Index: config.lua
==================================================================
--- config.lua
+++ config.lua
@@ -159,11 +159,11 @@
 				else return e
 			end
 		end
 		return coalesce(
 			pkgenv(v),
-			pkv(e or v),
+			e ~= false and pkv(e or v) or nil,
 			(fbo and eval(fbo[v])),
 			(fbv and eval(fbv[v])))
 	end
 	local name = cnfvar('override') or name
 	local pcname = coalesce(cnfvar('pcname'), name)
@@ -180,21 +180,25 @@
 	else
 		print '(warn) configuring on non-POSIX OS, all relevant paths must be specified manually in environment variables or build will fail!'
 	end
 	locdep = u.ping('./lib/' .. name)
 	local incdir, libdir, prefix
+	local libsfx = coalesce(cnfvar('libsuffix',false),'')
+	local incsfx = coalesce(cnfvar('incsuffix',false),'')
 	if locdep then
 		prefix = './lib/' .. name
-		libdir = prefix .. coalesce(cnfvar('libbuilddir'),cnfvar('builddir'),'')
-		incdir = prefix .. coalesce(cnfvar('srcincdir'),cnfvar('builddir'),'/include')
+		libdir = prefix .. coalesce(cnfvar 'libbuilddir',cnfvar 'builddir','')
+		incdir = prefix .. coalesce(cnfvar 'srcincdir',  cnfvar 'builddir','/include')
 	else
-		prefix = coalesce(cnfvar('prefix'), '/usr')
-		libdir = cnfvar('libdir')
-		incdir = cnfvar('incdir','includedir')
+		prefix = coalesce(cnfvar 'prefix', '/usr')
+		libdir = cnfvar 'libdir'
+			if libdir then libdir = libdir .. libsfx end
+		incdir = cnfvar('incdir','includedir') 
+			if incdir then incdir = incdir .. incsfx end
 	end
-	libdir = libdir or prefix .. '/lib'
-	incdir = incdir or prefix .. '/include'
+	libdir = libdir or (prefix .. '/lib'     .. libsfx)
+	incdir = incdir or (prefix .. '/include' .. incsfx)
 
 	local libstr = pkc '--libs-only-l' -- (--static is not reliable)
 	local libs = fb and fb.libs or {}
 	local linkstatic = locdep
 	if (not locdep) and libstr then

Index: parsav.t
==================================================================
--- parsav.t
+++ parsav.t
@@ -435,10 +435,11 @@
 lib.pk = lib.loadlib('mbedtls','mbedtls/pk.h')
 lib.md = lib.loadlib('mbedtls','mbedtls/md.h')
 lib.b64 = lib.loadlib('mbedtls','mbedtls/base64.h')
 lib.net = lib.loadlib('mongoose','mongoose.h')
 lib.pq = lib.loadlib('libpq','libpq-fe.h')
+lib.jc = lib.loadlib('json-c','json.h')
 
 lib.load {
 	'mem', 'math', 'str', 'file', 'crypt', 'ipc';
 	'http', 'html', 'session', 'tpl', 'store', 'acl';
 

Index: pkgdata.lua
==================================================================
--- pkgdata.lua
+++ pkgdata.lua
@@ -7,11 +7,22 @@
 		osvars = {
 			linux_nixos = { -- lacks a *.pc on nixos systems
 				prefix = sthunk('nix', 'path-info', 'nixos.mbedtls');
 			}
 		};
-		vars = { builddir = '/library' };
+		vars = { builddir = '/library', srcincdir = '/include' };
+	};
+	['json-c'] = {
+		osvars = {
+			linux_nixos = {
+				prefix = sthunk('nix','path-info','nixos.json_c');
+			};
+		};
+		vars = {
+			builddir = '';
+			incsuffix = '/json-c'; -- only used when path generated from prefix
+		}
 	};
 	mongoose = { vars = { builddir = '' } };
 	libpq = {
 		osvars = {
 			linux_nixos = {
@@ -23,15 +34,15 @@
 			};
 		};
 		vars = {pcname = 'postgresql';}
 	};
 	libc = {
-		libs = {'dl'}; -- libc.so does not need explicit mention
+		libs = {'c'}; -- libc.so probably does not need explicit mention, but
 		osvars = {
+			linux = { override = 'glibc'; };
 			linux_nixos = {
 				prefix = sthunk('nix', 'path-info', 'nixos.glibc');
 				override = 'glibc';
 			};
-			linux = { override = 'glibc'; };
 		}
 	};
 }

