@ogygia/core 0.0.0 → 0.11.0

package/dist/compiler/link/build-output.js

@@ -0,0 +1,147 @@
+import { dir_entries, fs, path } from "../host.js";
+import { islandDepsHandoffPath } from "./island-deps.js";
+// src/compiler/link/build-output.ts
+/**
+* Whole-program build-output side effects — the work the adapter's `writeBundle` does AFTER the
+* client bundle is on disk: the content-leak guardrail, and writing / inlining the island-deps
+* handoff so SSR can `modulepreload` a hydrate island's chunks and style a server-picked hole. Pure
+* over the finished bundle + the app root (fs is the only side effect); the adapter owns only the
+* Vite `this.getFileName` resolution and the trigger.
+*/
+const CORPUS_RE = /\.(svx|md)(\?|$)/;
+/** A `?…type=style…` / `lang.css` sub-import id — a CSS face, never a corpus JS leak. */
+const CONTENT_STYLE_QUERY_RE = /[?&](?:type=style|lang\.css)/;
+const BACKSLASH_G = /\\/g;
+const SINGLE_QUOTE_G = /'/g;
+const DOUBLE_QUOTE_G = /"/g;
+const LINE_SEPARATOR_G = /\u2028/g;
+const PARAGRAPH_SEPARATOR_G = /\u2029/g;
+/**
+* Guardrail: a content collection must never reach a CLIENT chunk. Ground truth is the finished
+* bundle. A compiled corpus module (.svx/.md) in a client chunk means a `content()` collection was
+* imported into client-shipped code (usually an island), which drags its eager `import.meta.glob` —
+* every doc — into the browser. On a csr=false site the corpus renders server-side and should never
+* appear here, so any hit is a real leak. A warning, not a throw: the guardrail must never break a build.
+*/
+function warn_content_leaks(bundle, root, is_island_path) {
+	try {
+		const leaks = [];
+		for (const [key, chunk] of Object.entries(bundle)) {
+			if (chunk.type !== "chunk") continue;
+			const corpus = (chunk.moduleIds ?? Object.keys(chunk.modules ?? {})).filter((id) => CORPUS_RE.test(id) && !is_island_path(id) && !CONTENT_STYLE_QUERY_RE.test(id));
+			if (corpus.length) leaks.push({
+				chunk: chunk.fileName ?? key,
+				modules: corpus
+			});
+		}
+		if (leaks.length) {
+			const all = [...new Set(leaks.flatMap((l) => l.modules))];
+			const sample = all.slice(0, 5).map((m) => "    " + path.relative(root, m.split("?")[0])).join("\n");
+			console.warn(`[ogygia] content leaked into the CLIENT bundle: ${all.length} corpus module(s) (.svx/.md) shipped to the browser (in chunk '${leaks[0].chunk}').\n  A content() collection was imported into client-shipped code — usually an island — which drags its eager import.meta.glob (every doc) in.\n  Fix: keep the collection in a server-only module (or a .remote.ts) and feed islands DATA (refs) via props or a remote, never the collection itself.\n${sample}${all.length > 5 ? "\n    …" : ""}`);
+		}
+	} catch {}
+}
+/**
+* Write the island-deps handoff JSON (the map SSR reads at render): the stable path under Kit's
+* `outDir` (`.svelte-kit` unless the app configured `kit.outDir`), an adapter-friendly copy next
+* to the server bundle, AND an in-place inline into every server chunk that carries the token slot
+* — inlining is what makes it survive serverless tracing (@vercel/nft only bundles *imported*
+* files, not runtime fs reads, so the co-located JSON is dropped there; that is why held/dual
+* regions that cross the wire rendered unstyled on Vercel/Netlify). Unpatched builds keep the fs
+* fallback (adapter-node, dev-preview).
+*/
+function emit_island_deps_handoff(root, json, out_dir) {
+	const handoff = islandDepsHandoffPath(out_dir);
+	fs.mkdirSync(path.dirname(handoff), { recursive: true });
+	fs.writeFileSync(handoff, json);
+	const server_copy = path.join(out_dir, "output", "server", "og-region-deps.json");
+	try {
+		fs.mkdirSync(path.dirname(server_copy), { recursive: true });
+		fs.writeFileSync(server_copy, json);
+	} catch {}
+	try {
+		const server_dir = path.join(out_dir, "output", "server");
+		const token = "__OGYGIA_ISLAND_DEPS_INLINE__";
+		const inline = json.replace(BACKSLASH_G, "\\\\").replace(SINGLE_QUOTE_G, "\\'").replace(DOUBLE_QUOTE_G, "\\\"").replace(LINE_SEPARATOR_G, "\\u2028").replace(PARAGRAPH_SEPARATOR_G, "\\u2029");
+		const patch_server = (dir) => {
+			let entries;
+			try {
+				entries = dir_entries(dir);
+			} catch {
+				return;
+			}
+			for (const e of entries) {
+				const full = path.join(dir, e.name);
+				if (e.isDirectory()) {
+					patch_server(full);
+					continue;
+				}
+				if (!e.name.endsWith(".js")) continue;
+				let code;
+				try {
+					code = fs.readFileSync(full, "utf8");
+				} catch {
+					continue;
+				}
+				if (!code.includes(token)) continue;
+				fs.writeFileSync(full, code.split(token).join(inline));
+			}
+		};
+		patch_server(server_dir);
+	} catch {}
+}
+/**
+* SEED SHAPING report (client `writeBundle`): which islands read `page.data` through the shim, how
+* many keys they were pinned to, and — the actionable part — the modules whose reads could not be
+* pinned, each with its line and why, since one such module makes every page carrying that island
+* ship its whole `page.data`. Same shape as the barrels report: a few lines, a count for the rest.
+*/
+function report_seed_shaping(map, bundle, program, root, file_of = (identity) => identity) {
+	/** per island entry that ships all: the modules in its closure whose reads could not be pinned */
+	const why_of = {};
+	const readers = Object.keys(map.page).filter((e) => map.page[e]);
+	if (!readers.length) return why_of;
+	const pinned = readers.filter((e) => Array.isArray(map.page_keys[e]));
+	const unpinned = readers.filter((e) => !Array.isArray(map.page_keys[e]));
+	const key_count = new Set(pinned.flatMap((e) => map.page_keys[e] ?? [])).size;
+	const rel = (p) => p.startsWith(root) ? p.slice(root.length).replace(/^\//, "") : p;
+	const lines = [];
+	lines.push(`[ogygia] page seed: ${readers.length} island${readers.length === 1 ? "" : "s"} read page.data — ${pinned.length} pinned to ${key_count} key${key_count === 1 ? "" : "s"}, ${unpinned.length} ship all of it`);
+	if (unpinned.length) {
+		const closure = (entry) => {
+			const seen = /* @__PURE__ */ new Set();
+			const queue = [file_of(entry).replace(/^\//, "")];
+			while (queue.length) {
+				const f = queue.pop();
+				if (seen.has(f)) continue;
+				seen.add(f);
+				for (const i of bundle[f]?.imports ?? []) queue.push(i);
+			}
+			return seen;
+		};
+		const blamed = /* @__PURE__ */ new Map();
+		for (const e of unpinned) {
+			const own = /* @__PURE__ */ new Set();
+			for (const chunk of closure(e)) for (const id of bundle[chunk]?.moduleIds ?? []) {
+				const clean = id.split("?")[0].split("\\").join("/");
+				const r = program.page_key_reasons.get(clean);
+				if (!r) continue;
+				if (!blamed.has(clean)) blamed.set(clean, r);
+				if (own.has(clean)) continue;
+				own.add(clean);
+				(why_of[e] ??= []).push({
+					file: rel(clean),
+					line: r.line,
+					why: r.why
+				});
+			}
+		}
+		const rows = [...blamed].slice(0, 8);
+		for (const [file, r] of rows) lines.push(`  ${rel(file)}${r.line === null ? "" : ":" + r.line} — ${r.why}`);
+		if (blamed.size > rows.length) lines.push(`  … and ${blamed.size - rows.length} more module${blamed.size - rows.length === 1 ? "" : "s"}`);
+		if (!blamed.size) lines.push(`  (read through code the build never saw — a dependency, or a foreign fragment)`);
+	}
+	console.log(lines.join("\n"));
+	return why_of;
+}
+export { emit_island_deps_handoff, report_seed_shaping, warn_content_leaks };

