fedipod-server 0.16.0 → 0.17.0

package/dist/handler.js

@@ -17,6 +17,14 @@ const adapt_1 = require("./adapt");
 const store_css_1 = require("./store-css");
 const store_pod_1 = require("./store-pod");
 const directory_1 = require("./directory");
+/** The pod's path as a mount prefix: `''` for a host root, else `/aisha`. */
+function mountOf(podBase) {
+    return new URL(podBase).pathname.replace(/\/+$/u, '');
+}
+/** Whether `a` is `b` or an ancestor path of `b` (both mount-shaped, no trailing slash). */
+function pathContains(a, b) {
+    return a === b || b.startsWith(a + '/') || a === '';
+}
 // The JS front-core is FediPod's own ESM tree, reached at runtime. A real
 // dynamic import() built via Function keeps tsc from downleveling it to
 // require() — which cannot load an ESM module with top-level await under a
@@ -54,7 +62,7 @@ function deriveHandle(podBase) {
 function normalizeUiPath(raw) {
     if (raw === '')
         return '';
-    const path = raw ?? '/fedipod/';
+    const path = raw ?? '/fp/';
     return `/${path.replace(/^\/+|\/+$/gu, '')}/`;
 }
 class FediPodServerHandler extends community_server_1.HttpHandler {
@@ -63,12 +71,17 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
     dir;
     podPut;
     logger = (0, community_server_1.getLoggerFor)(this);
-    agentHosts = new Set();
+    // Every pod whose routes this server claims, keyed by pod base. A claim
+    // records the host it answers on and the mount — the pod's own path, `''` for
+    // a host-root or subdomain pod, `/aisha` for a suffix pod on `server/aisha/`.
+    // A suffix pod shares its host (often the front's own) with others, so a
+    // request is matched to an identity by host AND mount, never host alone.
+    claimed = new Map(); // pod base → claim
     agentHandles = new Map(); // handle → pod base
     frontHost;
     uiPath;
     identities = new Map();
-    surfaces = new Map();
+    surfaces = new Map(); // pod base → running identity
     registry;
     doorSecrets = new Map(); // pod base → its door secret
     starting = new Set();
@@ -100,32 +113,81 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             : null;
     }
     /**
-     * Whether this pod may become an identity here: a real URL, an origin of its
-     * own, not the front's host, and a handle no other identity already uses —
-     * two pods must never share <agentDataDir>/<handle>/.
+     * Whether this pod may become an identity here, and the claim it earns: a
+     * real URL, a place no other identity already sits, and a handle no other
+     * identity uses — two pods must never share <agentDataDir>/<handle>/.
+     *
+     * A HOST-ROOT or subdomain pod needs an origin of its own, and it may not be
+     * the front's host: the whole surface answers at the origin root, so two of
+     * them, or one sharing the front, would collide. A SUFFIX pod lives on a path
+     * (`server/aisha/`), so it may share its host — with the front and with other
+     * suffix pods — provided no claim already contains or nests under its path.
      */
-    validateAgentHost(podBase) {
+    validateAgentPod(podBase) {
         let host;
+        let mount;
         try {
-            host = new URL(podBase).host.toLowerCase();
+            const u = new URL(podBase);
+            host = u.host.toLowerCase();
+            mount = mountOf(podBase);
         }
         catch {
             throw new Error(`not a pod URL: ${podBase}`);
         }
-        // The Mastodon client API is rooted at an origin, so two identities
-        // cannot share one — and an identity cannot share the front's origin.
-        if (this.agentHosts.has(host)) {
-            throw new Error(`the host ${host} already carries an identity — an identity needs an origin of its own`);
+        if (mount === '') {
+            // A pod at the root of its host: it owns the whole origin, so it cannot
+            // share it with the front or with any other claim.
+            if (host.split(':')[0] === String(this.frontHost).toLowerCase()) {
+                throw new Error(`${podBase} is on the front's own host — give the identity its own origin, or host it on a path`);
+            }
+            for (const c of this.claimed.values()) {
+                if (c.host === host) {
+                    throw new Error(`the host ${host} already carries an identity — a host-root identity needs an origin of its own`);
+                }
+            }
         }
-        if (host.split(':')[0] === String(this.frontHost).toLowerCase()) {
-            throw new Error(`${podBase} is on the front's own host — give the identity its own origin`);
+        else {
+            // A pod on a path: it owns only its subtree. Refuse anything that already
+            // contains it or that it would contain, so no identity can answer under
+            // another's path (and none straddles the front's own routes underneath).
+            for (const c of this.claimed.values()) {
+                if (c.host !== host)
+                    continue;
+                if (pathContains(c.mount, mount) || pathContains(mount, c.mount)) {
+                    throw new Error(`${podBase} nests with the identity already at ${c.podBase} — a path pod owns only its own subtree`);
+                }
+            }
         }
         const handle = deriveHandle(podBase);
