fedipod-server 0.14.0 → 0.15.0

package/lib/client/masto/index.mjs

@@ -78,7 +78,12 @@ export class MastoApi {
     });
     return this._push;
   }
-  get host() { return this.urls ? new URL(this.urls.base).host : 'unconfigured.invalid'; }
+  // The host in the owner's own address: the gateway's when the identity is
+  // fronted (its documents still live on the pod, but its name does not).
+  get host() {
+    if (!this.urls) return 'unconfigured.invalid';
+    return new URL(this.urls.publicHome || this.urls.base).host;
+  }
 
   // Where the live feed is, as the CLIENT must address it: this agent's own
   // origin, taken from the request, not the pod's host. An instance document

package/lib/core/intake/activities.mjs

@@ -197,7 +197,7 @@ export async function onUndo(intake, activity, actor, { trusted = false } = {})
   intake.log(`unfollowed by ${actor}`);
 }
 
-export async function onCreate(intake, activity, actor) {
+export async function onCreate(intake, activity, actor, { trusted = false } = {}) {
   const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
   if (!objectId) return 'Create without object id';
   if (intake.store.isBlocked(objectId)) return `blocked domain (${objectId})`;
@@ -219,7 +219,15 @@ export async function onCreate(intake, activity, actor) {
   const ingested = intake.store.getStatuses()
     .some(x => x.noteId === objectId && (x.kind === 'timeline' || x.kind === 'mention'));
   if (!ingested) {
-    const rejected = await intake.ingestNote(objectId, actor);
+    // A verified delivery that carries the note inline is read from that
+    // copy: the door checked the sender's signature over these very bytes,
+    // and the receipt vouches for this actor. That is the only way a direct
+    // or followers-only post can ever be read — it lives in the sender's
+    // owner-only container, and fetching it from there answers 401 to
+    // everyone. An unverified delivery still fetches, as it always did.
+    const inline = trusted && typeof activity.object === 'object' && activity.object?.id === objectId
+      ? activity.object : null;
+    const rejected = await intake.ingestNote(objectId, actor, { inline });
     if (rejected) return rejected;
   }
   // A group carries its members' posts onward. Only reached from Create, so an

package/lib/core/intake/index.mjs

@@ -539,7 +539,7 @@ export class Intake {
     switch (activity.type) {
       case 'Follow': return this.onFollow(activity, actor, { trusted });
       case 'Undo': return this.onUndo(activity, actor, { trusted });
-      case 'Create': return this.onCreate(activity, actor);
+      case 'Create': return this.onCreate(activity, actor, { trusted });
       case 'Accept': return this.onAccept(activity, actor, { trusted });
       case 'Like': case 'Announce': {
         // FEP-1b12: a group Announces the member's whole Create, not the note.

package/lib/core/intake/notes.mjs

@@ -114,8 +114,10 @@ export function referencesOurObject(intake, activity) {
 // Shared tail of Create/Announce: deref the note at its origin (never trust
 // the delivered copy), mirror it into pod RDF + statuses, notify on replies
 // to our own notes. Returns a rejection reason string, or undefined.
-export async function ingestNote(intake, objectId, actor, { via } = {}) {
-  const note = await intake.fetchAP(objectId);
+export async function ingestNote(intake, objectId, actor, { via, inline = null } = {}) {
+  // `inline` is the note as delivered, offered only for a delivery whose
+  // signature the door verified (onCreate); otherwise the origin's copy.
+  const note = inline || await intake.fetchAP(objectId);
   if (!note) return `object fetch failed (${objectId})`;
   if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
   const { attachmentsOf, titledContent } = await import('../wire.mjs');

