1 files changed, 27 insertions, 3 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index a27522d..ce38d35 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -21,7 +21,31 @@
  */
 
 const PBKDF2_ITERATIONS = 600000;  // OWASP 2023 recommendation for PBKDF2-SHA512
-const HUB = '';                     // same origin
+/**
+ * Where the hub is, and how to reach it — resolved when a call is made, not
+ * when this file loads.
+ *
+ * This used to be `const HUB = ''`, "same origin", which is true of a page the
+ * hub served and false of one loaded from a package: there the origin is
+ * `app://meshbay`, so `/v1/users/register` resolved against it and the
+ * application's own protocol handler answered 404. Registration and sign-in —
+ * the first two things anybody does — failed with "Not found".
+ *
+ * This is a classic script, loaded before the module graph, so it cannot import
+ * the adapter. It reads the global the adapter publishes, at call time: by then
+ * `platform.js` has run, and in a browser both of these are exactly what they
+ * were before.
+ */
+function hubBase() {
+  const p = typeof window !== 'undefined' && window.MeshBayPlatform;
+  return p ? p.hubBase() : '';
+}
+
+function hubCall(path, init) {
+  const p = typeof window !== 'undefined' && window.MeshBayPlatform;
+  return p && p.apiFetch ? p.apiFetch(hubBase() + path, init)
+                         : fetch(hubBase() + path, init);
+}
 
 // ── Auth key derivation (password split) ──────────────────────────────────────
 
@@ -198,7 +222,7 @@ async function registerUser(username, email, password) {
   // It also means the hub stores no user key to publish, which is what H3 read.
   const authKey = await deriveAuthKey(password, username);
 
-  const resp = await fetch(`${HUB}/v1/users/register`, {
+  const resp = await hubCall('/v1/users/register', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ username, email, auth_key: authKey }),
@@ -258,7 +282,7 @@ async function decryptBundleWithKey(bundleB64, aesKeyOrPair) {
 async function loginAndRecover(username, password) {
   const authKey = await deriveAuthKey(password, username);
 
-  const resp = await fetch(`${HUB}/v1/users/login`, {
+  const resp = await hubCall('/v1/users/login', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ username, auth_key: authKey }),