v4: an instance can be named by the address of its pages — sign-in and the trust list took only an instance's issuer, its API's origin, so where the pages live elsewhere the address people see in their browser named no instance: in development, localhost:3000 answered its /.well-known with index.html, and the sign-in failed as "doesn't answer as a gerbeur". resolveIssuer (remote/gerbeur-instance.ts) now reads the metadata at the address given and, when it names another issuer, takes it only if that issuer's own metadata names those pages back as where its /authorize is, so an impostor can't claim one; sign-in, the trust list and the check against this instance go through it. The Vite dev server passes /.well-known on to its API, as whatever serves the pages must in production (README). A handle still carries the API's host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vite.config.ts

@@ -118,6 +118,14 @@ export default defineConfig({
     watch: {
       ignored: ["**/api/**"],
     },
+    // Another instance may know this one by its pages' address, and reads its
+    // metadata there (resolveIssuer in api/remote/gerbeur-instance.ts), which
+    // the API serves; in production, whatever serves the pages passes it on.
+    proxy: {
+      "/.well-known": `${process.env.VITE_API_PROTOCOL || "http"}://${
+        process.env.VITE_API_HOSTNAME || "localhost"
+      }:${process.env.VITE_API_PORT || "8000"}`,
+    },
   },
   build: {
     rollupOptions: {