package/dist/compiler/link/caps.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `virtual:ogygia/secret` — SERVER only: the per-build random key material and whether the BUILD
+ * saw an `OGYGIA_SECRET` (its region ids are salted from it). CLIENT build: empty (never mint in the
+ * browser). Which key signs is decided at first use, not here (server/signing-key.ts): the runtime's
+ * `OGYGIA_SECRET` when the host sets it — read then, so an env a host fills after module eval still
+ * counts — else this build's key.
+ */
+export declare function secret_module(ssr: boolean, build_secret: string, build_had_secret: boolean): string;
+/**
+ * `virtual:ogygia/sign` — same split as secret: SSR mints with node:crypto (re-exports the real
+ * HMAC module); client never mints (secret is ''), but still needs `region_mac_message` for the
+ * length-prefixed canonical form the runtime compares against.
+ */
+export declare function sign_module(ssr: boolean, hmac_module: string): string;
+/**
+ * `virtual:ogygia/server-plugins` — SERVER only: each plugin's server half, one static import per
+ * plugin, in the order the app listed them. The handle runs their stages straight off this list; an
+ * app with no plugins gets an empty one (and the client always does).
+ */
+/** One plugin's server realm, as the build wires it. */
+export interface ServerRealm {
+  /** the plugin's (package) name */
+  name: string;
+  /** the realm module's absolute POSIX path (the plugin's `server`) */
+  module: string;
+  /** the plugin's options (JSON) */
+  options: unknown;
+}
+export declare function server_plugins_module(ssr: boolean, realms: readonly ServerRealm[]): string;
+/** `virtual:ogygia/route-config` — SERVER only: every Kit page route id → the keys the plugins claim
+ *  inside Kit's `config` page option, merged the way Kit merges it (a key no level sets is absent).
+ *  Empty on the client, and when no plugin claims a key: the route list never ships to the browser. */
+export declare function route_config_module(ssr: boolean, routesDir: string, keys: readonly string[]): string;
+/** `virtual:ogygia/rate-limit` — SERVER only; the region handle is the only consumer. */
+export declare function rate_limit_module(ssr: boolean, rate_limit: {
+  max: number;
+  windowMs: number;
+}): string;
+/** `virtual:ogygia/session-cookie` — SERVER only; sealed into the region MAC when non-empty. */
+export declare function session_cookie_module(ssr: boolean, session_cookie: string): string;
+/** `virtual:ogygia/region-ttl` — SERVER only; the capability expiry window for mint, and how long
+ *  after expiry an anonymous capability still renews. */
+export declare function region_ttl_module(ssr: boolean, region_ttl: number, renew_window: number): string;
+/** `virtual:ogygia/route-csr` — SERVER only: the csr=true route ids, so a csr=false layout's islands
+ *  degrade to inline when the LEAF page is csr=true (Kit hydrates the whole document). The CLIENT leg
+ *  is an empty set — the client reads the identical signal from `kit_hydrates_page()`, and the route
+ *  list never ships to the browser. */
+export declare function route_csr_module(ssr: boolean, routesDir: string): string;

