@ogygia/core 0.0.0 → 0.11.0

package/dist/server/head-presence.js

@@ -0,0 +1,156 @@
+import { is_word } from "./html-scan.js";
+// src/server/head-presence.ts
+/**
+* Presence checks for the head tags the `handle()` transform injects (the router meta, the runtime
+* bootstrap, the dev-HMR script, MPA speculation rules). Each must detect a REAL element, never the
+* tag's name as TEXT.
+*
+* Why this exists as its own module: a page that DOCUMENTS one of these tags in a code block renders
+* it HTML-escaped — `` `<meta name="ogygia-router" content="plain">` `` becomes
+* `<code>&lt;meta name="ogygia-router" content="plain"></code>`. A substring check like
+* `html.includes('name="ogygia-router"')` false-matches that prose and suppresses the injection; for
+* the router marker that silently drops the whole page to full-page navigation (no marker → the
+* client router hands off to `location.href`, so no SPA and no view transition). The changelog page
+* documents exactly these tags, which is how the bug surfaced.
+*
+* The fix each predicate shares: require a literal `<meta` / `<script` — the escaped copy carries
+* `&lt;`, never a bare `<`, so it can't match. `[^>]*` is bounded to the opening tag, so a `<script>`
+* whose BODY mentions the attribute (inline JS) can't false-match either. Every pattern is a single
+* unnested `[^>]*`, so `.test()` is linear — no backtracking on any input.
+*
+* The patterns are module constants (compiled once), never rebuilt per call: these predicates run on
+* the page HTML during every SSR response transform. They STAY regexes: measured against hand-written
+* scans (a tag walk, a rare-needle-first search), the engine's compiled matcher was 2–4× faster on
+* real heads, allocation-free either way. `dedupe_head_links` is hand-written: it won.
+*/
+/** A real `<meta name="ogygia-router" …>` element — a page opting a route out of view transitions. */
+const ROUTER_META_RE = /<meta\b[^>]*\bname=["']ogygia-router["']/i;
+/** A real runtime bootstrap `<script … data-ogygia-runtime …>` (Region emits it on island pages). */
+const RUNTIME_SCRIPT_RE = /<script\b[^>]*\bdata-ogygia-runtime\b/i;
+/** A real dev-HMR `<script … data-ogygia-dev-hmr …>`. */
+const DEV_HMR_SCRIPT_RE = /<script\b[^>]*\bdata-ogygia-dev-hmr\b/i;
+/** A real `<script type="speculationrules" …>` (a page authoring its own MPA speculation rules). */
+const SPECULATION_RULES_RE = /<script\b[^>]*\btype=["']speculationrules["']/i;
+function page_declares_router_meta(html) {
+	return ROUTER_META_RE.test(html);
+}
+function page_declares_runtime_script(html) {
+	return RUNTIME_SCRIPT_RE.test(html);
+}
+function page_declares_dev_hmr_script(html) {
+	return DEV_HMR_SCRIPT_RE.test(html);
+}
+function page_declares_speculation_rules(html) {
+	return SPECULATION_RULES_RE.test(html);
+}
+/** The value of the first `\b<attr>=` + quote in `[from, to)`, up to the next quote of either kind
+*  (case-sensitive, as the `rel` / `href` probes always were), or `undefined`. */
+function quoted_attr(s, from, to, attr) {
+	const n = attr.length;
+	for (let i = s.indexOf(attr, from); i !== -1 && i + n + 2 <= to; i = s.indexOf(attr, i + 1)) {
+		if (is_word(s.charCodeAt(i - 1)) || s.charCodeAt(i + n) !== 61) continue;
+		const q = s.charCodeAt(i + n + 1);
+		if (q !== 34 && q !== 39) continue;
+		const start = i + n + 2;
+		let end = start;
+		for (; end < to; end++) {
+			const c = s.charCodeAt(end);
+			if (c === 34 || c === 39) return s.slice(start, end);
+		}
+	}
+}
+/**
+* Drop duplicate `<link>` tags in the HEAD — one pass over the head slice, two families:
+*
+*  - `rel="stylesheet"`: same href → first occurrence wins. Kit links a route's client-graph CSS
+*    and Region.svelte links a rendered island's CSS from the render pass; a layout island compiled
+*    as a real wrapper (a csr=true-capable layout host) is in both, so its sheet was linked twice —
+*    two render-blocking fetches of one asset. `<style>` tags are untouched.
+*  - `rel="modulepreload"`: same href → first occurrence wins. Each island's SSR emits its own
+*    dep-hint block, so islands sharing dep chunks — or one island rendered N times — repeat
+*    identical hints (a real page carried ~44 duplicate tags). Every hint ogygia emits is