package/lib/core/social.mjs

@@ -15,7 +15,14 @@ import { dropFollower } from './store.mjs';
 // belongs behind the same SSRF guard as every other outbound request. fedify's
 // lookup did not go through ours. https only, because a handle resolved over
 // plaintext is a handle anyone on the path can answer for.
-export async function lookupWebFinger(acct) {
+//
+// `fetchImpl`, when given, makes the request instead of safeFetch: the agent's
+// own remote read, which in the browser build is the relay — a server-side
+// fetch, so the lookup does not depend on the far pod host answering a
+// browser's cross-origin request. Every other remote read there goes the
+// same way; WebFinger went direct and was the one lookup that could fail
+// while the rest worked.
+export async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
   const clean = String(acct || '').replace(/^acct:/, '');
   const at = clean.lastIndexOf('@');
   if (at < 1) return null;
@@ -23,9 +30,8 @@ export async function lookupWebFinger(acct) {
   if (!host || /[/\\?#]/.test(host)) return null;
   const { safeFetch, readCapped } = await import('../shared/safefetch.mjs');
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const res = await safeFetch(url, {
-    headers: { accept: 'application/jrd+json, application/json' },
-  }).catch(() => null);
+  const headers = { accept: 'application/jrd+json, application/json' };
+  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch(url, { headers })).catch(() => null);
   if (!res || res.status >= 400) return null;
   let jrd;
   try { jrd = JSON.parse(await readCapped(res, 256 * 1024)); } catch { return null; }
@@ -80,13 +86,18 @@ export async function resolveHandle(agent, handle) {
   const clean = String(handle || '').replace(/^@/, '');
   if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error('handle must look like user@host');
   if (agent.store.isBlocked('https://' + clean.split('@')[1] + '/')) throw new Error('domain is blocked');
-  const jrd = await lookupWebFinger('acct:' + clean);
+  // Through the agent's own remote read where it has one — the relay, in the
+  // browser build — and directly otherwise.
+  const remote = agent.intake?.deliverer?.signedFetch
+    ? (u, i) => agent.intake.deliverer.signedFetch(u, i) : null;
+  const lookup = (a) => lookupWebFinger(a, { fetchImpl: remote });
+  const jrd = await lookup('acct:' + clean);
   const self = selfLink(jrd);
   if (!self?.href) throw new Error(`webfinger found no actor for ${clean}`);
   const doc = await agent.intake.fetchAP(self.href);
   if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
   if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc);
+  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc, lookup);
   // Counts live in the collections, not the actor document, so a client asking
   // "who is this" would otherwise be told everyone has none. Two GETs, and only
   // when someone asked by name — never on the drain path.

package/lib/core/wire.mjs

@@ -49,9 +49,10 @@ export function hostMeta(base) {
   return `<?xml version="1.0" encoding="UTF-8"?>\n<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">\n  <Link rel="lrdd" template="${base}.well-known/webfinger?resource={uri}"/>\n</XRD>\n`;
 }
 
-export function jrd({ handle, host, actor }) {
+export function jrd({ handle, host, actor, aliases = [] }) {
   return {
     subject: `acct:${handle}@${host}`,
+    ...(aliases.length ? { aliases } : {}),
     links: [{ rel: 'self', type: 'application/activity+json', href: actor }],
   };
 }

package/lib/gateway/front-core.mjs

@@ -25,8 +25,9 @@ import * as podPolicy from '../pod/policy.mjs';
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
 // friends), which a serverless front must never carry — it crashed the
 // deployed function before it answered its first request.
-const jrd = ({ handle, host, actor }) => ({
+const jrd = ({ handle, host, actor, aliases = [] }) => ({
   subject: `acct:${handle}@${host}`,
+  ...(aliases.length ? { aliases } : {}),
   links: [{ rel: 'self', type: 'application/activity+json', href: actor }],
 });
 
