improved a lot of things

packages/app/src/app/page.tsx

@@ -1,9 +1,8 @@
+import { redirect } from 'next/navigation';
+
+// The marketing site lives at /marketing.html (static file in /public).
+// The Clerk middleware will intercept any unauthenticated visit to /canvas
+// and redirect to /sign-in, so we simply send everyone to the marketing page.
 export default function Home() {
-  return (
-    <main style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', height: '100%' }}>
-      <p style={{ fontFamily: 'system-ui, sans-serif', color: '#888', fontSize: '0.875rem' }}>
-        Originmain — coming soon
-      </p>
-    </main>
-  );
+  redirect('/marketing.html');
 }

packages/app/src/app/sign-in/[[...sign-in]]/page.tsx

@@ -0,0 +1,9 @@
+import { SignIn } from '@clerk/nextjs';
+
+export default function SignInPage() {
+  return (
+    <main style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', minHeight: '100vh' }}>
+      <SignIn />
+    </main>
+  );
+}

packages/app/src/app/sign-up/[[...sign-up]]/page.tsx

@@ -0,0 +1,9 @@
+import { SignUp } from '@clerk/nextjs';
+
+export default function SignUpPage() {
+  return (
+    <main style={{ display: 'flex', alignItems: 'center', justifyContent: 'center', minHeight: '100vh' }}>
+      <SignUp />
+    </main>
+  );
+}

packages/app/src/middleware.ts

@@ -1,10 +1,25 @@
-import { clerkMiddleware } from '@clerk/nextjs/server';
+import { clerkMiddleware, createRouteMatcher } from '@clerk/nextjs/server';
 
-export default clerkMiddleware();
+// Routes that do NOT require a Clerk session.
+// • /sign-in and /sign-up — Clerk's own auth UI
+// • /api/webhooks/* — carrier-level HMAC auth (Linear, Slack, GitHub, Intercom)
+// • /api/agent-bridge — workspace Bearer-token auth issued to Cursor / Claude Code
+const isPublicRoute = createRouteMatcher([
+  '/sign-in(.*)',
+  '/sign-up(.*)',
+  '/api/webhooks(.*)',
+  '/api/agent-bridge(.*)',
+]);
+
+export default clerkMiddleware(async (auth, req) => {
+  if (!isPublicRoute(req)) {
+    await auth.protect();
+  }
+});
 
 export const config = {
   matcher: [
-    // Skip Next.js internals and all static files
+    // Skip Next.js internals and all static files (html, css, images, fonts…)
     '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)',
     // Always run for API routes
     '/(api|trpc)(.*)',