+*    `fetchpriority="low"` (Region.svelte), so there is no priority to arbitrate between copies.
+*
+* Every other `<link>` passes through byte-identical. The handle calls this on the HEAD SLICE of
+* the document only (everything before `</head>`, tens of KB): the hints and the sheets live there,
+* so the 2.6 MB body is never scanned for them.
+*/
+function dedupe_head_links(head) {
+	if (!head.includes("<link")) return head;
+	const sheets = /* @__PURE__ */ new Set();
+	const hints = /* @__PURE__ */ new Set();
+	let out = null;
+	let kept = 0;
+	for (let lt = head.indexOf("<link"), gt = 0; lt !== -1; lt = head.indexOf("<link", gt + 1)) {
+		if (is_word(head.charCodeAt(lt + 5))) {
+			gt = lt;
+			continue;
+		}
+		gt = head.indexOf(">", lt);
+		if (gt === -1) break;
+		const from = lt + 5;
+		const rel = quoted_attr(head, from, gt, "rel");
+		const seen = rel === "stylesheet" ? sheets : rel === "modulepreload" ? hints : null;
+		if (seen === null) continue;
+		const href = quoted_attr(head, from, gt, "href");
+		if (href === void 0) continue;
+		if (!seen.has(href)) {
+			seen.add(href);
+			continue;
+		}
+		(out ??= []).push(head.slice(kept, lt));
+		kept = gt + 1;
+	}
+	if (out === null) return head;
+	out.push(head.slice(kept));
+	return out.join("");
+}
+const RUNTIME_SCRIPT_ELEMENT_RE = /<script\b[^>]*\bdata-ogygia-runtime\b[^>]*><\/script>(?:<link\b[^>]*\bdata-ogygia-runtime-dep\b[^>]*>)*/i;
+const HEAD_OPEN_RE = /<head\b[^>]*>/i;
+const FIRST_JS_G = /<script\b|<link\b[^>]*\brel=["']?modulepreload\b/gi;
+const HEAD_CLOSE_G = /<\/head\s*>/gi;
+/** The first match of a global pattern at or after `from` (its index), or -1. */
+function search_from(re, s, from) {
+	re.lastIndex = from;
+	const m = re.exec(s);
+	return m ? m.index : -1;
+}
+/**
+* Put the runtime bootstrap BEFORE ALL OF THE PAGE'S JAVASCRIPT in `<head>` — immediately ahead of
+* the first `<script>` or `<link rel="modulepreload">` the app's template and the page carry, and
+* no earlier. `runtime` is the tag to place when the head has none yet (`null` = only reorder what
+* is there; the tag an island page emits sits wherever Kit's head slot is, after the app's own
+* scripts in `app.html`). With no JavaScript in the head it goes last in it. Returns `head` itself
+* when there is nothing to move.
+*
+* Why BEFORE THE JS: module and deferred scripts run in document order once parsing ends, and the
+* runtime's custom-element definition is what makes every `<ogygia-region>` connect and keep its
+* server markup — the copy an island hydrates against when something edited it while it slept
+* (runtime/core.ts `#ssr_html`). A design-system runtime loaded from the app template ran BEFORE the
+* runtime on a customer page and stripped the whitespace nodes of every island in the header before
+* the runtime ever saw them, so the "server copy" was the edited DOM and the login island still
+* re-rendered client-side on its first tap. Ahead of every script, the runtime sees the document as
+* the server sent it, whatever the app loads after it.
+*
+* Why NOT FIRST IN THE HEAD: that ordering guarantee is about execution, and only needs "before the
+* other scripts". Heading the whole `<head>` also made the runtime the page's FIRST REQUEST, ahead of
+* its stylesheets and its LCP image preload. Everything that is not JavaScript — the charset and
+* other `<meta>`, the `<title>`, stylesheets, preconnects, image/font preloads — keeps its place in
+* front of it.
+*/
+function runtime_first(head, runtime) {
+	const found = RUNTIME_SCRIPT_ELEMENT_RE.exec(head);
+	const tag = found ? found[0] : runtime;
+	if (tag === null) return head;
+	const rest = found ? head.slice(0, found.index) + head.slice(found.index + found[0].length) : head;
+	const open = HEAD_OPEN_RE.exec(rest);
+	const from = open ? open.index + open[0].length : 0;
+	let at = search_from(FIRST_JS_G, rest, from);
+	if (at === -1) {
+		const close = search_from(HEAD_CLOSE_G, rest, from);
+		at = close === -1 ? rest.length : close;
+	}
+	if (found && found.index === at) return head;
+	return rest.slice(0, at) + tag + rest.slice(at);
+}
+export { dedupe_head_links, page_declares_dev_hmr_script, page_declares_router_meta, page_declares_runtime_script, page_declares_speculation_rules, runtime_first };

