@ogygia/core 0.0.0 → 0.11.0

package/dist/hooks.js

@@ -0,0 +1,1191 @@
+import { REGION_BRAND } from "./region-brand.js";
+import { signing_key } from "./server/signing-key.js";
+import { mpaSpeculationRules } from "./compiler/link/speculation.js";
+import { set_page_route_config } from "./plugin/routes.js";
+import { kit_page_facts_tail, kit_page_ready, kit_render_context, set_kit_event_reader, set_kit_page_reader, set_render_page_port } from "./server/kit-context.js";
+import { PAGE_FACTS_ROUTE_HEADER } from "./server/page-facts.js";
+import { configure_render_page, note_render_page_ask, page_url_of, prepare_render_page, render_page, render_page_facts_script, render_page_version } from "./server/render-page.js";
+import { absolutize_hole_html } from "./server/hole-urls.js";
+import { is_keep_fallback } from "./keep-fallback.js";
+import { set_source_recorder } from "./source.js";
+import { kit_asset } from "./kit-paths.js";
+import { region_mac_message, sign, verify } from "./server/hmac.js";
+import { expiry_refusal, note_cache_control } from "./server/shared-cache.js";
+import { app_lifetime } from "./server/region-endpoint.js";
+import { cached_render, render_cache_key } from "./server/render-cache.js";
+import { B64Url } from "./server/payload.js";
+import { REF_WIRE_KEY, ref_reviver } from "./ref.js";
+import { current_facts, facts_of, mark_per_visitor, set_current_request } from "./plugin/facts.js";
+import { around, request_contexts, start_plugins } from "./plugin/server.js";
+import { register_wire_kind } from "./live-transport.js";
+import { register_derived_kind, register_store_kind } from "./store-transport.js";
+import { register_snippet_kind } from "./region-snippet.js";
+import { register_fn_kind } from "./fn-transport.js";
+import { configure_islands_endpoint, is_region_id, is_region_ttl, islands_endpoint } from "./server/endpoint.js";
+import { build_parcel, done_parcel } from "./server/stream-regions.js";
+import { dedupe_head_links, page_declares_dev_hmr_script, page_declares_router_meta, page_declares_runtime_script, page_declares_speculation_rules, runtime_first } from "./server/head-presence.js";
+import { assemble, locate } from "./server/document-assembly.js";
+import { error_route_is_csr_true, route_is_csr_true } from "./context.js";
+import { merge_seed_ask, shape_page_data } from "./server/seed-shape.js";
+import { html_has_kit_bootstrap } from "./runtime/kit-boot.js";
+import { STAND_IN_CSS, check_script, mark, settle } from "./server/reversible.js";
+import { hole_head } from "./server/hole-graph.js";
+import { restore, restore_adopt } from "./runtime/restore.js";
+import { RateLimiter } from "./server/rate-limit.js";
+import { KEEP_FALLBACK_HTML } from "./keep-fallback-marker.js";
+import { PageSeed } from "./server/page-seed.js";
+import { analyze, index_seed, json_culprit, set_measure_memo_reader } from "./seed-refs.js";
+import { WIRE_FORMAT_ATTR, WIRE_FORMAT_JSON } from "./server/props-wire.js";
+import { page_seed_reducers, resolve_script, settle_deferred, stage_deferred } from "./server/page-stream.js";
+import { PAGE_DEFER_BOOTSTRAP, PAGE_DEFER_GLOBAL } from "./page-defer.js";
+import { ConcurrencyGate } from "./runtime/concurrency.js";
+import { serialize_provided_context } from "./context-bridge.js";
+import { escape_script_text } from "./escape.js";
+import { hole_copy_key } from "./runtime/hash.js";
+import { PAGE_CTX_MARKER, set_ctx_recorder } from "./context-registry.js";
+import { set_ask_scope_opener, set_page_recorder, set_seed_ask_reader } from "./page-seed-registry.js";
+import { collect_remote_seed } from "./server/remote-seed-gate.js";
+import { DocumentTail, set_tail_reader } from "./server/document-tail.js";
+import { runtime_bootstrap } from "./server/entry-location.js";
+import { region_css_tag } from "./server/region-css.js";
+import { set_late_recorder, set_late_scope_opener, set_late_taker } from "./late-region-registry.js";
+import { has_batch_hole_listener, record_batch_hole_stats, record_hole_stats, record_request_stats, request_stats_detailed, request_stats_wanted } from "./server/request-stats.js";
+import { set_server_devtools_recorder } from "./events/server-registry.js";
+import { drop_dead_kit_resolves } from "./server/dead-kit-resolves.js";
+import "./events/schema.js";
+import { DEVTOOLS_COOKIE, SWITCH_COOKIE_OPTIONS, switch_in_url } from "./insights/switch.js";
+import { mark_personal } from "./server/personal-response.js";
+import { ogygiaTransport } from "./transport.js";
+import { document } from "./document.js";
+import { liftRegions, restoreRegions, scanRegions } from "./server/split-regions.js";
+import { render } from "svelte/server";
+import * as devalue from "devalue";
+import { stringify } from "devalue";
+import runtime_url from "virtual:ogygia/runtime-url";
+import { fnManifest, islandCss } from "virtual:ogygia/island-deps";
+import { try_get_request_store } from "@sveltejs/kit/internal/server";
+import dev_hmr_url from "virtual:ogygia/dev-hmr-url";
+import { enabled, viewTransitions } from "virtual:ogygia/router-config";
+import { island_name, island_reads_page_data, island_url, load_islands, render_island } from "virtual:ogygia/server-manifest";
+import { create_remote_key } from "virtual:ogygia/kit-wire";
+import { building, dev } from "$app/env";
+import { rateLimit } from "virtual:ogygia/rate-limit";
+import { sessionCookie } from "virtual:ogygia/session-cookie";
+import { route_config } from "virtual:ogygia/route-config";
+import devtools_boot_url from "virtual:ogygia/devtools-boot-url";
+import { plugins } from "virtual:ogygia/server-plugins";
+// src/hooks.ts
+/**
+* SvelteKit server `handle` for signed region holes (`defer` / remount:`swr`).
+*
+* Serves `GET <base>/__ogygia__?id=…&props=…&exp=…&sig=…` by verifying the region MAC,
+* rendering the region component server-side (cookies, remote functions, and `await` work),
+* and returning HTML for the client runtime to swap in.
+*
+* Composable with `sequence()` — intercepts only the region endpoint path; otherwise
+* calls `resolve(event)`. Also injects the document-level page seed used by islands.