package/dist/compiler/link/caps.js

@@ -0,0 +1,64 @@
+import { csrTrueRouteIds, errorCsrTrueRouteIds, page_route_config, rootLayoutCsrTrue } from "../kit.js";
+// src/compiler/link/caps.ts
+/**
+* Capability virtual-module emitters — the leg-split sources for the signed-capability family:
+* `virtual:ogygia/secret`, `/sign`, `/rate-limit`, `/session-cookie`, `/region-ttl`. Each is a pure
+* `(ssr, <one resolved config value>) => string`: the SSR leg carries the real signer / baked config,
+* the client leg gets an inert stub (a browser never mints). The driver's `emit` dispatch calls these.
+*/
+/**
+* `virtual:ogygia/secret` — SERVER only: the per-build random key material and whether the BUILD
+* saw an `OGYGIA_SECRET` (its region ids are salted from it). CLIENT build: empty (never mint in the
+* browser). Which key signs is decided at first use, not here (server/signing-key.ts): the runtime's
+* `OGYGIA_SECRET` when the host sets it — read then, so an env a host fills after module eval still
+* counts — else this build's key.
+*/
+function secret_module(ssr, build_secret, build_had_secret) {
+	if (!ssr) return `export const buildKey = '';\nexport const buildHadSecret = false;`;
+	return `export const buildKey = ${JSON.stringify(build_secret)};\nexport const buildHadSecret = ${build_had_secret};`;
+}
+/**
+* `virtual:ogygia/sign` — same split as secret: SSR mints with node:crypto (re-exports the real
+* HMAC module); client never mints (secret is ''), but still needs `region_mac_message` for the
+* length-prefixed canonical form the runtime compares against.
+*/
+function sign_module(ssr, hmac_module) {
+	if (!ssr) return "export function sign(_secret, _message) { return ''; }\nexport function verify(_secret, _message, _sig) { return false; }\nexport function region_mac_message(id, exp, props, session = '', ttl = '', render = '') {\n  const enc = new TextEncoder();\n  const lp = (s) => enc.encode(String(s)).byteLength + ':' + String(s);\n  const v1 = lp(id) + '|' + lp(exp) + '|' + lp(props) + '|' + lp(session) + '|' + lp(ttl);\n  return render === '' ? 'v1|' + v1 : 'v2|' + v1 + '|' + lp(render);\n}\n";
+	return `export { sign, verify, region_mac_message } from ${JSON.stringify(hmac_module)};`;
+}
+function server_plugins_module(ssr, realms) {
+	if (!ssr || realms.length === 0) return `export const plugins = [];`;
+	return `${realms.map((r, i) => `import p${i} from ${JSON.stringify(r.module)};`).join("\n")}\nexport const plugins = [\n\t${realms.map((r, i) => `{ name: ${JSON.stringify(r.name)}, options: ${JSON.stringify(r.options)}, server: p${i} }`).join(",\n	")}\n];`;
+}
+/** `virtual:ogygia/route-config` — SERVER only: every Kit page route id → the keys the plugins claim
+*  inside Kit's `config` page option, merged the way Kit merges it (a key no level sets is absent).
+*  Empty on the client, and when no plugin claims a key: the route list never ships to the browser. */
+function route_config_module(ssr, routesDir, keys) {
+	if (!ssr || keys.length === 0) return `export const route_config = {};`;
+	return `export const route_config = ${JSON.stringify(page_route_config(routesDir, keys))};`;
+}
+/** `virtual:ogygia/rate-limit` — SERVER only; the region handle is the only consumer. */
+function rate_limit_module(ssr, rate_limit) {
+	if (!ssr) return `export const rateLimit = { max: 0, windowMs: 60000 };`;
+	return `export const rateLimit = ${JSON.stringify(rate_limit)};`;
+}
+/** `virtual:ogygia/session-cookie` — SERVER only; sealed into the region MAC when non-empty. */
+function session_cookie_module(ssr, session_cookie) {
+	if (!ssr) return `export const sessionCookie = '';`;
+	return `export const sessionCookie = ${JSON.stringify(session_cookie)};`;
+}
+/** `virtual:ogygia/region-ttl` — SERVER only; the capability expiry window for mint, and how long
+*  after expiry an anonymous capability still renews. */
+function region_ttl_module(ssr, region_ttl, renew_window) {
+	if (!ssr) return `export const regionTtl = 3600;\nexport const renewWindow = 0;`;
+	return `export const regionTtl = ${region_ttl};\nexport const renewWindow = ${renew_window};`;
+}
+/** `virtual:ogygia/route-csr` — SERVER only: the csr=true route ids, so a csr=false layout's islands
+*  degrade to inline when the LEAF page is csr=true (Kit hydrates the whole document). The CLIENT leg
+*  is an empty set — the client reads the identical signal from `kit_hydrates_page()`, and the route
+*  list never ships to the browser. */
+function route_csr_module(ssr, routesDir) {
+	if (!ssr) return "export const csr_true_routes = new Set();\nexport const error_csr_true_routes = new Set();\nexport const root_layout_csr_true = true;";
+	return `export const csr_true_routes = new Set(${JSON.stringify(csrTrueRouteIds(routesDir))});\nexport const error_csr_true_routes = new Set(${JSON.stringify(errorCsrTrueRouteIds(routesDir))});\nexport const root_layout_csr_true = ${rootLayoutCsrTrue(routesDir)};`;
+}
+export { rate_limit_module, region_ttl_module, route_config_module, route_csr_module, secret_module, server_plugins_module, session_cookie_module, sign_module };

