# Your page

Your page lives at `neverlogoff.com/@yourname`. You claim a name once, build the page, and anyone with the link can open it. [Preview]

## Claim a name [Preview]

- Sign in, link a wallet, and confirm you are 18 or over, then pick a name at `/sites`.
- 3 to 30 letters, numbers or hyphens; no hyphen at the start or end, and no two in a row.
- One name per person. In this first version you cannot change it or give it up.
- Names that look like another name, or like us, are refused: if `alice` is taken, `a1ice` is too.

## Build it from blocks [Preview]

Your page is a stack of blocks: an about box, links, a wall of posts, one post, a stream, clips, ways to get paid, and your own HTML. You build it at `/me/page`, with a phone and a laptop preview side by side, or your own AI builds it for you.

- Each block has its own audience: only you, people you approve, your followers, or everyone. A block someone may not see is left out entirely.
- A private block never turns public without your yes.
- The last 10 versions are kept, so you can undo.
- Arrange the same blocks differently for a computer, a phone and your stream: see [Scenes](/agents/scenes.md).

<!-- diagram: blocks-page -->

## The social wall [Preview]

The wall shows posts on your page: your own, people you follow, a saved search (for example "food england", which also finds Manchester), or a mix. Visitors can switch between a photo grid, a list, a video player, a timeline and a map; you can filter by type, date and language. Newest first, always: nothing is ranked by likes. Every post keeps its own audience, and a post someone may not see looks exactly like one that does not exist.

## Using your own HTML [Preview]

Instead of blocks, you can upload your own HTML, CSS and JavaScript. For safety it runs **boxed in**: no cookies, no way to act as you or a visitor, no pop-ups, camera, microphone, location or payments, and it cannot take over the tab. A bar above it says it is a user page, with a report link. It can still ask a visitor's wallet to sign something: never sign on a page you do not trust.

## Limits [Preview]

| What | Free limit |
|---|---|
| Whole page | 50 MB |
| Files | 2,000 |
| One file | 4 MB |
| Uploads | 20 an hour |
| Pages per person | 1 |

File types: html, htm, css, js, mjs, json, txt, svg, png, jpg, jpeg, gif, webp, avif, ico, woff, woff2, ttf, otf, wasm.

## Undo a change [Preview]

Every upload is a new version, and publishing switches to it all at once. If something breaks, **roll back** to the previous version; roll back again to undo that.

## What can go wrong

- **The name you want is refused:** it is taken, looks like a taken name, or looks like ours. Try another; you cannot change it later.
- **"Link a wallet first":** claiming a name and publishing need a linked wallet, at [Your wallet](/me/wallet).
- **A block is missing for a visitor:** its audience is narrower than everyone. Check who it is set to.
- **Something broke after a change:** undo it from the versions list, or roll back.
- **Someone copies your page or uses your name:** [report it](/trust).

<!-- agent -->

## For agents

Start with [the quickstart](/agents/quickstart.md): the keys, the block types and a worked example. This part covers the own-HTML site.

Ask the person **before** you claim a name (it cannot be changed), publish, or roll back a live page. You may check whether a name is free, prepare files and run a dry run alone. Never put a wallet "connect" or "sign" prompt on a page unless the person asked for it, and never copy the look of neverlogoff.com.

## Site pass

1. The person signs in at `/sites` in their browser. You cannot: the sign-in cookie is not readable by scripts.
2. In that browser, `POST /api/sites/pass-nonce` returns `{ nonce, message, expires_at }`; the message says it moves no funds.
3. The person signs `message` in their wallet; `POST /api/sites/pass` with `{ nonce, signature }` returns the pass: good for **15 minutes** and **one site**.
4. The person pastes the pass to you. Send it as `Authorization: Bearer <pass>`. A post pass or page key is refused here (`token_wrong_type`).

## Endpoints

| Method | Path | Auth | Does |
|---|---|---|---|
| GET | `/api/sites/me` | sign-in cookie | name, wallet, current version, limits |
| GET | `/api/sites/check?name=alice` | none | is a name free |
| POST | `/api/sites/claim` | sign-in cookie | claim a name |
| PUT | `/api/sites/upload?path=<file>` | site pass | one file, 4 MB max |
| POST | `/api/sites/publish` | site pass | switch visitors to the new version (ask first) |
| POST | `/api/sites/rollback` | site pass or cookie | swap current and previous |
| POST | `/api/sites/report` | none | report a page |

<!-- example: nlo-sites-v0#claim -->
```json
{ "name": "alice" }
```

<!-- example: nlo-sites-v0#report -->
```json
{ "name": "alice", "reason": "scam_or_drainer", "detail": "asks visitors to sign a wallet message" }
```

Report reasons: `scam_or_drainer`, `malware`, `impersonation`, `illegal`, `abuse`, `other`.

The command-line uploaders (`nlo-site-push` for a site, `nlo-page-push` for a block page) are built but have no download place yet.

## Errors

| Code | Means |
|---|---|
| `not_signed_in` | no sign-in cookie |
| `no_linked_wallet` | link a wallet first |
| `age_attestation_required` | confirm 18 or over first |
| `name_taken` | someone has it |
| `name_confusable_taken` | a look-alike name is taken |
| `one_site_per_person` | already has a name |
| `token_wrong_type` | that pass is for something else |
| `token_expired` | the 15 minutes are up |
| `file_too_large` | over 4 MB |
| `upload_rate_limited` | more than 20 uploads this hour |
| `nothing_to_roll_back_to` | no previous version |