fedipod 1.57.2 → 1.57.5

package/gateway.md

@@ -192,7 +192,8 @@ browser, the gateway and any app you use all work from one copy of your
 timeline, notifications, followers, settings and the rest of your FediPod
 state, made at fedipod.net from your pod, so they never disagree. Every
 fifteen minutes, whatever is happening, fedipod.net writes that copy to your
-pod and deletes it. The next time anything needs your account (FediPod, an
+pod and deletes it. If your pod will not take it, the copy stays at
+fedipod.net and is tried again an hour later. The next time anything needs your account (FediPod, an
 app, or the gateway's own work while you're away), the copy is made again from
 your pod. You don't notice, except that an app's first check after a deletion
 can take a few seconds longer. When your address moves or is closed, the copy
@@ -206,7 +207,8 @@ with one setting, `FEDIPOD_HOLD` ([netlify/README.md](netlify/README.md)).
 
 - **On**, the default and fedipod.net's choice: as above. Mail waits at the
   gateway for up to fifteen minutes, and each account's copy is written to its
-  pod and deleted every fifteen minutes.
+  pod and deleted every fifteen minutes. A pod that refuses its copy is asked
+  again an hour later.
 - **Off**: the gateway keeps no copy of anyone's account and holds no mail.
   Mail goes straight to the pod as it arrives, an app's every check reads the
   pod, and FediPod in the browser works on the pod, taking turns with the

package/lib/core/intake/group.mjs

@@ -19,9 +19,11 @@ export function isModerationAsk(intake, activity) {
   if (activity.type === 'Delete') {
     const id = typeof activity.object === 'string' ? activity.object : activity.object?.id;
     const s = id && intake.store.getStatuses().find(x => x.noteId === id);
-    // Only a post the group holds and did not author — removing those is
-    // moderation; everything else is the author's own Delete.
-    return !!s && s.kind !== 'post';
+    const by = typeof activity.actor === 'string' ? activity.actor : activity.actor?.id;
+    // Only a post the group holds, written by neither the group nor whoever
+    // is deleting it: removing those is moderation. Everything else is the
+    // author's own Delete, a moderator's of their own post included.
+    return !!s && s.kind !== 'post' && s.actor !== by;
   }
   if (activity.type === 'Add' || activity.type === 'Remove') {
     const target = typeof activity.target === 'string' ? activity.target : activity.target?.id;

package/lib/core/intake/index.mjs

@@ -370,6 +370,9 @@ export class Intake {
   }
 
   async _drainOnce() {
+    // Whether this sweep took mail in and left more in the inbox: a caller that
+    // runs one sweep and stops (a forum kept by a gateway) asks to come back.
+    this.moreWaiting = false;
     this._sweepGen = this.store.generation;
     const cooling = this.drainCooldownUntil - Date.now();
     if (cooling > 0) {
@@ -452,9 +455,10 @@ export class Intake {
     };
 
     let spent = 0;                   // deliveries taken this sweep, a batch counting each of its own
+    let cut = false;                 // stopped at the cap with the listing not finished
     for (const { url, size, receipt: hasReceipt } of items) {
       if (url.endsWith('.keep')) continue;
-      if (spent >= MAX_ITEMS_PER_DRAIN) { this._drainAgain = handled > 0 || pending.length > 0; break; }
+      if (spent >= MAX_ITEMS_PER_DRAIN) { cut = this._drainAgain = handled > 0 || pending.length > 0; break; }
       if (isBatch(url)) {
         try {
           const took = await this._takeBatch(url);
@@ -531,7 +535,9 @@ export class Intake {
     // Made progress and there is more waiting: go straight round rather than
     // sleeping. Gated on progress so a sweep that achieved nothing — a
     // cooldown, an unwritable store, poison at the head — cannot spin.
-    if (handled > 0 && all.length > items.length && !this.stopped) this._drainAgain = true;
+    const more = handled > 0 && all.length > items.length;
+    this.moreWaiting = more || cut;
+    if (more && !this.stopped) this._drainAgain = true;
   }
 