+*
+* @example
+* ```ts
+* // src/hooks.server.ts
+* import { ogygiaHandle } from 'ogygia/hooks';
+* import { sequence } from '@sveltejs/kit/hooks';
+* export const handle = sequence(ogygiaHandle(), myOtherHandle);
+* ```
+*
+* @packageDocumentation
+*/
+/** Is devtools on for this request's browser (a devtools BUILD): the URL's `?og-devtools=on|off`
+*  wins and is written to the response's cookie, else the cookie (insights/switch.ts). */
+function devtools_switch(event) {
+	if (building) return false;
+	const want = switch_in_url(event.url);
+	if (want === null) return event.cookies.get(DEVTOOLS_COOKIE) === "on";
+	if (want) event.cookies.set(DEVTOOLS_COOKIE, "on", SWITCH_COOKIE_OPTIONS);
+	else event.cookies.delete(DEVTOOLS_COOKIE, { path: "/" });
+	return want;
+}
+/** Hard cap on rendered region HTML (bytes). */
+const MAX_REGION_BODY = 2e6;
+const DEVTOOLS = typeof __OGYGIA_DEVTOOLS__ !== "undefined" ? __OGYGIA_DEVTOOLS__ : false;
+const DEVTOOLS_LAZY = typeof __OGYGIA_DEVTOOLS_LAZY__ !== "undefined" ? __OGYGIA_DEVTOOLS_LAZY__ : false;
+/** High-res clock for server-realm devtools timestamps. */
+const dt_now = () => typeof performance !== "undefined" && performance.now ? performance.now() : Date.now();
+const bags = /* @__PURE__ */ new WeakMap();
+/** This request's bag, or `undefined` outside a Kit page request (a hole endpoint, a remote-function
+*  call, a render with no Kit store around it). */
+function bag_of() {
+	const request = try_get_request_store()?.event?.request;
+	return request ? bags.get(request) : void 0;
+}
+set_ctx_recorder((key, value) => {
+	const bag = bag_of();
+	if (bag) bag.ctx.set(key, value);
+});
+const doc_asks = /* @__PURE__ */ new WeakMap();
+const request_of = () => try_get_request_store()?.event?.request;
+set_ask_scope_opener(() => {
+	const request = request_of();
+	if (request && !bags.has(request) && !doc_asks.has(request)) doc_asks.set(request, {
+		wanted: false,
+		keys: null
+	});
+});
+set_seed_ask_reader(() => {
+	const bag = bag_of();
+	if (bag) return {
+		wanted: bag.seed_wanted,
+		keys: bag.seed_keys
+	};
+	const request = request_of();
+	const d = request ? doc_asks.get(request) : void 0;
+	return d ? {
+		wanted: d.wanted,
+		keys: d.keys
+	} : void 0;
+});
+set_page_recorder((snapshot, seed, remotes, entry) => {
+	const event = try_get_request_store()?.event;
+	if (event && note_render_page_ask(event, seed)) return;
+	const bag = bag_of();
+	if (!bag) {
+		const request = request_of();
+		const d = request ? doc_asks.get(request) : void 0;
+		if (d && seed !== false) {
+			d.wanted = true;
+			d.keys = merge_seed_ask(d.keys, seed);
+		}
+		return;
+	}
+	bag.page = {
+		...bag.page,
+		...snapshot
+	};
+	if (seed !== false) {
+		bag.seed_wanted = true;
+		bag.seed_keys = merge_seed_ask(bag.seed_keys, seed);
+	}
+	if (bag.seed_asks && entry && seed !== false) bag.seed_asks.set(entry, seed);
+	if (remotes === null) bag.remotes_wanted = null;
+	else if (bag.remotes_wanted) for (const h of remotes) bag.remotes_wanted.add(h);
+});
+set_tail_reader(() => bag_of()?.tail ?? null);
+set_measure_memo_reader(() => bag_of()?.measure_memo ?? null);
+configure_render_page({ warn: dev ? (m) => console.warn(m) : null });
+set_kit_event_reader(() => try_get_request_store()?.event ?? null);
+/** Does this hole's server tree read `page.data` (the build's answer; unknown in dev → yes). */
+const hole_reads_page_data = (id) => island_reads_page_data === null || island_reads_page_data[id] !== false;
+set_render_page_port({
+	ready(reads_data) {
+		const store = try_get_request_store();
+		return prepare_render_page(store?.event, store?.state?.transport, reads_data);
+	},
+	tail() {
+		const store = try_get_request_store();
+		return render_page_facts_script(store?.event, store?.state?.transport);
+	},
+	version(hole_id) {
+		if (!hole_reads_page_data(hole_id)) return "";
+		const v = render_page_version(try_get_request_store()?.event, bag_of()?.page ?? void 0);
+		return v ? "&pv=" + v : "";
+	}
+});
+set_kit_page_reader(() => {
+	const bag = bag_of();
+	return render_page(bag ? bag.page ?? {} : void 0, try_get_request_store()?.event);
+});
+set_late_scope_opener(() => {
+	const bag = bag_of();
+	if (bag) bag.late_open = true;
+});
+set_late_recorder((promise) => {
+	const bag = bag_of();
+	if (!bag?.late_open) return null;
+	const id = `r${bag.late_next++}`;
+	(bag.late ??= []).push({
+		id,
+		promise
+	});
+	return id;
+});
+set_late_taker(() => {
+	const bag = bag_of();
+	if (!bag?.late?.length) return null;
+	const list = bag.late;
+	bag.late = null;
+	return list;
+});
+set_current_request(() => try_get_request_store()?.event?.request);
+set_source_recorder((tag) => {
+	current_facts()?.sources?.push(tag);
+});
+set_page_route_config(route_config);
+const plugins$1 = start_plugins(plugins, {
+	sign: (message) => sign(signing_key().secret, message),
+	verify: (message, signature) => verify(signing_key().secret, message, signature),
+	lifetime: app_lifetime,
+	deny: region_denied
+});
+const dt_buffers = /* @__PURE__ */ new WeakMap();
+function dt_record(bag, input) {
+	const buf = bag ? dt_buffers.get(bag) : void 0;
+	if (!buf) return;
+	buf.events.push({
+		...input,
+		v: 1,
+		seq: buf.seq++,
+		t: dt_now(),
+		realm: "server"
+	});
+}
+if (DEVTOOLS) set_server_devtools_recorder((input) => dt_record(bag_of(), input));
+/** Cap on a batch POST body before `request.json()` buffers it. 32 endpoints × ~8.5kB (props cap
+*  8192 + URL overhead) ≈ 270kB; 512kB leaves margin. Rejected up front via `content-length`. */
+const MAX_BATCH_BODY = 524288;
+/** Abort waiting on slow region SSR (work may continue — see INVARIANTS · RENDER-TIMEOUT). */
+const RENDER_TIMEOUT_MS = 1e4;
+/** Process-local cap on concurrent region SSR (M1 CPU amp under valid MAC). */
+const render_gate = new ConcurrencyGate(4);
+/** The per-plugin contexts of an app with no plugins (shared: never written to). */
+const NO_CTXS = [];
+/**
+* Anti-framing + MIME + Referrer on every region response.
+* Referrer-Policy strips capability query strings from third-party asset requests (H6).
+*/
+const REGION_FRAME_HEADERS = {
+	"X-Frame-Options": "DENY",
+	"Content-Security-Policy": "frame-ancestors 'none'",
+	"X-Content-Type-Options": "nosniff",
+	"Referrer-Policy": "no-referrer"
+};
+function region_response(body, init) {
+	return new Response(body, {
+		status: init.status,
+		headers: {
+			...REGION_FRAME_HEADERS,
+			...init.headers
+		}
+	});
+}
+/**
+* Every refused region request: a 403 that says why (`x-ogygia-deny`) and which key answered
+* (`x-ogygia-key`, the fingerprint a capability carries as `&k=`). Neither is an oracle: every
+* reason past `sig` is reached only with a capability this key signed (an unknown id still never
+* tells from a bad MAC, SEC-01), and the fingerprint is an HMAC of a constant.
