[object Object]

← back to 4square Agentabrams

scaffold 4square design board

57645dbae8360c4b4d76afcde59c878dcc06acd5 · 2026-05-14 09:01:14 -0700 · Steve

- 2x2 drop slots with HTML5 drag-and-drop from a TSD-catalog rail
- Selections persist in localStorage (key: 4square.agentabrams.layout.v1)
- Slot↔slot swap + clear-per-slot + reset-all
- Basic auth gate (admin / DWShowroom2026) via timing-safe compare
- TSD catalog proxied through /api/catalog/* + /img (no CORS, same-origin)
- Runs on PORT 9702 (9900 collided with wallpaperdictionary)

Verified locally: 60 catalog tiles load, 3 drops persist across reload,
slot↔slot swap persists across reload, zero console errors.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit 57645dbae8360c4b4d76afcde59c878dcc06acd5
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu May 14 09:01:14 2026 -0700

    scaffold 4square design board
    
    - 2x2 drop slots with HTML5 drag-and-drop from a TSD-catalog rail
    - Selections persist in localStorage (key: 4square.agentabrams.layout.v1)
    - Slot↔slot swap + clear-per-slot + reset-all
    - Basic auth gate (admin / DWShowroom2026) via timing-safe compare
    - TSD catalog proxied through /api/catalog/* + /img (no CORS, same-origin)
    - Runs on PORT 9702 (9900 collided with wallpaperdictionary)
    
    Verified locally: 60 catalog tiles load, 3 drops persist across reload,
    slot↔slot swap persists across reload, zero console errors.
    
    Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .deploy.conf        |   7 +
 .gitignore          |   9 +
 ecosystem.config.js |  17 ++
 package-lock.json   | 827 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 package.json        |  12 +
 public/index.html   | 348 ++++++++++++++++++++++
 server.js           | 102 +++++++
 7 files changed, 1322 insertions(+)