package/dist/compiler/link/context-detect.d.ts

@@ -0,0 +1,23 @@
+export declare function source_uses_ogygia_context(src: string): boolean;
+/** The string-literal keys a file READS via getContext and SETS via setContext — each PROVEN, by
+ *  following the import binding rather than matching text, to be Svelte/ogygia's. */
+export interface ContextKeys {
+  reads: string[];
+  sets: string[];
+}
+/**
+ * Resolve the string-literal keys a file reads via `getContext(…)` and sets via `setContext(…)`, where
+ * each call is PROVEN — by following the import binding, not by matching text — to be Svelte's or
+ * ogygia's. Counts a `getContext as gc` alias and a namespace `ns.getContext(…)`; ignores a local
+ * function of the same name, a `foo.getContext(…)` on an unrelated object, and a dynamic key. ogygia's
+ * own bridge keys are `Symbol.for(…)` (never string literals), so they never appear.
+ *
+ * `reads` drives the WARNING: on a csr=false page the page/layout `<script>` never runs on the client,
+ * so a value set with Svelte's own `setContext` in a page/layout is gone by the time an island hydrates
+ * in isolation — the island reads `undefined`, renders a different tree, and Svelte discards its server
+ * DOM (a silent full re-render). `sets` is what makes the warning precise: a key an island's OWN code
+ * both sets and reads lives inside one hydration root (a component library using context internally) and
+ * needs no bridge — the caller subtracts island sets from island reads so only a key provided OUTSIDE
+ * the island is flagged. Empty on a file with no such call, or one that cannot be parsed.
+ */
+export declare function context_string_keys(src: string, kind: "svelte" | "script"): ContextKeys;