+*/
+function region_denied(why) {
+	return region_response("Forbidden", {
+		status: 403,
+		headers: {
+			"x-ogygia-deny": why,
+			"x-ogygia-key": signing_key().fp
+		}
+	});
+}
+/** A capability minted under another key than this deployment's (its `&k=` fingerprint). One
+*  without `k` (minted before capabilities named their key) is left to the MAC. */
+function foreign_key(k) {
+	return k !== null && k !== signing_key().fp;
+}
+function capability_of(params) {
+	return {
+		id: params.get("id") ?? "",
+		render: params.get("r") ?? "",
+		payload: params.get("props") ?? "",
+		exp: params.get("exp") ?? "",
+		ttl: params.get("ttl") ?? "",
+		sig: params.get("sig") ?? "",
+		k: params.get("k")
+	};
+}
+/**
+* The server entry that answers a verified capability: its own id when this build has it, else an
+* entry of this build rendering the same component (its signed render identity) — the capability
+* came from another build: an older cached page, another deployment, a changed schedule or salt.
+* Null when this build renders neither: the component is gone, moved or renamed.
+*/
+function capability_target(cap) {
+	if (Object.hasOwn(island_url, cap.id)) return cap.id;
+	if (cap.render !== "" && Object.hasOwn(render_island, cap.render)) return render_island[cap.render];
+	return null;
+}
+/**
+* Decode a request pathname without throwing on malformed percent-encoding (SEC-05).
+* @returns decoded path, or null if the encoding is invalid
+*/
+function decode_pathname(pathname) {
+	try {
+		return decodeURIComponent(pathname);
+	} catch {
+		return null;
+	}
+}
+/** Resolve a rate-limit key; fail closed (null) when the adapter cannot identify the client.
+* Never trust X-Forwarded-For / spoofable proxy headers — adapters must provide getClientAddress(). */
+function client_ip(event) {
+	try {
+		return event.getClientAddress();
+	} catch {
+		return null;
+	}
+}
+/**
+* Stylesheet `<link>`s a server-picked region needs so a page that never imported the component
+* still styles the fetched HTML (the whole point of a held region — the page can't know which
+* component the server will choose). Tagged `data-ogygia-region-css` so the client runtime HOISTS
+* them into `<head>`: a body `<link>` wouldn't load inside a `<template>` batch parcel, and a head
+* link loads once and is deduped across regions. Empty for a plain island (its CSS is already in the
+* page's own stylesheet) or before a build (`islandCss` reads the build-time handoff).
+*/
+function region_css_links(id) {
+	const url = island_url[id];
+	if (!url) return "";
+	let out = "";
+	for (const href of islandCss(url)) out += region_css_tag(href, kit_asset(href));
+	return out;
+}
+/**
+* Wrap a payload as an `application/ogygia-*` side-channel `<script>` the runtime reads. The
+* `payload` MUST be `<`-safe already: devalue output is by construction (it writes `<`), a
+* JSON payload goes through `escape_script_text` first — so this only builds the tag. One spot for
+* the side-channel shape (page / remote / ctx / devtools).
+*/
+function emit_ogygia_script(subtype, escaped_payload, marker = "") {
+	return `<script type="application/ogygia-${subtype}"${marker ? " " + marker : ""}>${escaped_payload}<\/script>`;
+}
+const DOUBLE_QUOTE_G = /"/g;
+/** Stamped into the head of a csr=true document: the runtime reads it (`kit_hydrates_page`)
+*  instead of scanning the page's inline scripts for Kit's bootstrap. */
+const CSR_META = "<meta name=\"ogygia-csr\" content=\"true\">";
+const CSR_FALSE_META = "<meta name=\"ogygia-csr\" content=\"false\">";
+/** the og.$ factory script, per manifest object (the build's, the same every request) */
+const fnm_script_cache = /* @__PURE__ */ new WeakMap();
+/** A document fetched by ogygia's router (runtime/router-nav.ts `nav_headers`: a navigation or a
+*  prefetch) — morphed into the live page rather than loaded as one. */
+function router_fetched(event) {
+	return event.request.headers.get("x-ogygia-spa") !== null;
+}
+const NO_TRANSPORT = {};
+const seed_codec_cache = /* @__PURE__ */ new WeakMap();
+/** The seed's devalue reducers — the app's transport encoders merged with the defer markers — and a
+*  stringify bound to them, made once per transport object (Kit hands the same one every request). */
+function seed_codecs(transport) {
+	const key = transport ?? NO_TRANSPORT;
+	let hit = seed_codec_cache.get(key);
+	if (!hit) {
+		const seed_reducers = {
+			...Object.fromEntries(Object.entries(transport ?? {}).map(([name, codec]) => [name, codec.encode])),
+			...page_seed_reducers
+		};
+		hit = {
+			seed_reducers,
+			seed_stringify: ((v) => stringify(v, seed_reducers))
+		};
+		seed_codec_cache.set(key, hit);
+	}
+	return hit;
+}
+/** `</body>` as bytes (ASCII: the same in every UTF-8 document). */
+const BODY_CLOSE_BYTES = [
+	60,
+	47,
+	98,
+	111,
+	100,
+	121,
+	62
+];
+/** Does `</body>` end in `chunk` — searched backwards from its end, where it sits — or straddle the
+*  boundary with the previous chunk's last bytes (`carry`, at most 6)? No decode. */
+function has_body_close(carry, chunk) {
+	const at_bytes = (buf, i) => {
+		for (let k = 0; k < 7; k++) if (buf[i + k] !== BODY_CLOSE_BYTES[k]) return false;
+		return true;
+	};
+	for (let i = chunk.lastIndexOf(60); i !== -1; i = i === 0 ? -1 : chunk.lastIndexOf(60, i - 1)) if (at_bytes(chunk, i)) return true;
+	if (!carry.length) return false;
+	const seam = new Uint8Array(carry.length + Math.min(6, chunk.length));
+	seam.set(carry);
+	seam.set(chunk.subarray(0, seam.length - carry.length), carry.length);
+	for (let i = 0; i + 7 <= seam.length; i++) if (at_bytes(seam, i)) return true;
+	return false;
+}
+function csr_page_of(html, body_end, event, bag) {
+	return event?.route?.id != null ? bag?.page?.error != null ? error_route_is_csr_true(event.route.id) : route_is_csr_true(event.route.id) : body_end !== -1 && html_has_kit_bootstrap(html, body_end);
+}
+/** The restorer, inline (runtime/restore.ts — self-contained, so its source runs as is): restores the
+*  document now, and stays as `__og_restore` / `__og_restore_adopt` for hole answers and router swaps. */
+const RESTORER_SCRIPT = `<script data-og-restore>(function(){var r=${restore.toString()};window.__og_restore=r;window.__og_restore_adopt=${restore_adopt.toString()};r(document)})()<\/script>`;
+var OgygiaHandle = class {
+	#endpoint;
+	#speculation_rules;
+	/** The app's server transform (documents and region answers) — see OgygiaHandleOptions. */
+	#transform;
+	render_rate;
+	probe_rate;
+	constructor(options = {}) {
+		this.#transform = options.transform;
+		configure_islands_endpoint(options.endpoint);
+		this.#endpoint = islands_endpoint();
+		this.#speculation_rules = enabled ? "" : mpaSpeculationRules(this.#endpoint);
+		this.render_rate = new RateLimiter({
+			max: rateLimit.max,
+			windowMs: rateLimit.windowMs
+		});
+		/** Cheap pre-HMAC probe budget — forged traffic pays this, not full render quota (HMAC-CPU-DOS). */
+		this.probe_rate = new RateLimiter({
+			max: rateLimit.max <= 0 ? 0 : Math.max(rateLimit.max * 5, 120),
+			windowMs: rateLimit.windowMs
+		});
+	}
+	handle = around(plugins$1, (input) => this.#core(input));
+	#core = async ({ event, resolve }) => {