Index: render/conf/users.t
==================================================================
--- render/conf/users.t
+++ render/conf/users.t
@@ -184,24 +184,24 @@
 		end
 	end
 end)
 
 local input_pusher = function(kind,wrap,uniq)
-	local fn = terra(acc: &lib.str.acc, name: pstr, val: pstr, lbl: pstr, on: bool, enabled: bool, class: pstr)
+	local fn = terra(acc: &lib.str.acc, id: pstr, name: pstr, val: pstr, lbl: pstr, on: bool, enabled: bool, class: pstr)
 		if wrap then acc:lpush('<label>') end
 		acc:lpush(['<input type="'..kind..'" name="']):ppush(name)
 		if not wrap then
-			acc:lpush('" id="'):ppush(name)
+			acc:lpush('" id="'):ppush(id)
 			if uniq then acc:lpush('-'):ppush(val) end
 		end
 		if val:ref()   then acc:lpush('" value="'):ppush(val) end
 		if class:ref() then acc:lpush('" class="'):ppush(class) end
 		acc:lpush('"')
 		if on then acc:lpush(' checked') end
 		if not enabled then acc:lpush(' disabled') end
 		acc:lpush('>')
-		if not wrap then acc:lpush('<label for="'):ppush(name)
+		if not wrap then acc:lpush('<label for="'):ppush(id)
 		                 if uniq then acc:lpush('-'):ppush(val) end
 		                 acc:lpush('">')
 		            else acc:lpush(' ') end
 		acc:ppush(lbl):lpush('</label>')
 	end
@@ -275,11 +275,11 @@
 			cinp:lpush('</div><div class="elem"><div class="check-panel">')
 
 			if user.ptr.id ~= co.who.id and
 			   ((user.ptr.rights.rank == 0 and co.who.rights.powers.elevate()) or
 				(user.ptr.rights.rank >  0 and co.who.rights.powers.demote())) then
-				push_checkbox(&cinp, 'staff', pstr.null(), 'site staff member', user.ptr.rights.rank > 0, true, pstr.null())
+				push_checkbox(&cinp, 'staff', 'staff', pstr.null(), 'site staff member', user.ptr.rights.rank > 0, true, pstr.null())
 			end
 
 			cinp:lpush('</div></div>')
 
 			if (co.who.rights.powers.elevate() or
@@ -291,11 +291,11 @@
 							var on = (user.ptr.rights.powers and map[i].val):sz() > 0
 							var enabled = (     on  and co.who.rights.powers.demote() ) or
 										  ((not on) and co.who.rights.powers.elevate())
 							var namea: lib.str.acc namea:pcompose(&co.srv.pool,'power-', map[i].name)
 							var name = namea:finalize()
-							push_pickbox(&cinp, name, pstr.null(), map[i].name, on, enabled, pstr.null())
+							push_pickbox(&cinp, name, 'power', map[i].name, map[i].name, on, enabled, pstr.null())
 							--name:free()
 						end
 					end
 				cinp:lpush('</div></details>')
 			end

Index: route.t
==================================================================
--- route.t
+++ route.t
@@ -19,11 +19,10 @@
 				if act:cmp('follow') or act:cmp('subscribe') then
 					co:complain(403,'blocked','you cannot follow a user you are blocked by') return
 				end
 			end
 			if act:cmp('circle') then
-				lib.dbg('encircling user!')
 				var allcircs = co.srv:circle_search(&co.srv.pool, co.who.id, 0)
 				var mycircs = co.srv:circle_memberships_uid(&co.srv.pool, co.who.id, actor.id)
 				var marked = co.srv.pool:alloc(bool, allcircs.ct)
 				var member = co.srv.pool:alloc(bool, allcircs.ct)
 				for i = 0, marked.ct do
@@ -109,13 +108,10 @@
 	elseif handle.ct + 2 < uri.ct then uri:advance(handle.ct + 2) end
 
 	lib.dbg('looking up user by xid "', {handle.ptr,handle.ct} ,'", path: ', {uri.ptr,uri.ct})
 
 	var path = lib.http.hier(&co.srv.pool, uri) --defer path:free()
-	for i=0,path.ct do
-		lib.dbg('got path component ', {path.ptr[i].ptr, path.ptr[i].ct})
-	end
 
 	var actor = co.srv:actor_fetch_xid(handle)
 	if actor.ptr == nil then
 		co:complain(404,'no such user','no such user known to this server')
 		return
@@ -926,10 +922,16 @@
 		co:bytestream(mime,data)
 	return end
 