   // One delivery, alone in the inbox or in a batch: read as JSON-LD, checked

package/lib/gateway/copy.mjs

@@ -258,8 +258,10 @@ export class CopyStorage {
  * Held for `ms` at a time and extended while its holder runs, so a long run
  * keeps it and a holder that died loses it within `ms`.
  */
-export async function lockCopy(kv, h, { ms = 60_000, waitMs = 8_000, by = crypto.randomUUID() } = {}) {
-  const key = `${account(h)}/lock`;
+export const lockCopy = (kv, h, opts) => lockKey(kv, `${account(h)}/lock`, opts);
+
+/** The same lock under any key: the round holds one, so two rounds never run at once. */
+export async function lockKey(kv, key, { ms = 60_000, waitMs = 8_000, by = crypto.randomUUID() } = {}) {
   const give = (etag) => {
     let tag = etag;
     const timer = setInterval(async () => {
@@ -488,6 +490,25 @@ export async function holdOver(kv, h, { pod, podFetch, stateUrl, log = () => {}
   } finally { await kv.delete(`${h}/closing`).catch(() => {}); }
 }
 
+/**
+ * A pod that would not take an account's copy is left alone for COPY_RETRY_MS
+ * before the round asks it again (flush-mail.mjs): asked every round, a pod
+ * that goes on refusing took a quarter of the round. With no wait (`waitMs`
+ * 0), every round asks. `refusedAt` answers when the pod last refused, or 0
+ * when the account is to be tried; `afterTry` records how the try went.
+ */
+export const COPY_RETRY_MS = 3_600_000;
+export async function refusedAt(kv, h, { waitMs = COPY_RETRY_MS, now = Date.now() } = {}) {
+  if (!waitMs) return 0;
+  const at = (await readJson(kv, `${account(h)}/refused`)).doc?.at || 0;
+  return at && now - at < waitMs ? at : 0;
+}
+export async function afterTry(kv, h, ok, { waitMs = COPY_RETRY_MS, now = Date.now() } = {}) {
+  if (!waitMs) return;
+  if (!ok) await kv.set(`${account(h)}/refused`, JSON.stringify({ at: now }));
+  else if (await kv.get(`${h}/refused`)) await kv.delete(`${h}/refused`);
+}
+
 /** A copy listed with no meta is one whose delete was cut off: its documents go. */
 export async function clearLeftover(kv, h, { log = () => {} } = {}) {
   if (await copyMeta(kv, h)) return false;

package/lib/gateway/front-core.mjs

@@ -23,7 +23,7 @@ import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer, provedOwner } from './quiet.mjs';
-import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, waitsForRound, routeHereApi, routeKeeperApi, routePushApi, routeAlertApi } from './held-mail.mjs';
+import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi, routeAlertApi } from './held-mail.mjs';
 import { routeCheckApi, missingLetter } from './check-letter.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { routeForumPage } from './forum-pages.mjs';
@@ -827,17 +827,17 @@ async function route(request, ctx) {
     const standing = await accountState(ctx, up.handle, rec);
     // A browser account's mail waits here while its app is closed (held-mail.mjs), unless the hold is off.
     const away = mayBeAway(ctx, rec) && !(await isPresent(ctx, up.handle)); const held = away && holdsMail(ctx, rec);
-    const { status, reason, content, bytes, type, accountDeleted, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
+    const keptForum = !!(ctx.forum?.isForumRow(rec) && rec.keeper); // it acts on no notice that an account was deleted: its door keeps none
+    const { status, reason, content, bytes, type, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
       { podPut: held ? holdingPut(ctx, up.handle, rec) : (u, b, ct) => ctx.podPut(up.handle, u, b, ct),
-        fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null });
+        fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null, dropAccountDeleted: keptForum });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason}${held && status === 202 ? ', held' : ''})`);
     if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
     if (away && status === 202) await afterHeld(ctx, up.handle, rec, { type, notifies });
-    // A forum fedipod.net keeps: the delivery is placed now, in this request,
-    // and the run that carries it is started. Whatever could not be placed
-    // here is still in the inbox for that run. A notice that an account was deleted waits for the round's run (held-mail.mjs).
-    if (status === 202 && name && ctx.forum?.isForumRow(rec) && rec.keeper && !await waitsForRound(ctx, up.handle, rec, { accountDeleted })) {
+    // The delivery is placed now, in this request, and the run that carries it
+    // is started. Whatever could not be placed is still in the inbox for that run.
+    if (status === 202 && name && keptForum) {
       const placed = await ctx.forum.placeAtDoor(ctx, up.handle, rec, { name, raw, receipt })
         .catch((e) => ({ placed: false, why: e.message }));
       console.log(`door @${up.handle}: ${placed.placed ? 'placed' : `not placed (${placed.why})`}`);