+		const path = decode_pathname(event.url.pathname);
+		if (path === null) return new Response("Bad Request", { status: 400 });
+		const facts = facts_of(event.request);
+		if (plugins$1.length === 0) return this.#route(event, resolve, path, NO_CTXS, facts);
+		const ctxs = request_contexts(plugins$1, event, path, facts, (endpoint) => this.#render_hole(endpoint, event));
+		try {
+			for (let i = 0; i < plugins$1.length; i++) {
+				const answer = await plugins$1[i].def.request?.(ctxs[i]);
+				if (answer) return answer;
+			}
+			return await this.#route(event, resolve, path, ctxs, facts);
+		} finally {
+			for (let i = 0; i < plugins$1.length; i++) try {
+				plugins$1[i].def.done?.(ctxs[i]);
+			} catch {}
+		}
+	};
+	/** One signed hole rendered in place with THIS request's event (a plugin's `ctx.renderHole`:
+	*  the stored-page stitch). Null keeps the fallback: a refused capability, a failed render, or
+	*  an answer that asks to keep it. */
+	async #render_hole(endpoint, event) {
+		const out = await this.#render_capability(endpoint, event);
+		return out && out.html !== "<!--ogygia:keep-fallback-->" ? out.html : null;
+	}
+	async #route(event, resolve, path, ctxs, facts) {
+		if (!path.endsWith(this.#endpoint)) {
+			if (event.isDataRequest && event.request.headers.has("x-ogygia-page-facts")) {
+				const res = await resolve(event);
+				try {
+					res.headers.set(PAGE_FACTS_ROUTE_HEADER, encodeURIComponent(JSON.stringify({
+						id: event.route.id,
+						params: event.params
+					})));
+				} catch {}
+				return res;
+			}
+			const devtools_on = DEVTOOLS && (!DEVTOOLS_LAZY || devtools_switch(event));
+			const devtools_personal = DEVTOOLS_LAZY && !building && (devtools_on || switch_in_url(event.url) !== null);
+			facts.private = devtools_personal;
+			facts.answerForm = !!this.#transform && router_fetched(event);
+			const store = try_get_request_store();
+			const bag = {
+				ctx: /* @__PURE__ */ new Map(),
+				page: null,
+				seed_wanted: false,
+				seed_keys: null,
+				seed_asks: request_stats_detailed() ? /* @__PURE__ */ new Map() : null,
+				remotes_wanted: /* @__PURE__ */ new Set(),
+				tail: new DocumentTail(),
+				measure_memo: /* @__PURE__ */ new Map(),
+				deferred: null,
+				defer_next_id: 0,
+				late: null,
+				late_next: 0,
+				late_open: false,
+				seed_reducers: null,
+				facts
+			};
+			const lean = devtools_on && !building && (event.cookies.get("og_testing") === "lean" || event.url.searchParams.get("og-testing") === "lean");
+			if (devtools_on && !lean) dt_buffers.set(bag, {
+				events: [],
+				seq: 0
+			});
+			bags.set(event.request, bag);
+			for (let i = 0; i < ctxs.length; i++) {
+				const answer = await plugins$1[i].def.page?.(ctxs[i]);
+				if (answer) return answer;
+			}
+			const set_headers = event.setHeaders;
+			event.setHeaders = (headers) => {
+				set_headers(headers);
+				for (const key in headers) if (key.toLowerCase() === "cache-control") note_cache_control(event.request, headers[key]);
+			};
+			const response = await resolve(event, { transformPageChunk: async ({ html }) => this.inject_client_seeds(this.#transform ? await this.#transform_document(html, event, bag) : html, store?.state, event, bag) });
+			if (devtools_personal) mark_personal(response);
+			if (this.#transform && (response.headers.get("content-type") ?? "").includes("text/html")) try {
+				response.headers.append("vary", "x-ogygia-spa");
+			} catch {}
+			if (devtools_on && DEVTOOLS_LAZY && (response.headers.get("content-type") ?? "").includes("text/html")) try {
+				if (!response.headers.has("document-policy")) response.headers.set("document-policy", "js-profiling");
+				if (event.route?.id) response.headers.append("server-timing", `og-route;desc=${JSON.stringify(event.route.id)}`);
+			} catch {}
+			if (bag.deferred && bag.deferred.length) facts.streamed = true;
+			let out = response;
+			for (let i = 0; i < ctxs.length; i++) out = await plugins$1[i].def.response?.(ctxs[i], out) ?? out;
+			if (out !== response) return out;
+			if (bag.deferred && bag.deferred.length) return this.stream_page_deferred(response, bag.deferred, bag.defer_next_id, bag.seed_reducers ?? void 0);
+			if (!bag.kit_client && !response.headers.has("content-length") && (response.headers.get("content-type") ?? "").includes("text/html")) return drop_dead_kit_resolves(response);
+			return response;
+		}
+		if (event.request.method.toUpperCase() === "POST") return this.render_batch(event);
+		return this.render_region(event);
+	}
+	/**
+	* Batch frame stream (client navigation, single-flight). POST body: a JSON `string[]` of signed
+	* region endpoints — the calls the client needs. Renders them in parallel and flushes each as a
+	* `<template data-ogygia-slot="sig">…</template>` frame the moment IT settles (out of order); a
+	* done sentinel ends it. One response, many frames. Every call carries its own MAC so there's no
+	* extra auth; same-origin + per-IP budget mirror the single-region path.
+	*/
+	async render_batch(event) {
+		const MAX_BATCH = 32;
+		if (event.request.headers.get("sec-fetch-site") === "cross-site") return region_denied("cross-site");
+		const ip = client_ip(event);
+		if (!ip) return region_response("Too Many Requests", { status: 429 });
+		if (this.probe_rate.limited(ip) || this.render_rate.limited(ip)) return region_response("Too Many Requests", { status: 429 });
+		const content_length = Number(event.request.headers.get("content-length"));
+		if (Number.isFinite(content_length) && content_length > MAX_BATCH_BODY) return region_response("Payload Too Large", { status: 413 });
+		let parsed;
+		try {
+			parsed = await event.request.json();
+		} catch {
+			return region_response("Bad Request", { status: 400 });
+		}
+		if (!Array.isArray(parsed) || parsed.length === 0) return region_response("Bad Request", { status: 400 });
+		const calls = parsed.filter((e) => typeof e === "string").slice(0, MAX_BATCH);
+		const render = (endpoint) => this.#render_capability(endpoint, event, true);
+		const encoder = new TextEncoder();
+		return region_response(new ReadableStream({ async start(controller) {
+			await Promise.all(calls.map(async (endpoint) => {
+				const out = await render(endpoint).catch(() => null);
+				const parcel = out ? build_parcel(out.slot, out.html) : null;
+				if (parcel) controller.enqueue(encoder.encode(parcel));
+			}));
+			controller.enqueue(encoder.encode(done_parcel()));
+			controller.close();
+		} }), {
+			status: 200,
+			headers: {
+				"content-type": "text/html; charset=utf-8",
+				"cache-control": "no-store",
+				"x-accel-buffering": "no"
+			}
+		});
+	}
+	/**
+	* THE APP'S TRANSFORM ON A DOCUMENT (server/reversible.ts): the chunk carrying `</head>` (the
+	* document; a streamed tail chunk passes untouched) is marked, handed to the transform, settled.
+	* Then the head gets the transform's `data-og-head` assets (deduped) and, when the parser would have
+	* restructured a tag, the stand-ins' sheet; the body gets the restorer — inline, before `</body>`,
+	* so it runs before any island wakes, before Kit starts, and before a deferred module upgrades a
+	* host. It also stays on the page as a global for the runtime's hole answers and router swaps.