package/dist/server/hmac.d.ts

@@ -0,0 +1,38 @@
+/** Minimum UTF-8 byte length for a user-supplied `OGYGIA_SECRET` in production builds. */
+export declare const MIN_SECRET_BYTES = 16;
+/** HKDF-SHA256 → 32-byte MAC key (hex for stable logging / tests; Buffer used internally). */
+export declare function derive_mac_key(secret: string): Buffer;
+/** HKDF-SHA256 → 16-byte id salt (hex). Empty input must not be used — caller gates on env. */
+export declare function derive_id_salt(secret: string): string;
+/** True when a configured secret meets the production entropy floor. */
+export declare function secret_has_min_entropy(secret: string): boolean;
+export declare class Hmac {
+  static sha256(key: Buffer, message: string): string;
+  static sign(secret: string, message: string): string;
+  static verify(secret: string, message: string, sig: string): boolean;
+  /**
+   * MAC message for a signed region capability. Every field is length-prefixed (`<utf8 bytes>:<value>`),
+   * so a field's content can never forge a `|` boundary. Two versions:
+   *
+   * - `v1|id|exp|props|session|ttl` — the capability names only its region `id` (the wrapper that
+   *   minted it: component ⊕ page-side schedule ⊕ the build's salt). Only a build that has that
+   *   exact id can answer it. Minted before render identities (ogygia ≤ 0.8.6); still verified, so
+   *   pages cached before an upgrade keep their holes.
+   * - `v2|id|exp|props|session|ttl|render` — the same five, plus the region's render identity (the
+   *   URL's `r`: the component the endpoint renders, compiler/region/identity.ts `renderId`). Signing
+   *   it lets a build that no longer has `id` (another schedule, preset or salt) answer the
+   *   capability with its own entry for that component, and only for that component. Every current
+   *   mint is `v2`.
+   *
+   * The version follows from the URL: a capability with `r` is checked as `v2`, one without as `v1`.
+   * A `v2` MAC never verifies as `v1` (the prefix and the field count differ), so stripping `r` or
+   * swapping it for another component breaks the signature. Empty `session`/`ttl` are still fields
+   * (prerender / unbound / no-store) — never optional concat. `ttl` is the response cache max-age in
+   * seconds (`''` = no-store); signing it keeps a harvested URL from being re-pointed at a longer
+   * browser cache.
+   */
+  static region_message(id: string, exp: number | string, props: string, session?: string, ttl?: number | string, render?: string): string;
+}
+export declare const sign: typeof Hmac.sign;
+export declare const verify: typeof Hmac.verify;
+export declare const region_mac_message: typeof Hmac.region_message;