package/lib/gateway/gateway-core.mjs

@@ -115,7 +115,9 @@ export function asSigned(request, bytes, origin) {
 // `admit(verified)`, when given, says whether the inbox has room for this
 // delivery now; one without room is answered 503 and written nowhere, so its
 // sender tries again later. Without it every delivery that passes is written.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null, admit = null } = {}) {
+// `dropAccountDeleted`: a sender's notice that its own account is gone is
+// answered and written nowhere, for an inbox whose reader acts on none.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null, admit = null, dropAccountDeleted = false } = {}) {
   // The body, once, as the bytes the sender digested; the text of it is what
   // is filed and hashed, as before.
   let bytes, raw;
@@ -131,6 +133,10 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // Edge drops — silent 202 so a rejected sender does not retry a delivery we
   // will never accept. None of these becomes a pod write.
   if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
+  // Mastodon sends one of these to every inbox it knows, for every account it deletes.
+  if (dropAccountDeleted && activity.type === 'Delete' && idOf(activity.object) === actor) {
+    return { status: 202, reason: "an account's deletion, not kept" };
+  }
   const content = !CONTROL.has(activity.type);
   if (content && paused) return { status: 202, reason: 'paused' };
   if (content && !concernsUsAtEdge(activity, ident)) {
@@ -180,11 +186,8 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // that is what preserves the pod's buffer property without the gateway
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
-  // `accountDeleted`: the sender says its own account is gone. Mastodon sends
-  // one of these to every inbox it knows, for every account it deletes.
   return { status: 202, reason: v.verified ? 'verified' : failed ? `buffered-unverified: ${failed}` : 'buffered-unverified',
-    content, bytes: bytes.byteLength, type: activity.type, accountDeleted: activity.type === 'Delete' && idOf(activity.object) === actor,
-    notifies: notifies(activity, ident), name: hash, raw, receipt };
+    content, bytes: bytes.byteLength, type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.

package/lib/gateway/held-mail.mjs

@@ -133,18 +133,6 @@ export async function wakesKeeper(ctx, handle, rec, type) {
   return true;
 }
 
-// A notice that an account was deleted, arriving for a forum this gateway
-// keeps, starts no run of its own: the forum is marked as having work, and the
-// round's run reads the notice from the inbox. False where that cannot be
-// noted, so the caller starts the run as for any delivery.
-export async function waitsForRound(ctx, handle, rec, { accountDeleted = false } = {}) {
-  const forum = rec.kind === 'application' ? handle : rec.forum;
-  if (!accountDeleted || !forum || !ctx.noteNext) return false;
-  const noted = await ctx.noteNext(forum, new Date().toISOString(), { earliest: true }).then(() => true, () => false);
-  if (noted) console.log(`door @${handle}: an account's deletion, left for the round's run of @${forum}`);
-  return noted;
-}
-
 // After a delivery is held: a follow wakes the keeper, and anything that
 // becomes a notification is read in and pushed at once to the phones and
 // browsers the owner signed up for notifications (masto-gateway.mjs: pushHeld).

package/lib/gateway/keeper-due.mjs

@@ -7,18 +7,30 @@
 // sets it to now, and one that arrives while a run is going is not lost when
 // the run finishes. A run that could not take the account's lease tries again
 // next round; one that failed, in an hour.
+//
+// A time is kept as an ISO string. A run may hand one in as a number of
+// milliseconds (a forum's does), and one stored that way is read the same.
 
 const RETRY_FAILED_MS = 3_600_000;
 