package/dist/compiler/link/context-detect.js

@@ -0,0 +1,137 @@
+import { parse_roots } from "./page-keys.js";
+import { OWN_PACKAGE_NAMES, OWN_SPECIFIER_SOURCE } from "../../own-package.js";
+// src/compiler/link/context-detect.ts
+/**
+* Detect whether a source file uses an ogygia **context provider** — `Provide`, the drop-in
+* `setContext`, or `createContext` imported from `'ogygia'`. Drives the `context` runtime mark, which
+* gates the ~4.7 kB cross-island context bridge OUT of apps that never provide context.
+*
+* WHY IMPORT-CLAUSE SCANNING IS SOUND: every entry point to the bridge is an
+* `import { … } from 'ogygia'` (or a namespace import used as `og.setContext(…)`) naming one of the
+* three. A read-only `getContext` needs no bridge, so it's deliberately NOT a trigger. Over-inclusion
+* is the safe direction — a MISSED provider silently drops context inside islands, an extra include is
+* just bytes — so the scan biases to include: any one matching file in `src/` sets the whole-app mark.
+*
+* Regexes are module-level (compiled once); `source_uses_ogygia_context` runs per file in the prescan
+* walk. The `g` regexes are stateful, so each use resets `lastIndex`. (The READER side — `getContext`
+* — instead follows the import binding through the AST, see `get_context_string_keys` below; a text
+* scan there would count an unrelated `getContext`.)
+*/
+const OGYGIA_NAMED_IMPORT = new RegExp(`import\\s+(?:type\\s+)?\\{([\\s\\S]*?)\\}\\s*from\\s*['"]${OWN_SPECIFIER_SOURCE}['"]`, "g");
+const OGYGIA_NS_IMPORT = new RegExp(`import\\s*\\*\\s*as\\s+(\\w+)\\s*from\\s*['"]${OWN_SPECIFIER_SOURCE}['"]`);
+const CTX_PROVIDER = /\b(?:Provide|setContext|createContext)\b/;
+const NS_CTX_USAGE = /\b(\w+)\.(?:Provide|setContext|createContext)\b/g;
+function source_uses_ogygia_context(src) {
+	OGYGIA_NAMED_IMPORT.lastIndex = 0;
+	let m;
+	while (m = OGYGIA_NAMED_IMPORT.exec(src)) if (CTX_PROVIDER.test(m[1])) return true;
+	const ns = OGYGIA_NS_IMPORT.exec(src);
+	if (!ns) return false;
+	NS_CTX_USAGE.lastIndex = 0;
+	let u;
+	while (u = NS_CTX_USAGE.exec(src)) if (u[1] === ns[1]) return true;
+	return false;
+}
+/** Modules whose `getContext` reads the Svelte/ogygia context map (both resolve the same map — ogygia
+*  re-exports Svelte's, and the drop-in is read with the unchanged `getContext`). */
+const CTX_MODULES = /* @__PURE__ */ new Set(["svelte", ...OWN_PACKAGE_NAMES]);
+/** AST back-references / positions the walk must not descend into. */
+const NODE_SKIP = /* @__PURE__ */ new Set([
+	"start",
+	"end",
+	"loc",
+	"range",
+	"parent",
+	"metadata",
+	"leadingComments",
+	"trailingComments",
+	"__parent",
+	"__key"
+]);
+/** An import/member name node → its string name (`Identifier` or a string `Literal`). */
+function name_of(n) {
+	if (!n) return null;
+	if (n.type === "Identifier") return n.name ?? null;
+	if (n.type === "Literal" && typeof n.value === "string") return n.value;
+	return null;
+}
+/** A string-literal argument's value, else null (a dynamic key is deliberately not counted). */
+function literal_string(n) {
+	return n && n.type === "Literal" && typeof n.value === "string" ? n.value : null;
+}
+/**
+* Resolve the string-literal keys a file reads via `getContext(…)` and sets via `setContext(…)`, where
+* each call is PROVEN — by following the import binding, not by matching text — to be Svelte's or
+* ogygia's. Counts a `getContext as gc` alias and a namespace `ns.getContext(…)`; ignores a local
+* function of the same name, a `foo.getContext(…)` on an unrelated object, and a dynamic key. ogygia's
+* own bridge keys are `Symbol.for(…)` (never string literals), so they never appear.
+*
+* `reads` drives the WARNING: on a csr=false page the page/layout `<script>` never runs on the client,
+* so a value set with Svelte's own `setContext` in a page/layout is gone by the time an island hydrates
+* in isolation — the island reads `undefined`, renders a different tree, and Svelte discards its server
+* DOM (a silent full re-render). `sets` is what makes the warning precise: a key an island's OWN code
+* both sets and reads lives inside one hydration root (a component library using context internally) and
+* needs no bridge — the caller subtracts island sets from island reads so only a key provided OUTSIDE
+* the island is flagged. Empty on a file with no such call, or one that cannot be parsed.
+*/
+function context_string_keys(src, kind) {
+	const wants_get = src.includes("getContext");
+	const wants_set = src.includes("setContext");
+	if (!wants_get && !wants_set) return {
+		reads: [],
+		sets: []
+	};
+	const roots = parse_roots(src, "ogygia:context-detect", kind);
+	if (!roots) return {
+		reads: [],
+		sets: []
+	};
+	const get_locals = /* @__PURE__ */ new Set();
+	const set_locals = /* @__PURE__ */ new Set();
+	const namespaces = /* @__PURE__ */ new Set();
+	const calls = [];
+	const walk = (node) => {
+		if (!node || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const c of node) walk(c);
+			return;
+		}
+		if (node.type === "ImportDeclaration" && CTX_MODULES.has(String(node.source?.value ?? ""))) {
+			for (const s of node.specifiers ?? []) if (s.type === "ImportSpecifier" && s.local?.name) {
+				const imported = name_of(s.imported);
+				if (imported === "getContext") get_locals.add(s.local.name);
+				else if (imported === "setContext") set_locals.add(s.local.name);
+			} else if (s.type === "ImportNamespaceSpecifier" && s.local?.name) namespaces.add(s.local.name);
+		} else if (node.type === "CallExpression") calls.push(node);
+		for (const k in node) {
+			if (NODE_SKIP.has(k)) continue;
+			const v = node[k];
+			if (v && typeof v === "object") walk(v);
+		}
+	};
+	for (const root of roots) walk(root);
+	if (get_locals.size === 0 && set_locals.size === 0 && namespaces.size === 0) return {
+		reads: [],
+		sets: []
+	};
+	const reads = /* @__PURE__ */ new Set();
+	const sets = /* @__PURE__ */ new Set();
+	for (const call of calls) {
+		const key = literal_string(call.arguments?.[0]);
+		if (key == null) continue;
+		const callee = call.callee;
+		if (callee?.type === "Identifier") {
+			if (get_locals.has(callee.name)) reads.add(key);
+			else if (set_locals.has(callee.name)) sets.add(key);
+		} else if (callee?.type === "MemberExpression" && !callee.computed && callee.object?.type === "Identifier" && namespaces.has(callee.object.name)) {
+			const member = name_of(callee.property);
+			if (member === "getContext") reads.add(key);
+			else if (member === "setContext") sets.add(key);
+		}
+	}
+	return {
+		reads: [...reads],
+		sets: [...sets]
+	};
+}
+export { context_string_keys, source_uses_ogygia_context };