@@ -429,7 +430,14 @@ async function route(request, ctx) {
     // Re-attaching your own pod — a retry, a re-provision, a second browser — is
     // idempotent: it updates the row in place and keeps the same door secret.
     const prior = await ctx.lookup(key);
-    if (prior && prior.podHome !== podHome) return j(409, { error: 'that name is taken' });
+    // The same account on the same pod may correct where its tree lives — a
+    // row made by an older sign-up named the pod root, and every delivery
+    // to it was written where nothing reads. A different pod is still taken.
+    const sameOwner = (a, b) => { try { return new URL(a).origin === new URL(b).origin; } catch { return false; } };
+    if (prior && prior.podHome !== podHome
+      && !(prior.webId && prior.webId === webid && sameOwner(prior.podHome, podHome))) {
+      return j(409, { error: 'that name is taken' });
+    }
     // Re-attaching is idempotent — a retry, a re-provision, a second browser —
     // and it hands back the EXISTING receipt secret. So it has to be the same
     // person: matching podHome was enough on a subdomain server and, on a
@@ -573,7 +581,11 @@ async function route(request, ctx) {
     if (!m || m[2] !== ctx.host) return notFound();
     const rec = await ctx.lookup(m[1]);
     if (!rec) return notFound();
-    return j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl }),
+    // A fronted identity's documents live on its pod; the pod's own actor id
+    // is the alias, so a client signing in by the fronted address can find
+    // the pod (and its login) without a lookup only the host could answer.
+    const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
+    return j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor }),
       'application/jrd+json');
   }
 
@@ -600,6 +612,13 @@ async function route(request, ctx) {
   // fixed to the front so a consumer cross-checks it consistently.
   if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
   const podTarget = rec.podHome + up.rest;
+  // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
+  // the id rewrite below turns media links onto the front like every other
+  // pod url in a document. Answer those by pointing at the pod: bytes are not
+  // a document to cap and relabel, and remotes follow a redirect for a picture.
+  if (up.rest.startsWith('ap/media/')) {
+    return { status: 302, headers: { location: podTarget, 'cache-control': 'no-store' }, body: '' };
+  }
   // The pod this read belongs to travels with it: an adapter reading a store
   // directly (the CSS server component) has no access control of its own and
   // needs to be told what it may reach. See podHomeProblem above for the other

package/lib/pod/inbox.mjs

@@ -22,10 +22,13 @@ const RECEIPT_CT = 'application/json';
  *
  * @returns {Promise<boolean>} whether it landed
  */
-export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch } = {}) {
+export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null } = {}) {
   const headers = { 'content-type': contentType,
     ...(appendToken ? { authorization: `Bearer ${appendToken}` } : {}) };
   const r = await fetchImpl(url, { method: 'PUT', headers, body }).catch(() => null);
+  // The pod's answer, for a caller that keeps a log: a refused write is
+  // otherwise a bare "failed" with the status thrown away.
+  report?.(r ? r.status : 0);
   return !!r && r.status < 400;
 }
 

package/lib/pod/root.mjs

@@ -39,6 +39,33 @@ export async function readOwnerLinks(fetchImpl, podBase, { timeoutMs = OWNER_LOO
  *
  * ---- asked by: a provisioning client, about a pod the person brought ----
  */
+/**
+ * Where a provider puts its pods: on hosts of their own, or on paths of one
+ * shared host. No spec says. What does say is the storage description at the
+ * provider's root: a CSS that keeps pods on subdomains answers 501 there,
+ * because its root is not a storage; one that keeps them on paths answers 200
+ * with the root described as a storage. Anything else is unknown.
+ *
+ * Decides, at sign-up, whether the address can live on the pod at all: a pod
+ * on a path shares its host, so nothing there answers WebFinger for it.
+ *
+ * @returns 'host' | 'path' | null
+ */
+export async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  let origin;
+  try { origin = new URL(providerOrigin).origin; } catch { return null; }
+  let res;
+  try {
+    res = await fetchImpl(`${origin}/.well-known/solid`,
+      { headers: { accept: 'text/turtle' }, signal: AbortSignal.timeout(timeoutMs) });
+  } catch { return null; }
+  if (res.status === 501) return 'host';
+  if (res.status !== 200) return null;
+  let body = '';
+  try { body = await readCapped(res, 64 * 1024); } catch { return null; }
+  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? 'path' : null;
+}
+
 export async function probeAnswers(podUrl, fetchImpl = fetch) {
   try {
     const res = await fetchImpl(podUrl, { method: 'HEAD' });