-// The sooner of two times (ISO strings, either of them null).
-export const earliest = (a, b) => (!a ? b || null : !b ? a : Date.parse(a) <= Date.parse(b) ? a : b);
+// A time as an ISO string, or null where there is none to read.
+const iso = (t) => {
+  const ms = typeof t === 'number' ? t : t ? Date.parse(t) : NaN;
+  return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+};
+
+// The sooner of two times (either of them null).
+export const earliest = (a, b) => {
+  const [x, y] = [iso(a), iso(b)];
+  return !x ? y : !y ? x : Date.parse(x) <= Date.parse(y) ? x : y;
+};
 
 export function keeperBook(store) {
   return {
     async noteKept(handle, out, started = 0, now = Date.now()) {
       const prev = (await store.get(handle)) || {};
       const next = out?.retry === 'soon' ? prev.nextAt
-        : out?.retry === 'later' ? new Date(now + RETRY_FAILED_MS).toISOString() : out?.nextAt;
+        : out?.retry === 'later' ? new Date(now + RETRY_FAILED_MS).toISOString() : iso(out?.nextAt);
       const woken = prev.noted >= started ? prev.nextAt : null;
       await store.set(handle, { at: now, waiting: out?.waiting || 0, skipped: out?.skipped || null,
         nextAt: earliest(next || null, woken) });
@@ -31,7 +43,8 @@ export function keeperBook(store) {
       const due = [];
       for (const key of await store.keys()) {
         const k = (await store.get(key)) || {};
-        if (k.nextAt && Date.parse(k.nextAt) <= now) due.push(key);
+        const at = iso(k.nextAt);
+        if (at && Date.parse(at) <= now) due.push(key);
       }
       return due;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.57.2",
+  "version": "1.57.5",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -76,7 +76,7 @@
     "@rdfjs/term-set": "^2.0.3",
     "@solid/access-token-verifier": "^2.1.1",
     "clownface": "^2.0.3",
-    "fediverse-session": "^0.2.1",
+    "fediverse-session": "^0.2.2",
     "jose": "^6.2.8",
     "json-canon": "^1.0.1",
     "jsonld": "^9.0.0",

package/scripts/check-netlify-bundles.mjs

@@ -18,9 +18,14 @@ const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'fn-bundles-'));
 let fails = 0;
 const check = (ok, msg) => { console.log(`${ok ? 'PASS' : 'FAIL'}  ${msg}`); if (!ok) fails++; };
 try {
-  // The functions carry the forum as it is in its own folder now.
-  const { bringForum } = await import('./forum-package.mjs');
+  // The functions carry the forum as it is in its own folder now, running on
+  // this folder's FediPod: on an older copy the forum lacked the day's fixes
+  // while every test, which runs it on this folder, passed (1.57.3, 2026-11-14).
+  const { bringForum, forumCoreDiffers } = await import('./forum-package.mjs');
   bringForum();
+  const behind = forumCoreDiffers();
+  check(behind.length === 0, `the forum runs on this folder's FediPod${behind.length
+    ? ` (${behind.length} file(s) under lib/ differ: ${behind.slice(0, 5).join(', ')}${behind.length > 5 ? ', …' : ''})` : ''}`);
   execFileSync('netlify', ['functions:build', '--src', path.join(root, 'netlify/functions'), '--functions', path.join(tmp, 'zips')],
     { cwd: root, stdio: 'ignore' });
   const manifest = JSON.parse(fs.readFileSync(path.join(tmp, 'zips/manifest.json'), 'utf8'));

package/scripts/forum-package.mjs

@@ -5,22 +5,44 @@
 // publish it and put in node_modules without touching FediPod's package list,
 // so nothing FediPod records names a forum version. Staging the site, the
 // bundle check and the app build each bring it first.
+//
+// The forum runs on FediPod, and here that is this folder: packed the same
+// way and installed beside the forum, so the forum's `fedipod` is the code
+// being deployed and not the one the registry has.
 import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path';
 import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 import { fetchDependent, root } from './dependents.mjs';
 
