fedipod-server 0.14.1 → 0.16.0

package/web/app/README.md

@@ -72,6 +72,6 @@ See the `MastoApi` options in `agent.mjs`.
 | **Streaming** | a service worker answers fetches, not sockets. No streaming URL is advertised, so clients poll. |
 | **Web push** | `shims/web-push.mjs` is a no-op. `vapid` is omitted, and a client that subscribes anyway gets a 422 rather than a subscription nothing will push to. |
 | **Scheduled posts** | nothing runs between now and the scheduled time. A `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
-| **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the installed agent. See `groups.md`. |
-| **A fronted `@you@front` handle** | the browser model is `@you@yourpod` with the gateway as a mail door. `admin-facade.mjs` refuses a fronted attach, and `stage-site.mjs` hides the radio that offered it. |
+| **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the DeviceAgent. See `groups.md`. |
+| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a suffix-based host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
 | **Moving the private half** | `/state-move` is about filesystem paths and `credential.json`. A browser has neither; its private half is always on the pod. |

package/web/app/admin-facade.mjs

@@ -317,7 +317,7 @@ export class AdminFacade {
         const aliases = [...(cfg.aliases || [])];
         if (body.add) {
           if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
-            return json(400, { error: 'this pod is a path on a shared host, so other servers could never resolve it as a Move target' });
+            return json(400, { error: 'this pod is a suffix-based host, so other servers could never resolve it as a Move target' });
           }
           const id = await this.resolveActor(body.add);
           if (!id) return json(400, { error: `could not fetch the old account (${body.add}) — enter its URL or @user@host, and it must answer` });

package/web/app/agent.mjs

@@ -17,7 +17,7 @@ import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
-import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
+import { importSigningKey, loadKeysFromPod, cacheOpenedKeys, podActorOf } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
 import { RelayDeliverer, doorKeyOf } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
@@ -26,6 +26,7 @@ import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
 import { BrowserFediAccounts } from './fediacct-browser.mjs';
 import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
 import { followActor, unfollowActor, resolveHandle } from '../../lib/core/social.mjs';
+import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { ImportWorker } from '../../lib/connections/import.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
@@ -159,7 +160,7 @@ export class BrowserAgent {
     if (oidc) {
       session = { fetch: (u, i) => oidc.fetch(u, i) };
       webId = oidc.webId;
-      remotePod = new URL(webId).origin + '/';
+      remotePod = podBaseOfWebId(webId);              // the pod, which on a suffix-based host is a path
     } else {
       const dpop = await makeDpopSession(credential);
       session = { fetch: (u, i) => dpop.fetch(u, i) };
@@ -169,6 +170,8 @@ export class BrowserAgent {
     this.webId = webId;
     const root = (config && config.root) || 'fedipod/';
     this.remote = new BrowserRemotePod(session, { webId, log: this.log });
+    // Pod-native for now: the state store below is read with these, and only
+    // the config it holds says whether this identity is fronted.
     this.urls = apUrls(remotePod, root);
 
     // State store, on the pod.
@@ -189,9 +192,18 @@ export class BrowserAgent {
     // document it published landed under `activitypods-js/`. One root, decided
     // once, carried by the config everything downstream reads.
     this.store.setConfig({ ...(this.store.getConfig() || {}), ...cfg, root });
+    config = this.store.getConfig();
+    // A fronted identity (config.gateway.frontActor) advertises its ids at the
+    // gateway; the documents stay on the pod. Same three lines as the Node
+    // agent (run-agent.mjs connect): the advertised urls, and the map that
+    // turns an advertised url back into the pod one at the transport's single
+    // write and read choke point. State and media stay pod-native either way.
+    const publicBase = config.gateway?.frontActor
+      ? config.gateway.frontActor.replace(/ap\/actor\/?$/, '') : null;
+    this.urls = apUrls(remotePod, root, { publicBase });
+    if (this.urls.toPod) this.remote.setUrlMap(this.urls.toPod);
     // Keys: handed in (offline), or the owner-only keys.json read from the pod.
     const keys = keysRecord ? await importSigningKey(keysRecord) : await loadKeysFromPod(this.remote, this.urls);
-    config = this.store.getConfig();
 