package/dist/compiler/link/emit-gate.d.ts

@@ -0,0 +1,11 @@
+export declare const SSR_HOSTS_HANDOFF = "og-ssr-hosts.json";
+/** `<outDir>/og-ssr-hosts.json` — written by the server leg, read by the client leg. */
+export declare function ssr_hosts_handoff_path(out_dir: string): string;
+/**
+ * Should an island whose host module is `host_path` get a client chunk? `loaded` is the server
+ * leg's transformed-module set (`host_key`-normalised), or `null` when there is no handoff.
+ * An island with no recorded host (a library island registered through a bridge) is always emitted.
+ */
+export declare function island_host_loaded(host_path: string | null | undefined, loaded: Set<string> | null | undefined): boolean;
+/** Parse the handoff file's contents into the set `island_host_loaded` consumes. */
+export declare function parse_ssr_hosts(json: string): Set<string>;

package/dist/compiler/link/emit-gate.js

@@ -0,0 +1,40 @@
+import { path } from "../host.js";
+import { host_key } from "../program.js";
+// src/compiler/link/emit-gate.ts
+/**
+* Island-chunk emit gate — which prescanned islands the CLIENT leg should actually build.
+*
+* The prescan registers every marked import under the app's `src/` (both build legs, so ids agree),
+* and the client leg used to emit a chunk for each of them. But a registered island is not an island
+* the app SERVES: a host module nothing imports — a second route tree's pages built from the same
+* source, a retired component — is dead weight, and worse than weight: its imports enter a client
+* build whose server pass never analysed them (an island importing a `.remote.ts` there fails Kit's
+* "Expected to find metadata for remote file" check and the build stops).
+*
+* Kit builds the SERVER bundle first. Its transform pass is the ground truth for reachability — the
+* driver records every module id it transforms there (`Program.ssr_transformed`), the plugin writes
+* the set under Kit's `outDir` at the end of that leg, and the client leg reads it back and emits
+* only islands whose host is in it. No handoff (standalone builds, a client-only build) → emit all,
+* the previous behaviour.
+*/
+const SSR_HOSTS_HANDOFF = "og-ssr-hosts.json";
+/** `<outDir>/og-ssr-hosts.json` — written by the server leg, read by the client leg. */
+function ssr_hosts_handoff_path(out_dir) {
+	return path.join(out_dir, SSR_HOSTS_HANDOFF);
+}
+/**
+* Should an island whose host module is `host_path` get a client chunk? `loaded` is the server
+* leg's transformed-module set (`host_key`-normalised), or `null` when there is no handoff.
+* An island with no recorded host (a library island registered through a bridge) is always emitted.
+*/
+function island_host_loaded(host_path, loaded) {
+	if (!loaded) return true;
+	if (!host_path) return true;
+	return loaded.has(host_key(host_path));
+}
+/** Parse the handoff file's contents into the set `island_host_loaded` consumes. */
+function parse_ssr_hosts(json) {
+	const arr = JSON.parse(json);
+	return new Set(Array.isArray(arr) ? arr.filter((x) => typeof x === "string") : []);
+}
+export { SSR_HOSTS_HANDOFF, island_host_loaded, parse_ssr_hosts, ssr_hosts_handoff_path };