package/dist/server/hmac.js

@@ -0,0 +1,89 @@
+import { is_lower_hex } from "./endpoint.js";
+import { createHmac, hkdfSync, timingSafeEqual } from "node:crypto";
+// src/server/hmac.ts
+/**
+* HMAC-SHA256 for region capability URLs — Node `createHmac` (sync).
+*
+* Used by `ogygiaHandle` and by SSR `virtual:ogygia/sign`. The client never imports this
+* module: ServerIsland goes through `virtual:ogygia/sign`, which is a no-op on the client
+* (secret is already empty there). Web Crypto is not used — browsers must not mint with a
+* real secret.
+*
+* MAC format is versioned (`v1|…`) with UTF-8 length-prefixed fields so `\0` inside a
+* field cannot shift boundaries. Signing keys are HKDF-derived (`ogygia-mac-v1`) from the
+* raw secret so the id-salt domain stays separate.
+*/
+const MAC_INFO = Buffer.from("ogygia-mac-v1");
+const ID_SALT_INFO = Buffer.from("ogygia-id-salt-v1");
+const utf8 = new TextEncoder();
+/** Minimum UTF-8 byte length for a user-supplied `OGYGIA_SECRET` in production builds. */
+const MIN_SECRET_BYTES = 16;
+const mac_keys = /* @__PURE__ */ new Map();
+/** HKDF-SHA256 → 32-byte MAC key (hex for stable logging / tests; Buffer used internally). */
+function derive_mac_key(secret) {
+	let key = mac_keys.get(secret);
+	if (key === void 0) {
+		key = Buffer.from(hkdfSync("sha256", Buffer.from(secret, "utf8"), Buffer.alloc(0), MAC_INFO, 32));
+		if (mac_keys.size >= 16) mac_keys.clear();
+		mac_keys.set(secret, key);
+	}
+	return key;
+}
+/** HKDF-SHA256 → 16-byte id salt (hex). Empty input must not be used — caller gates on env. */
+function derive_id_salt(secret) {
+	return Buffer.from(hkdfSync("sha256", Buffer.from(secret, "utf8"), Buffer.alloc(0), ID_SALT_INFO, 16)).toString("hex");
+}
+/** True when a configured secret meets the production entropy floor. */
+function secret_has_min_entropy(secret) {
+	return Buffer.byteLength(secret, "utf8") >= 16;
+}
+/** UTF-8 length-prefix so field contents cannot forge delimiters. */
+function lp(s) {
+	return `${utf8.encode(s).byteLength}:${s}`;
+}
+var Hmac = class Hmac {
+	static sha256(key, message) {
+		return createHmac("sha256", key).update(message, "utf8").digest("hex");
+	}
+	static sign(secret, message) {
+		return Hmac.sha256(derive_mac_key(secret), message);
+	}
+	static verify(secret, message, sig) {
+		if (typeof sig !== "string" || !is_lower_hex(sig, 64)) return false;
+		const expected = Hmac.sha256(derive_mac_key(secret), message);
+		try {
+			return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(sig, "hex"));
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* MAC message for a signed region capability. Every field is length-prefixed (`<utf8 bytes>:<value>`),
+	* so a field's content can never forge a `|` boundary. Two versions:
+	*
+	* - `v1|id|exp|props|session|ttl` — the capability names only its region `id` (the wrapper that
+	*   minted it: component ⊕ page-side schedule ⊕ the build's salt). Only a build that has that
+	*   exact id can answer it. Minted before render identities (ogygia ≤ 0.8.6); still verified, so
+	*   pages cached before an upgrade keep their holes.
+	* - `v2|id|exp|props|session|ttl|render` — the same five, plus the region's render identity (the
+	*   URL's `r`: the component the endpoint renders, compiler/region/identity.ts `renderId`). Signing
+	*   it lets a build that no longer has `id` (another schedule, preset or salt) answer the
+	*   capability with its own entry for that component, and only for that component. Every current
+	*   mint is `v2`.
+	*
+	* The version follows from the URL: a capability with `r` is checked as `v2`, one without as `v1`.
+	* A `v2` MAC never verifies as `v1` (the prefix and the field count differ), so stripping `r` or
+	* swapping it for another component breaks the signature. Empty `session`/`ttl` are still fields
+	* (prerender / unbound / no-store) — never optional concat. `ttl` is the response cache max-age in
+	* seconds (`''` = no-store); signing it keeps a harvested URL from being re-pointed at a longer
+	* browser cache.
+	*/
+	static region_message(id, exp, props, session = "", ttl = "", render = "") {
+		const v1 = `${lp(String(id))}|${lp(String(exp))}|${lp(String(props))}|${lp(String(session))}|${lp(String(ttl))}`;
+		return render === "" ? `v1|${v1}` : `v2|${v1}|${lp(String(render))}`;
+	}
+};
+const sign = Hmac.sign.bind(Hmac);
+const verify = Hmac.verify.bind(Hmac);
+const region_mac_message = Hmac.region_message.bind(Hmac);
+export { Hmac, MIN_SECRET_BYTES, derive_id_salt, derive_mac_key, region_mac_message, secret_has_min_entropy, sign, verify };

package/dist/server/hole-graph.d.ts

@@ -0,0 +1,7 @@
+/** What the answer carries of the render's head: its islands' graph and their CSS ('' for none). */
+export declare function hole_head(head: string, base: URL | undefined): string;
+/** Every region-CSS tag in the head, as written (`<link … data-ogygia-region-css>` or
+ *  `<style data-ogygia-region-css="…">…</style>`). */
+export declare function head_region_css(head: string): string;
+/** One graph script for the answer (or '' when the render's head carries none). */
+export declare function hole_graph_script(head: string, base: URL): string;