 
     // `passive`: no queue-drain timer until this device is the active one.
@@ -212,7 +224,7 @@ export class BrowserAgent {
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,
-      // Who a post names, resolved — the same lookup the installed agent
+      // Who a post names, resolved — the same lookup the DeviceAgent
       // gives its publisher. Without it no mention from the browser ever
       // resolved: a direct message went to nobody, a mention notified no one.
       resolveMention: (h) => resolveHandle(this, h),
@@ -370,7 +382,7 @@ export class BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;                  // one key, one actor (lib/keys.mjs)
     await podState.writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    const keys = await cacheOpenedKeys(this.urls.actor, rec);
+    const keys = await cacheOpenedKeys(podActorOf(this.urls), rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();

package/web/app/boot.mjs

@@ -12,6 +12,8 @@
 import { signUp, handleProblem, AP_ROOT } from './signup.mjs';
 import * as podActor from '../../lib/pod/actor.mjs';
 import * as podState from '../../lib/pod/state.mjs';
+import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
+import { podLayout } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
 import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
@@ -68,7 +70,7 @@ window.fedipodUnlock = async (password) => {
   if (!session) throw new Error('Sign in first.');
   // The config on the pod says where this account's state lives; the key sits
   // beside it. Both are read with the session, as the owner.
-  const podFromWebId = new URL(session.webId).origin + '/';
+  const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
   // Through the transport rather than the bare session: this is a pod read
   // like any other, and going round it skipped the retry ladder that exists
@@ -112,21 +114,38 @@ export function parseAddress(input) {
 }
 async function issuerForPod(pod) {
   // The pod's actor says where a client signs in (oauthAuthorizationEndpoint's
-  // origin); failing that, the account provider is the pod host's parent domain.
+  // origin); failing that, the account provider is the pod host's parent
+  // domain for a subdomain pod, and the host itself for a pod on a path.
   try {
     const authz = await podActor.readIssuer(`${pod}${AP_ROOT}ap/actor`);
     if (authz) return new URL(authz).origin;
   } catch { /* fall through */ }
-  const host = new URL(pod).host;
-  const parent = host.split('.').slice(1).join('.');
-  return `https://${parent || host}`;
+  const u = new URL(pod);
+  if (u.pathname !== '/') return u.origin;
+  const parent = u.host.split('.').slice(1).join('.');
+  return `https://${parent || u.host}`;
+}
+// An address at this site names a fronted identity. Its documents live on a
+// pod this site's WebFinger names as an alias — the pod's own actor id.
+async function podForFrontedAddress(handle) {
+  const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
+    { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
+  const doc = await res.json().catch(() => ({}));
+  const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
+  if (!podActorId) throw new Error(`@${handle}@${location.host} lives here but names no pod to sign in to`);
+  const tail = `${AP_ROOT}ap/actor`;
+  if (!podActorId.endsWith(tail)) throw new Error(`the pod actor ${podActorId} is not where a FediPod pod keeps one`);
+  return podActorId.slice(0, -tail.length);
 }
 window.fedipodSignin = async ({ address }) => {
   const parsed = parseAddress(address);
   if (!parsed) throw new Error('Enter your address as @you@yourpod (for example @alice@alice.solidcommunity.net).');
   const bad = handleProblem(parsed.handle);
   if (bad) throw new Error(bad);
-  const pod = `https://${parsed.host}/`;
+  const pod = parsed.host === location.host.toLowerCase()
+    ? await podForFrontedAddress(parsed.handle)
+    : `https://${parsed.host}/`;
   const issuer = await issuerForPod(pod);
   const { authorizationUrl } = await beginLogin({ issuer, redirectUri: REDIRECT });
   location.href = authorizationUrl;
@@ -262,24 +281,61 @@ if (typeof document !== 'undefined') (async () => {
   // --- register form: two screens, pod first then Fediverse identity ---
   const f = () => $('form').elements;