         const holder = this.agentHandles.get(handle);
         if (holder && holder !== podBase) {
             throw new Error(`the name ${handle} already belongs to ${holder} — two identities cannot share it`);
         }
-        return host;
+        return { host, mount, podBase, handle };
+    }
+    /**
+     * The claim a request belongs to, or null. A request matches when its host is
+     * the claim's host and its path is at or under the claim's mount; the deepest
+     * mount wins, so a suffix pod's own routes are never swallowed by a shallower
+     * claim on the same host.
+     */
+    resolveClaim(host, pathname) {
+        let best = null;
+        for (const c of this.claimed.values()) {
+            if (c.host !== host)
+                continue;
+            if (c.mount === '' || pathname === c.mount || pathname.startsWith(c.mount + '/')) {
+                if (!best || c.mount.length > best.mount.length)
+                    best = c;
+            }
+        }
+        return best;
+    }
+    /** A request path relative to a mount: `/aisha/ap/actor` under `/aisha` → `/ap/actor`. */
+    stripMount(pathname, mount) {
+        if (!mount)
+            return pathname;
+        return pathname.slice(mount.length) || '/';
     }
     /**
      * Start an agent for each opted-in pod. Runs before the server listens, so
@@ -164,21 +226,22 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // persist, and the next start recovers them.
         const pods = [];
         try {
-            const hosts = await this.registry.listHosts();
-            for (const host of hosts) {
-                const row = await this.registry.get(host);
+            const keys = await this.registry.listKeys();
+            for (const key of keys) {
+                const row = await this.registry.get(key);
                 if (!row)
                     continue;
-                if (this.agentHosts.has(row.host) || this.identities.has(row.podBase))
+                if (this.claimed.has(row.podBase) || this.identities.has(row.podBase))
                     continue; // already claimed
+                let claim;
                 try {
-                    this.validateAgentHost(row.podBase);
+                    claim = this.validateAgentPod(row.podBase);
                 }
                 catch (e) {
                     this.logger.error(`opted-in pod ${row.podBase} no longer valid: ${e.message}`);
                     continue;
                 }
-                this.agentHosts.add(row.host);
+                this.claimed.set(row.podBase, claim);
                 this.agentHandles.set(row.handle, row.podBase);
                 pods.push(row.podBase);
             }
@@ -266,10 +329,15 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                         return;
                     }
                     this.identities.set(podBase, identity);
-                    this.surfaces.set(identity.host, identity);
+                    this.surfaces.set(podBase, identity);
                     this.logger.info(`FediPod agent @${identity.handle} running on ${podBase}`);
-                    if (this.args.agentAutoFront)
+                    // A suffix pod cannot answer WebFinger for itself — its host root is
+                    // the front's — so it is followable ONLY through the door's apex
+                    // dispatch. Front it whether or not auto-front is on: the row is the
+                    // whole of what makes @handle@host resolve to it.
+                    if (this.args.agentAutoFront || this.claimed.get(podBase)?.mount) {
                         await this.frontIdentity(podBase, identity);
+                    }
                     return;
                 }
                 catch (e) {
@@ -318,14 +386,20 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         }
     }
     async canHandle({ request }) {
-        const host = request.headers.host;
+        const host = String(request.headers.host ?? '').toLowerCase();
         const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
-        // Claimed from the opt-in roster, never from what is running: a pod resource
-        // must not be served by CSS for the seconds before an identity finishes
-        // starting, and then stop being served once it has.
+        // The front's own routes win first, so a suffix pod can never shadow the
+        // door's dispatch, its WebFinger or its API even where its mount would
+        // otherwise contain that path.
         if ((0, claims_1.claims)({ host, pathname }, this.frontHost))
             return;
-        if ((0, claims_1.agentClaims)({ host, pathname, method: request.method }, this.agentHosts, this.uiPath))
+        // Claimed from the opt-in roster, never from what is running: a pod resource
+        // must not be served by CSS for the seconds before an identity finishes
+        // starting, and then stop being served once it has. The path is matched
+        // relative to the claim's mount, so a suffix pod's `/aisha/ap/actor` is
+        // judged as `/ap/actor`.
+        const c = this.resolveClaim(host, pathname);
+        if (c && (0, claims_1.agentClaims)({ pathname: this.stripMount(pathname, c.mount), method: request.method }, this.uiPath))
             return;
         throw new Error('not a gateway route'); // reject → CSS's LDP handler takes it
     }