package/dist/server/hole-graph.js

@@ -0,0 +1,71 @@
+import { ISLAND_GRAPH_ATTR, decode_island_graph, decode_island_locations } from "../island-graph.js";
+import { island_graph_script } from "./document-tail.js";
+// src/server/hole-graph.ts
+/**
+* WHAT A HOLE'S HEAD CARRIES INTO ITS ANSWER. A hole renders on its own, and the endpoint ships only
+* the body — but the islands inside it write into the render's head what the page needs of them:
+*
+* - their GRAPH (the chunks their code needs — island-graph.ts). Without it the islands a hole brings
+*   loaded in a waterfall: each chunk discovered only after the last one parsed (+1.1 s at a 150 ms
+*   round trip, measured). Carried as one script; the runtime reads any graph script in the document
+*   (runtime/island-graph-preload.ts), so a nested island's wake preloads its whole graph at once.
+* - their CSS (the `data-ogygia-region-css` tags Region.svelte writes for each island it renders: the
+*   island's own chunk CSS, exact — the bundler's, over what the island really imports). Without it
+*   an island in a hole had only the hole's own sheet, and whatever it rendered after the server
+*   render (a dropdown's contents, a branch behind a click) arrived unstyled. Carried as written; the
+*   runtime hoists these tags from an answer into `<head>` before the swap, deduped by href.
+*
+* URLs are made root-absolute (the graph here, the CSS tags by the answer's own absolutizing pass):
+* the answer lands in a page at any depth, and a `./_app/…` resolved there would 404. indexOf only.
+*/
+function root_absolute(value, base) {
+	if (!value.startsWith("./") && !value.startsWith("../")) return value;
+	try {
+		const u = new URL(value, base);
+		return u.origin === base.origin ? u.pathname + u.search + u.hash : value;
+	} catch {
+		return value;
+	}
+}
+/** What the answer carries of the render's head: its islands' graph and their CSS ('' for none). */
+function hole_head(head, base) {
+	return (base ? hole_graph_script(head, base) : "") + head_region_css(head);
+}
+const REGION_CSS_ATTR = "data-ogygia-region-css";
+/** Every region-CSS tag in the head, as written (`<link … data-ogygia-region-css>` or
+*  `<style data-ogygia-region-css="…">…</style>`). */
+function head_region_css(head) {
+	let out = "";
+	for (let at = head.indexOf(REGION_CSS_ATTR); at !== -1; at = head.indexOf(REGION_CSS_ATTR, at + 1)) {
+		const start = head.lastIndexOf("<", at);
+		if (start === -1) continue;
+		const is_style = head.startsWith("<style", start);
+		const end = is_style ? head.indexOf("</style>", at) : head.indexOf(">", at);
+		if (end === -1) break;
+		const stop = is_style ? end + 8 : end + 1;
+		out += head.slice(start, stop);
+		at = stop - 1;
+	}
+	return out;
+}
+/** One graph script for the answer (or '' when the render's head carries none). */
+function hole_graph_script(head, base) {
+	let at = head.indexOf(ISLAND_GRAPH_ATTR);
+	if (at === -1) return "";
+	const graph = /* @__PURE__ */ new Map();
+	const locations = /* @__PURE__ */ new Map();
+	for (; at !== -1; at = head.indexOf(ISLAND_GRAPH_ATTR, at + ISLAND_GRAPH_ATTR.length)) {
+		const open = head.indexOf(">", at);
+		const close = open === -1 ? -1 : head.indexOf("<\/script", open);
+		if (close === -1) break;
+		const text = head.slice(open + 1, close);
+		for (const [entry, hrefs] of decode_island_graph(text)) {
+			const key = root_absolute(entry, base);
+			if (!graph.has(key)) graph.set(key, hrefs.map((h) => root_absolute(h, base)));
+		}
+		for (const [entry, src] of decode_island_locations(text)) locations.set(root_absolute(entry, base), root_absolute(src, base));
+		at = close;
+	}
+	return island_graph_script(graph, locations);
+}
+export { head_region_css, hole_graph_script, hole_head };

package/dist/server/hole-urls.d.ts

@@ -0,0 +1,3 @@
+/** Rewrite the relative `entry` / `src` / `endpoint` / region-css `href` values in `html` to root-absolute
+ *  paths resolved against `base` (the endpoint request URL). */
+export declare function absolutize_hole_html(html: string, base: URL): string;