package/dist/compiler/link/entry-shim.d.ts

@@ -0,0 +1,4 @@
+/** An island entry's shim: every export of its hashed file (a component entry has a default). */
+export declare function island_shim_source(shim_file: string, entry_file: string): string;
+/** The runtime's shim: the hashed runtime, run (it has no exports; loading it boots). */
+export declare function runtime_shim_source(shim_file: string, runtime_file: string): string;

package/dist/compiler/link/entry-shim.js

@@ -0,0 +1,29 @@
+import { path } from "../host.js";
+// src/compiler/link/entry-shim.ts
+/**
+* THE STABLE-NAME SHIMS. An island entry and the runtime are content-hashed files; each one's old
+* stable name is ALSO written, as a shim of the hashed file, so that a page cached before content
+* hashing (whose islands import their stable names), and a load whose location failed (the runtime
+* re-fetches the stable name fresh), still reach the CURRENT build.
+*
+* A shim is written as a plain ASSET at the bundle's end, once every hashed name is final — never as
+* a bundled chunk. Its name never changes, so the bundler has nothing to hash, and a chunk would make
+* the island's module the target of two entries: the bundler would split its code behind two facades
+* and every island load would cost two requests. As an asset, the island has one entry, its location
+* IS its code, and the shim is a static re-export by relative path.
+*/
+/** The specifier from the shim's file to the hashed file (both output-relative paths). */
+function relative_specifier(from_file, to_file) {
+	const rel = path.posix.relative(path.posix.dirname(from_file), to_file);
+	return rel.startsWith(".") ? rel : "./" + rel;
+}
+/** An island entry's shim: every export of its hashed file (a component entry has a default). */
+function island_shim_source(shim_file, entry_file) {
+	const spec = JSON.stringify(relative_specifier(shim_file, entry_file));
+	return `export * from ${spec};\nexport { default } from ${spec};\n`;
+}
+/** The runtime's shim: the hashed runtime, run (it has no exports; loading it boots). */
+function runtime_shim_source(shim_file, runtime_file) {
+	return `import ${JSON.stringify(relative_specifier(shim_file, runtime_file))};\n`;
+}
+export { island_shim_source, runtime_shim_source };