@@ -340,9 +414,17 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         const cluster = this.args.clusterManager;
         return !cluster || cluster.isSingleThreaded() || cluster.isPrimary();
     }
-    /** The running identity answering on a host, if it has finished starting. */
-    surfaceFor(host) {
-        return this.surfaces.get(String(host ?? '').toLowerCase());
+    /**
+     * The identity a request belongs to (matched by host and mount) and the
+     * request path relative to that identity's mount, or null. The identity is
+     * undefined when the pod is claimed but still starting. Used by the streaming
+     * upgrade, which has only the request to go on.
+     */
+    matchIdentity(host, pathname = '/') {
+        const c = this.resolveClaim(String(host ?? '').toLowerCase(), pathname);
+        if (!c)
+            return null;
+        return { identity: this.surfaces.get(c.podBase), rel: this.stripMount(pathname, c.mount) };
     }
     /**
      * A pod owner, already proven to control podBase, asks this server to run
@@ -366,13 +448,14 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             return { httpStatus: 201, ok: true, handle, host: new URL(base).host.toLowerCase(),
                 doorSecret: door.secret, doorPath: this.uiPath, status: 'rotated' };
         }
-        let host;
+        let claim;
         try {
-            host = this.validateAgentHost(base);
+            claim = this.validateAgentPod(base);
         }
         catch (e) {
             return { httpStatus: 409, error: e.message };
         }
+        const { host } = claim;
         try {
             await this.registry.add({ podBase: base, handle, host, webId, optedInAt: new Date().toISOString() });
         }
@@ -382,7 +465,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         }
         // From this instant the pod's identity routes answer 503 instead of LDP,
         // until the agent registers its surface.
-        this.agentHosts.add(host);
+        this.claimed.set(base, claim);
         this.agentHandles.set(handle, base);
         const door = await this.doorSecretFor(base, undefined, { rotate: true });
         this.doorSecrets.set(base, door.secret);
@@ -397,19 +480,20 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             return { httpStatus: 501, error: 'this server does not offer runtime opt-in' };
         const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
         const host = new URL(base).host.toLowerCase();
-        const row = await this.registry.get(host);
+        const key = (0, directory_1.agentKey)(host, base);
+        const row = await this.registry.get(key);
         if (!row || row.podBase !== base)
             return { httpStatus: 404, error: 'this pod has not opted in' };
-        this.agentHosts.delete(host); // routes fall to LDP now
+        this.claimed.delete(base); // routes fall to LDP now
         this.startCancelled.add(base); // a pending start stands down
         const identity = this.identities.get(base);
         this.identities.delete(base);
-        this.surfaces.delete(host);
+        this.surfaces.delete(base);
         this.agentHandles.delete(row.handle);
         this.doorSecrets.delete(base);
         if (identity)
             await identity.stop();
-        await this.registry.remove(host);
+        await this.registry.remove(key);
         this.logger.info(`runtime opt-out: @${row.handle} on ${base} — the pod serves plain LDP again`);
         return { httpStatus: 200, ok: true, stopped: Boolean(identity) };
     }
@@ -442,8 +526,13 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
     }
     async handle({ request, response }) {
         const host = String(request.headers.host ?? '').toLowerCase();
-        if (this.agentHosts.has(host)) {
-            const identity = this.surfaces.get(host);
+        const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
+        // The front's own routes win first — its dispatch, WebFinger and API sit at
+        // the apex above every suffix pod — so a claim is consulted only where the
+        // front does not answer.
+        const claimed = (0, claims_1.claims)({ host, pathname }, this.frontHost) ? null : this.resolveClaim(host, pathname);
+        if (claimed) {
+            const identity = this.surfaces.get(claimed.podBase);
             if (!identity) {
                 // Claimed, but nothing here can answer for it. Saying which of the two
                 // reasons it is beats letting the pod answer for a route that is not
@@ -459,8 +548,10 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                 response.end(JSON.stringify({ error: 'this identity is still starting' }));
                 return;
             }
-            const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
-            if (pathname === claims_1.INBOX_PATH && String(request.method).toUpperCase() === 'POST') {
+            // This identity's own inbox path — <mount>/<root>/ap/inbox/, from its
+            // actor, so it already carries the mount for a suffix pod.
+            const inboxPath = new URL(identity.actorUrl).pathname.replace(/ap\/actor$/u, 'ap/inbox/');
+            if (pathname === inboxPath && String(request.method).toUpperCase() === 'POST') {
                 await this.deliverAtDoor(identity, request, response);
                 return;
             }