package/lib/pod/transport.mjs

@@ -334,9 +334,14 @@ export class PodTransport {
   }
 
   async setAcl(targetUrl, publicModes, opts = {}) {
-    const url = await this.aclUrlFor(targetUrl);
+    // The rule names the resource on the POD. A fronted identity hands in
+    // advertised urls; `fetch` maps the request, but a rule whose accessTo
+    // named the advertised url would guard a resource the pod does not have,
+    // and lock the real one to nobody — the owner included.
+    const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
+    const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(targetUrl, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
+    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
   }
 
   // Child documents of an LDP container (URLs under it, excluding aux docs).

package/lib/pod/urls.mjs

@@ -65,6 +65,20 @@ export function apUrls(remotePod, root, { publicBase = null } = {}) {
 // here. @name@host is looked up at https://host/.well-known/webfinger, so only
 // a pod that owns the root of its host can answer for one; a pod living at
 // https://server/name/ may publish the document but nothing will ever ask.
+/**
+ * The pod a WebID lives in: the URL up to the profile document's container.
+ * `https://alice.pod/profile/card#me` → `https://alice.pod/`, and on a shared
+ * host `https://server/alice/profile/card#me` → `https://server/alice/`. Taking
+ * the origin alone named the wrong pod for the second, which is every pod on a
+ * path.
+ */
+export function podBaseOfWebId(webId) {
+  const u = new URL(webId);
+  u.hash = ''; u.search = '';
+  const dir = u.pathname.replace(/profile\/card$/u, '').replace(/[^/]*$/u, '');
+  return `${u.origin}${dir.endsWith('/') ? dir : dir + '/'}`;
+}
+
 export function webfingerHost(podUrl) {
   const u = new URL(podUrl);
   return u.pathname === '/' ? u.host : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/web/app/README.md

@@ -73,5 +73,5 @@ See the `MastoApi` options in `agent.mjs`.
 | **Web push** | `shims/web-push.mjs` is a no-op. `vapid` is omitted, and a client that subscribes anyway gets a 422 rather than a subscription nothing will push to. |
 | **Scheduled posts** | nothing runs between now and the scheduled time. A `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
 | **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the installed agent. See `groups.md`. |
-| **A fronted `@you@front` handle** | the browser model is `@you@yourpod` with the gateway as a mail door. `admin-facade.mjs` refuses a fronted attach, and `stage-site.mjs` hides the radio that offered it. |
+| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a path of a shared host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
 | **Moving the private half** | `/state-move` is about filesystem paths and `credential.json`. A browser has neither; its private half is always on the pod. |

package/web/app/agent.mjs

@@ -17,7 +17,7 @@ import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
-import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
+import { importSigningKey, loadKeysFromPod, cacheOpenedKeys, podActorOf } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
 import { RelayDeliverer, doorKeyOf } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
@@ -25,7 +25,8 @@ import { BrowserAtproto } from './atproto-browser.mjs';
 import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
 import { BrowserFediAccounts } from './fediacct-browser.mjs';
 import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
-import { followActor, unfollowActor } from '../../lib/core/social.mjs';
+import { followActor, unfollowActor, resolveHandle } from '../../lib/core/social.mjs';
+import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { ImportWorker } from '../../lib/connections/import.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
@@ -159,7 +160,7 @@ export class BrowserAgent {
     if (oidc) {
       session = { fetch: (u, i) => oidc.fetch(u, i) };
       webId = oidc.webId;
-      remotePod = new URL(webId).origin + '/';
+      remotePod = podBaseOfWebId(webId);              // the pod, which on a shared host is a path
     } else {
       const dpop = await makeDpopSession(credential);
       session = { fetch: (u, i) => dpop.fetch(u, i) };
@@ -169,6 +170,8 @@ export class BrowserAgent {
     this.webId = webId;
     const root = (config && config.root) || 'fedipod/';
     this.remote = new BrowserRemotePod(session, { webId, log: this.log });
+    // Pod-native for now: the state store below is read with these, and only
+    // the config it holds says whether this identity is fronted.
     this.urls = apUrls(remotePod, root);
 
