@undefineds.co/xpod 0.4.16 → 0.4.18

package/node_modules/@undefineds.co/shared-ui/dist/toast.js

@@ -64,5 +64,5 @@ function getSnapshot() {
 }
 export function Toaster({ className }) {
     const toasts = useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
-    return (_jsx("div", { "aria-live": "polite", role: "status", className: cn('pointer-events-none fixed bottom-4 right-4 z-[100] flex w-full max-w-sm flex-col gap-2', className), children: toasts.map((item) => (_jsxs("div", { className: cn(toastVariants({ variant: item.variant }), item.className), children: [_jsxs("div", { className: "min-w-0 flex-1", children: [item.title ? _jsx("p", { className: "font-medium", children: item.title }) : null, item.description ? _jsx("p", { className: cn(item.title ? 'mt-0.5' : undefined), children: item.description }) : null] }), _jsx("button", { type: "button", "aria-label": "\u5173\u95ED\u901A\u77E5", className: cn('shrink-0 rounded-sm opacity-60 transition-opacity hover:opacity-100', interactiveFocusClass), onClick: () => dismissToast(item.id), children: _jsx(X, { "aria-hidden": "true", className: "h-3.5 w-3.5" }) })] }, item.id))) }));
+    return (_jsx("div", { "aria-live": "polite", role: "status", className: cn('pointer-events-none fixed bottom-4 right-4 z-[var(--layer-toast)] flex w-full max-w-sm flex-col gap-2', className), children: toasts.map((item) => (_jsxs("div", { className: cn(toastVariants({ variant: item.variant }), item.className), children: [_jsxs("div", { className: "min-w-0 flex-1", children: [item.title ? _jsx("p", { className: "font-medium", children: item.title }) : null, item.description ? _jsx("p", { className: cn(item.title ? 'mt-0.5' : undefined), children: item.description }) : null] }), _jsx("button", { type: "button", "aria-label": "\u5173\u95ED\u901A\u77E5", className: cn('shrink-0 rounded-sm opacity-60 transition-opacity hover:opacity-100', interactiveFocusClass), onClick: () => dismissToast(item.id), children: _jsx(X, { "aria-hidden": "true", className: "h-3.5 w-3.5" }) })] }, item.id))) }));
 }

package/node_modules/@undefineds.co/shared-ui/dist/tooltip.js

@@ -5,6 +5,6 @@ import { cn } from "./utils.js";
 const TooltipProvider = TooltipPrimitive.Provider;
 const Tooltip = TooltipPrimitive.Root;
 const TooltipTrigger = TooltipPrimitive.Trigger;
-const TooltipContent = React.forwardRef(({ className, sideOffset = 4, ...props }, ref) => (_jsx(TooltipPrimitive.Content, { ref: ref, sideOffset: sideOffset, className: cn("z-50 overflow-hidden rounded-md border border-border/50 bg-popover", "px-2 py-1 text-xs text-popover-foreground shadow-md", "animate-in fade-in-0 zoom-in-95", "data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95", "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2", "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2", className), ...props })));
+const TooltipContent = React.forwardRef(({ className, sideOffset = 4, ...props }, ref) => (_jsx(TooltipPrimitive.Content, { ref: ref, sideOffset: sideOffset, className: cn("z-[var(--layer-popover)] overflow-hidden rounded-md border border-border/50 bg-popover", "px-2 py-1 text-xs text-popover-foreground shadow-md", "animate-in fade-in-0 zoom-in-95", "data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95", "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2", "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2", className), ...props })));
 TooltipContent.displayName = TooltipPrimitive.Content.displayName;
 export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };

package/node_modules/@undefineds.co/solid-sdk/dist/access-route.cjs

@@ -41,7 +41,8 @@ var exports_access_route = {};
 __export(exports_access_route, {
   usableRoutes: () => usableRoutes,
   createSolidAccessRouteFetch: () => createSolidAccessRouteFetch,
-  chooseAccessRoute: () => chooseAccessRoute
+  chooseAccessRoute: () => chooseAccessRoute,
+  NoUsableAccessRouteError: () => NoUsableAccessRouteError
 });
 module.exports = __toCommonJS(exports_access_route);
 