package/dist/handler.jsonld

@@ -249,8 +249,8 @@
           "memberFieldName": "logger"
         },
         {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_agentHosts",
-          "memberFieldName": "agentHosts"
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_claimed",
+          "memberFieldName": "claimed"
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_agentHandles",
@@ -301,8 +301,16 @@
           "memberFieldName": "constructor"
         },
         {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_validateAgentHost",
-          "memberFieldName": "validateAgentHost"
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_validateAgentPod",
+          "memberFieldName": "validateAgentPod"
+        },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_resolveClaim",
+          "memberFieldName": "resolveClaim"
+        },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_stripMount",
+          "memberFieldName": "stripMount"
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_initialize",
@@ -333,8 +341,8 @@
           "memberFieldName": "runsIdentities"
         },
         {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_surfaceFor",
-          "memberFieldName": "surfaceFor"
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_matchIdentity",
+          "memberFieldName": "matchIdentity"
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_optInPod",

package/dist/streaming-handler.js

@@ -23,12 +23,17 @@ class FediPodStreamingHandler extends community_server_1.WebSocketHandler {
     async canHandle({ upgradeRequest }) {
         const host = upgradeRequest.headers.host;
         const { pathname } = new URL(upgradeRequest.url ?? '/', `http://${host}`);
-        if (!pathname.startsWith(STREAMING_PATH) || !this.server.surfaceFor(host)) {
+        // Matched relative to the identity's mount, so a suffix pod's own streaming
+        // socket at `/aisha/api/v1/streaming` is recognised as `/api/v1/streaming`.
+        const match = this.server.matchIdentity(host, pathname);
+        if (!match || !match.rel.startsWith(STREAMING_PATH)) {
             throw new Error('not a FediPod streaming socket');
         }
     }
     async handle({ webSocket, upgradeRequest }) {
-        const identity = this.server.surfaceFor(upgradeRequest.headers.host);
+        const host = upgradeRequest.headers.host;
+        const { pathname } = new URL(upgradeRequest.url ?? '/', `http://${host}`);
+        const identity = this.server.matchIdentity(host, pathname)?.identity;
         const streaming = identity?.surface?.streaming;
         if (!streaming) {
             webSocket.close(1011, 'identity not running');

package/lib/client/masto/index.mjs

@@ -32,8 +32,14 @@ export { attachmentType, extensionFor } from './media.mjs';
 
 export class MastoApi {
   constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false,
-    streaming = true, webPush = true, scheduling = true }) {
+    mount = '', streaming = true, webPush = true, scheduling = true }) {
     this.agent = agent;
+    // The path this identity's surface answers under, when it shares its origin
+    // with others (a suffix pod, e.g. `/aisha`). Empty for a host-root or
+    // subdomain pod. Folded into the self-URLs the client is handed —
+    // pagination links, the OAuth issuer — so they name the address the client
+    // actually reached.
+    this.mount = mount;
     // A server-hosted identity has no CLI of its own, so the advice this gives
     // when it refuses has to name the route that identity really has.
     this.embedded = embedded;

package/lib/client/masto/timelines.mjs

@@ -254,7 +254,7 @@ export async function handle(api, ctx) {
 
     // A client pages by following these rather than by guessing ids.
     if (page.length) {
-      const base = `${api.scheme || (req.socket?.encrypted ? 'https' : 'http')}://${req.headers.host}${pathname}`;
+      const base = `${api.scheme || (req.socket?.encrypted ? 'https' : 'http')}://${req.headers.host}${api.mount || ''}${pathname}`;
       const link = (params) => {
         const u = new URL(base);
         for (const [k, v] of q) if (k !== 'max_id' && k !== 'since_id' && k !== 'min_id') u.searchParams.append(k, v);

package/lib/client/oidc-auth.mjs

@@ -8,7 +8,7 @@
 // The verifier is injected so offline tests stub it, and wrapped so the
 // library (CJS, older jose) can be replaced without touching any caller.
 