     // State store, on the pod.
@@ -189,9 +192,18 @@ export class BrowserAgent {
     // document it published landed under `activitypods-js/`. One root, decided
     // once, carried by the config everything downstream reads.
     this.store.setConfig({ ...(this.store.getConfig() || {}), ...cfg, root });
+    config = this.store.getConfig();
+    // A fronted identity (config.gateway.frontActor) advertises its ids at the
+    // gateway; the documents stay on the pod. Same three lines as the Node
+    // agent (run-agent.mjs connect): the advertised urls, and the map that
+    // turns an advertised url back into the pod one at the transport's single
+    // write and read choke point. State and media stay pod-native either way.
+    const publicBase = config.gateway?.frontActor
+      ? config.gateway.frontActor.replace(/ap\/actor\/?$/, '') : null;
+    this.urls = apUrls(remotePod, root, { publicBase });
+    if (this.urls.toPod) this.remote.setUrlMap(this.urls.toPod);
     // Keys: handed in (offline), or the owner-only keys.json read from the pod.
     const keys = keysRecord ? await importSigningKey(keysRecord) : await loadKeysFromPod(this.remote, this.urls);
-    config = this.store.getConfig();
 
 
     // `passive`: no queue-drain timer until this device is the active one.
@@ -212,6 +224,10 @@ export class BrowserAgent {
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,
+      // Who a post names, resolved — the same lookup the installed agent
+      // gives its publisher. Without it no mention from the browser ever
+      // resolved: a direct message went to nobody, a mention notified no one.
+      resolveMention: (h) => resolveHandle(this, h),
     });
 
     // The Bluesky connection, stamped to this actor. The same client the Node
@@ -366,7 +382,7 @@ export class BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;                  // one key, one actor (lib/keys.mjs)
     await podState.writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    const keys = await cacheOpenedKeys(this.urls.actor, rec);
+    const keys = await cacheOpenedKeys(podActorOf(this.urls), rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();