@@ -148,24 +149,34 @@ async function chooseAccessRoute(routeSet, options = {}) {
   if (candidates.length === 0) {
     return null;
   }
+  const best = candidates[0];
+  if (isSelfProvenRoute(best)) {
+    return best;
+  }
   const probe = options.probe ?? defaultProbe;
   const timeoutMs = options.probeTimeoutMs ?? 1000;
   const results = await Promise.all(candidates.map(async (route) => ({
     route,
-    ok: await probeWithTimeout(route, probe, timeoutMs)
+    ok: isSelfProvenRoute(route) || await probeWithTimeout(route, probe, timeoutMs)
   })));
   return results.find((result) => result.ok)?.route ?? null;
 }
+function isSelfProvenRoute(route) {
+  return route.health === "healthy";
+}
 function usableRoutes(routeSet, managedClient, allowLocalOnlyRoutes) {
   return routeSet.routes.filter((route) => route.health !== "unreachable").filter((route) => managedClient || !route.requiresManagedClient).filter((route) => allowLocalOnlyRoutes || route.visibility !== "local-only").slice().sort((left, right) => left.priority - right.priority || left.id.localeCompare(right.id));
 }
 function createSolidAccessRouteFetch(options) {
   const managedClient = options.managedClient ?? true;
   let selected;
+  let failed;
   const selectRoute = async () => {
+    const all = options.routes();
+    const routes = failed === undefined ? all : all.filter((route) => routeKey(route) !== failed);
     const routeSet = {
-      canonicalUrl: options.routes()[0]?.canonicalUrl ?? "",
-      routes: options.routes()
+      canonicalUrl: routes[0]?.canonicalUrl ?? "",
+      routes
     };
     const candidate = await chooseAccessRoute(routeSet, {
       managedClient,
@@ -189,24 +200,88 @@ function createSolidAccessRouteFetch(options) {
       localBaseUrl: route.targetUrl
     }]
   });
+  const routeCovers = (url) => Boolean(resolveSolidLocalRouteUrl(url, options.routes().map(toLocalRoute)));
+  const unreachablePassThrough = (input) => {
+    const url = requestUrl2(input);
+    if (!url || !routeCovers(url)) {
+      return;
+    }
+    const routes = options.routes();
+    const preferred = usableRoutes({ canonicalUrl: routes[0]?.canonicalUrl ?? "", routes }, managedClient, options.allowLocalOnlyRoutes ?? false)[0];
+    if (!preferred || sameOrigin(preferred.targetUrl, url)) {
+      return;
+    }
+    return url;
+  };
   return async (input, init) => {
     const route = await routeFor();
     if (!route) {
+      const unreachable = unreachablePassThrough(input);
+      if (unreachable) {
+        throw new NoUsableAccessRouteError(unreachable.href, options.routes());
+      }
       return init === undefined ? options.fetch.call(globalThis, input) : options.fetch.call(globalThis, input, init);
     }
     try {
-      return await routedFetchFor(route)(input, init);
+      const response = await routedFetchFor(route)(input, init);
+      failed = undefined;
+      return response;
     } catch (error) {
+      failed = routeKey(route);
       selected = undefined;
       await options.refreshRoutes?.();
       const retryRoute = await selectRoute();
-      if (!retryRoute || retryRoute.id === route.id) {
-        throw error;
+      if (retryRoute && routeKey(retryRoute) !== routeKey(route)) {
+        return routedFetchFor(retryRoute)(input, init);
       }
-      return routedFetchFor(retryRoute)(input, init);
+      const url = requestUrl2(input);
+      if (url && routeCovers(url)) {
+        throw new NoUsableAccessRouteError(url.href, options.routes(), error);
+      }
+      throw error;
     }
   };
 }
+function routeKey(route) {
+  return `${route.id}|${route.targetUrl}`;
+}
+
+class NoUsableAccessRouteError extends Error {
+  url;
+  routes;
+  reason;
+  constructor(url, routes, reason) {
+    super(`No usable access route can reach ${url}`);
+    this.url = url;
+    this.routes = routes;
+    this.reason = reason;
+    this.name = "NoUsableAccessRouteError";
+  }
+}
+function toLocalRoute(route) {
+  return { canonicalBaseUrl: route.canonicalUrl, localBaseUrl: route.targetUrl };
+}
+function sameOrigin(value, url) {
+  try {
+    return new URL(value).origin === url.origin;
+  } catch {
+    return false;
+  }
+}
+function requestUrl2(input) {
+  if (input instanceof Request) {
+    try {
+      return new URL(input.url);
+    } catch {
+      return;
+    }
+  }
+  try {
+    return new URL(String(input));
+  } catch {
+    return;
+  }
+}
 async function probeWithTimeout(route, probe, timeoutMs) {
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -218,6 +293,9 @@ async function probeWithTimeout(route, probe, timeoutMs) {
     clearTimeout(timer);
   }
 }
+function answersAccessRoute(response) {
+  return response.status < 500;
+}
 async function defaultProbe(route, signal) {
   if (!route.targetUrl.startsWith("http://") && !route.targetUrl.startsWith("https://")) {
     return route.health === "healthy";
@@ -226,5 +304,5 @@ async function defaultProbe(route, signal) {
     method: "HEAD",
     signal
   });
-  return response.ok || response.status === 401 || response.status === 403;
+  return answersAccessRoute(response);
 }