+	*/
+	async #transform_document(html, event, bag) {
+		if (html.indexOf("</head>") === -1) return html;
+		const csr = csr_page_of(html, html.lastIndexOf("</body>"), event, bag);
+		const answer = router_fetched(event);
+		const marked = mark(html, "document", csr, answer);
+		const out = await this.#transform(marked ? marked.html : html, {
+			kind: "document",
+			csr,
+			event
+		});
+		const s = marked ? settle(out, marked.record, { dev }) : null;
+		let first_load = false;
+		if (marked && !answer) {
+			for (const h of marked.record.hosts.values()) if (!h.planned) first_load = true;
+		}
+		bag.transform_head = (s?.head.join("") ?? "") + (s?.stand_ins ? `<style data-og-stand-ins>${STAND_IN_CSS}</style>` : "") + (first_load ? "<meta name=\"ogygia-first-load\">" : "");
+		bag.transform_body = (s?.check ? check_script(s.check) : "") + RESTORER_SCRIPT;
+		return s ? s.html : out;
+	}
+	/** THE APP'S TRANSFORM ON A REGION ANSWER: marked, transformed, settled. The runtime restores it
+	*  before insertion (and hoists its `data-og-head` assets), so no stand-in sheet is needed. */
+	async #transform_region(html, event) {
+		const marked = mark(html, "region", false);
+		const out = await this.#transform(marked ? marked.html : html, {
+			kind: "region",
+			csr: false,
+			event
+		});
+		if (!marked) return out;
+		const s = settle(out, marked.record, { dev });
+		return s.check ? s.html + check_script(s.check) : s.html;
+	}
+	/**
+	* Document-level side-channels: one page snapshot + optional remote query seed.
+	* Skips Kit-booted (csr=true) pages which serialize remotes themselves.
+	*/
+	async inject_client_seeds(html, state, event, bag) {
+		const t_start = performance.now();
+		const spans = locate(html);
+		const head = spans.head_end === -1 ? null : html.slice(0, spans.head_end);
+		const csr_page = csr_page_of(html, spans.body_end, event, bag);
+		if (csr_page && bag) bag.kit_client = true;
+		if (csr_page) {
+			let head_inject = "";
+			if (head !== null) {
+				head_inject = CSR_META;
+				if (devtools_boot_url && !head.includes("data-ogygia-devtools-boot")) head_inject += `<script type="module" data-ogygia-devtools-boot src="${devtools_boot_url}"><\/script>`;
+			}
+			if (head !== null && bag?.transform_head) head_inject = bag.transform_head + head_inject;
+			const tail = spans.body_end !== -1 && bag ? (bag.transform_body ?? "") + bag.tail.render(null) : "";
+			if (head === null && !tail) return html;
+			const ordered = head === null ? null : runtime_first(head, null);
+			return assemble(html, spans, ordered === head ? null : ordered, head_inject, tail);
+		}
+		let head_out = null;
+		let head_inject = head !== null ? CSR_FALSE_META : "";
+		if (head !== null) {
+			const deduped = dedupe_head_links(head);
+			if (deduped !== head) head_out = deduped;
+			const probe = head_out ?? head;
+			if (!enabled && !page_declares_speculation_rules(probe)) head_inject += `<script type="speculationrules" data-ogygia-speculate>${this.#speculation_rules}<\/script>`;
+			if (enabled && !page_declares_router_meta(probe)) head_inject += `<meta name="ogygia-router" content="${viewTransitions ? "vt" : "plain"}">`;
+			const runtime_tag = enabled && runtime_url && !page_declares_runtime_script(probe) ? runtime_bootstrap(kit_asset) : null;
+			const ordered = runtime_first(probe, runtime_tag);
+			if (ordered !== probe) head_out = ordered;
+			if (dev_hmr_url && !page_declares_dev_hmr_script(probe)) {
+				head_inject += `<script type="module" data-ogygia-dev-hmr src="${kit_asset(dev_hmr_url)}"><\/script>`;
+				const scope = (event?.route.id ?? "").split("/").filter(Boolean)[0] ?? "";
+				head_inject += `<meta name="ogygia-dev-scope" content="${scope.replace(DOUBLE_QUOTE_G, "")}">`;
+			}
+		}
+		if (head !== null && bag?.transform_head) head_inject = bag.transform_head + head_inject;
+		if (spans.body_end === -1) return assemble(html, spans, head_out, head_inject, "");
+		const rendered = !!bag && bag.page !== null;
+		const scripts = bag?.transform_body ? [bag.transform_body] : [];
+		if (!rendered) {
+			this.append_devtools_seed(scripts, bag);
+			return assemble(html, spans, head_out, head_inject, scripts.join(""));
+		}
+		const page_snap = bag.page;
+		const seed_wanted = bag.seed_wanted;
+		const detail = request_stats_detailed();
+		const tail_html = bag.tail.render(seed_wanted ? index_seed(page_snap.data) : null, detail);
+		let seed_keys = bag.seed_keys;
+		if (seed_wanted && seed_keys !== "all" && seed_keys !== null) for (const k of index_seed(page_snap.data).touched) seed_keys.add(k);
+		const shaped_data = shape_page_data(page_snap.data, seed_keys);
+		let seed_data = shaped_data;
+		let seed_form = page_snap.form;
+		const { seed_reducers, seed_stringify } = seed_codecs(state?.transport);
+		const data_shape = analyze(shaped_data);
+		const form_shape = analyze(page_snap.form ?? null);
+		const has_pending = data_shape.thenable || form_shape.thenable;
+		if (has_pending) mark_per_visitor(bag.facts, "streamed load (promise in page data)");
+		const can_stream = event?.request.headers.get("sec-fetch-mode") === "navigate";
+		if (has_pending && can_stream && seed_wanted) {
+			const staged_data = stage_deferred(shaped_data, 0);
+			const staged_form = stage_deferred(page_snap.form, staged_data.next_id);
+			seed_data = staged_data.staged;
+			seed_form = staged_form.staged;
+			bag.deferred = [...staged_data.deferred, ...staged_form.deferred];
+			bag.defer_next_id = staged_form.next_id;
+			bag.seed_reducers = seed_reducers;
+			scripts.push(`<script>${PAGE_DEFER_BOOTSTRAP}<\/script>`);
+		} else if (has_pending && seed_wanted) {
+			seed_data = await settle_deferred(shaped_data);
+			seed_form = await settle_deferred(page_snap.form);
+		}
+		if (tail_html) scripts.push(tail_html);
+		let remote_seed_bytes = 0;
+		let fnm_bytes = 0;
+		let ctx_bytes = 0;
+		const page_payload = event && seed_wanted ? PageSeed.serialize({
+			url: event.url,
+			params: event.params,
+			route: event.route,
+			status: page_snap.status ?? 200,
+			data: seed_data,
+			form: seed_form,
+			error: page_snap.error
+		}, seed_stringify, !has_pending && data_shape.json && form_shape.json && analyze(page_snap.error ?? null).json) : null;
+		if (page_payload) {
+			scripts.push(emit_ogygia_script("page", page_payload.text, "data-ogygia-page" + (page_payload.json ? ` ${WIRE_FORMAT_ATTR}="${WIRE_FORMAT_JSON}"` : "")));
+			if (DEVTOOLS) dt_record(bag, {
+				domain: "server",
+				name: "server.seed.injected",
+				kind: "page",
+				bytes: page_payload.text.length
+			});
+		}
+		if (state?.remote?.implicit) {
+			const remote_script = await this.build_remote_seed_script(state, bag.remotes_wanted);
+			if (remote_script) {
+				scripts.push(remote_script);
+				remote_seed_bytes = remote_script.length;
+				if (DEVTOOLS) dt_record(bag, {
+					domain: "server",
+					name: "server.seed.injected",