-export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null }) {
+export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null, mount = '' }) {
   let verify = verifier;
   const loadVerifier = async () => {
     if (!verify) {
@@ -31,9 +31,11 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
       // The URL the client signed its proof over. The Host header already
       // passed the Authorities firewall, so whichever alias the client used
       // (localhost, 127.0.0.1, the named origin) is one this agent answers on;
-      // the scheme is whichever listener the request arrived on.
+      // the scheme is whichever listener the request arrived on. `pathname` is
+      // relative to this identity's mount, so a suffix pod folds the mount back
+      // in — the client signed over the full path it actually requested.
       const htu = `${scheme ? scheme.replace(/:$/u, '') : req.socket?.encrypted ? 'https' : 'http'
-      }://${req.headers.host}${pathname}`;
+      }://${req.headers.host}${mount}${pathname}`;
       ({ webid } = await v(
         req.headers.authorization,
         req.headers.dpop ? { header: req.headers.dpop, method: req.method, url: htu } : undefined,

package/lib/core/wire.mjs

@@ -20,7 +20,10 @@ export { webfingerHost } from '../pod/urls.mjs';
 // contains; the browser build states `fedipod/` on its own configs. A config
 // that names a root is always believed — this is only the answer for one that
 // does not.
-export const DEFAULT_ROOT = 'activitypods-js/';
+// Every build writes its data into a `fedipod/` container in the pod. This is
+// the answer for a config that names no root; a config that names one is always
+// believed. (`activitypods-js/` was an earlier name, now abandoned.)
+export const DEFAULT_ROOT = 'fedipod/';
 
 // The handle the fediverse sees: a fronted identity's name is the front's.
 export function publicHandle(config) {

package/lib/device/admin/routes/gateway.mjs

@@ -47,7 +47,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
       };
       const podActorId = () => {
         const base = cfg.remotePod.endsWith('/') ? cfg.remotePod : `${cfg.remotePod}/`;
-        const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'activitypods-js/';
+        const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'fedipod/';
         return `${base}${root}ap/actor`;
       };
       // The reply first, the restart a beat later — same shape as /update.

package/lib/device/admin/surface.mjs

@@ -76,14 +76,14 @@ const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
 // a fediverse instance must let strangers reach /api and /oauth, so the gate
 // guards the operator's door (basePath) instead of the whole surface.
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
-  port = null, handle = null, embedded = false, basePath = '/',
+  port = null, handle = null, embedded = false, basePath = '/', mount = '',
   publicOrigin = null, scheme = null,
   versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
-  const masto = new MastoApi({ agent, log, allowed, scheme, embedded });
+  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
-  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme }) });
+  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
   const streaming = new Streaming({ masto, log, allowed, gate, gateOptional: embedded });
   // Asked per request, not once here: startAdmin runs before connect, so the
   // kind is not known yet at mount time.
@@ -104,21 +104,29 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
     } catch (e) { log(`streaming broadcast: ${e.message}`); }
   };
 
-  // A path as the browser must ask for it: behind the door, prefixed with it.
-  const atPath = (p_) => (basePath === '/' ? p_ : basePath.slice(0, -1) + p_);
+  // A path as the browser must ask for it: under this identity's mount (a
+  // suffix pod's own path, or nothing) and behind the door, prefixed with it.
+  const atPath = (p_) => mount + (basePath === '/' ? p_ : basePath.slice(0, -1) + p_);
 
   // What every route may reach: the agent and the deployment's facts.
   const ctx = { agent, log, allowed, embedded, port, handle, publicOrigin, versionOnDisk, isGroup, json, setup: setup_ };
 