package/dist/compiler/link/island-deps.d.ts

@@ -0,0 +1,142 @@
+import { PageKeys } from "./page-keys.js";
+import { IslandHazard } from "../../insights/hydration-hazards.js";
+/**
+ * Kit's own `hash()` (`@sveltejs/kit/src/utils/hash.js`: djb2 ×33 xor, unsigned, base36) — the
+ * function a remote's id is minted with: `${hash(file)}/${exportName}`, `file` the module's path
+ * relative to `process.cwd()`, posix. Mirrored here (Kit does not export it) so the build can
+ * name a remote by the same id the server sees on `internals.id` at render time. Covered by a
+ * vector test against ids observed from a real Kit build.
+ */
+export declare function kit_remote_hash(file: string): string;
+/**
+ * The Kit remote id-hash of a CLIENT module id, or `null` for a module that is not a remote file.
+ * `cwd` is what Kit hashed the file against (`process.cwd()` at build), either separator.
+ *
+ * @internal Exported for the plugin and unit tests.
+ */
+export declare function remote_hash_of(module_id: string, cwd: string): string | null;
+/**
+ * From a client `generateBundle` output, collect transitive static `imports` for each
+ * `og-region.<id>.js` facade. Keys/values are public URLs (`/_app/immutable/…`).
+ * Used so SSR can `modulepreload` hashed dependency chunks for `hydrate: 'load'` islands
+ * (Vite’s auto graph does not apply to `@vite-ignore` `import(entry)`).
+ *
+ * @internal Exported for unit tests.
+ */
+export declare function collectIslandDepModulepreloads(bundle: Record<string, {
+  type: string;
+  fileName?: string;
+  imports?: string[];
+  dynamicImports?: string[];
+  /** The source module ids bundled into this chunk (Rollup/rolldown `OutputChunk`). */
+  moduleIds?: string[];
+  /** Vite/rolldown-vite chunk metadata — `importedCss` lists the CSS assets a chunk owns. */
+  viteMetadata?: {
+    importedCss?: Set<string> | string[];
+  };
+}>, page_reader_files?: readonly string[], remote_hash?: ((module_id: string) => string | null) | null, page_keys_of?: ((module_id: string) => PageKeys | null) | null, read_source?: ((id: string) => string | null) | null, runtime_file?: string | null, entries?: {
+  islands: ReadonlyMap<string, string>;
+  runtime: string | null;
+} | null): {
+  js: Record<string, string[]>;
+  css: Record<string, string[]>;
+  page: Record<string, boolean>;
+  page_keys: Record<string, string[] | null>;
+  remotes: Record<string, string[]>;
+  interactivity: Record<string, IslandInteractivityFacts>;
+  /** each island's components' lines that draw differently in the browser (hydration-hazards.ts),
+   *  by entry — the app's own and the site kit's (ogygia's content components); not other packages */
+  hazards: Record<string, IslandHazard[]>;
+  /** what is inside each chunk an island pulls: a readable source list per public href */
+  contents: Record<string, string[]>;
+  /** each chunk's heaviest named modules with their rendered bytes (a package sums its modules):
+   *  what the report names as most of an island's code. Apart from `contents`, which stays names
+   *  only (a chunk's identity across builds) */
+  heavy: Record<string, ChunkHeavy>;
+  /** modules the build shipped as two copies (one package file by two paths), each copy's chunk */
+  dupes: DuplicateModule[];
+};
+/** One module the build shipped as two (or more) copies: the same file of a package reached by two
+ *  paths (its source and its build, two versions in node_modules), each copy in its chunk. */
+export interface DuplicateModule {
+  /** the module, package-relative (`ogygia/runtime/beacon`, `svelte/internal/client/index`) */
+  name: string;
+  /** `from`: where the copy came from — the package's folder (`ogygia/src`, `ogygia/dist`) or its
+   *  installed version (`svelte@5.56.8`) — the two paths, told apart */
+  copies: {
+    file: string;
+    bytes: number;
+    from?: string;
+  }[];
+}
+/** Where a module id's copy came from: an installed package's version (`name@1.2.3`, from a pnpm
+ *  store path), else the package's top folder (`name/src`, `name/dist`). */
+export declare function module_origin(id: string): string | undefined;
+/** A module id as the file of its package, the build-or-source folder and the extension left out:
+ *  two ids with one key are one module twice. Null for ids that are no file (virtual, `\0`). */
+export declare function module_key(id: string): string | null;
+/** Every module the build shipped more than once: one key, two or more ids (a single id is in one
+ *  chunk only). The heaviest first, copies of 512 bytes or more, at most 50.
+ *  @internal exported for the tests */
+export declare function duplicate_modules(chunks: readonly {
+  file: string;
+  ids: readonly string[];
+  size_of?: (id: string) => number;
+}[]): DuplicateModule[];
+/** A chunk's rendered size and its heaviest named modules. */
+export interface ChunkHeavy {
+  /** every module's rendered bytes in the chunk */
+  total: number;
+  /** the five heaviest, by the names `contents` uses (a package's modules summed) */
+  top: {
+    name: string;
+    bytes: number;
+  }[];
+}
+/** A chunk's modules as readable names (the same names `contents` uses) with their rendered bytes,
+ *  heaviest first, the five heaviest; a package's modules summed under its name.
+ *  @internal exported for the tests */
+export declare function chunk_module_bytes(module_ids: readonly string[], size_of: (id: string) => number): ChunkHeavy;
+/**
+ * A chunk's source modules as a short readable list: the app's own files first (relative to
+ * `src/`), then the packages, the framework runtimes named plainly. Capped; the tail is "+N more".
+ * @internal exported for the tests
+ */
+export declare function summarize_chunk_contents(module_ids: readonly string[], max_files?: number, max_pkgs?: number, size_of?: (id: string) => number): string[];
+/** What an island's components do (the wake advisor's evidence) — see `interactivity_facts`. */
+export interface IslandInteractivityFacts {
+  handlers: number;
+  state: number;
+  effects: number;
+  binds: number;
+  actions: number;
+  /** remote modules its closure can call (set per island from the remotes scan) */
+  remotes?: number;
+  /** `{await …}` / `{#await …}` in its markup: a value that lands after it wakes */
+  awaits?: number;
+  /** context reads and rune-module imports: state another island can change */
+  shared?: number;
+  files: number;
+}
+/** Count a component source's interactivity markers. */
+export declare function interactivity_facts(src: string): IslandInteractivityFacts;
+/** Stable handoff path under Kit's `outDir`: client `generateBundle` writes; SSR reads at render
+ *  (Kit is SSR-first). */
+export declare function islandDepsHandoffPath(out_dir: string): string;
+/**
+ * INLINE REGION CSS. For every region CSS asset (`hrefs`: the union of the handoff's `css` and
+ * `content_css` lists) whose bytes are under `threshold` — Kit's `inlineStyleThreshold`, the same
+ * number Kit inlines its own route sheets under — keep the asset's text, keyed by its public href.
+ * The render then emits `<style data-ogygia-region-css="href">` in place of a blocking `<link>`:
+ * a page carrying twenty-five small island sheets (42 KB on a measured home page, twenty of them
+ * under 3 KB) stops paying twenty-five requests before first paint. `0` = keep nothing (Kit's
+ * default: never inline). Above the threshold, or not an emitted asset, → not in the map → linked.
+ *
+ * @internal Exported for unit tests.
+ */
+export declare function collect_inline_css(bundle: Record<string, {
+  type: string;
+  fileName?: string;
+  source?: string | Uint8Array;
+}>, hrefs: Iterable<string>, threshold: number): Record<string, string>;
+export declare function island_deps_module(ssr: boolean, is_dev: boolean, out_dir_rel?: string): string;