package/web/app/boot.mjs

@@ -12,6 +12,8 @@
 import { signUp, handleProblem, AP_ROOT } from './signup.mjs';
 import * as podActor from '../../lib/pod/actor.mjs';
 import * as podState from '../../lib/pod/state.mjs';
+import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
+import { podLayout } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
 import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
@@ -68,7 +70,7 @@ window.fedipodUnlock = async (password) => {
   if (!session) throw new Error('Sign in first.');
   // The config on the pod says where this account's state lives; the key sits
   // beside it. Both are read with the session, as the owner.
-  const podFromWebId = new URL(session.webId).origin + '/';
+  const podFromWebId = podBaseOfWebId(session.webId);   // a path on a shared host, or its own host
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
   // Through the transport rather than the bare session: this is a pod read
   // like any other, and going round it skipped the retry ladder that exists
@@ -112,21 +114,38 @@ export function parseAddress(input) {
 }
 async function issuerForPod(pod) {
   // The pod's actor says where a client signs in (oauthAuthorizationEndpoint's
-  // origin); failing that, the account provider is the pod host's parent domain.
+  // origin); failing that, the account provider is the pod host's parent
+  // domain for a subdomain pod, and the host itself for a pod on a path.
   try {
     const authz = await podActor.readIssuer(`${pod}${AP_ROOT}ap/actor`);
     if (authz) return new URL(authz).origin;
   } catch { /* fall through */ }
-  const host = new URL(pod).host;
-  const parent = host.split('.').slice(1).join('.');
-  return `https://${parent || host}`;
+  const u = new URL(pod);
+  if (u.pathname !== '/') return u.origin;
+  const parent = u.host.split('.').slice(1).join('.');
+  return `https://${parent || u.host}`;
+}
+// An address at this site names a fronted identity. Its documents live on a
+// pod this site's WebFinger names as an alias — the pod's own actor id.
+async function podForFrontedAddress(handle) {
+  const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
+    { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
+  const doc = await res.json().catch(() => ({}));
+  const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
+  if (!podActorId) throw new Error(`@${handle}@${location.host} lives here but names no pod to sign in to`);
+  const tail = `${AP_ROOT}ap/actor`;
+  if (!podActorId.endsWith(tail)) throw new Error(`the pod actor ${podActorId} is not where a FediPod pod keeps one`);
+  return podActorId.slice(0, -tail.length);
 }
 window.fedipodSignin = async ({ address }) => {
   const parsed = parseAddress(address);
   if (!parsed) throw new Error('Enter your address as @you@yourpod (for example @alice@alice.solidcommunity.net).');
   const bad = handleProblem(parsed.handle);
   if (bad) throw new Error(bad);
-  const pod = `https://${parsed.host}/`;
+  const pod = parsed.host === location.host.toLowerCase()
+    ? await podForFrontedAddress(parsed.handle)
+    : `https://${parsed.host}/`;
   const issuer = await issuerForPod(pod);
   const { authorizationUrl } = await beginLogin({ issuer, redirectUri: REDIRECT });
   location.href = authorizationUrl;
@@ -262,24 +281,61 @@ if (typeof document !== 'undefined') (async () => {
   // --- register form: two screens, pod first then Fediverse identity ---
   const f = () => $('form').elements;
   // The pod provider is a free-text URL; default and normalise to a scheme.
-  const providerUrl = () => { let v = f().provider.value.trim(); if (!v) v = 'https://solidcommunity.net'; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; return v; };
+  // The provider is picked from the list, or typed under "Other…".
+  const providerUrl = () => { let v = (f().provider.value || f().providerOther.value).trim(); if (!v) return ''; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; return v; };
   const providerHost = () => { try { return new URL(providerUrl()).host; } catch { return ''; } };
-  // The pod is always a subdomain of the provider, so both new and existing pods
-  // resolve to https://<subdomain>.<provider-host>/ and carry a host-root address.
+  // A new pod is named by its subdomain under the provider; an existing pod is
+  // brought by its address, which may be its own host or a path on a shared one.
   const podHostOf = () => { const sub = f().podName.value.trim().toLowerCase(); const ph = providerHost(); return (sub && ph) ? `${sub}.${ph}` : ''; };
+  const podUrl = () => { let v = f().pod.value.trim(); if (!v) return ''; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; if (!v.endsWith('/')) v += '/'; try { return new URL(v).href; } catch { return ''; } };
+  // A pod on a path of a shared host cannot answer WebFinger, so its address
+  // lives at this site; a pod at its own host root gets the choice.
+  const isPathPod = (u) => { try { return new URL(u).pathname !== '/'; } catch { return false; } };
+  // Where the chosen provider puts new pods, asked of the provider itself
+  // (lib/pod/root.mjs podLayout) and remembered per provider: 'host', 'path',
+  // or null when it would not say.
+  const layouts = new Map();
+  let layout = null;
+  const learnLayout = async () => {
+    const origin = providerHost() ? new URL(providerUrl()).origin : '';
+    if (!origin) { layout = null; return; }
+    if (!layouts.has(origin)) layouts.set(origin, podLayout(fetch, origin).catch(() => null));
+    const known = await layouts.get(origin);
+    if (providerHost() && new URL(providerUrl()).origin === origin) { layout = known; applyShape(); previewAddr(); }
+  };
+  const pathPod = () => (f().mode.value === 'existing' ? isPathPod(podUrl()) : layout === 'path');
+  const shape = () => (pathPod() ? 'front' : f().shape.value);
   const answers = () => {
     const mode = f().mode.value;
     const a = { mode, handle: f().handle.value.trim().toLowerCase(), email: f().email.value.trim(),
-      password: f().password.value, issuer: providerUrl() };
+      password: f().password.value, issuer: providerUrl(), shape: shape() };
     if (mode === 'new') a.podName = f().podName.value.trim().toLowerCase();
-    else a.pod = `https://${podHostOf()}/`;
+    else a.pod = podUrl();
     return a;
   };
   const previewAddr = () => {
-    const handle = f().handle.value.trim().toLowerCase(); const ph = podHostOf();
-    $('preview').textContent = (handle && ph) ? `@${handle}@${ph}` : '@…@…';
+    const handle = f().handle.value.trim().toLowerCase();
+    const host = shape() === 'front' ? location.host
+      : (f().mode.value === 'existing' ? (podUrl() ? new URL(podUrl()).host : '') : podHostOf());
+    $('preview').textContent = (handle && host) ? `@${handle}@${host}` : '@…@…';
+  };
+  // The shape choice is fixed for a path pod, and open for a host-root pod.
+  // A path pod has no choice to make: the radios go away and the note says why.
+  const applyShape = () => {
+    const fixed = pathPod();
+    for (const r of f().shape) { if (fixed) r.checked = r.value === 'front'; }
+    $('shape-group').hidden = fixed;
+    $('shape-hint').hidden = !fixed;
   };
-  for (const el of $('form').elements) el.addEventListener('input', previewAddr);
+  const applyMode = () => {
+    const existing = f().mode.value === 'existing';
+    $('pod-field').hidden = !existing;
+    $('podname-field').hidden = existing;
+    $('provider-other-field').hidden = f().provider.value !== '';
+  };
+  for (const el of $('form').elements) for (const evt of ['input', 'change']) el.addEventListener(evt, () => { applyMode(); applyShape(); previewAddr(); });
+  for (const evt of ['input', 'change']) { $('provider').addEventListener(evt, learnLayout); $('providerOther').addEventListener(evt, learnLayout); }
+  applyMode(); learnLayout();
 