   const handler = async (req, res) => {
     const url = new URL(req.url, 'http://localhost');
+    // A suffix pod's surface answers under its mount (its own path on a shared
+    // host). Strip it once, here, so every route below is matched relative to
+    // the mount and a host-root/subdomain pod (empty mount) is unchanged. The
+    // full path stays on `url`/`req.url` for self-URLs that fold the mount back
+    // in themselves (the pagination base, the DPoP htu).
+    let p = url.pathname;
+    if (mount && (p === mount || p.startsWith(mount + '/'))) p = p.slice(mount.length) || '/';
     // Mastodon-style: the bearer-gated client API and the OAuth + nodeinfo
     // routes answer any origin — a browser client is served the way any
     // instance serves it. CORS headers and the preflight make that work; the
     // bearer stays the only credential, and the Host check below (which is
     // what stops DNS rebinding) still runs.
-    const apiPath = url.pathname.startsWith('/api/') || url.pathname.startsWith('/oauth/')
-      || url.pathname === '/.well-known/nodeinfo' || url.pathname === '/nodeinfo/2.0';
+    const apiPath = p.startsWith('/api/') || p.startsWith('/oauth/')
+      || p === '/.well-known/nodeinfo' || p === '/nodeinfo/2.0';
     if (apiPath) {
       res.setHeader('access-control-allow-origin', '*');
       res.setHeader('access-control-expose-headers', 'Link');
@@ -142,11 +150,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       res.end('forbidden\n');
       return;
     }
-    let p = url.pathname;
-    // Embedded, the operator's door is one path on the pod's origin. Behind it
-    // is everything that was the admin server; in front of it are the protocol
-    // routes, which have to answer strangers because that is what makes the pod
-    // an instance other software can talk to.
+    // Embedded, the operator's door is one path on the pod's origin (under the
+    // mount, when there is one). Behind it is everything that was the admin
+    // server; in front of it are the protocol routes, which have to answer
+    // strangers because that is what makes the pod an instance other software
+    // can talk to.
     let atDoor = !embedded;
     if (embedded && basePath !== '/'
       && (p === basePath.slice(0, -1) || p.startsWith(basePath))) {
@@ -171,7 +179,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // above still decides who gets this far.
       if (p === '/.well-known/oauth-authorization-server') {
         const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}`));
+        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}${mount}`));
       }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
@@ -180,7 +188,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // NodeInfo on the agent origin — clients probe it at login.
       if (p === '/.well-known/nodeinfo') {
         return json(res, 200, nodeinfoPointer(
-          `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}/nodeinfo/2.0`));
+          `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}${mount}/nodeinfo/2.0`));
       }
       if (p === '/nodeinfo/2.0') {
         return json(res, 200, nodeinfoDoc({
@@ -206,8 +214,8 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         // Our own pages come before the group check: a group is set up in the
         // browser like anything else, and it has a record to edit. It still
         // serves no fediverse client — see the 404 two lines down.
-        const mount = webMount(p);
-        if (mount) {
+        const wmount = webMount(p);
+        if (wmount) {
           // Without the slash a page's own relative <script src> resolves one
           // level up and 404s — and that is true at any depth, so ask the
           // filesystem rather than only special-casing the mount itself.
@@ -217,7 +225,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             res.end();
             return;
           }
-          return serveWeb(res, p, mount, allowed);
+          return serveWeb(res, p, wmount, allowed);
         }
         // The bare URL means "show me what this agent wants from me now".
         // Keyed on the credential FILE, never on configured(): a healthy

package/lib/device/cli/commands/setup.mjs

@@ -18,7 +18,7 @@ export async function setup() {
   if (process.stdin.isTTY && !has('cli') && !IDENTITY_FLAGS.some(f => args.includes('--' + f))) {
     return runBrowserSetup();
   }
-const root = flag('root');
+const root = flag('root') || 'fedipod/';   // new installs default to the fedipod/ container
 const kind = has('group') ? 'group' : 'person';
 const approveJoins = has('group') && has('approve-joins');
 const summary = flag('summary');
@@ -48,6 +48,14 @@ if (!newAccount && !pod) {
   }
 }
 if (!newAccount && !pod) { console.error('no pod given'); process.exit(2); }
+if (!newAccount) {
+  const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
+  const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
+  if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
+    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    process.exit(2);
+  }
+}
 
 const issuer = flag('issuer') || await ask('Solid identity provider', 'https://solidcommunity.net');
 // Before the password is asked for, let alone sent. The issuer is where it

package/lib/device/setup.mjs

@@ -19,6 +19,7 @@ import { hashPassword } from '../client/masto/index.mjs';
 import { webfingerHost, apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
+import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
@@ -222,6 +223,8 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     gateway = null, shape = 'pod', gatewayOrigin = 'https://fedipod.net',
   } = answers;
   let { pod, root } = answers;
+  if (!root) root = 'fedipod/';   // new installs default to the fedipod/ container; a
+  // resuming run overwrites this with the credential's own root below.
   let accountWebId = null;   // what createAccountWithPod reported, when it ran
   // The private half always starts here, beside the credential and the keys —
   // not on the pod. Every activity you receive would otherwise cost the pod
@@ -263,6 +266,9 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
+      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      }
       skip('account', 'using the pod you already have');
     }