package/node_modules/@undefineds.co/solid-sdk/dist/access-route.d.ts

@@ -43,9 +43,20 @@ export interface ChooseAccessRouteOptions {
     probe?: (route: AccessRoute, signal: AbortSignal) => Promise<boolean> | boolean;
 }
 /**
- * Pick the best route that actually answers: candidates are ordered by priority
- * and probed in parallel, so a same-machine client lands on loopback while a
- * remote one skips it without waiting for it to time out.
+ * Pick the best route that is known to work: candidates are ordered by priority,
+ * and only the ones this client cannot vouch for are probed.
+ *
+ * A route the client already knows is up is never probed. The current origin
+ * served this very document, and the node's own runtime reports the health of
+ * the routes beside it, so a probe could only replace a known fact with a guess.
+ * That guess is what made local login fail: the local gateway answers the probe
+ * path with 405 (CSS does not implement the optional `/.well-known/solid`), the
+ * probe called the one reachable route dead, and the client fell back to a
+ * canonical URL it could not reach.
+ *
+ * Probes remain for candidates whose health is unknown, and are run in parallel
+ * so a same-machine client still lands on loopback without waiting for a remote
+ * one to time out.
  */
 export declare function chooseAccessRoute(routeSet: AccessRouteSet, options?: ChooseAccessRouteOptions): Promise<AccessRoute | null>;
 export declare function usableRoutes(routeSet: AccessRouteSet, managedClient: boolean, allowLocalOnlyRoutes: boolean): AccessRoute[];
@@ -74,3 +85,20 @@ export interface CreateSolidAccessRouteFetchOptions {
  * routes are refreshed and the request is retried once against the new best one.
  */
 export declare function createSolidAccessRouteFetch(options: CreateSolidAccessRouteFetchOptions): typeof globalThis.fetch;
+/**
+ * A URL this client can only reach through a route, with no route usable.
+ *
+ * Thrown instead of sending the request to its canonical address, because that
+ * address is not the path this client meant to take: something is wrong with the
+ * routes themselves (the node's own gateway is down, a tunnel is gone), and the
+ * caller has to say so rather than report whatever the canonical URL answers.
+ */
+export declare class NoUsableAccessRouteError extends Error {
+    readonly url: string;
+    readonly routes: readonly AccessRoute[];
+    /** The transport failure that left no route usable, when there was one. */
+    readonly reason?: unknown | undefined;
+    constructor(url: string, routes: readonly AccessRoute[], 
+    /** The transport failure that left no route usable, when there was one. */
+    reason?: unknown | undefined);
+}