diff --git a/.deploy.conf b/.deploy.conf
new file mode 100644
index 0000000..dab3994
--- /dev/null
+++ b/.deploy.conf
@@ -0,0 +1,7 @@
+PROJECT_NAME=4square-agentabrams
+DEPLOY_PATH=/root/public-projects/4square-agentabrams
+HEALTH_URL=http://localhost:9702/health
+INSTALL_CMD="npm ci --omit=dev"
+BUILD_CMD=""
+REQUIRED_ENVS=""
+RSYNC_EXTRA_EXCLUDES="tmp"
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..711f94e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,9 @@
+node_modules/
+.env
+.env.*
+*.log
+.DS_Store
+dist/
+build/
+.next/
+tmp/
diff --git a/ecosystem.config.js b/ecosystem.config.js
new file mode 100644
index 0000000..baeacd4
--- /dev/null
+++ b/ecosystem.config.js
@@ -0,0 +1,17 @@
+module.exports = {
+  apps: [{
+    name: '4square-agentabrams',
+    script: 'server.js',
+    cwd: __dirname,
+    env: {
+      NODE_ENV: 'production',
+      PORT: 9702,
+      BASIC_AUTH_USER: 'admin',
+      BASIC_AUTH_PASS: 'DWShowroom2026',
+      CATALOG_UPSTREAM: 'https://thesetdecorator.com',
+    },
+    max_memory_restart: '256M',
+    autorestart: true,
+    watch: false,
+  }],
+};
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000..adc50f5
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,827 @@
+{
+  "name": "4square-agentabrams",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "4square-agentabrams",
+      "version": "0.1.0",
+      "dependencies": {
+        "express": "^4.19.2"
+      }
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+      "license": "MIT"
+    },
+    "node_modules/body-parser": {
+      "version": "1.20.5",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
+      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "content-type": "~1.0.5",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "~1.2.0",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "on-finished": "~2.4.1",
+        "qs": "~6.15.1",
+        "raw-body": "~2.5.3",
+        "type-is": "~1.6.18",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
+      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
+      "license": "MIT"
+    },
+    "node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "license": "MIT"
+    },
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "license": "MIT"
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/express": {
+      "version": "4.22.2",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
+      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "accepts": "~1.3.8",
+        "array-flatten": "1.1.1",
+        "body-parser": "~1.20.5",
+        "content-disposition": "~0.5.4",
+        "content-type": "~1.0.4",
+        "cookie": "~0.7.1",
+        "cookie-signature": "~1.0.6",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "~1.3.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.0",
+        "merge-descriptors": "1.0.3",
+        "methods": "~1.1.2",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "~0.1.12",
+        "proxy-addr": "~2.0.7",
+        "qs": "~6.15.1",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.2.1",
+        "send": "~0.19.0",
+        "serve-static": "~1.16.2",
+        "setprototypeof": "1.2.0",
+        "statuses": "~2.0.1",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/finalhandler": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
+      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.4.1",
+        "parseurl": "~1.3.3",
+        "statuses": "~2.0.2",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
+      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "license": "MIT",
+      "dependencies": {
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "license": "MIT",
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "license": "MIT"
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+      "license": "MIT"
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "license": "MIT",
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "side-channel": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "2.5.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.4.24",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/send": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
+      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
+        "mime": "1.6.0",
+        "ms": "2.1.3",
+        "on-finished": "~2.4.1",
+        "range-parser": "~1.2.1",
+        "statuses": "~2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/send/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/serve-static": {
+      "version": "1.16.3",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
+      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "~2.0.0",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "~0.19.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "license": "ISC"
+    },
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-list": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.4"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    }
+  }
+}
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..28f2bd7
--- /dev/null