   // The pod provider is a free-text URL; default and normalise to a scheme.
-  const providerUrl = () => { let v = f().provider.value.trim(); if (!v) v = 'https://solidcommunity.net'; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; return v; };
+  // The provider is picked from the list, or typed under "Other…".
+  const providerUrl = () => { let v = (f().provider.value || f().providerOther.value).trim(); if (!v) return ''; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; return v; };
   const providerHost = () => { try { return new URL(providerUrl()).host; } catch { return ''; } };
-  // The pod is always a subdomain of the provider, so both new and existing pods
-  // resolve to https://<subdomain>.<provider-host>/ and carry a host-root address.
+  // A new pod is named by its subdomain under the provider; an existing pod is
+  // brought by its address, which may be its own host or a path on a shared one.
   const podHostOf = () => { const sub = f().podName.value.trim().toLowerCase(); const ph = providerHost(); return (sub && ph) ? `${sub}.${ph}` : ''; };
+  const podUrl = () => { let v = f().pod.value.trim(); if (!v) return ''; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; if (!v.endsWith('/')) v += '/'; try { return new URL(v).href; } catch { return ''; } };
+  // A pod on a suffix-based host cannot answer WebFinger, so its address
+  // lives at this site; a pod at its own host root gets the choice.
+  const isPathPod = (u) => { try { return new URL(u).pathname !== '/'; } catch { return false; } };
+  // Where the chosen provider puts new pods, asked of the provider itself
+  // (lib/pod/root.mjs podLayout) and remembered per provider: 'host', 'path',
+  // or null when it would not say.
+  const layouts = new Map();
+  let layout = null;
+  const learnLayout = async () => {
+    const origin = providerHost() ? new URL(providerUrl()).origin : '';
+    if (!origin) { layout = null; return; }
+    if (!layouts.has(origin)) layouts.set(origin, podLayout(fetch, origin).catch(() => null));
+    const known = await layouts.get(origin);
+    if (providerHost() && new URL(providerUrl()).origin === origin) { layout = known; applyShape(); previewAddr(); }
+  };
+  const pathPod = () => (f().mode.value === 'existing' ? isPathPod(podUrl()) : layout === 'path');
+  const shape = () => (pathPod() ? 'front' : f().shape.value);
   const answers = () => {
     const mode = f().mode.value;
     const a = { mode, handle: f().handle.value.trim().toLowerCase(), email: f().email.value.trim(),
-      password: f().password.value, issuer: providerUrl() };
+      password: f().password.value, issuer: providerUrl(), shape: shape() };
     if (mode === 'new') a.podName = f().podName.value.trim().toLowerCase();
-    else a.pod = `https://${podHostOf()}/`;
+    else a.pod = podUrl();
     return a;
   };
   const previewAddr = () => {
-    const handle = f().handle.value.trim().toLowerCase(); const ph = podHostOf();
-    $('preview').textContent = (handle && ph) ? `@${handle}@${ph}` : '@…@…';
+    const handle = f().handle.value.trim().toLowerCase();
+    const host = shape() === 'front' ? location.host
+      : (f().mode.value === 'existing' ? (podUrl() ? new URL(podUrl()).host : '') : podHostOf());
+    $('preview').textContent = (handle && host) ? `@${handle}@${host}` : '@…@…';
+  };
+  // The shape choice is fixed for a path pod, and open for a host-root pod.
+  // A path pod has no choice to make: the radios go away and the note says why.
+  const applyShape = () => {
+    const fixed = pathPod();
+    for (const r of f().shape) { if (fixed) r.checked = r.value === 'front'; }
+    $('shape-group').hidden = fixed;
+    $('shape-hint').hidden = !fixed;
   };
-  for (const el of $('form').elements) el.addEventListener('input', previewAddr);
+  const applyMode = () => {
+    const existing = f().mode.value === 'existing';
+    $('pod-field').hidden = !existing;
+    $('podname-field').hidden = existing;
+    $('provider-other-field').hidden = f().provider.value !== '';
+  };
+  for (const el of $('form').elements) for (const evt of ['input', 'change']) el.addEventListener(evt, () => { applyMode(); applyShape(); previewAddr(); });
+  for (const evt of ['input', 'change']) { $('provider').addEventListener(evt, learnLayout); $('providerOther').addEventListener(evt, learnLayout); }
+  applyMode(); learnLayout();
 