+					kind: "remote",
+					bytes: remote_script.length
+				});
+			}
+		}
+		const fnm = fnManifest();
+		if (fnm) {
+			let fnm_script = fnm_script_cache.get(fnm);
+			if (fnm_script === void 0) {
+				fnm_script = `<script data-ogygia-fnm>globalThis.__OG_FNM=Object.assign(globalThis.__OG_FNM||{},{${Object.entries(fnm).map(([tag, src]) => `${JSON.stringify(tag)}:(${src})`).join(",")}});<\/script>`;
+				fnm_script_cache.set(fnm, fnm_script);
+			}
+			scripts.push(fnm_script);
+			fnm_bytes = fnm_script.length;
+		}
+		const provided = bag?.ctx;
+		if (provided?.size) {
+			const payload = serialize_provided_context(provided);
+			if (payload) {
+				scripts.push(emit_ogygia_script("ctx", payload, PAGE_CTX_MARKER));
+				ctx_bytes = payload.length;
+			}
+		}
+		this.append_devtools_seed(scripts, bag);
+		const out = assemble(html, spans, head_out, head_inject, scripts.join(""));
+		if (event && request_stats_wanted()) {
+			const size = bag.tail.size;
+			record_request_stats(event.request, {
+				transform_ms: Math.round((performance.now() - t_start) * 100) / 100,
+				islands: size.props,
+				hints: size.hints,
+				holes: size.holes,
+				seed_bytes: page_payload ? page_payload.text.length : 0,
+				remote_seed_bytes,
+				tail_bytes: tail_html.length,
+				fnm_bytes,
+				ctx_bytes,
+				seed_json: page_payload?.json ?? false,
+				...detail ? {
+					seed_culprit: page_payload && !page_payload.json ? json_culprit(seed_data) : null,
+					island_rows: bag.tail.island_rows() ?? [],
+					seed: this.explain_seed(page_snap.data, seed_keys, bag),
+					hole_rows: bag.tail.hole_rows()
+				} : {}
+			});
+		}
+		return out;
+	}
+	/**
+	* THE SEED EXPLAINER: per top-level `page.data` key, its size and why it ships — an island's
+	* client code reads it (the build's per-entry keys), a sidecar points into it (seed refs), or
+	* some island reads the page whole and everything ships. Profiler detail only.
+	*/
+	explain_seed(data, seed_keys, bag) {
+		const rows = bag.tail.island_rows() ?? [];
+		const names = /* @__PURE__ */ new Map();
+		for (const row of rows) if (row.name && !names.has(row.entry)) names.set(row.entry, row.name);
+		const name_of = (entry) => names.get(entry) ?? entry;
+		const add = (m, k, v) => (m.get(k) ?? m.set(k, /* @__PURE__ */ new Set()).get(k)).add(v);
+		const whole = /* @__PURE__ */ new Set();
+		const readers = /* @__PURE__ */ new Map();
+		for (const [entry, ask] of bag.seed_asks ?? []) if (ask === "all") whole.add(name_of(entry));
+		else if (ask !== false) for (const k of ask) add(readers, k, name_of(entry));
+		const referenced = /* @__PURE__ */ new Map();
+		for (const row of rows) for (const k of row.ref_keys) add(referenced, k, name_of(row.entry));
+		const whole_by = [...whole];
+		const keys = [];
+		if (data && typeof data === "object" && !Array.isArray(data)) for (const key of Object.keys(data)) {
+			const shipped = seed_keys === "all" || seed_keys !== null && seed_keys.has(key);
+			const read = [...readers.get(key) ?? []];
+			const refd = [...referenced.get(key) ?? []];
+			keys.push({
+				key,
+				bytes: analyze(data[key]).bytes,
+				readers: read,
+				referenced_by: refd,
+				shipped,
+				reason: !shipped ? null : read.length ? "read" : refd.length ? "referenced" : whole_by.length ? "whole" : "read"
+			});
+		}
+		keys.sort((a, b) => b.bytes - a.bytes);
+		return {
+			keys,
+			whole_by
+		};
+	}
+	/** DEVTOOLS: drain this request's server-realm events (region renders, capability mints, seeds)
+	*  into an `application/ogygia-devtools` side-channel the client bus ingests — one stream, both
+	*  realms, correlated by fingerprint. Appended LAST so the seed.injected events are included. */
+	append_devtools_seed(scripts, bag) {
+		const dt_buf = DEVTOOLS && bag ? dt_buffers.get(bag) : void 0;
+		if (DEVTOOLS && dt_buf && dt_buf.events.length) scripts.push(emit_ogygia_script("devtools", escape_script_text(JSON.stringify(dt_buf.events))));
+	}
+	/**
+	* Stream the captured `$page.data` promises into islands (csr=false, real browser load). The
+	* document — carrying the pending seed + resolve-global bootstrap — is already built by `resolve`;
+	* here we (1) forward it, (2) DRAIN Kit's own dead csr=false resolve tail so its
+	* `__sveltekit_<hash> is not defined` never reaches the browser, and (3) emit one
+	* `<script>__ogygia_page_resolve(id, ok, value)<\/script>` per promise AS IT SETTLES — completion
+	* order, non-blocking. Each island's `{#await page.data.x}` flips pending → resolved live.
+	*/
+	stream_page_deferred(response, deferred, initial_next_id, reducers) {
+		const source = response.body;
+		if (!source) return response;
+		const reader = source.getReader();
+		const encoder = new TextEncoder();
+		const stream = new ReadableStream({
+			async start(controller) {
+				let carry = /* @__PURE__ */ new Uint8Array(0);
+				try {
+					for (;;) {
+						const { value, done } = await reader.read();
+						if (done) break;
+						controller.enqueue(value);
+						if (has_body_close(carry, value)) break;
+						carry = value.length >= 6 ? value.subarray(value.length - 6) : value;
+					}
+				} catch {}
+				(async () => {
+					try {
+						for (;;) {
+							const { done } = await reader.read();
+							if (done) break;
+						}
+					} catch {}
+				})();
+				let pending = deferred.length;
+				let next_id = initial_next_id;
+				let closed = false;
+				const maybe_close = () => {
+					if (pending === 0 && !closed) {
+						closed = true;
+						try {
+							controller.close();
+						} catch {}
+					}
+				};
+				const push = (id, ok, value) => {
+					try {
+						controller.enqueue(encoder.encode(resolve_script(PAGE_DEFER_GLOBAL, id, {
+							ok,
+							value
+						}, reducers)));
+					} catch {}
+				};
+				const stream_one = (id, promise) => {
+					Promise.resolve(promise).then((value) => {
+						const { staged, deferred: nested, next_id: after } = stage_deferred(value, next_id);
+						next_id = after;
+						push(id, true, staged);
+						pending += nested.length;
+						for (const n of nested) stream_one(n.id, n.promise);
+						pending -= 1;
+						maybe_close();
+					}, (error) => {
+						push(id, false, error);
+						pending -= 1;
+						maybe_close();
+					});
+				};
+				for (const { id, promise } of deferred) stream_one(id, promise);
+				maybe_close();
+			},
+			cancel() {
+				reader.cancel().catch(() => {});
+			}
+		});
+		const headers = new Headers(response.headers);
+		headers.delete("content-length");
+		return new Response(stream, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+	/**
+	* True when a remote's resolved value (deep) contains a region carrying baked SSR HTML — a
+	* page-sized render, not seed data (see the skip in {@link build_remote_seed_script}). Depth-capped:
+	* a region ticket sits shallow in any sane payload (a DocView's `entry.body` is 2 levels deep).