+++ b/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "4square-agentabrams",
+  "version": "0.1.0",
+  "private": true,
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js"
+  },
+  "dependencies": {
+    "express": "^4.19.2"
+  }
+}
diff --git a/public/index.html b/public/index.html
new file mode 100644
index 0000000..480b5c0
--- /dev/null
+++ b/public/index.html
@@ -0,0 +1,348 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+  <title>4Square — Agent Abrams</title>
+  <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Playfair+Display:wght@400;700&family=Inter:wght@400;500;600&display=swap">
+  <style>
+    :root {
+      --bg: #0e0d0b;
+      --card: #19181640;
+      --rule: #2a2825;
+      --fg: #f3ecdd;
+      --muted: #9d9586;
+      --accent: #d9b14e;
+      --font-display: 'Playfair Display', serif;
+      --font-ui: 'Inter', system-ui, sans-serif;
+      --rad: 14px;
+      --slot-gap: 18px;
+    }
+    * { box-sizing: border-box; }
+    html, body { margin: 0; background: var(--bg); color: var(--fg); font-family: var(--font-ui); }
+    body { min-height: 100vh; }
+    header.top {
+      display: flex; align-items: center; justify-content: space-between;
+      padding: 14px 22px; border-bottom: 1px solid var(--rule);
+      background: linear-gradient(180deg, #1c1a17 0%, #14130f 100%);
+    }
+    header.top h1 {
+      font-family: var(--font-display); margin: 0;
+      font-size: 1.45rem; letter-spacing: 0.01em;
+      color: var(--accent);
+    }
+    header.top .sub { color: var(--muted); font-size: 0.82rem; letter-spacing: 0.06em; text-transform: uppercase; }
+    header .save-status { color: var(--muted); font-size: 0.75rem; }
+    header .save-status.flash { color: var(--accent); }
+
+    .app { display: grid; grid-template-columns: 320px 1fr; gap: 18px; padding: 18px; min-height: calc(100vh - 60px); }
+
+    /* Rail — draggable tile catalog */
+    aside.rail {
+      background: var(--card); border: 1px solid var(--rule); border-radius: var(--rad);
+      padding: 14px; display: flex; flex-direction: column; gap: 10px; min-height: 0;
+    }
+    aside.rail h2 { font-family: var(--font-display); margin: 0 0 4px; font-size: 1.05rem; }
+    aside.rail .controls { display: flex; flex-direction: column; gap: 6px; }
+    aside.rail input, aside.rail select {
+      background: #100f0d; color: var(--fg); border: 1px solid var(--rule); border-radius: 8px;
+      padding: 7px 10px; font: 0.85rem var(--font-ui);
+    }
+    aside.rail .meta { color: var(--muted); font-size: 0.72rem; }
+    .tile-list { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; overflow-y: auto; padding-right: 4px; flex: 1 1 auto; }
+    .tile {
+      aspect-ratio: 1/1.15; background: #100f0d; border: 1px solid var(--rule); border-radius: 10px;
+      overflow: hidden; cursor: grab; position: relative; user-select: none;
+      transition: border-color 0.15s ease, transform 0.15s ease;
+    }
+    .tile:active { cursor: grabbing; }
+    .tile.dragging { opacity: 0.4; }
+    .tile img { width: 100%; height: 100%; object-fit: cover; display: block; }
+    .tile .tile-label {
+      position: absolute; left: 0; right: 0; bottom: 0; padding: 5px 7px;
+      font: 600 0.65rem var(--font-ui); color: #fff; line-height: 1.1;
+      background: linear-gradient(180deg, transparent 0%, rgba(0,0,0,0.78) 100%);
+      letter-spacing: 0.02em; text-transform: uppercase;
+    }
+
+    /* 2×2 board */
+    main.board { display: grid; grid-template-columns: 1fr 1fr; grid-template-rows: 1fr 1fr; gap: var(--slot-gap); min-height: 0; }
+    .slot {
+      position: relative; background: #131210; border: 2px dashed var(--rule); border-radius: var(--rad);
+      overflow: hidden; min-height: 240px; transition: border-color 0.15s ease, background 0.15s ease;
+    }
+    .slot.empty::after {
+      content: attr(data-empty-label); position: absolute; inset: 0;
+      display: flex; align-items: center; justify-content: center;
+      color: var(--muted); font: 600 0.85rem var(--font-ui); letter-spacing: 0.16em; text-transform: uppercase;
+      pointer-events: none;
+    }
+    .slot.over { border-color: var(--accent); background: #1a1714; }
+    .slot.filled { border-style: solid; border-color: var(--rule); cursor: grab; }
+    .slot.filled:active { cursor: grabbing; }
+    .slot.dragging-source { opacity: 0.5; }
+    .slot img { width: 100%; height: 100%; object-fit: cover; display: block; }
+    .slot .badge {
+      position: absolute; top: 8px; left: 8px;
+      background: rgba(20, 18, 15, 0.85); color: var(--accent);
+      font: 700 0.65rem var(--font-ui); letter-spacing: 0.1em;
+      padding: 3px 8px; border-radius: 999px; backdrop-filter: blur(6px);
+    }
+    .slot .info {
+      position: absolute; left: 0; right: 0; bottom: 0; padding: 10px 14px;
+      background: linear-gradient(180deg, transparent 0%, rgba(0,0,0,0.85) 100%);
+      font-family: var(--font-display); color: #fff; font-size: 0.95rem;
+    }
+    .slot .info .by { font: 0.72rem var(--font-ui); color: var(--muted); margin-top: 2px; }