-/** The forum from its folder, installed in node_modules. Returns its folder and version. */
+/** The forum from its folder, and this folder for it to run on, installed in node_modules. Returns the forum's folder and version. */
 export function bringForum({ log = console.log } = {}) {
   const dir = fetchDependent('fedipod-bb', { log });
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'forum-pack-'));
   try {
-    const packed = JSON.parse(execFileSync('npm', ['pack', dir, '--pack-destination', tmp, '--ignore-scripts', '--json'],
+    const pack = (from) => JSON.parse(execFileSync('npm', ['pack', from, '--pack-destination', tmp, '--ignore-scripts', '--json'],
       { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }))[0];
-    execFileSync('npm', ['install', '--no-save', '--no-audit', '--no-fund', '--ignore-scripts', path.join(tmp, packed.filename)],
-      { cwd: root, stdio: 'ignore' });
-    log(`forum: fedipod-bb ${packed.version} from ${path.relative(root, dir) || dir}`);
-    return { dir, version: packed.version };
+    const forum = pack(dir);
+    const self = pack(root);
+    execFileSync('npm', ['install', '--no-save', '--no-audit', '--no-fund', '--ignore-scripts',
+      path.join(tmp, forum.filename), path.join(tmp, self.filename)], { cwd: root, stdio: 'ignore' });
+    log(`forum: fedipod-bb ${forum.version} from ${path.relative(root, dir) || dir}, on fedipod ${self.version} from this folder`);
+    return { dir, version: forum.version };
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 }
 
+/**
+ * The files under lib/ that the forum's `fedipod` and this folder do not
+ * have the same. Empty when the forum runs on this folder's code.
+ */
+export function forumCoreDiffers() {
+  const theirs = path.join(path.dirname(createRequire(path.join(root, 'node_modules/fedipod-bb/package.json')).resolve('fedipod/package.json')), 'lib');
+  const ours = path.join(root, 'lib');
+  const files = (base) => fs.readdirSync(base, { recursive: true, withFileTypes: true })
+    .filter((e) => e.isFile()).map((e) => path.relative(base, path.join(e.parentPath, e.name)));
+  const same = (rel) => {
+    try { return fs.readFileSync(path.join(ours, rel)).equals(fs.readFileSync(path.join(theirs, rel))); } catch { return false; }
+  };
+  return [...new Set([...files(ours), ...files(theirs)])].filter((rel) => !same(rel)).sort();
+}
+
 if (import.meta.url === `file://${process.argv[1]}`) bringForum();

package/web/app/boot.mjs

@@ -222,9 +222,10 @@ window.fedipodSignin = async ({ address }) => {
 };
 
 // Called on every page load. Returns 'signed-in' | 'restored' | 'anonymous' |
-// 'signup' | 'move-in' — the last two being a return from the pod's login
-// in the middle of creating an account: with no account on the pod yet, or
-// with one whose address lives at another gateway.
+// 'signup' | 'move-in' | 'leaving' — 'signup' and 'move-in' being a return
+// from the pod's login in the middle of creating an account: with no account
+// on the pod yet, or with one whose address lives at another gateway.
+// 'leaving': the page is on its way to the pod's login.
 window.fedipodOnLoad = async () => {
   if (new URLSearchParams(location.search).get('code')) {
     const done = await completeLogin({ currentUrl: location.href });
@@ -240,8 +241,21 @@ window.fedipodOnLoad = async () => {
     await bootWorker({ reset: true });        // this may be a different account
     return 'signed-in';
   }
-  if (await getSession()) { await bootWorker(); return 'restored'; }
-  return 'anonymous';
+  const kept = await getSession();
+  if (!kept) return 'anonymous';
+  // What the browser has stored says a sign-in was made, not that the pod
+  // still honours it. The pod is asked before anything is started on it, and
+  // only when the sign-in's time is up. One the pod has ended goes to the
+  // pod's own login, which the stored sign-in names: nobody is asked to press
+  // a button for it. A pod that cannot be asked is left to the start below.
+  if (await kept.check().catch(() => true) === false) {
+    try {
+      location.href = (await beginLogin({ issuer: kept.issuer, redirectUri: REDIRECT })).authorizationUrl;
+      return 'leaving';
+    } catch { return 'anonymous'; }   // its login cannot be reached: the sign-in page, as for anybody
+  }
+  await bootWorker();
+  return 'restored';
 };
 