+	*/
+	has_baked_region(value, depth = 0) {
+		if (depth > 6 || value === null || typeof value !== "object") return false;
+		const r = value;
+		if (r[REGION_BRAND] === true && typeof r.html === "string") return true;
+		if (Array.isArray(value)) return value.some((x) => this.has_baked_region(x, depth + 1));
+		for (const k in r) if (this.has_baked_region(r[k], depth + 1)) return true;
+		return false;
+	}
+	async build_remote_seed_script(state, wanted = null) {
+		const implicit = state.remote?.implicit;
+		if (!implicit) return null;
+		const data = await collect_remote_seed(implicit, wanted, {
+			memo: (internals) => state.remote.data?.get(internals),
+			skip_value: (v) => this.has_baked_region(v),
+			key: create_remote_key
+		});
+		if (!Object.values(data).some((b) => Object.keys(b).length > 0)) return null;
+		const transport = state.transport || {};
+		const reducers = Object.fromEntries(Object.entries(transport).map(([name, codec]) => [name, codec.encode]));
+		return emit_ogygia_script("remote", devalue.stringify(data, reducers));
+	}
+	/**
+	* `render()` the island under the concurrency gate + timeout. Returns the HTML body, or `null`
+	* if the render threw or timed out. Shared by the endpoint ({@link render_region}) and the
+	* batch path ({@link #render_capability}).
+	*/
+	async #render_component(load, props, cache, report, timing, base, reads_page_data = false) {
+		const render_body = async () => {
+			const mod = await load();
+			const rendered = render(mod.default, {
+				props,
+				context: kit_render_context()
+			});
+			return await Promise.race([Promise.resolve(rendered).then((out) => {
+				const body = out.body;
+				if (body === "<!--ogygia:keep-fallback-->") return body;
+				return hole_head(out.head, base) + body + kit_page_facts_tail();
+			}), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("region render timeout")), RENDER_TIMEOUT_MS))]);
+		};
+		try {
+			return await cached_render(async () => {
+				await kit_page_ready(reads_page_data);
+				if (!timing) return render_gate.run(render_body);
+				const asked = performance.now();
+				return render_gate.run(async () => {
+					const entered = performance.now();
+					timing.queue_ms = entered - asked;
+					try {
+						return await render_body();
+					} finally {
+						timing.render_ms = performance.now() - entered;
+					}
+				});
+			}, cache, Date.now(), report);
+		} catch (e) {
+			if (is_keep_fallback(e)) return KEEP_FALLBACK_HTML;
+			if (import.meta.env.DEV) console.warn("[ogygia] region render failed:", e);
+			return null;
+		}
+	}
+	/** A cached hole's memo key: the call and the visitor's session, and — when its tree reads
+	*  `page.data` — the page it renders for (one page's facts never answer another page's hole). */
+	#hole_cache_key(id, payload, event, reads_page_data) {
+		const session = this.#region_session(event);
+		return render_cache_key(id, payload, reads_page_data ? session + "\n" + page_url_of(event).href : session);
+	}
+	/** The session cookie value sealed into a region capability (empty when no `sessionCookie` is
+	*  configured) — the same read the MAC verify uses, and the per-user part of the render-cache key. */
+	#region_session(event) {
+		return sessionCookie ? event.cookies.get(sessionCookie) ?? "" : "";
+	}
+	/**
+	* Every check a capability passes BEFORE any HMAC (P5-HMAC-CPU), in order: charset/length (ids
+	* are 12-hex from the transform; `ttl` is signed, but charset-gated here so a forged value never
+	* reaches a response header), expiry (a renewal instead needs one inside the renew window: a URL
+	* that has not expired never renews), and the signing key it names. Null when it passes, else why
+	* it is refused.
+	*/
+	#capability_precheck(cap, renewal = false) {
+		if (!is_region_id(cap.id) || cap.render !== "" && !is_region_id(cap.render) || cap.payload.length > 8192 || !is_region_ttl(cap.ttl)) return "shape";
+		const expiry = expiry_refusal(cap.exp, Math.floor(Date.now() / 1e3), renewal, app_lifetime.renew_window);
+		if (expiry) return expiry;
+		if (foreign_key(cap.k)) return "foreign-key";
+		return null;
+	}
+	/**
+	* RENEWAL (server/shared-cache.ts): re-sign an EXPIRED capability this app minted for an
+	* anonymous hole — the rescue for a hole on a document a cache kept longer than the hole's
+	* capability. Refused (null) unless the visitor carries no session and the MAC over the ORIGINAL
+	* tuple verifies with an empty session: nothing session-bound is ever renewed, and only a URL the
+	* app itself put in public HTML can be. The caller has already gated shape + the renew window
+	* and charged the probe budget. Returns the fresh `exp` + `sig`.
+	*/
+	#renew_capability(cap, event) {
+		if (this.#region_session(event) !== "") return null;
+		const { secret } = signing_key();
+		if (!verify(secret, region_mac_message(cap.id, cap.exp, cap.payload, "", cap.ttl, cap.render), cap.sig)) return null;
+		const exp = String(app_lifetime.renewed_expiry());
+		return {
+			...cap,
+			exp,
+			sig: sign(secret, region_mac_message(cap.id, exp, cap.payload, "", cap.ttl, cap.render)),
+			k: signing_key().fp
+		};
+	}
+	/** THE auth check: session-bound region MAC verify (its render identity inside, when it has one). */
+	#verify_region_mac(cap, event) {
+		const session = sessionCookie ? event.cookies.get(sessionCookie) ?? "" : "";
+		return verify(signing_key().secret, region_mac_message(cap.id, cap.exp, cap.payload, session, cap.ttl, cap.render), cap.sig);
+	}
+	/** Eval the island module (registers transportable codecs the reviver needs on a cold-start defer),
+	*  then decode + revive the props payload. Null on parse failure or a non-object/array result. */
+	async #decode_region_props(payload, load) {
+		let props;
+		try {
+			await load();
+			register_wire_kind();
+			register_store_kind();
+			register_snippet_kind();
+			register_fn_kind();
+			register_derived_kind();
+			props = devalue.parse(B64Url.decode(payload), { [REF_WIRE_KEY]: ref_reviver(false) });
+		} catch (e) {
+			if (import.meta.env.DEV) console.warn("[ogygia] region endpoint 403: island module load / props decode failed", e);
+			return null;
+		}
+		if (props === null || typeof props !== "object" || Array.isArray(props)) return null;
+		return props;
+	}
+	/**
+	* Batch (single-flight navigation): verify a hole's OWN signed capability URL and render it in-process. Same
+	* trust boundary as the endpoint (verify the MAC before touching the manifest), but every failure —
+	* bad/expired MAC, unknown id, non-serializable props, render error, oversize — resolves to
+	* `null` so the hole silently falls back to a client fetch. Never throws.