   // Step machine: one screen at a time, each gated by its own validation.
   const STEP_IDS = ['step-1', 'step-2'];
@@ -287,15 +343,19 @@ if (typeof document !== 'undefined') (async () => {
   const goStep = (n) => {
     STEP_IDS.forEach((id, i) => { $(id).hidden = i !== n - 1; });
     $('err-1').textContent = ''; $('form-error').textContent = '';
-    if (n === 2) previewAddr();
+    if (n === 2) { applyShape(); previewAddr(); learnLayout(); }
     if (FOCUS[n]) $(FOCUS[n]).focus();
   };
   const validateStep1 = () => {
-    if (!providerHost()) return 'A valid pod provider URL is required.';
-    const sub = f().podName.value.trim().toLowerCase();
-    if (!sub) return 'A pod username/subdomain is required.';
-    const sp = window.fedipodHandleProblem(sub);
-    if (sp) return `Pod username: ${sp}`;
+    if (!providerHost()) return f().provider.value === '' ? 'A pod provider address is required under Other….' : 'A valid pod provider URL is required.';
+    if (f().mode.value === 'existing') {
+      if (!podUrl()) return 'A pod address is required, like https://alice.solidcommunity.net/ or https://server.example/alice/.';
+    } else {
+      const sub = f().podName.value.trim().toLowerCase();
+      if (!sub) return 'A pod username/subdomain is required.';
+      const sp = window.fedipodHandleProblem(sub);
+      if (sp) return `Pod username: ${sp}`;
+    }
     if (!f().email.value.trim()) return 'A pod email is required.';
     if (!f().password.value) return 'A pod password is required.';
     return null;