 	::e404:: do co:complain(404, 'artifact not found', 'no such artifact has been uploaded to this instance') return end
 end
+
+local json = {}
+
+terra json.webfinger(co: &lib.srv.convo)
+	
+end
 
 -- entry points
 terra r.dispatch_http(co: &lib.srv.convo, uri: lib.mem.ptr(int8), meth: method.t)
 	lib.dbg('handling URI of form ', {uri.ptr,uri.ct})
 	co.navbar = lib.render.nav(co)
@@ -967,23 +969,27 @@
 			then goto notfound
 			else co:reroute_cookie('/','auth=; Path=/')
 		end
 	else -- hierarchical routes
 		var path = lib.http.hier(&co.srv.pool, uri) --defer path:free()
-		if path.ct > 1 and path(0):cmp(lib.str.lit('user')) then
+		if path.ct > 1 and path(0):cmp('user') then
 			http.actor_profile_uid(co, path, meth)
-		elseif path.ct > 1 and path(0):cmp(lib.str.lit('post')) then
+		elseif path.ct > 1 and path(0):cmp('post') then
 			http.tweet_page(co, path, meth)
-		elseif path(0):cmp(lib.str.lit('tl')) then
+		elseif path(0):cmp('tl') then
 			http.timeline(co, path)
-		elseif path(0):cmp(lib.str.lit('media')) then
+		elseif path(0):cmp('.well-known') then
+			if path(1):cmp('webfinger') then
+				json.webfinger(co)
+			end
+		elseif path(0):cmp('media') then
 			if co.aid == 0 then goto unauth end
 			http.media_manager(co, path, meth, co.who.id)
-		elseif path(0):cmp(lib.str.lit('doc')) then
+		elseif path(0):cmp('doc') then
 			if not meth_get(meth) then goto wrongmeth end
 			http.documentation(co, path)
-		elseif path(0):cmp(lib.str.lit('conf')) then
+		elseif path(0):cmp('conf') then
 			if co.aid == 0 then goto unauth end
 			http.configure(co,path,meth)
 		else goto notfound end
 	end
 	do return end

Index: srv.t
==================================================================
--- srv.t
+++ srv.t
@@ -306,10 +306,22 @@
 		})
 	end
 end
 
 terra convo:stdpage(pg: convo.page) self:statpage(200, pg) end
+
+terra convo:bytestream_trusted(lockdown: bool, mime: pstring, data: lib.mem.ptr(uint8))
+	var lockhdr = "Content-Security-Policy: sandbox; default-src 'none'; form-action 'none'; navigate-to 'none';\r\n"
+	if not lockdown then lockhdr = "" end
+	lib.net.mg_printf(self.con, "HTTP/1.1 200 OK\r\nContent-Type: %.*s\r\nContent-Length: %llu\r\n%sX-Content-Options: nosniff\r\n\r\n", mime.ct, mime.ptr, data.ct + 2, lockdown)
+	lib.net.mg_send(self.con, data.ptr, data.ct)
+	lib.net.mg_send(self.con, '\r\n', 2)
+end
+
+terra convo:json(data: pstring)
+	self:bytestream_trusted(false, 'application/ld+json', data:blob())
+end
 
 terra convo:bytestream(mime: pstring, data: lib.mem.ptr(uint8))
 	-- TODO this is not a satisfactory solution; it's a bandaid on a gaping
 	-- chest wound. ultimately we need to compile a whitelist of safe mime
 	-- types as part of mimelib, but that is no small task. for now, this
@@ -321,13 +333,11 @@
 	then -- danger will robinson
 		mime = 'text/plain'
 	elseif mime:cmp('application/x-shockwave-flash') then
 		mime = 'application/octet-stream'
 	end
-	lib.net.mg_printf(self.con, "HTTP/1.1 200 OK\r\nContent-Type: %.*s\r\nContent-Length: %llu\r\nContent-Security-Policy: sandbox; default-src 'none'; form-action 'none'; navigate-to 'none';\r\nX-Content-Options: nosniff\r\n\r\n", mime.ct, mime.ptr, data.ct + 2)
-	lib.net.mg_send(self.con, data.ptr, data.ct)
-	lib.net.mg_send(self.con, '\r\n', 2)
+	self:bytestream_trusted(true, mime, data)
 end
 
 terra convo:reroute_cookie(dest: rawstring, cookie: rawstring)
 	var hdrs = array(
 		lib.http.header { key = 'Content-Type', value = 'text/html; charset=UTF-8' },