 window.fedipodSignOut = async () => {
@@ -366,6 +380,7 @@ if (typeof document !== 'undefined') (async () => {
       const signIn = () => { location.href = '/?add'; };
       const known = {
         'sign-in-refused': { title: 'Your pod refused this sign-in', retry: 'Sign in again', go: signIn },
+        'signed-out': { title: 'Your sign-in has ended', retry: 'Sign in again', go: signIn },
         'pod-busy': { title: 'Your pod is asking for a pause', retry: 'Reload', go: reload, wait: 45 },
         'pod-error': { title: 'Your pod had an error', retry: 'Reload', go: reload, wait: 20 },
         'pod-unreachable': { title: 'Your pod could not be reached', retry: 'Reload', go: reload, wait: 20 },
@@ -440,6 +455,7 @@ if (typeof document !== 'undefined') (async () => {
     // web/admin surface as local). Its own script signs the framed client in on
     // a fresh session and forwards deep links on a returning one, so both a
     // fresh sign-in and a restored session land in the same place.
+    if (state === 'leaving') return;
     if (state === 'signed-in' || state === 'restored') { location.href = '/admin/client/'; return; }
     // Back from the pod's login with no account there yet, or with one to
     // move here: the identity screen, once the form below is wired.

package/web/app/dist/boot.js

@@ -34591,49 +34591,89 @@ function solidOidcSession({ dbName = "solid-oidc-session", clientName = "Solid a
     await idbDel("session");
     await idbDel("pending");
   }
-  function sessionHandle(s) {
-    let { accessToken, expiresAt, refreshToken } = s;
-    const jwkP = publicJwk(s.pair);
-    const refresh = async () => {
-      if (!refreshToken) throw new Error("session expired and there is no refresh token \u2014 sign in again");
+  const ended = (message) => Object.assign(new Error(message), { signedOut: true });
+  const stillGood = (row) => Date.now() < row.expiresAt - 3e4;
+  const locks = () => globalThis.navigator?.locks;
+  const oneAtATime = (fn) => locks()?.request ? locks().request(`${dbName}:renew`, fn) : fn();
+  const RACE_WAIT_MS = 1500;
+  function sessionHandle(first) {
+    let s = first;
+    let jwkP = publicJwk(s.pair);
+    const host = () => new URL(s.tokenEndpoint).host;
+    const takeUp = (row) => {
+      s = row;
+      jwkP = publicJwk(row.pair);
+    };
+    const reread = async () => {
+      const row = await idbGet("session");
+      if (!row) throw ended("signed out \u2014 sign in again");
+      if (row.webId !== s.webId) throw new Error("signed in as somebody else since this session was read");
+      takeUp(row);
+    };
+    const refresh = () => oneAtATime(async () => {
+      const mine = s.accessToken;
+      await reread();
+      if (s.accessToken !== mine && stillGood(s)) return;
+      if (!s.refreshToken) {
+        await idbDel("session");
+        throw ended("session expired and there is no refresh token \u2014 sign in again");
+      }
+      const sent = s;
       const jwk = await jwkP;
       let res;
       try {
-        res = await fetch(s.tokenEndpoint, {
+        res = await fetch(sent.tokenEndpoint, {
           method: "POST",
-          headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(s.pair, jwk, "POST", s.tokenEndpoint) },
-          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: s.client_id, scope: "openid webid offline_access" })
+          headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(sent.pair, jwk, "POST", sent.tokenEndpoint) },
+          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: sent.refreshToken, client_id: sent.client_id, scope: "openid webid offline_access" })
         });
       } catch (e) {
-        throw new Error(`${e.message} \u2014 renewing your sign-in at ${new URL(s.tokenEndpoint).host}`);
+        throw new Error(`${e.message} \u2014 renewing your sign-in at ${host()}`);
       }
       const tok = await res.json().catch(() => ({}));
+      const now = await idbGet("session");
+      if (now && now.webId !== sent.webId) throw new Error("signed in as somebody else while this session was refreshing");
+      if (res.ok && tok.access_token) {
+        if (!now) throw ended("signed out while this sign-in was being renewed");
+        takeUp({
+          ...sent,
+          accessToken: tok.access_token,
+          refreshToken: tok.refresh_token || sent.refreshToken,
+          expiresAt: Date.now() + Math.max(30, tok.expires_in || 300) * 1e3
+        });
+        await idbPut("session", s);
+        return;
+      }
       if (res.status === 429) {