package/web/app/dist/boot.js

@@ -33025,9 +33025,10 @@ var PodTransport = class {
     return serialize(doc, g, url, "text/turtle");
   }
   async setAcl(targetUrl, publicModes, opts = {}) {
-    const url = await this.aclUrlFor(targetUrl);
+    const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
+    const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(targetUrl, publicModes, { ...opts, aclUrl: url }), "text/turtle");
+    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), "text/turtle");
   }
   // Child documents of an LDP container (URLs under it, excluding aux docs).
   // Revalidated: the inbox is polled every couple of minutes and is usually
@@ -33266,6 +33267,15 @@ function handleProblem(handle) {
 }
 var PROGRESS = /* @__PURE__ */ new Map();
 var progressKey = (a) => [a.issuer, a.mode, a.handle, a.mode === "new" ? a.podName || a.handle : a.pod].join("|");
+async function assertFrontNameFree(frontOrigin, handle) {
+  const res = await fetch(
+    `${frontOrigin.replace(/\/$/, "")}/api/handle?handle=${encodeURIComponent(handle)}`,
+    { headers: { accept: "application/json" } }
+  ).catch(() => null);
+  const d = res ? await res.json().catch(() => ({})) : null;
+  if (!d) throw new Error(`${new URL(frontOrigin).host} did not answer whether @${handle} is free`);
+  if (!d.available) throw new Error(d.reason || `the name @${handle}@${new URL(frontOrigin).host} is taken \u2014 choose another handle`);
+}
 async function signUp(answers, { onStep = () => {
 }, frontOrigin = null } = {}) {
   const { mode, issuer, email, password, handle } = answers;
@@ -33274,6 +33284,9 @@ async function signUp(answers, { onStep = () => {
   if (!email) throw new Error("an email is required");
   if (!password) throw new Error("a password is required");
   if (mode === "existing" && !answers.pod) throw new Error("a pod address is required");
+  const wantsFront = answers.shape === "front";
+  if (wantsFront && !frontOrigin) throw new Error("an address at the gateway needs a gateway, and this page has none");
+  if (wantsFront) await assertFrontNameFree(frontOrigin, handle);
   const key = progressKey(answers);
   const prog = PROGRESS.get(key) || {};
   PROGRESS.set(key, prog);
@@ -33305,11 +33318,14 @@ async function signUp(answers, { onStep = () => {
   }
   const pod = prog.pod;
   const webId = prog.webId || null;
-  const podUrl = new URL(pod);
-  if (podUrl.pathname !== "/") {
-    throw new Error(`${pod} is a path on ${podUrl.host}, not its own host. A Fediverse address lives at a host root, so this pod cannot carry one. Use a pod that is the root of its own subdomain.`);
+  const pathPod = new URL(pod).pathname !== "/";
+  const fronted = pathPod || wantsFront;
+  if (fronted && !frontOrigin) {
+    throw new Error(`${pod} is a suffix-based host, so its address must live at a gateway, and this page has none.`);
   }
+  if (pathPod && !wantsFront) await assertFrontNameFree(frontOrigin, handle);
   const actorUrl = actorUrlFor(pod);
+  const frontActor = fronted ? `${frontOrigin.replace(/\/$/, "")}/u/${handle}/ap/actor` : null;
   const cred = step("credential");
   let credential;
   if (!prog.credential) {
@@ -33324,12 +33340,36 @@ async function signUp(answers, { onStep = () => {
     cred.ok();
   }
   const session = await makeDpopSession(credential);
+  let gateway = answers.gateway || prog.gateway || null;
+  if (frontOrigin && !gateway) {
+    const gw = step("gateway");
+    gw.running(fronted ? `taking your address at ${new URL(frontOrigin).host}` : `connecting your mail door on ${new URL(frontOrigin).host}`);
+    const res = await session.fetch(`${frontOrigin.replace(/\/$/, "")}/api/attach`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      // podHome is the AP CONTAINER, not the pod root: the front builds the
+      // delivery target as `podHome + 'ap/inbox/'` (lib/front-core.mjs), so a
+      // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
+      // the container the agent drains, where nothing would ever read it. The
+      // manage surface has always sent `urls.home`; this is the same value.
+      body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl, kind: "person", fronted })
+    });
+    const d = await res.json().catch(() => ({}));
+    if (res.status !== 201 || !d.hmacSecret) {
+      throw new Error(`could not connect the gateway (HTTP ${res.status}): ${d.error || ""}`);
+    }
+    gateway = fronted ? { url: `${frontOrigin.replace(/\/$/, "")}/u/${handle}/ap/inbox/`, frontActor: String(d.frontActor || frontActor), hmacSecret: d.hmacSecret, mode: "trust" } : { url: d.doorInbox, hmacSecret: d.hmacSecret, mode: "trust" };
+    prog.gateway = gateway;
+    gw.ok();
+  } else if (frontOrigin && gateway) {
+    step("gateway").ok();
+  }
   const keysStep = step("keys");
   let keys;
   if (!prog.keysStored) {
     keysStep.running("making your signing key and locking it under your password");
     keys = await generateKeys();
-    keys.mintedFor = actorUrl;
+    keys.mintedFor = gateway?.frontActor || actorUrl;
     const remote = new BrowserRemotePod(session, { webId: credential.webId, role: "signup", log: () => {
     } });
     try {
@@ -33349,30 +33389,6 @@ async function signUp(answers, { onStep = () => {
     keys = prog.keys;
     keysStep.ok();
   }
-  let gateway = answers.gateway || prog.gateway || null;
-  if (frontOrigin && !gateway) {
-    const gw = step("gateway");
-    gw.running(`connecting your mail door on ${new URL(frontOrigin).host}`);
-    const res = await session.fetch(`${frontOrigin.replace(/\/$/, "")}/api/attach`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      // podHome is the AP CONTAINER, not the pod root: the front builds the
-      // delivery target as `podHome + 'ap/inbox/'` (lib/front-core.mjs), so a
-      // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
-      // the container the agent drains, where nothing would ever read it. The
-      // manage surface has always sent `urls.home`; this is the same value.
-      body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl, kind: "person" })
-    });
-    const d = await res.json().catch(() => ({}));
-    if (res.status !== 201 || !d.hmacSecret) {
-      throw new Error(`could not connect the mail door (HTTP ${res.status}): ${d.error || ""}`);
-    }
-    gateway = { url: d.doorInbox, hmacSecret: d.hmacSecret, mode: "trust" };
-    prog.gateway = gateway;
-    gw.ok();
-  } else if (frontOrigin && gateway) {
-    step("gateway").ok();
-  }
   const config = {
     remotePod: pod,
     root: AP_ROOT,
@@ -33397,7 +33413,7 @@ async function signUp(answers, { onStep = () => {
     onStep("credential", "ok", "this browser is ready (the setup credential could not be revoked automatically \u2014 you can remove it from your pod's account page)");
   }
   PROGRESS.delete(key);
-  const host = new URL(pod).host;
+  const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
   return {
     credential,
     config,
@@ -33425,6 +33441,45 @@ async function readIssuer(actorUrl, fetchImpl = fetch) {
   }
 }
 