   // Step machine: one screen at a time, each gated by its own validation.
   const STEP_IDS = ['step-1', 'step-2'];
@@ -287,15 +343,19 @@ if (typeof document !== 'undefined') (async () => {
   const goStep = (n) => {
     STEP_IDS.forEach((id, i) => { $(id).hidden = i !== n - 1; });
     $('err-1').textContent = ''; $('form-error').textContent = '';
-    if (n === 2) previewAddr();
+    if (n === 2) { applyShape(); previewAddr(); learnLayout(); }
     if (FOCUS[n]) $(FOCUS[n]).focus();
   };
   const validateStep1 = () => {
-    if (!providerHost()) return 'A valid pod provider URL is required.';
-    const sub = f().podName.value.trim().toLowerCase();
-    if (!sub) return 'A pod username/subdomain is required.';
-    const sp = window.fedipodHandleProblem(sub);
-    if (sp) return `Pod username: ${sp}`;
+    if (!providerHost()) return f().provider.value === '' ? 'A pod provider address is required under Other….' : 'A valid pod provider URL is required.';
+    if (f().mode.value === 'existing') {
+      if (!podUrl()) return 'A pod address is required, like https://alice.solidcommunity.net/ or https://server.example/alice/.';
+    } else {
+      const sub = f().podName.value.trim().toLowerCase();
+      if (!sub) return 'A pod username/subdomain is required.';
+      const sp = window.fedipodHandleProblem(sub);
+      if (sp) return `Pod username: ${sp}`;
+    }
     if (!f().email.value.trim()) return 'A pod email is required.';
     if (!f().password.value) return 'A pod password is required.';
     return null;