package/node_modules/@undefineds.co/solid-sdk/dist/access-route.js

@@ -1,22 +1,45 @@
-import { createSolidLocalRouteFetch } from './local-route-fetch.js';
+import { createSolidLocalRouteFetch, resolveSolidLocalRouteUrl } from './local-route-fetch.js';
 /**
- * Pick the best route that actually answers: candidates are ordered by priority
- * and probed in parallel, so a same-machine client lands on loopback while a
- * remote one skips it without waiting for it to time out.
+ * Pick the best route that is known to work: candidates are ordered by priority,
+ * and only the ones this client cannot vouch for are probed.
+ *
+ * A route the client already knows is up is never probed. The current origin
+ * served this very document, and the node's own runtime reports the health of
+ * the routes beside it, so a probe could only replace a known fact with a guess.
+ * That guess is what made local login fail: the local gateway answers the probe
+ * path with 405 (CSS does not implement the optional `/.well-known/solid`), the
+ * probe called the one reachable route dead, and the client fell back to a
+ * canonical URL it could not reach.
+ *
+ * Probes remain for candidates whose health is unknown, and are run in parallel
+ * so a same-machine client still lands on loopback without waiting for a remote
+ * one to time out.
  */
 export async function chooseAccessRoute(routeSet, options = {}) {
     const candidates = usableRoutes(routeSet, options.managedClient ?? true, options.allowLocalOnlyRoutes ?? false);
     if (candidates.length === 0) {
         return null;
     }
+    const best = candidates[0];
+    if (isSelfProvenRoute(best)) {
+        return best;
+    }
     const probe = options.probe ?? defaultProbe;
     const timeoutMs = options.probeTimeoutMs ?? 1000;
     const results = await Promise.all(candidates.map(async (route) => ({
         route,
-        ok: await probeWithTimeout(route, probe, timeoutMs),
+        ok: isSelfProvenRoute(route) || await probeWithTimeout(route, probe, timeoutMs),
     })));
     return results.find((result) => result.ok)?.route ?? null;
 }
+/**
+ * A route this client can vouch for without asking: `healthy` is the runtime's
+ * own report about its own node, and the current-origin route is the document
+ * this client is already running in. `unknown` and `degraded` still get probed.
+ */
+function isSelfProvenRoute(route) {
+    return route.health === 'healthy';
+}
 export function usableRoutes(routeSet, managedClient, allowLocalOnlyRoutes) {
     return routeSet.routes
         .filter((route) => route.health !== 'unreachable')
@@ -37,10 +60,16 @@ export function usableRoutes(routeSet, managedClient, allowLocalOnlyRoutes) {
 export function createSolidAccessRouteFetch(options) {
     const managedClient = options.managedClient ?? true;
     let selected;
+    // A route that just failed the request itself is the one route we must not
+    // pick again for the retry: a trusted route that turns out to be down has to
+    // be able to fail over to a probed one. Cleared by the next success.
+    let failed;
     const selectRoute = async () => {
+        const all = options.routes();
+        const routes = failed === undefined ? all : all.filter((route) => routeKey(route) !== failed);
         const routeSet = {
-            canonicalUrl: options.routes()[0]?.canonicalUrl ?? '',
-            routes: options.routes(),
+            canonicalUrl: routes[0]?.canonicalUrl ?? '',
+            routes,
         };
         const candidate = await chooseAccessRoute(routeSet, {
             managedClient,
@@ -66,29 +95,126 @@ export function createSolidAccessRouteFetch(options) {
                 localBaseUrl: route.targetUrl,
             }],
     });
+    /**
+     * Whether this client knows a route for the URL: the URLs it may rewrite and
+     * therefore the only ones it is entitled to judge. Everything else — the IdP,
+     * another Pod — is sent unchanged, whatever the routes are doing.
+     */
+    const routeCovers = (url) => Boolean(resolveSolidLocalRouteUrl(url, options.routes().map(toLocalRoute)));
+    /**
+     * The URL a request would have to reach if it is sent unchanged, when sending
+     * it unchanged is *not* the path this client meant to take.
+     *
+     * A URL no route covers is none of our business — the IdP, another Pod — and is
+     * passed through as before. A URL whose origin is where the best route would
+     * have sent it is already its own physical address, so passing it through is
+     * exactly what that route would have done. Anything else means the client
+     * knows a shorter path and has none usable: sending the request to the
+     * canonical URL anyway would leave over a path this client cannot reach, and
+     * that has to be reported (with the candidates) instead of quietly attempted.
+     */
+    const unreachablePassThrough = (input) => {
+        const url = requestUrl(input);
+        if (!url || !routeCovers(url)) {
+            return undefined;
+        }
+        const routes = options.routes();
+        const preferred = usableRoutes({ canonicalUrl: routes[0]?.canonicalUrl ?? '', routes }, managedClient, options.allowLocalOnlyRoutes ?? false)[0];
+        if (!preferred || sameOrigin(preferred.targetUrl, url)) {
+            return undefined;
