AtomGraph · namedgraph · Jun 19, 2026 · Jun 19, 2026
diff --git a/docs/about.ttl b/docs/about.ttl
@@ -49,7 +49,7 @@
         <h2 id="architecture">Architecture</h2>
         <p>Architecturally LinkedDataHub is a read-write RDF Graph Store combined with a rich Linked Data/SPARQL client. LinkedDataHub does not persist RDF data itself but rather serves it from, and stores it in,
             a backing triplestore, which by default is the <a href="https://jena.apache.org/documentation/fuseki2/" target="_blank">Apache Jena Fuseki</a>.</p>
-        <p>Every document in LinkedDataHub's dataspace is also a named graph in the Graph Store and has both RDF and HTML representations. The client is implemented using XSLT 3.0, a standard, declarative data transformation language. It can connect to any Linked Data resource or SPARQL 1.1 endpoint.</p>
+        <p>Every document in LinkedDataHub's dataspace is also a named graph in the Graph Store and has both RDF and HTML representations. The client is implemented using XSLT 3.0, a standard, declarative data transformation language. The same stylesheets run in two environments: on the server (Saxon-HE) to produce the initial HTML response, and in the browser (Saxon-JS 3 with Interactive XSLT) to render the layout and drive all subsequent navigation without full page reloads. It can connect to any Linked Data resource or SPARQL 1.1 endpoint.</p>
         <p>Since version 3.x LinkedDataHub does not use the <a href="https://atomgraph.github.io/Linked-Data-Templates/" target="_blank">Linked Data Templates</a> anymore. However they can still be used to publish Linked Data from SPARQL endpoints
             using <a href="https://github.com/AtomGraph/Processor" target="_blank">Processor</a>.</p>
         <p>You can find the changelog <a href="https://github.com/AtomGraph/LinkedDataHub/blob/master/CHANGELOG.md" target="_blank">here</a>.</p>

diff --git a/docs/get-started/get-an-account.ttl b/docs/get-started/get-an-account.ttl
@@ -19,6 +19,7 @@
           <ul class="nav nav-tabs">
             <li class="active"><a>Get WebID</a></li>
             <li><a>Login with Google</a></li>
+            <li><a>Login with ORCID</a></li>
           </ul>
           <div class="tab-content">
             <div class="tab-pane active">
@@ -93,7 +94,14 @@
                 <p>Click the <span class="btn btn-primary">Login with Google</span> button in the navbar to authenticate with your Google account.</p>
                 <p>If the email address of your Google account matches the dataspace owner's email address that was specified during <a href="../setup/">setup</a>, you will be authenticated as the owner with <a href="../../reference/administration/acl/">full control</a> access rights.</p>
                 <div class="alert alert-info">
-                    <p>Login with Google is only enabled if LinkedDataHub was <a href="../../reference/configuration/#social-login">configured with social login</a>.</p>
+                    <p>Login with Google is only enabled if LinkedDataHub was <a href="../../reference/configuration/#secrets">configured with social login</a>.</p>
+                </div>
+             </div>
+             <div class="tab-pane">
+                <p>Click the <span class="btn btn-primary">Login with ORCID</span> button in the navbar to authenticate with your <a href="https://orcid.org" target="_blank">ORCID</a> account using OpenID Connect.</p>
+                <p>If the email address of your ORCID account matches the dataspace owner's email address that was specified during <a href="../setup/">setup</a>, you will be authenticated as the owner with <a href="../../reference/administration/acl/">full control</a> access rights.</p>
+                <div class="alert alert-info">
+                    <p>Login with ORCID is only enabled if LinkedDataHub was <a href="../../reference/configuration/#secrets">configured with social login</a>.</p>
                 </div>
              </div>
           </div>

diff --git a/docs/reference/configuration.ttl b/docs/reference/configuration.ttl
@@ -71,6 +71,11 @@
                 <dd><a href="../../get-started/get-an-account/">Login with Google</a> authentication is enabled when this value is provided</dd>
                 <dt><samp>google_client_secret</samp></dt>
                 <dd><a href="https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid">OAuth client secret</a></dd>