+    .slot .clear {
+      position: absolute; top: 8px; right: 8px;
+      background: rgba(20, 18, 15, 0.85); color: var(--fg); border: 1px solid var(--rule);
+      width: 26px; height: 26px; border-radius: 999px; cursor: pointer;
+      display: none; align-items: center; justify-content: center; font-size: 1rem; line-height: 1;
+    }
+    .slot.filled .clear { display: flex; }
+    .slot .clear:hover { background: #d44; color: #fff; }
+
+    @media (max-width: 880px) {
+      .app { grid-template-columns: 1fr; padding: 12px; gap: 14px; }
+      main.board { grid-template-columns: 1fr 1fr; }
+      aside.rail { max-height: 50vh; }
+    }
+
+    button.action {
+      background: transparent; color: var(--fg); border: 1px solid var(--rule);
+      padding: 7px 14px; border-radius: 8px; cursor: pointer; font: 600 0.78rem var(--font-ui);
+      letter-spacing: 0.05em;
+    }
+    button.action:hover { border-color: var(--accent); color: var(--accent); }
+  </style>
+</head>
+<body>
+  <header class="top">
+    <div>
+      <h1>4Square</h1>
+      <div class="sub">Agent Abrams · drag a piece into a square</div>
+    </div>
+    <div style="display:flex;align-items:center;gap:14px">
+      <span class="save-status" id="save-status">layout autosaves to this browser</span>
+      <button class="action" id="reset-all" title="Clear all four squares">Reset all</button>
+    </div>
+  </header>
+
+  <div class="app">
+    <aside class="rail">
+      <h2>Catalog</h2>
+      <div class="controls">
+        <input id="q" type="search" placeholder="Search title, artist, era…" autocomplete="off">
+        <select id="artist"><option value="">All artists</option></select>
+      </div>
+      <div class="meta" id="rail-meta">loading…</div>
+      <div class="tile-list" id="tiles"></div>
+    </aside>
+
+    <main class="board" id="board">
+      <div class="slot empty" data-slot="1" data-empty-label="1"></div>
+      <div class="slot empty" data-slot="2" data-empty-label="2"></div>
+      <div class="slot empty" data-slot="3" data-empty-label="3"></div>
+      <div class="slot empty" data-slot="4" data-empty-label="4"></div>
+    </main>
+  </div>
+
+  <script>
+    const STORAGE_KEY = '4square.agentabrams.layout.v1';
+
+    // ── persisted state ──────────────────────────────────────────────
+    let layout = loadLayout();
+
+    function loadLayout() {
+      try {
+        const raw = localStorage.getItem(STORAGE_KEY);
+        if (!raw) return { 1: null, 2: null, 3: null, 4: null };
+        const parsed = JSON.parse(raw);
+        return { 1: parsed[1] || null, 2: parsed[2] || null, 3: parsed[3] || null, 4: parsed[4] || null };
+      } catch { return { 1: null, 2: null, 3: null, 4: null }; }
+    }
+    function saveLayout() {
+      try {
+        localStorage.setItem(STORAGE_KEY, JSON.stringify(layout));
+        flashSaved();
+      } catch (e) {
+        document.getElementById('save-status').textContent = 'autosave failed: ' + e.message;
+      }
+    }
+    function flashSaved() {
+      const el = document.getElementById('save-status');
+      el.textContent = 'saved ✓';
+      el.classList.add('flash');
+      clearTimeout(flashSaved._t);
+      flashSaved._t = setTimeout(() => {
+        el.classList.remove('flash');
+        el.textContent = 'layout autosaves to this browser';
+      }, 1200);
+    }
+
+    // ── render slots ─────────────────────────────────────────────────
+    const board = document.getElementById('board');
+    function renderSlots() {
+      board.querySelectorAll('.slot').forEach(slot => {
+        const n = slot.dataset.slot;
+        const item = layout[n];
+        slot.innerHTML = '';
+        slot.classList.toggle('filled', !!item);
+        slot.classList.toggle('empty', !item);
+        slot.setAttribute('draggable', item ? 'true' : 'false');
+        if (item) {
+          const img = document.createElement('img');
+          img.src = item.imageProxy;
+          img.alt = item.title || '';
+          img.loading = 'lazy';
+          const badge = document.createElement('span');
+          badge.className = 'badge';
+          badge.textContent = '#' + n;
+          const info = document.createElement('div');
+          info.className = 'info';
+          info.innerHTML = '<div>' + escapeHtml(item.title || 'Untitled') + '</div>' +
+            '<div class="by">' + escapeHtml(item.artist || '') + (item.year ? ' · ' + item.year : '') + '</div>';
+          const clear = document.createElement('button');
+          clear.className = 'clear'; clear.title = 'Clear this square'; clear.textContent = '×';
+          clear.addEventListener('click', (e) => {
+            e.stopPropagation();
+            layout[n] = null; saveLayout(); renderSlots();
+          });
+          slot.append(img, badge, info, clear);
+        }
+      });
+    }
+
+    function escapeHtml(s) {
+      return String(s).replace(/[&<>"']/g, c => ({ '&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;' }[c]));
+    }
+
+    // ── drag/drop wiring ─────────────────────────────────────────────