+        }
+        return url;
+    };
     return async (input, init) => {
         const route = await routeFor();
         if (!route) {
+            const unreachable = unreachablePassThrough(input);
+            if (unreachable) {
+                throw new NoUsableAccessRouteError(unreachable.href, options.routes());
+            }
             return init === undefined
                 ? options.fetch.call(globalThis, input)
                 : options.fetch.call(globalThis, input, init);
         }
         try {
-            return await routedFetchFor(route)(input, init);
+            const response = await routedFetchFor(route)(input, init);
+            failed = undefined;
+            return response;
         }
         catch (error) {
-            // The route went away (laptop moved networks, tunnel restarted). Ask for
-            // the current set once and retry against whatever is best now.
+            // The route went away (laptop moved networks, tunnel restarted, or the
+            // runtime reported a health it cannot back up). Ask for the current set
+            // once and retry against whatever is best now, without this one.
+            failed = routeKey(route);
             selected = undefined;
             await options.refreshRoutes?.();
             const retryRoute = await selectRoute();
-            if (!retryRoute || retryRoute.id === route.id) {
-                throw error;
+            if (retryRoute && routeKey(retryRoute) !== routeKey(route)) {
+                return routedFetchFor(retryRoute)(input, init);
             }
-            return routedFetchFor(retryRoute)(input, init);
+            // Nothing else can serve this request. When the URL was one this client
+            // only reaches through a route, the failure *is* "no usable route" — say
+            // so, with the transport failure kept as the reason, instead of letting
+            // the caller report whatever the canonical URL would have answered. A URL
+            // no route covers (the IdP, another Pod) keeps its own error.
+            const url = requestUrl(input);
+            if (url && routeCovers(url)) {
+                throw new NoUsableAccessRouteError(url.href, options.routes(), error);
+            }
+            throw error;
         }
     };
 }
+/** Identity of one physical path: the same route id can point at a new target. */
+function routeKey(route) {
+    return `${route.id}|${route.targetUrl}`;
+}
+/**
+ * A URL this client can only reach through a route, with no route usable.
+ *
+ * Thrown instead of sending the request to its canonical address, because that
+ * address is not the path this client meant to take: something is wrong with the
+ * routes themselves (the node's own gateway is down, a tunnel is gone), and the
+ * caller has to say so rather than report whatever the canonical URL answers.
+ */
+export class NoUsableAccessRouteError extends Error {
+    constructor(url, routes, 
+    /** The transport failure that left no route usable, when there was one. */
+    reason) {
+        super(`No usable access route can reach ${url}`);
+        this.url = url;
+        this.routes = routes;
+        this.reason = reason;
+        this.name = 'NoUsableAccessRouteError';
+    }
+}
+function toLocalRoute(route) {
+    return { canonicalBaseUrl: route.canonicalUrl, localBaseUrl: route.targetUrl };
+}
+function sameOrigin(value, url) {
+    try {
+        return new URL(value).origin === url.origin;
+    }
+    catch {
+        return false;
+    }
+}
+function requestUrl(input) {
+    if (input instanceof Request) {
+        try {
+            return new URL(input.url);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    try {
+        return new URL(String(input));
+    }
+    catch {
+        return undefined;
+    }
+}
 async function probeWithTimeout(route, probe, timeoutMs) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -102,6 +228,22 @@ async function probeWithTimeout(route, probe, timeoutMs) {
         clearTimeout(timer);
     }
 }
+/**
+ * Whether a route's host answered at all.
+ *
+ * The probe asks the target host for one small document; what it measures is
+ * reachability, not whether that host implements this optional discovery path.
+ * A Pod server that answers `HEAD /.well-known/solid` with 404/405/501 (CSS does:
+ * 405 for `HEAD`, 501 for `GET`) is up and serving this route, and the request
+ * that follows carries the canonical URL plus its own authorization. Rejecting
+ * those answers leaves a same-machine client with no route whenever the public
+ * one is down — the one case local login has to survive
+ * (`docs/multi-channel-access.md`). A failing host (5xx, or a closed socket,
+ * which throws) still reports no route.
+ */
+function answersAccessRoute(response) {
+    return response.status < 500;
+}
 async function defaultProbe(route, signal) {
     if (!route.targetUrl.startsWith('http://') && !route.targetUrl.startsWith('https://')) {
         // Non-HTTP routes (p2p sockets) report their own readiness.
@@ -111,5 +253,5 @@ async function defaultProbe(route, signal) {
         method: 'HEAD',
         signal,
     });
-    return response.ok || response.status === 401 || response.status === 403;
+    return answersAccessRoute(response);
 }