+                <dt><samp>orcid_client_id</samp></dt>
+                <dd><a href="https://info.orcid.org/documentation/integration-guide/registering-a-public-api-client/">ORCID OpenID Connect client ID</a></dd>
+                <dd><a href="../../get-started/get-an-account/">Login with ORCID</a> authentication is enabled when this value is provided</dd>
+                <dt><samp>orcid_client_secret</samp></dt>
+                <dd><a href="https://info.orcid.org/documentation/integration-guide/registering-a-public-api-client/">ORCID OpenID Connect client secret</a></dd>
                 <dt><samp>credentials</samp></dt>
                 <dd>RDF dataset file (<samp>./secrets/credentials.trig</samp>) containing service authentication credentials (optional)</dd>
                 <dd>Supports HTTP Basic authentication (<code>a:authUser</code>, <code>a:authPwd</code>) and Bearer token authentication (<code>a:authToken</code>)</dd>

diff --git a/docs/reference/dataspace.ttl b/docs/reference/dataspace.ttl
@@ -15,8 +15,8 @@
         <h2 id="dataspaces">Dataspaces</h2>
         <p>The LinkedDataHub URI address space is split into <dfn>dataspaces</dfn>. Every dataspace consists of a pair of LinkedDataHub applications:
             <a href="#end-user-apps">end-user</a> and <a href="#admin-apps">administration</a>.</p>
-        <p>The end-user app will be available on the given base URI; the admin app will be available
-            at that base URI with <code>admin/</code> appended. The <a href="../administration/acl/#agents">agent</a> that installed the admin dataset will be the application <dfn>owner</dfn>.</p>
+        <p>The end-user app will be available on the given base URI; the admin app will be available on the corresponding
+            <code>admin.</code> subdomain (e.g. the admin app of <samp>https://example.com/</samp> is served at <samp>https://admin.example.com/</samp>). The <a href="../administration/acl/#agents">agent</a> that installed the admin dataset will be the application <dfn>owner</dfn>.</p>
         <p>The <dfn>secretary</dfn> is a special agent which represents the software application itself. It is distinct from the owner agent and is used to delegate the owner's access.</p>
         <div>
             <h3 id="configuring-dataspaces">Configuring dataspaces</h3>
@@ -66,9 +66,13 @@
         <div>
             <h3 id="admin-apps">Administration</h3>
             <p>Every administration application is related to one <a href="#end-user-apps">end-user application</a>. It cannot exist standalone.</p>
-            <p>The base URI(s) of an administration application is the base URI(s) of its end-user application with <code>admin/</code> appended
-                to it. Note that any URIs in the end-user application that are equal or relative to the admin application base URI <em>will not
-                be accessible</em>.</p>
+            <p>The base URI of an administration application is the base URI of its end-user application with the <code>admin.</code> subdomain
+                prefixed to the host (e.g. <samp>https://example.com/</samp> &#8594; <samp>https://admin.example.com/</samp>). Because the admin application lives on
+                its own subdomain (origin), it no longer occupies a path within the end-user application.</p>
+            <div class="alert alert-info">
+                <p>Since LinkedDataHub 5.1.0 the administration application is served on the <code>admin.</code> subdomain rather than under an
+                    <code>admin/</code> path. The subdomain must resolve in DNS and be covered by the server's TLS certificate.</p>
+            </div>
             <p>Administration application provides means to control the <a href="../administration/ontologies/">domain model</a> and the
                 <a href="../administration/acl/">access control</a> of its end-user application. Only dataspace owners have access to its
                 administration application.</p>

diff --git a/docs/reference/http-api.ttl b/docs/reference/http-api.ttl
@@ -238,6 +238,9 @@ Content-Type: text/turtle</code></pre>
             All HTTP methods are supported.</p>
         <p>If the URL dereferences successfully as RDF, LinkedDataHub forwards its response body (re-serializing it to enable content negotiation).