package/dist/server/hole-urls.js

@@ -0,0 +1,76 @@
+import { escape_amp } from "../escape.js";
+// src/server/hole-urls.ts
+/**
+* Absolute URLs inside a hole's HTML.
+*
+* A server island renders in its OWN request — `/__ogygia__?…` — and Kit's `asset()` (with the
+* default `paths.relative`) emits every URL relative to THAT request: `./_app/immutable/x.js`,
+* `./__ogygia__?…`. The HTML then lands in a page at any depth (`/docs/guides/`), and a
+* region entry / nested-hole endpoint / region-css link inside it would resolve against the page:
+* `/docs/guides/_app/…` → 404, a dead island in a live hole. The batch parcel and an
+* ESI-stitched hole (the CDN splices the bytes straight into the page) have the same problem, so
+* the fix is on the server, once, at the point the response is assembled: resolve every relative
+* ogygia URL against the endpoint request URL and emit it root-absolute (Kit `base` included).
+* Absolute (`/…`) and scheme'd (foreign federation entries) values are left alone.
+*/
+const REGION_CSS_ATTR = "data-ogygia-region-css";
+function is_word(c) {
+	return c >= 48 && c <= 57 || c >= 65 && c <= 90 || c >= 97 && c <= 122 || c === 95;
+}
+function resolve_attr(value, base) {
+	if (!value || !(value.startsWith("./") || value.startsWith("../"))) return value;
+	let resolved;
+	try {
+		resolved = new URL(value.indexOf("&amp;") === -1 ? value : value.replaceAll("&amp;", "&"), base);
+	} catch {
+		return value;
+	}
+	if (resolved.origin !== base.origin) return value;
+	return escape_amp(resolved.pathname + resolved.search + resolved.hash);
+}
+/** Rewrite `name="…"` in `tag` (a word boundary before `name`; every occurrence, or the first). */
+function rewrite_attr(tag, name, base, all) {
+	const needle = name + "=\"";
+	let out = "";
+	let pos = 0;
+	for (let at = tag.indexOf(needle); at !== -1; at = tag.indexOf(needle, at + needle.length)) {
+		if (at > 0 && is_word(tag.charCodeAt(at - 1))) continue;
+		const start = at + needle.length;
+		const end = tag.indexOf("\"", start);
+		if (end === -1) break;
+		out += tag.slice(pos, start) + resolve_attr(tag.slice(start, end), base);
+		pos = end;
+		if (!all) break;
+	}
+	return pos === 0 ? tag : out + tag.slice(pos);
+}
+/** Does a tag named `name` open at `lt` (`<name` then a non-word character)? */
+function opens(html, lt, name) {
+	return html.startsWith(name, lt + 1) && !is_word(html.charCodeAt(lt + 1 + name.length));
+}
+/** Rewrite the relative `entry` / `src` / `endpoint` / region-css `href` values in `html` to root-absolute
+*  paths resolved against `base` (the endpoint request URL). */
+function absolutize_hole_html(html, base) {
+	if (!html.includes("<ogygia-region") && !html.includes(REGION_CSS_ATTR)) return html;
+	let out = "";
+	let pos = 0;
+	for (let lt = html.indexOf("<"); lt !== -1; lt = html.indexOf("<", lt + 1)) {
+		const region = opens(html, lt, "ogygia-region");
+		const link = !region && opens(html, lt, "link");
+		const style = !region && !link && opens(html, lt, "style");
+		if (!region && !link && !style) continue;
+		const gt = html.indexOf(">", lt);
+		if (gt === -1) break;
+		const tag = html.slice(lt, gt + 1);
+		let next = tag;
+		if (region) next = rewrite_attr(rewrite_attr(rewrite_attr(tag, "entry", base, true), "src", base, true), "endpoint", base, true);
+		else if (tag.indexOf(REGION_CSS_ATTR) !== -1) next = link ? rewrite_attr(tag, "href", base, false) : tag.indexOf(REGION_CSS_ATTR + "=\"") !== -1 ? rewrite_attr(tag, REGION_CSS_ATTR, base, false) : tag;
+		if (next !== tag) {
+			out += html.slice(pos, lt) + next;
+			pos = gt + 1;
+		}
+		lt = gt;
+	}
+	return pos === 0 ? html : out + html.slice(pos);
+}
+export { absolutize_hole_html };