+    // Tile -> slot OR slot -> slot. Data payload format: { kind: 'tile'|'slot', payload }
+    function attachSlotDnD() {
+      board.querySelectorAll('.slot').forEach(slot => {
+        slot.addEventListener('dragstart', (e) => {
+          const n = slot.dataset.slot;
+          if (!layout[n]) { e.preventDefault(); return; }
+          e.dataTransfer.effectAllowed = 'move';
+          e.dataTransfer.setData('application/x-4sq', JSON.stringify({ kind: 'slot', from: n }));
+          slot.classList.add('dragging-source');
+        });
+        slot.addEventListener('dragend', () => slot.classList.remove('dragging-source'));
+        slot.addEventListener('dragover', (e) => {
+          e.preventDefault();
+          e.dataTransfer.dropEffect = 'move';
+          slot.classList.add('over');
+        });
+        slot.addEventListener('dragleave', () => slot.classList.remove('over'));
+        slot.addEventListener('drop', (e) => {
+          e.preventDefault();
+          slot.classList.remove('over');
+          const raw = e.dataTransfer.getData('application/x-4sq');
+          if (!raw) return;
+          let payload;
+          try { payload = JSON.parse(raw); } catch { return; }
+          const target = slot.dataset.slot;
+          if (payload.kind === 'tile') {
+            layout[target] = payload.item;
+          } else if (payload.kind === 'slot') {
+            const from = payload.from;
+            if (from === target) return;
+            const tmp = layout[target];
+            layout[target] = layout[from];
+            layout[from] = tmp;  // swap (tmp may be null = move)
+          }
+          saveLayout();
+          renderSlots();
+        });
+      });
+    }
+    attachSlotDnD();
+    renderSlots();
+
+    // ── catalog rail ─────────────────────────────────────────────────
+    const $q = document.getElementById('q');
+    const $artist = document.getElementById('artist');
+    const $tiles = document.getElementById('tiles');
+    const $meta = document.getElementById('rail-meta');
+
+    let railItems = [];
+    let lastQueryToken = 0;
+    async function fetchRail() {
+      const token = ++lastQueryToken;
+      $meta.textContent = 'loading…';
+      const params = new URLSearchParams();
+      if ($q.value) params.set('q', $q.value);
+      if ($artist.value) params.set('artist', $artist.value);
+      params.set('limit', '60');
+      try {
+        const r = await fetch('/api/catalog/search?' + params.toString());
+        const j = await r.json();
+        if (token !== lastQueryToken) return; // a newer query already fired
+        railItems = j.items || [];
+        $meta.textContent = `${railItems.length} of ${(j.total || railItems.length).toLocaleString()} pieces`;
+        renderRail();
+      } catch (e) {
+        $meta.textContent = 'load failed: ' + e.message;
+      }
+    }
+    function renderRail() {
+      $tiles.innerHTML = '';
+      for (const it of railItems) {
+        const div = document.createElement('div');
+        div.className = 'tile';
+        div.draggable = true;
+        const imageProxy = '/img?path=' + encodeURIComponent(it.image_url || it.image || '');
+        const lite = {
+          id: it.id, title: it.title, artist: it.artist, year: it.year, era: it.era,
+          imageProxy,
+        };
+        div.dataset.item = JSON.stringify(lite);
+        const img = document.createElement('img');
+        img.src = imageProxy;
+        img.loading = 'lazy';
+        img.alt = it.title || '';
+        const label = document.createElement('div');
+        label.className = 'tile-label';
+        label.textContent = it.artist || it.title || '—';
+        div.append(img, label);
+        div.addEventListener('dragstart', (e) => {
+          e.dataTransfer.effectAllowed = 'copy';
+          e.dataTransfer.setData('application/x-4sq', JSON.stringify({ kind: 'tile', item: lite }));
+          div.classList.add('dragging');
+        });
+        div.addEventListener('dragend', () => div.classList.remove('dragging'));
+        // Click-to-place fallback for touch / accessibility: place into first empty slot.
+        div.addEventListener('dblclick', () => {
+          for (const n of ['1','2','3','4']) {
+            if (!layout[n]) { layout[n] = lite; saveLayout(); renderSlots(); return; }
+          }
+        });
+        $tiles.appendChild(div);
+      }
+    }
+
+    async function fetchArtists() {
+      try {
+        const r = await fetch('/api/catalog/artists');
+        const j = await r.json();
+        const opts = (j.artists || []).map(a => `<option value="${escapeHtml(a)}">${escapeHtml(a)}</option>`).join('');
+        $artist.insertAdjacentHTML('beforeend', opts);
+      } catch {}
+    }
+    let qDebounce;
+    $q.addEventListener('input', () => { clearTimeout(qDebounce); qDebounce = setTimeout(fetchRail, 220); });
+    $artist.addEventListener('change', fetchRail);
+
+    document.getElementById('reset-all').addEventListener('click', () => {
+      if (!confirm('Clear all 4 squares?')) return;