             During a write request, the request body is forwarded to the provided URL.</p>
+        <p>If the URL returns an HTML document, LinkedDataHub extracts every embedded <a href="https://json-ld.org/" target="_blank">JSON-LD</a> script
+            (<code>&lt;script type="application/ld+json"&gt;</code>) and parses it as RDF using JSON-LD 1.1, so pages annotated with <a href="https://schema.org/" target="_blank">schema.org</a> markup
+            can be browsed as Linked Data. The schema.org JSON-LD context is bundled with LinkedDataHub and served locally, so no external network request is made to resolve it.</p>
         <p>The proxy only accepts external (non-relative to the current application's base URI) URLs; local URLs have to be dereferenced directly.</p>
     </div>
     <div>

diff --git a/docs/reference/stylesheets.ttl b/docs/reference/stylesheets.ttl
@@ -47,7 +47,8 @@
             <p>One XSLT stylesheet can be specified per application. In order to reuse LinkedDataHub's built-in templates, it should import the <a href="https://github.com/AtomGraph/LinkedDataHub/blob/master/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/layout.xsl" target="_blank">system stylesheet <samp>layout.xsl</samp></a> and only override the necessary templates. That is however not a requirement, the stylesheet could also use its own independent transformation logic.</p>
             <p>If there is no stylesheet specified for the application, the system stylesheet is used. It defines the overall layout and imports resource-level and container-specific stylesheets, as well as per-vocabulary stylesheets.</p>
             <p>Note that LinkedDataHub itself imports stylesheets from <a href="https://github.com/AtomGraph/Web-Client" target="_blank">Web-Client</a>, which uses the same template modes but produces a much simpler layout.</p>
-            <p>There is also a special <a href="https://github.com/AtomGraph/LinkedDataHub/blob/master/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/client.xsl" target="_blank">client-side stylesheet</a> which is not used to render a full layout, but only manipulate DOM elements in the browser in response to user or system events. It is processed using <a href="http://www.saxonica.com/saxon-js/index.xml" target="_blank">Saxon-JS</a> which provides IXSL (<a href="https://www.saxonica.com/saxon-js/documentation/index.html#!ixsl-extension" target="_blank">client-side extensions for XSLT</a>). It imports and reuses some of the same sub-stylesheets as the server-side system stylesheet does, but avoids loading per-vocabulary stylesheets in order to improve page load time. Templates of the client-side stylesheet can also be overridden.</p>
+            <p>The same XSLT 3.0 stylesheets run in two environments. On the server they are executed by Saxon-HE to produce the initial HTML response. In the browser they are executed by <a href="https://www.saxonica.com/saxon-js/index.xml" target="_blank">Saxon-JS 3</a>, which provides IXSL (<a href="https://www.saxonica.com/saxonjs/documentation3/index.html#!ixsl-extension" target="_blank">Interactive XSLT extensions</a>) for reading and manipulating the browser DOM.</p>
+            <p>There is a dedicated <a href="https://github.com/AtomGraph/LinkedDataHub/blob/master/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/client.xsl" target="_blank">client-side stylesheet <samp>client.xsl</samp></a> that drives the browser. After the server-rendered page loads, its <code>main</code> template renders the layout client-side — the left sidebar, navigation, document and tab panes, content blocks, forms and modal dialogs are injected into the DOM using IXSL (e.g. <code>ixsl:append-content</code>). It also handles all subsequent navigation, so following links and switching documents re-renders in place without a full page reload. It imports and reuses the same document-, resource- and property-level templates as the server-side system stylesheet, but avoids loading per-vocabulary stylesheets in order to improve page load time. Templates of the client-side stylesheet can also be overridden.</p>
         </div>
         <div>
             <h3 id="namespaces">Namespaces</h3>
@@ -137,11 +138,6 @@
                     </tr>
                 </thead>
                 <tbody>
-                    <tr>
-                        <td><code>$ldt:base</code></td>
-                        <td><code>xs:anyURI</code></td>
-                        <td>Base URI of the current application</td>
-                    </tr>
                     <tr>
                         <td><code>$lapp:Application</code></td>
                         <td><code>document-node()?</code></td>
@@ -160,7 +156,7 @@
                     <tr>
                         <td><code>$ac:endpoint</code></td>
                         <td><code>xs:anyURI</code></td>
-                        <td>SPARQL query endpoint URI (defaults to <code>resolve-uri('sparql', $ldt:base)</code>)</td>
+                        <td>SPARQL query endpoint URI (defaults to <code>resolve-uri('sparql', ldt:base())</code>)</td>
                     </tr>
                     <tr>
                         <td><code>$sd:endpoint</code></td>
@@ -182,11 +178,6 @@
                         <td><code>xs:anyURI*</code></td>
                         <td>Current layout mode (derived: <code>ldh:ContentMode</code> if the document has content blocks, otherwise <code>ac:ReadMode</code>)</td>
                     </tr>
-                    <tr>
-                        <td><code>$lapp:origin</code></td>
-                        <td><code>xs:anyURI</code></td>
-                        <td>Origin URI of the current application</td>
-                    </tr>
                 </tbody>
             </table>
         </div>
@@ -223,6 +214,16 @@
                         <td><code>xs:string?</code></td>