package/dist/server/html-scan.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Small hand-written scans shared by the server's per-request HTML work, each kept only where it
+ * MEASURED faster (or allocation-lighter) than the regex it replaced — the engine's compiled
+ * matcher wins plain presence tests, so those stayed regexes (head-presence.ts).
+ */
+/** `[A-Za-z0-9_]` — the regex `\w` (NaN, past the end, is not). */
+export declare function is_word(c: number): boolean;
+/** The regex `\s`: ASCII whitespace and the Unicode spaces (NaN, past the end, is not). */
+export declare function is_space(c: number): boolean;
+/**
+ * Every region-CSS tag in `head`, in order, joined: the `<link … data-ogygia-region-css>` form AND the
+ * inline `<style data-ogygia-region-css="href">…</style>` form a sheet under Kit's
+ * `inlineStyleThreshold` takes. What an isolated render (a held region's body) must carry forward
+ * from its head: keeping links only silently unstyled every small sheet.
+ */
+export declare function region_css_tags(head: string): string;
+/** Every `<link …data-ogygia-region-css…>` tag in `head`, in order, joined — what
+ *  `head.match(/<link\b[^>]*data-ogygia-region-css[^>]*>/g).join('')` returned. */
+export declare function region_css_links(head: string): string;

package/dist/server/html-scan.js

@@ -0,0 +1,60 @@
+// src/server/html-scan.ts
+/**
+* Small hand-written scans shared by the server's per-request HTML work, each kept only where it
+* MEASURED faster (or allocation-lighter) than the regex it replaced — the engine's compiled
+* matcher wins plain presence tests, so those stayed regexes (head-presence.ts).
+*/
+/** `[A-Za-z0-9_]` — the regex `\w` (NaN, past the end, is not). */
+function is_word(c) {
+	return c >= 97 && c <= 122 || c >= 65 && c <= 90 || c >= 48 && c <= 57 || c === 95;
+}
+/** The regex `\s`: ASCII whitespace and the Unicode spaces (NaN, past the end, is not). */
+function is_space(c) {
+	if (c <= 32) return c === 32 || c >= 9 && c <= 13;
+	if (c < 160) return false;
+	return c === 160 || c === 5760 || c >= 8192 && c <= 8202 || c === 8232 || c === 8233 || c === 8239 || c === 8287 || c === 12288 || c === 65279;
+}
+const REGION_CSS_ATTR = "data-ogygia-region-css";
+/**
+* Every region-CSS tag in `head`, in order, joined: the `<link … data-ogygia-region-css>` form AND the
+* inline `<style data-ogygia-region-css="href">…</style>` form a sheet under Kit's
+* `inlineStyleThreshold` takes. What an isolated render (a held region's body) must carry forward
+* from its head: keeping links only silently unstyled every small sheet.
+*/
+function region_css_tags(head) {
+	let out = "";
+	for (let attr = head.indexOf(REGION_CSS_ATTR); attr !== -1; attr = head.indexOf(REGION_CSS_ATTR, attr + 1)) {
+		const open = head.lastIndexOf("<", attr);
+		if (open === -1) continue;
+		if (head.startsWith("<link", open) && !is_word(head.charCodeAt(open + 5))) {
+			const end = head.indexOf(">", attr);
+			if (end === -1) break;
+			out += head.slice(open, end + 1);
+			attr = end;
+		} else if (head.startsWith("<style", open) && !is_word(head.charCodeAt(open + 6))) {
+			const close = head.indexOf("</style>", attr);
+			if (close === -1) break;
+			out += head.slice(open, close + 8);
+			attr = close + 7;
+		}
+	}
+	return out;
+}
+/** Every `<link …data-ogygia-region-css…>` tag in `head`, in order, joined — what
+*  `head.match(/<link\b[^>]*data-ogygia-region-css[^>]*>/g).join('')` returned. */
+function region_css_links(head) {
+	let out = "";
+	let attr = head.indexOf("data-ogygia-region-css");
+	if (attr === -1) return "";
+	for (let at = head.indexOf("<link"); at !== -1; at = head.indexOf("<link", at + 5)) {
+		if (is_word(head.charCodeAt(at + 5))) continue;
+		const end = head.indexOf(">", at);
+		if (end === -1) break;
+		if (attr < at) attr = head.indexOf("data-ogygia-region-css", at);
+		if (attr === -1) break;
+		if (attr < end) out += head.slice(at, end + 1);
+		at = end - 4;
+	}
+	return out;
+}
+export { is_space, is_word, region_css_links, region_css_tags };