+	*/
+	async #render_capability(endpoint, event, batch = false) {
+		const q = endpoint.indexOf("?");
+		if (q === -1) return null;
+		const cap = capability_of(new URLSearchParams(endpoint.slice(q + 1)));
+		const { id, payload, sig } = cap;
+		if (this.#capability_precheck(cap)) return null;
+		if (!this.#verify_region_mac(cap, event)) return null;
+		const target = capability_target(cap);
+		if (target === null) return null;
+		const load = (await load_islands()).islands[target];
+		if (typeof load !== "function") return null;
+		const props = await this.#decode_region_props(payload, load);
+		if (!props) return null;
+		const ttl = Number(cap.ttl) || 0;
+		const reads_page_data = hole_reads_page_data(target);
+		const cache = ttl > 0 ? {
+			key: this.#hole_cache_key(target, payload, event, reads_page_data),
+			ttl
+		} : void 0;
+		const stats = batch && has_batch_hole_listener();
+		const t0 = stats ? performance.now() : 0;
+		const timing = {};
+		let outcome = "none";
+		const body = await this.#render_component(load, props, cache, stats ? (o) => outcome = o : void 0, stats ? timing : void 0, event.url, reads_page_data);
+		if (stats) record_batch_hole_stats(event.request, {
+			kind: "hole",
+			id,
+			cache: outcome,
+			ttl,
+			...timing.queue_ms !== void 0 ? { queue_ms: Math.round(timing.queue_ms * 10) / 10 } : {},
+			...island_name?.[target] ? { name: island_name[target] } : {},
+			p: hole_copy_key(payload),
+			ms: performance.now() - t0,
+			status: body === null ? 500 : 200
+		});
+		if (body === null || body.length > MAX_REGION_BODY) return null;
+		if (body === "<!--ogygia:keep-fallback-->") return {
+			slot: sig,
+			html: KEEP_FALLBACK_HTML
+		};
+		let html = absolutize_hole_html(region_css_links(target) + body, event.url);
+		if (batch && this.#transform) html = await this.#transform_region(html, event);
+		return {
+			slot: sig,
+			html
+		};
+	}
+	/**
+	* Verify the region MAC, then render. Unknown ids and bad MACs both return 403 so the
+	* existence of a region id is not an oracle (SEC-01). Expiry is part of the MAC message.
+	*
+	* Ordering: length/exp → probe rate (pre-HMAC) → verify → render rate → render.
+	* Probe stops forged CPU amplification; render budget is only charged after a valid MAC.
+	* A renewal (`&renew=1`) swaps the first three for its own: shape + renew window → probe →
+	* anonymous-only re-verify of the original tuple + re-sign; then the same render rate + render.
+	*/
+	async render_region(event) {
+		const method = event.request.method.toUpperCase();
+		if (method !== "GET" && method !== "HEAD") return region_response("Method Not Allowed", {
+			status: 405,
+			headers: { allow: "GET, HEAD" }
+		});
+		if (event.request.headers.get("sec-fetch-site") === "cross-site") return region_denied("cross-site");
+		const url = event.url;
+		const ip = client_ip(event);
+		if (!ip) return region_response("Too Many Requests", { status: 429 });
+		let cap = capability_of(url.searchParams);
+		const { id, payload } = cap;
+		const ttl_raw = cap.ttl;
+		let renewed = null;
+		const renewal = url.searchParams.get("renew") === "1";
+		const refused = this.#capability_precheck(cap, renewal);
+		if (refused) {
+			if (import.meta.env.DEV && refused === "foreign-key") console.warn(`[ogygia] region endpoint 403: id "${id}" was signed by key ${cap.k}, this server signs with ${signing_key().fp}`);
+			return region_denied(refused);
+		}
+		if (this.probe_rate.limited(ip)) return region_response("Too Many Requests", { status: 429 });
+		if (renewal) {
+			const fresh = this.#renew_capability(cap, event);
+			if (!fresh) return region_denied(this.#region_session(event) !== "" ? "renew-session" : "sig");
+			cap = fresh;
+			renewed = `${url.pathname}?id=${encodeURIComponent(id)}${cap.render ? `&r=${cap.render}` : ""}&props=${payload}&exp=${cap.exp}${ttl_raw ? `&ttl=${ttl_raw}` : ""}&sig=${cap.sig}&k=${cap.k}`;
+		} else if (!this.#verify_region_mac(cap, event)) {
+			if (import.meta.env.DEV) console.warn(`[ogygia] region endpoint 403: bad signature for id "${id}"`);
+			return region_denied("sig");
+		}
+		const cache_control = ttl_raw && !renewed ? `private, max-age=${Number(ttl_raw)}` : "no-store";
+		/** The fresh capability rides every successful answer to a renewal (the 204 too). */
+		const renew_headers = renewed ? { "x-ogygia-capability": renewed } : {};
+		if (this.render_rate.limited(ip)) return region_response("Too Many Requests", { status: 429 });
+		const target = capability_target(cap);
+		if (target === null) {
+			if (import.meta.env.DEV) console.warn(`[ogygia] region endpoint 403: id "${id}"${cap.render ? ` (component ${cap.render})` : ""} is not in the server manifest (${Object.keys(island_url).length} known)`);
+			return region_denied("unknown-id");
+		}
+		const load = (await load_islands()).islands[target];
+		if (typeof load !== "function") return region_denied("unknown-id");
+		const props = await this.#decode_region_props(payload, load);
+		if (!props) return region_denied("props");
+		const ttl = Number(ttl_raw) || 0;
+		const reads_page_data = hole_reads_page_data(target);
+		const cache = ttl > 0 ? {
+			key: this.#hole_cache_key(target, payload, event, reads_page_data),
+			ttl
+		} : void 0;
+		const timing = {};
+		let outcome = "none";
+		const body = await this.#render_component(load, props, cache, (o) => outcome = o, timing, event.url, reads_page_data);
+		record_hole_stats(event.request, {
+			kind: "hole",
+			id,
+			cache: outcome,
+			ttl,
+			...timing.queue_ms !== void 0 ? { queue_ms: Math.round(timing.queue_ms * 10) / 10 } : {},
+			...island_name?.[target] ? { name: island_name[target] } : {},
+			p: hole_copy_key(payload)
+		});
+		const server_timing = timing.queue_ms !== void 0 && (import.meta.env.DEV || DEVTOOLS && event.cookies.get("og_devtools") === "on" || event.cookies.get("og_profiler_beacon") === "1") ? { "server-timing": `og-queue;dur=${timing.queue_ms.toFixed(1)}, og-render;dur=${(timing.render_ms ?? 0).toFixed(1)}` } : {};
+		if (body === null) return region_response("Region render failed", { status: 500 });
+		if (body === "<!--ogygia:keep-fallback-->") return region_response(null, {
+			status: 204,
+			headers: renewed ? {
+				"cache-control": "no-store",
+				...renew_headers
+			} : void 0
+		});
+		if (body.length > MAX_REGION_BODY) return region_denied("oversize");
+		let html = absolutize_hole_html(region_css_links(target) + body, event.url);
+		if (this.#transform) html = await this.#transform_region(html, event);
+		if (method === "HEAD") return region_response(null, {
+			status: 200,
+			headers: {
+				"content-type": "text/html; charset=utf-8",
+				"content-length": String(new TextEncoder().encode(html).byteLength),
+				"cache-control": cache_control,
+				...renew_headers
+			}
+		});
+		return region_response(html, {
+			status: 200,
+			headers: {
+				"content-type": "text/html; charset=utf-8",
+				"cache-control": cache_control,
+				...renew_headers,
+				...server_timing
+			}
+		});
+	}
+};
+function handle(options = {}) {
+	const instance = new OgygiaHandle(options);
+	return (args) => instance.handle(args);
+}
+export { document, handle, liftRegions, restoreRegions, scanRegions, ogygiaTransport as transport };