                         <td>Extracts the fragment identifier (the part after <code>#</code>)</td>
                     </tr>
+                    <tr>
+                        <td><code>lapp:origin()</code></td>
+                        <td><code>xs:anyURI</code></td>
+                        <td>Returns the origin (scheme, host and port) of the current application, e.g. <code>https://localhost:4443/</code>. Used to build absolute URIs for static resources and same-site requests</td>
+                    </tr>
+                    <tr>
+                        <td><code>ldt:base()</code></td>
+                        <td><code>xs:anyURI</code></td>
+                        <td>Returns the base URI of the current application. Replaces the former <code>$ldt:base</code> parameter</td>
+                    </tr>
                     <tr>
                         <td><code>ldh:request-uri()</code></td>
                         <td><code>xs:anyURI</code></td>
@@ -238,6 +239,11 @@
                         <td><code>xs:anyURI</code></td>
                         <td>Resolves a URI to a local href, proxying external URIs through the LinkedDataHub proxy. Overloads accept <code>$query-params as map(xs:string, xs:string*)</code> and <code>$fragment as xs:string?</code></td>
                     </tr>
+                    <tr>
+                        <td><code>ldh:parse-href($href as xs:anyURI)</code></td>
+                        <td><code>map(xs:string, item()?)</code></td>
+                        <td>Inverse of <code>ldh:href()</code> — parses a local href back into its target URI, query parameters and fragment. Shared by the client-side navigation handlers</td>
+                    </tr>
                     <tr>
                         <td><code>ldh:query-params($mode as xs:anyURI*)</code></td>
                         <td><code>map(xs:string, xs:string*)</code></td>
@@ -386,7 +392,7 @@
                 each LinkedDataHub instance. As a result, retrieving their descriptions by dereferencing their URIs using <code>document()</code> does not incur an HTTP request and is much faster. The URI-to-file mapping
                 is defined as Jena's <a href="https://jena.apache.org/documentation/io/rdf-input.html#configuring-a-locationmapper" target="_blank">location mapping</a> and can be found in
                 <a href="https://github.com/AtomGraph/LinkedDataHub/blob/master/src/main/resources/location-mapping.n3" target="_blank"><samp>location-mapping.n3</samp></a> and <a href="https://github.com/AtomGraph/LinkedDataHub/blob/master/src/main/resources/prefix-mapping.n3" target="_blank"><samp>prefix-mapping.n3</samp></a>.</p>
-            <p>Client-side stylesheets use <a href="https://www.saxonica.com/saxon-js/documentation/index.html#!ixsl-extension/instructions/schedule-action" target="_blank"><code>&lt;ixsl:schedule-action&gt;</code></a> (deprecated) and <a href="https://www.saxonica.com/saxonjs/documentation3/index.html#!ixsl-extension/instructions/promise" target="_blank"><code>&lt;ixsl:promise&gt;</code></a> to load XML documents asynchronously.</p>
+            <p>Client-side stylesheets use <a href="https://www.saxonica.com/saxonjs/documentation3/index.html#!ixsl-extension/instructions/schedule-action" target="_blank"><code>&lt;ixsl:schedule-action&gt;</code></a> (deprecated) and <a href="https://www.saxonica.com/saxonjs/documentation3/index.html#!ixsl-extension/instructions/promise" target="_blank"><code>&lt;ixsl:promise&gt;</code></a> to load XML documents asynchronously. The metadata required to render forms — constructors, SHACL shapes, and property and object descriptions — is loaded client-side through chains of <code>&lt;ixsl:promise&gt;</code>, so the browser fetches it on demand rather than the server fetching everything up front.</p>
         </div>
     </div>
     <div>

diff --git a/docs/reference/user-interface.ttl b/docs/reference/user-interface.ttl
@@ -102,10 +102,19 @@
             <dt>Chart</dt>
             <dd>Renders the metadata of the <a href="../data-model/resources/">resources</a> in the current document as a chart with (multiple chart types are supported, such as table, scatter chart, timeline etc.)</dd>
             <dt>Graph</dt>
-            <dd>Renders <a href="../data-model/resources/">resources</a> in the current document graphically as nodes in a network using
-            force-directed layout.</dd>
+            <dd>Renders <a href="../data-model/resources/">resources</a> in the current document graphically as nodes in an interactive 3D network using a
+            force-directed layout. Clicking a node shows its details, double-clicking loads the resource, and right-clicking a URI node loads its backlinks (resources pointing at it).
+            The canvas can be toggled to fullscreen (press <kbd>Esc</kbd> to exit), and the graph state is preserved across search and filter re-renders.</dd>
         </dl>
     </div>
+    <div>
+        <h2 id="document-tabs">Document tabs</h2>
+        <p>LinkedDataHub navigates within a single page. When you follow a link to an external document (for example a resource fetched through the
+            <a href="../http-api/#linked-data-proxy">Linked Data proxy</a>), it opens in its own tab so that several documents can be kept open side by side.
+            A sticky tab bar appears at the top of the page once the first external tab is opened.</p>
+        <p>Each tab keeps its own content pane, and modal dialogs (such as creation and edit forms) are scoped to the active tab pane. Switching between tabs is cached, so
+            returning to a previously opened tab does not re-fetch it. Closing a tab removes its pane and falls back to the base document's tab.</p>
+    </div>
     <div>
         <h2 id="creation-bar">Creation bar</h2>
         <p>The creation bar serves different functions depending on the current mode:</p>