943430aed523a50f7930ad0f7f04627fdb65d476460",
+    "zh:e3e4684a581a02b76dbd64bc40db25aec6df59e5de6afb266b7178ac4f9044cd",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+    "zh:fd28bd284a69c6bdd6df8e34367cfcba7eea04adc245c1c19f6909ff056d8ad4",
+  ]
+}
diff --git a/terraform/README.md b/terraform/README.md
new file mode 100644
index 0000000..e1e669e
--- /dev/null
+++ b/terraform/README.md
@@ -0,0 +1,87 @@
+# Terraform — obs.gisk0.dev Infrastructure
+
+All Cloudflare infrastructure for `obs.gisk0.dev` is managed here as code.
+
+## What's managed
+
+| Resource      | Terraform name                                    | Notes                       |
+| ------------- | ------------------------------------------------- | --------------------------- |
+| KV Namespace  | `cloudflare_workers_kv_namespace.published_notes` | Stores published notes JSON |
+| Worker Script | `cloudflare_workers_script.obsidian_redirect`     | Bundled TS worker           |
+| Route         | `cloudflare_workers_route.obs_gisk0_dev`          | `obs.gisk0.dev/*` → worker  |
+
+## Prerequisites
+
+- `tofu` (OpenTofu) installed — `brew install opentofu` or use the install script
+- `pass` configured with:
+  - `pass cloudflare/workers-api-token`
+  - `pass obsidian-redirect/publish-token`
+- `bun` installed (for the build step)
+
+## First-time setup
+
+```bash
+# 1. Install providers
+make tf-init
+
+# 2. Import existing resources (only needed once, for resources created before TF)
+cd terraform
+export CLOUDFLARE_API_TOKEN=$(pass cloudflare/workers-api-token)
+export TF_VAR_publish_token=$(pass obsidian-redirect/publish-token)
+
+# Import the KV namespace that already exists
+tofu import cloudflare_workers_kv_namespace.published_notes \
+  '<your-account-id>/<your-kv-namespace-id>'
+
+# Import the worker route
+# First get the route ID:
+curl -s "https://api.cloudflare.com/client/v4/zones/<your-zone-id>/workers/routes" \
+  -H "Authorization: Bearer $(pass cloudflare/workers-api-token)" | python3 -m json.tool
+# Then:
+tofu import cloudflare_workers_route.obs_gisk0_dev '<your-zone-id>/<route_id>'
+```
+
+## Workflow
+
+```bash
+# Plan changes (auto-reads secrets from pass)
+make tf-plan
+
+# Apply changes
+make tf-apply
+
+# Or just: build → apply in one shot
+make deploy
+```
+
+## Secrets
+
+Secrets are **never** hardcoded. They're read at plan/apply time:
+
+| Secret                 | Source                                 | How used                |
+| ---------------------- | -------------------------------------- | ----------------------- |
+| `CLOUDFLARE_API_TOKEN` | `pass cloudflare/workers-api-token`    | Terraform provider auth |
+| `PUBLISH_TOKEN`        | `pass obsidian-redirect/publish-token` | Worker secret binding   |
+
+The `publish_token` variable is marked `sensitive = true` — it won't appear in plan output.
+
+## State
+
+State is stored locally in `terraform/terraform.tfstate`. Since this repo is **private**, that's fine. The state file is gitignored to avoid accidental commits of secrets.
+
+> If you ever want remote state, migrate to Cloudflare R2 or Terraform Cloud backend.
+
+## Variable overrides
+
+You can also override variables directly:
+
+```bash
+cd terraform
+CLOUDFLARE_API_TOKEN=<token> TF_VAR_publish_token=<secret> tofu plan
+```
+
+Or create a `terraform/terraform.tfvars` (gitignored):
+
+```hcl
+publish_token = "your-secret-here"
+```
diff --git a/terraform/main.tf b/terraform/main.tf
new file mode 100644
index 0000000..a4d28c6
--- /dev/null
+++ b/terraform/main.tf
@@ -0,0 +1,57 @@
+terraform {
+  required_version = ">= 1.5"
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 5.17"
+    }
+  }
+  # State stored locally in terraform/ directory (repo is private)
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+}
+
+provider "cloudflare" {
+  # Reads CLOUDFLARE_API_TOKEN env var automatically
+}
+
+# ─── KV Namespace ─────────────────────────────────────────────────────────────
+
+resource "cloudflare_workers_kv_namespace" "published_notes" {
+  account_id = var.account_id
+  title      = "PUBLISHED_NOTES"
+}
+
+# ─── Worker Script ────────────────────────────────────────────────────────────
+# The worker bundle is built by `bun run build` (wrangler --dry-run) before apply.