+// lib/pod/urls.mjs
+function podBaseOfWebId(webId) {
+  const u = new URL(webId);
+  u.hash = "";
+  u.search = "";
+  const dir = u.pathname.replace(/profile\/card$/u, "").replace(/[^/]*$/u, "");
+  return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
+}
+
+// lib/pod/root.mjs
+var OWNER_LOOKUP_MS = 5e3;
+var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
+async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  let origin;
+  try {
+    origin = new URL(providerOrigin).origin;
+  } catch {
+    return null;
+  }
+  let res;
+  try {
+    res = await fetchImpl(
+      `${origin}/.well-known/solid`,
+      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+  } catch {
+    return null;
+  }
+  if (res.status === 501) return "host";
+  if (res.status !== 200) return null;
+  let body = "";
+  try {
+    body = await readCapped(res, 64 * 1024);
+  } catch {
+    return null;
+  }
+  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
+}
+
 // web/app/oidc-session.mjs
 var DB2 = "fedipod-oidc";
 var STORE = "session";
@@ -33674,7 +33729,7 @@ window.fedipodUnlock = async (password) => {
   if (!password) throw new Error("Enter your account password.");
   const session = await getSession();
   if (!session) throw new Error("Sign in first.");
-  const podFromWebId = new URL(session.webId).origin + "/";
+  const podFromWebId = podBaseOfWebId(session.webId);
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: "signup", log: () => {
   } });
@@ -33711,16 +33766,30 @@ async function issuerForPod(pod) {
     if (authz) return new URL(authz).origin;
   } catch {
   }
-  const host = new URL(pod).host;
-  const parent = host.split(".").slice(1).join(".");
-  return `https://${parent || host}`;
+  const u = new URL(pod);
+  if (u.pathname !== "/") return u.origin;
+  const parent = u.host.split(".").slice(1).join(".");
+  return `https://${parent || u.host}`;
+}
+async function podForFrontedAddress(handle) {
+  const res = await fetch(
+    `/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
+    { headers: { accept: "application/jrd+json, application/json" } }
+  ).catch(() => null);
+  if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
+  const doc = await res.json().catch(() => ({}));
+  const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
+  if (!podActorId) throw new Error(`@${handle}@${location.host} lives here but names no pod to sign in to`);
+  const tail = `${AP_ROOT}ap/actor`;
+  if (!podActorId.endsWith(tail)) throw new Error(`the pod actor ${podActorId} is not where a FediPod pod keeps one`);
+  return podActorId.slice(0, -tail.length);
 }
 window.fedipodSignin = async ({ address }) => {
   const parsed = parseAddress(address);
   if (!parsed) throw new Error("Enter your address as @you@yourpod (for example @alice@alice.solidcommunity.net).");
   const bad = handleProblem(parsed.handle);
   if (bad) throw new Error(bad);
-  const pod = `https://${parsed.host}/`;
+  const pod = parsed.host === location.host.toLowerCase() ? await podForFrontedAddress(parsed.handle) : `https://${parsed.host}/`;
   const issuer = await issuerForPod(pod);
   const { authorizationUrl } = await beginLogin({ issuer, redirectUri: REDIRECT });
   location.href = authorizationUrl;
@@ -33866,8 +33935,8 @@ ${e.detail}` : "");
   });
   const f = () => $("form").elements;
   const providerUrl = () => {
-    let v = f().provider.value.trim();
-    if (!v) v = "https://solidcommunity.net";
+    let v = (f().provider.value || f().providerOther.value).trim();
+    if (!v) return "";
     if (!/^https?:\/\//i.test(v)) v = "https://" + v;
     return v;
   };
@@ -33883,6 +33952,42 @@ ${e.detail}` : "");
     const ph = providerHost();
     return sub && ph ? `${sub}.${ph}` : "";
   };
+  const podUrl = () => {
+    let v = f().pod.value.trim();
+    if (!v) return "";
+    if (!/^https?:\/\//i.test(v)) v = "https://" + v;
+    if (!v.endsWith("/")) v += "/";
+    try {
+      return new URL(v).href;
+    } catch {
+      return "";
+    }
+  };
+  const isPathPod = (u) => {
+    try {
+      return new URL(u).pathname !== "/";