+      layout = { 1: null, 2: null, 3: null, 4: null };
+      saveLayout(); renderSlots();
+    });
+
+    fetchArtists();
+    fetchRail();
+  </script>
+</body>
+</html>
diff --git a/server.js b/server.js
new file mode 100644
index 0000000..94f5bdc
--- /dev/null
+++ b/server.js
@@ -0,0 +1,102 @@
+// 4square.agentabrams.com — 2x2 design-showroom layout tool.
+// Drag tiles from the rail into one of 4 squares; layout persists in localStorage.
+// Image source is The Set Decorator catalog (proxied so no CORS).
+
+const express = require('express');
+const path = require('path');
+const http = require('http');
+const https = require('https');
+
+const PORT = parseInt(process.env.PORT || '9702', 10);
+const AUTH_USER = process.env.BASIC_AUTH_USER || 'admin';
+const AUTH_PASS = process.env.BASIC_AUTH_PASS || 'DWShowroom2026';
+const UPSTREAM = (process.env.CATALOG_UPSTREAM || 'https://thesetdecorator.com').replace(/\/$/, '');
+
+const app = express();
+
+// ── /health (NOT auth-gated, used by deploy.sh smoke test) ────────────────
+app.get('/health', (_req, res) => res.json({ ok: true, ts: new Date().toISOString() }));
+
+// ── Basic Auth gate (everything below this) ───────────────────────────────
+app.use((req, res, next) => {
+  const hdr = req.headers.authorization || '';
+  if (!hdr.startsWith('Basic ')) {
+    res.set('WWW-Authenticate', 'Basic realm="4Square Agent Abrams"');
+    return res.status(401).send('Authentication required');
+  }
+  let decoded;
+  try { decoded = Buffer.from(hdr.slice(6), 'base64').toString('utf8'); }
+  catch { return res.status(400).send('Bad auth header'); }
+  const idx = decoded.indexOf(':');
+  if (idx < 0) return res.status(400).send('Bad auth header');
+  const u = decoded.slice(0, idx);
+  const p = decoded.slice(idx + 1);
+  // Constant-time compare via crypto.timingSafeEqual when lengths match.
+  const crypto = require('crypto');
+  const uOK = u.length === AUTH_USER.length && crypto.timingSafeEqual(Buffer.from(u), Buffer.from(AUTH_USER));
+  const pOK = p.length === AUTH_PASS.length && crypto.timingSafeEqual(Buffer.from(p), Buffer.from(AUTH_PASS));
+  if (uOK && pOK) return next();
+  res.set('WWW-Authenticate', 'Basic realm="4Square Agent Abrams"');
+  return res.status(401).send('Invalid credentials');
+});
+
+// ── Catalog proxy → TSD ───────────────────────────────────────────────────
+// Frontend calls /api/catalog/search?... → we forward to thesetdecorator.com.
+// We also proxy /img/?path=<upstream-path> for image bytes so the browser
+// loads everything from this domain (no third-party-cookie / CORS surprises).
+function proxyJson(req, res, upstreamPath) {
+  const url = new URL(UPSTREAM + upstreamPath);
+  const lib = url.protocol === 'https:' ? https : http;
+  const upstream = lib.request({
+    method: 'GET',
+    hostname: url.hostname,
+    port: url.port || (url.protocol === 'https:' ? 443 : 80),
+    path: url.pathname + url.search,
+    headers: { 'User-Agent': '4square-agentabrams/0.1', 'Accept': 'application/json' },
+  }, (r) => {
+    res.status(r.statusCode || 502);
+    // Pass content-type through; default to JSON.
+    res.set('Content-Type', r.headers['content-type'] || 'application/json');
+    r.pipe(res);
+  });
+  upstream.on('error', (e) => res.status(502).json({ ok: false, error: 'upstream ' + e.message }));
+  upstream.end();
+}
+
+app.get('/api/catalog/search', (req, res) => {
+  const q = req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '';
+  proxyJson(req, res, '/api/catalog/search' + q);
+});
+app.get('/api/catalog/artists', (req, res) => {
+  proxyJson(req, res, '/api/catalog/artists');
+});
+
+// Image bytes — explicit path param so we don't accidentally proxy arbitrary URLs.
+app.get('/img', (req, res) => {
+  const p = String(req.query.path || '');
+  // Allow ONLY upstream-relative paths under /api/art-archive/photos/<digit>/image/<size>.
+  if (!/^\/api\/art-archive\/photos\/\d+\/image\/(thumb|medium|preview)$/.test(p)) {
+    return res.status(400).send('bad path');
+  }
+  const url = new URL(UPSTREAM + p);
+  const lib = url.protocol === 'https:' ? https : http;
+  const upstream = lib.request({
+    method: 'GET',
+    hostname: url.hostname,
+    port: url.port || (url.protocol === 'https:' ? 443 : 80),
+    path: url.pathname,
+    headers: { 'User-Agent': '4square-agentabrams/0.1' },
+  }, (r) => {
+    res.status(r.statusCode || 502);
+    if (r.headers['content-type']) res.set('Content-Type', r.headers['content-type']);
+    res.set('Cache-Control', 'public, max-age=86400');
+    r.pipe(res);
+  });
+  upstream.on('error', (e) => res.status(502).send('upstream ' + e.message));
+  upstream.end();
+});
+
+// ── Static frontend ───────────────────────────────────────────────────────
+app.use(express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));
+
+app.listen(PORT, () => console.log(`[4square-agentabrams] http://127.0.0.1:${PORT}`));

(oldest)  ·  back to 4square Agentabrams  ·  v2 layout — site nav rail + adjustable-width product browser 2c34d92 →