-        throw new Error(`${new URL(s.tokenEndpoint).host} is asking us to slow down \u2014 your sign-in could not be renewed just now`);
+        throw new Error(`${host()} is asking us to slow down \u2014 your sign-in could not be renewed just now`);
       }
-      if (!res.ok || !tok.access_token) {
+      if (res.status >= 400 && res.status < 500 && typeof tok.error === "string") {
+        let row = now;
+        if (row && row.accessToken === sent.accessToken && !locks()?.request) {
+          await new Promise((r) => setTimeout(r, RACE_WAIT_MS));
+          row = await idbGet("session");
+        }
+        if (row && row.webId === sent.webId && row.accessToken !== sent.accessToken && stillGood(row)) {
+          takeUp(row);
+          return;
+        }
+        if (!row) throw ended("signed out \u2014 sign in again");
         await idbDel("session");
-        throw new Error("refresh failed \u2014 sign in again");
-      }
-      accessToken = tok.access_token;
-      expiresAt = Date.now() + Math.max(30, tok.expires_in || 300) * 1e3;
-      if (tok.refresh_token) refreshToken = tok.refresh_token;
-      const now = await idbGet("session");
-      if (now && now.webId !== s.webId) {
-        throw new Error("signed in as somebody else while this session was refreshing");
+        throw ended("refresh failed \u2014 sign in again");
       }
-      await idbPut("session", { ...s, accessToken, expiresAt, refreshToken });
-    };
+      throw new Error(`${host()} could not renew your sign-in just now (HTTP ${res.status})`);
+    });
     const send = async (url, init) => {
+      const { accessToken, pair } = s;
       const jwk = await jwkP;
       const ath = b64u(await sha2562(accessToken));
-      const headers = { ...init.headers || {}, authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, init.method || "GET", url, ath) };
+      const headers = { ...init.headers || {}, authorization: `DPoP ${accessToken}`, dpop: await dpopProof(pair, jwk, init.method || "GET", url, ath) };
       return fetch(url, { ...init, headers });
     };
     const authFetch = async (url, init = {}) => {
-      if (Date.now() > expiresAt - 3e4) await refresh();
+      if (!stillGood(s)) await refresh();
       const res = await send(url, init);
-      if (res.status === 401 && refreshToken) {
+      if (res.status === 401 && s.refreshToken) {
         try {
           await refresh();
         } catch {
@@ -34643,7 +34683,17 @@ function solidOidcSession({ dbName = "solid-oidc-session", clientName = "Solid a
       }
       return res;
     };
-    return { webId: s.webId, issuer: s.issuer, fetch: authFetch, refresh, signOut: signOut2 };
+    const check = async () => {
+      try {
+        await reread();
+        if (!stillGood(s)) await refresh();
+        return true;
+      } catch (e) {
+        if (e.signedOut) return false;
+        throw e;
+      }
+    };
+    return { webId: first.webId, issuer: first.issuer, fetch: authFetch, refresh, check, signOut: signOut2 };
   }
   return { beginLogin: beginLogin2, completeLogin: completeLogin2, getSession: getSession2, signOut: signOut2 };
 }
@@ -34836,11 +34886,18 @@ window.fedipodOnLoad = async () => {
     await bootWorker({ reset: true });
     return "signed-in";
   }
-  if (await getSession()) {
-    await bootWorker();
-    return "restored";
+  const kept = await getSession();
+  if (!kept) return "anonymous";
+  if (await kept.check().catch(() => true) === false) {
+    try {
+      location.href = (await beginLogin({ issuer: kept.issuer, redirectUri: REDIRECT })).authorizationUrl;
+      return "leaving";
+    } catch {
+      return "anonymous";
+    }
   }
-  return "anonymous";
+  await bootWorker();
+  return "restored";
 };
 window.fedipodSignOut = async () => {
   await signOut();
@@ -34943,6 +35000,7 @@ if (typeof document !== "undefined") (async () => {
       };
       const known = {
         "sign-in-refused": { title: "Your pod refused this sign-in", retry: "Sign in again", go: signIn },
+        "signed-out": { title: "Your sign-in has ended", retry: "Sign in again", go: signIn },
         "pod-busy": { title: "Your pod is asking for a pause", retry: "Reload", go: reload, wait: 45 },
         "pod-error": { title: "Your pod had an error", retry: "Reload", go: reload, wait: 20 },
         "pod-unreachable": { title: "Your pod could not be reached", retry: "Reload", go: reload, wait: 20 },
@@ -35018,6 +35076,7 @@ ${e.detail}` : "");
       });
       return;
     }
+    if (state === "leaving") return;
     if (state === "signed-in" || state === "restored") {
       location.href = "/admin/client/";
       return;