package/node_modules/@undefineds.co/solid-sdk/dist/index.cjs

@@ -67,6 +67,7 @@ __export(exports_src, {
   SOLID_LOCAL_ROUTE_CANONICAL_URL_HEADER: () => SOLID_LOCAL_ROUTE_CANONICAL_URL_HEADER,
   SOLID_LOCAL_ROUTE_CANONICAL_ORIGIN_HEADER: () => SOLID_LOCAL_ROUTE_CANONICAL_ORIGIN_HEADER,
   SOLID_LOCAL_ROUTE_CANONICAL_HOST_HEADER: () => SOLID_LOCAL_ROUTE_CANONICAL_HOST_HEADER,
+  NoUsableAccessRouteError: () => NoUsableAccessRouteError,
   DEFAULT_PROVIDERS: () => DEFAULT_PROVIDERS
 });
 module.exports = __toCommonJS(exports_src);
@@ -1163,24 +1164,34 @@ async function chooseAccessRoute(routeSet, options = {}) {
   if (candidates.length === 0) {
     return null;
   }
+  const best = candidates[0];
+  if (isSelfProvenRoute(best)) {
+    return best;
+  }
   const probe = options.probe ?? defaultProbe;
   const timeoutMs = options.probeTimeoutMs ?? 1000;
   const results = await Promise.all(candidates.map(async (route) => ({
     route,
-    ok: await probeWithTimeout(route, probe, timeoutMs)
+    ok: isSelfProvenRoute(route) || await probeWithTimeout(route, probe, timeoutMs)
   })));
   return results.find((result) => result.ok)?.route ?? null;
 }
+function isSelfProvenRoute(route) {
+  return route.health === "healthy";
+}
 function usableRoutes(routeSet, managedClient, allowLocalOnlyRoutes) {
   return routeSet.routes.filter((route) => route.health !== "unreachable").filter((route) => managedClient || !route.requiresManagedClient).filter((route) => allowLocalOnlyRoutes || route.visibility !== "local-only").slice().sort((left, right) => left.priority - right.priority || left.id.localeCompare(right.id));
 }
 function createSolidAccessRouteFetch(options) {
   const managedClient = options.managedClient ?? true;
   let selected;
+  let failed;
   const selectRoute = async () => {
+    const all = options.routes();
+    const routes = failed === undefined ? all : all.filter((route) => routeKey(route) !== failed);
     const routeSet = {
-      canonicalUrl: options.routes()[0]?.canonicalUrl ?? "",
-      routes: options.routes()
+      canonicalUrl: routes[0]?.canonicalUrl ?? "",
+      routes
     };
     const candidate = await chooseAccessRoute(routeSet, {
       managedClient,
@@ -1204,24 +1215,88 @@ function createSolidAccessRouteFetch(options) {
       localBaseUrl: route.targetUrl
     }]
   });
+  const routeCovers = (url) => Boolean(resolveSolidLocalRouteUrl(url, options.routes().map(toLocalRoute)));
+  const unreachablePassThrough = (input) => {
+    const url = requestUrl2(input);
+    if (!url || !routeCovers(url)) {
+      return;
+    }
+    const routes = options.routes();
+    const preferred = usableRoutes({ canonicalUrl: routes[0]?.canonicalUrl ?? "", routes }, managedClient, options.allowLocalOnlyRoutes ?? false)[0];
+    if (!preferred || sameOrigin(preferred.targetUrl, url)) {
+      return;
+    }
+    return url;
+  };
   return async (input, init) => {
     const route = await routeFor();
     if (!route) {
+      const unreachable = unreachablePassThrough(input);
+      if (unreachable) {
+        throw new NoUsableAccessRouteError(unreachable.href, options.routes());