package/dist/server/kit-context.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Kit's request context for ogygia's OWN server render roots.
+ *
+ * Kit's server `$app/state` answers `page.*` from `getContext('__request__').page` — a Svelte
+ * context Kit's page render sets on ITS root. Every `svelte/server` `render()` ogygia starts is a
+ * fresh root with no such context: the routeless document (`document()`), the inline island render
+ * (`region.ts`), the deferred-region endpoint, snippet bodies. A component reading `page.data`
+ * during SSR under any of them crashed with "reading 'page' of undefined". Every such root now
+ * passes `kit_render_context()`, which rebuilds Kit's shape from the per-request page snapshot
+ * (Region.svelte records it; the handle keeps it in the request bag) or, absent that, from the
+ * live request via the reader hooks.ts installs.
+ *
+ * Isomorphic and dependency-free by design: `region.ts` is in the client graph, so nothing here may
+ * import Kit's server internals. The reader rides ONE `globalThis` + `Symbol.for` slot — the
+ * PAGE-STATE-SINGLETON law (dist entries can double-evaluate a module).
+ */
+export declare const KIT_REQUEST_CONTEXT = "__request__";
+/** Kit's `$app/stores` server side reads `getContext('__svelte__')` — `{ page, navigating, updated }`
+ *  stores Kit's page render sets on ITS root (`render.js`). Same gap as `__request__`: a component
+ *  using the (deprecated, still everywhere) `$page` store crashed under every ogygia render root. */
+export declare const KIT_STORES_CONTEXT = "__svelte__";
+/** Kit's `props.page` shape (what `$app/state`'s server getters read). */
+export interface KitPage {
+  url: URL | undefined;
+  params: Record<string, string | undefined>;
+  route: {
+    id: string | null;
+  };
+  status: number;
+  data: unknown;
+  form: unknown;
+  error: unknown;
+  state: Record<string, unknown>;
+}
+type Reader = () => KitPage | null;
+type EventReader = () => unknown | null;
+/** THE PAGE OF A RENDER, as a render root uses it (server/render-page.ts behind it). */
+interface RenderPagePort {
+  /** Before the root renders: its page ready for the reader. `reads_data` — `true`: this render
+   *  reads `page.data`; `false`: it does not; `null`: unknown here (the request's kind decides). */
+  ready(reads_data: boolean | null): Promise<void> | void;
+  /** After it rendered: what its answer carries of the page it rendered for (`''`: nothing). */
+  tail(): string;
+  /** A hole minted in this render: the address part naming the page facts it renders from
+   *  (`&pv=…`), `''` for a hole whose tree reads no `page.data`. */
+  version(hole_id: string): string;
+}
+/** hooks.ts installs the request-scoped reader (page snapshot + live event). */
+export declare function set_kit_page_reader(fn: Reader | null): void;
+/** hooks.ts installs the live `RequestEvent` reader — what `requestEvent()` (public, isomorphic)
+ *  hands a server island: `locals`, `cookies`, `url`, `request` of the request rendering it. */
+export declare function set_kit_event_reader(fn: EventReader | null): void;
+/** hooks.ts installs the render-page port: in a request rendering for a page it is not (a hole, a
+ *  remote call), that page is looked up once (server/page-facts.ts) so the reader answers from it,
+ *  and an answer carries the facts its islands read. */
+export declare function set_render_page_port(port: RenderPagePort | null): void;
+/**
+ * Await before an async render root starts: the page this render belongs to, ready for the reader.
+ * Inside a page request, on the client, or for a render that reads no `page.data`: nothing to wait for
+ * (`undefined`, no microtask).
+ */
+export declare function kit_page_ready(reads_data?: boolean | null): Promise<void> | void;
+/** Append to a render root's HTML: the page facts its islands read, when it rendered for a page. */
+export declare function kit_page_facts_tail(): string;
+/** Append to a minted hole endpoint: its page version (server/render-page.ts), or `''`. */
+export declare function kit_page_version(hole_id: string): string;
+/** The live event the installed reader answers (null off-request / on the client). */
+export declare function kit_request_event(): unknown | null;
+/** A page no component can crash on: what a render outside any request sees (tests, tools). */
+export declare function empty_kit_page(): KitPage;
+/** The `context` option for a `svelte/server` `render()` ogygia starts. An explicit `page` (the
+ *  document root, built from the router's seed) wins; else the request reader; else empty. Both
+ *  of Kit's contexts ride along: `__request__` for `$app/state`, `__svelte__` for `$app/stores`.
+ *  The `__request__` entry also carries the live `event` (Kit's own render sets `{ page }` only)
+ *  — the channel `requestEvent()` reads, so a server island can see its request without importing
+ *  `$app/server` (which Kit's client guard rejects the moment a csr=true page shares the layout). */
+export declare function kit_render_context(page?: KitPage, event?: unknown): Map<string, unknown>;
+export {};