+    } catch {
+      return false;
+    }
+  };
+  const layouts = /* @__PURE__ */ new Map();
+  let layout = null;
+  const learnLayout = async () => {
+    const origin = providerHost() ? new URL(providerUrl()).origin : "";
+    if (!origin) {
+      layout = null;
+      return;
+    }
+    if (!layouts.has(origin)) layouts.set(origin, podLayout(fetch, origin).catch(() => null));
+    const known = await layouts.get(origin);
+    if (providerHost() && new URL(providerUrl()).origin === origin) {
+      layout = known;
+      applyShape();
+      previewAddr();
+    }
+  };
+  const pathPod = () => f().mode.value === "existing" ? isPathPod(podUrl()) : layout === "path";
+  const shape = () => pathPod() ? "front" : f().shape.value;
   const answers = () => {
     const mode = f().mode.value;
     const a = {
@@ -33890,18 +33995,43 @@ ${e.detail}` : "");
       handle: f().handle.value.trim().toLowerCase(),
       email: f().email.value.trim(),
       password: f().password.value,
-      issuer: providerUrl()
+      issuer: providerUrl(),
+      shape: shape()
     };
     if (mode === "new") a.podName = f().podName.value.trim().toLowerCase();
-    else a.pod = `https://${podHostOf()}/`;
+    else a.pod = podUrl();
     return a;
   };
   const previewAddr = () => {
     const handle = f().handle.value.trim().toLowerCase();
-    const ph = podHostOf();
-    $("preview").textContent = handle && ph ? `@${handle}@${ph}` : "@\u2026@\u2026";
+    const host = shape() === "front" ? location.host : f().mode.value === "existing" ? podUrl() ? new URL(podUrl()).host : "" : podHostOf();
+    $("preview").textContent = handle && host ? `@${handle}@${host}` : "@\u2026@\u2026";
+  };
+  const applyShape = () => {
+    const fixed = pathPod();
+    for (const r of f().shape) {
+      if (fixed) r.checked = r.value === "front";
+    }
+    $("shape-group").hidden = fixed;
+    $("shape-hint").hidden = !fixed;
   };
-  for (const el of $("form").elements) el.addEventListener("input", previewAddr);
+  const applyMode = () => {
+    const existing = f().mode.value === "existing";
+    $("pod-field").hidden = !existing;
+    $("podname-field").hidden = existing;
+    $("provider-other-field").hidden = f().provider.value !== "";
+  };
+  for (const el of $("form").elements) for (const evt of ["input", "change"]) el.addEventListener(evt, () => {
+    applyMode();
+    applyShape();
+    previewAddr();
+  });
+  for (const evt of ["input", "change"]) {
+    $("provider").addEventListener(evt, learnLayout);
+    $("providerOther").addEventListener(evt, learnLayout);
+  }
+  applyMode();
+  learnLayout();
   const STEP_IDS = ["step-1", "step-2"];
   const FOCUS = { 1: "provider", 2: "handle" };
   const goStep = (n) => {
@@ -33910,15 +34040,23 @@ ${e.detail}` : "");
     });
     $("err-1").textContent = "";
     $("form-error").textContent = "";
-    if (n === 2) previewAddr();
+    if (n === 2) {
+      applyShape();
+      previewAddr();
+      learnLayout();
+    }
     if (FOCUS[n]) $(FOCUS[n]).focus();
   };
   const validateStep1 = () => {
-    if (!providerHost()) return "A valid pod provider URL is required.";
-    const sub = f().podName.value.trim().toLowerCase();
-    if (!sub) return "A pod username/subdomain is required.";
-    const sp = window.fedipodHandleProblem(sub);
-    if (sp) return `Pod username: ${sp}`;
+    if (!providerHost()) return f().provider.value === "" ? "A pod provider address is required under Other\u2026." : "A valid pod provider URL is required.";
+    if (f().mode.value === "existing") {
+      if (!podUrl()) return "A pod address is required, like https://alice.solidcommunity.net/ or https://server.example/alice/.";
+    } else {
+      const sub = f().podName.value.trim().toLowerCase();
+      if (!sub) return "A pod username/subdomain is required.";
+      const sp = window.fedipodHandleProblem(sub);
+      if (sp) return `Pod username: ${sp}`;
+    }
     if (!f().email.value.trim()) return "A pod email is required.";
     if (!f().password.value) return "A pod password is required.";
     return null;