+      }
       return init === undefined ? options.fetch.call(globalThis, input) : options.fetch.call(globalThis, input, init);
     }
     try {
-      return await routedFetchFor(route)(input, init);
+      const response = await routedFetchFor(route)(input, init);
+      failed = undefined;
+      return response;
     } catch (error) {
+      failed = routeKey(route);
       selected = undefined;
       await options.refreshRoutes?.();
       const retryRoute = await selectRoute();
-      if (!retryRoute || retryRoute.id === route.id) {
-        throw error;
+      if (retryRoute && routeKey(retryRoute) !== routeKey(route)) {
+        return routedFetchFor(retryRoute)(input, init);
+      }
+      const url = requestUrl2(input);
+      if (url && routeCovers(url)) {
+        throw new NoUsableAccessRouteError(url.href, options.routes(), error);
       }
-      return routedFetchFor(retryRoute)(input, init);
+      throw error;
     }
   };
 }
+function routeKey(route) {
+  return `${route.id}|${route.targetUrl}`;
+}
+
+class NoUsableAccessRouteError extends Error {
+  url;
+  routes;
+  reason;
+  constructor(url, routes, reason) {
+    super(`No usable access route can reach ${url}`);
+    this.url = url;
+    this.routes = routes;
+    this.reason = reason;
+    this.name = "NoUsableAccessRouteError";
+  }
+}
+function toLocalRoute(route) {
+  return { canonicalBaseUrl: route.canonicalUrl, localBaseUrl: route.targetUrl };
+}
+function sameOrigin(value, url) {
+  try {
+    return new URL(value).origin === url.origin;
+  } catch {
+    return false;
+  }
+}
+function requestUrl2(input) {
+  if (input instanceof Request) {
+    try {
+      return new URL(input.url);
+    } catch {
+      return;
+    }
+  }
+  try {
+    return new URL(String(input));
+  } catch {
+    return;
+  }
+}
 async function probeWithTimeout(route, probe, timeoutMs) {
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -1233,6 +1308,9 @@ async function probeWithTimeout(route, probe, timeoutMs) {
     clearTimeout(timer);
   }
 }
+function answersAccessRoute(response) {
+  return response.status < 500;
+}
 async function defaultProbe(route, signal) {
   if (!route.targetUrl.startsWith("http://") && !route.targetUrl.startsWith("https://")) {
     return route.health === "healthy";
@@ -1241,5 +1319,5 @@ async function defaultProbe(route, signal) {
     method: "HEAD",
     signal
   });
-  return response.ok || response.status === 401 || response.status === 403;
+  return answersAccessRoute(response);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@undefineds.co/xpod",
-  "version": "0.4.16",
+  "version": "0.4.18",
   "description": "Xpod is an extended Community Solid Server, offering rich-feature, production-level Solid Pod and identity management.",
   "repository": "https://github.com/undefinedsco/xpod",
   "author": "developer@undefineds.co",
@@ -385,7 +385,7 @@
     }
   },
   "optionalDependencies": {
-    "@undefineds.co/xpod-darwin-arm64": "0.4.16"
+    "@undefineds.co/xpod-darwin-arm64": "0.4.18"
   },
   "resolutions": {
     "@inrupt/solid-client-authn-browser": "^3.1.1",