+
+resource "cloudflare_workers_script" "obsidian_redirect" {
+  account_id         = var.account_id
+  script_name        = "obsidian-redirect"
+  content_file       = "${path.module}/../dist/index.js"
+  content_sha256     = filesha256("${path.module}/../dist/index.js")
+  main_module        = "index.js"
+  compatibility_date = "2024-01-01"
+
+  bindings = [
+    {
+      name         = "PUBLISHED_NOTES"
+      type         = "kv_namespace"
+      namespace_id = cloudflare_workers_kv_namespace.published_notes.id
+    },
+    {
+      name = "PUBLISH_TOKEN"
+      type = "secret_text"
+      text = var.publish_token
+    }
+  ]
+}
+
+# ─── Route ────────────────────────────────────────────────────────────────────
+
+resource "cloudflare_workers_route" "obs_gisk0_dev" {
+  zone_id = var.zone_id
+  pattern = "obs.gisk0.dev/*"
+  script  = cloudflare_workers_script.obsidian_redirect.script_name
+}
diff --git a/terraform/outputs.tf b/terraform/outputs.tf
new file mode 100644
index 0000000..df3988a
--- /dev/null
+++ b/terraform/outputs.tf
@@ -0,0 +1,14 @@
+output "worker_url" {
+  description = "Public URL for the worker"
+  value       = "https://obs.gisk0.dev"
+}
+
+output "kv_namespace_id" {
+  description = "KV namespace ID for PUBLISHED_NOTES"
+  value       = cloudflare_workers_kv_namespace.published_notes.id
+}
+
+output "share_base_url" {
+  description = "Base URL for shared notes"
+  value       = "https://obs.gisk0.dev/s/<slug>"
+}
diff --git a/terraform/terraform.tfvars.example b/terraform/terraform.tfvars.example
new file mode 100644
index 0000000..ed09bf4
--- /dev/null
+++ b/terraform/terraform.tfvars.example
@@ -0,0 +1,2 @@
+account_id = "your-cloudflare-account-id"
+zone_id    = "your-cloudflare-zone-id"
diff --git a/terraform/variables.tf b/terraform/variables.tf
new file mode 100644
index 0000000..89c6cfd
--- /dev/null
+++ b/terraform/variables.tf
@@ -0,0 +1,18 @@
+variable "account_id" {
+  description = "Cloudflare account ID"
+  type        = string
+  # Set via terraform.tfvars (gitignored) or TF_VAR_account_id
+}
+
+variable "zone_id" {
+  description = "Cloudflare zone ID for gisk0.dev"
+  type        = string
+  # Set via terraform.tfvars (gitignored) or TF_VAR_zone_id
+}
+
+variable "publish_token" {
+  description = "Secret token for the /api/publish management endpoints (X-Publish-Token header)"
+  type        = string
+  sensitive   = true
+  # Set via TF_VAR_publish_token env var or terraform.tfvars (gitignored)
+}
diff --git a/wrangler.toml b/wrangler.toml
index 5773b83..e9b2616 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -2,6 +2,12 @@ name = "obsidian-redirect"
 main = "src/index.ts"
 compatibility_date = "2024-01-01"
 
-routes = [
-  { pattern = "obs.gisk0.dev/*", zone_name = "gisk0.dev" }
-]
+routes = [{ pattern = "obs.gisk0.dev/*", zone_name = "gisk0.dev" }]
+
+## KV namespace ID — Terraform is the source of truth.
+## This value must match `cloudflare_workers_kv_namespace.published_notes.id`
+## from terraform/main.tf. After `tofu apply`, get it via:
+##   tofu -chdir=terraform output -raw kv_namespace_id
+[[kv_namespaces]]
+binding = "PUBLISHED_NOTES"
+id = "cf83f0a936324351985100e78363da07"