@ogygia/core 0.0.0 → 0.11.1

package/dist/runtime/region-attrs.js

@@ -0,0 +1,153 @@
+// src/runtime/region-attrs.ts
+/**
+* DOM attribute vocabulary for `<ogygia-region>` (DESIGN.md two axes).
+*
+* - `wake`    — when JS wakes: `none` | `load` | `idle` | `visible` | `interaction` | media query
+* - `render`  — when HTML arrives: omit/`page` | `defer`
+* - `when`    — schedule for `render="defer"` OR `remount="swr"` revalidate
+* - `hydrate-margin` — IntersectionObserver rootMargin for phase-2 `wake="visible"`
+* - `remount` — `{#if}` re-creation of `wake="none"`: `cache` | `empty` | `swr`
+* - `max-age` — client lake-cache TTL in ms (optional)
+* - `on-expire` — past max-age: `empty` | `fetch` (swr default `fetch`, cache default `empty`)
+*
+* No "island" / "lake" attribute names — those are nicknames, not the mechanism.
+*/
+/** CSS selector for frozen regions (`hydrate: 'none'`). */
+const FROZEN_SELECTOR = "ogygia-region[wake=\"none\"]";
+/** True if this region is a wake boundary (JS will / did run for its subtree). */
+function is_awake(el) {
+	const h = el.getAttribute("wake");
+	return h != null && h !== "none";
+}
+/** True if this region freezes its subtree (SSR DOM preserved; no client module). */
+function is_frozen(el) {
+	return el.getAttribute("wake") === "none";
+}
+/** True if this region fetches HTML later (`render="defer"`). */
+function is_deferred(el) {
+	return el.getAttribute("render") === "defer";
+}
+/**
+* The regions whose INSIDE Kit's hydration never walks — OPAQUE to it, adopted as one element: a lake
+* (frozen server HTML), a hole (a fallback, then an answer fetched after load — a region found inside
+* one on a Kit-hydrated document came with that answer: the page's own fallback renders its islands
+* inline, as Kit's), and a BAKED live region (its first HTML is server-only, morphed in after by the
+* runtime). Their insides are ogygia's on every page: nothing else will wake them. The server twins:
+* `isInLake()` (context.ts — set by LakeBoundary and on every render root whose HTML lands in one) and
+* `region_kind` (reversible.ts).
+*/
+const OPAQUE_SELECTOR = "ogygia-region[wake=\"none\"],ogygia-region[render=\"defer\"],ogygia-region[data-og-baked]";
+/** True if this region sits inside an {@link OPAQUE_SELECTOR opaque} region: on a Kit-hydrated
+*  document nothing but the runtime will ever wake it. */
+function inside_opaque(el) {
+	return !!el.parentElement?.closest(OPAQUE_SELECTOR);
+}
+/** Mixed mode (a csr=true document): Kit hydrates the tree, so an island there is Kit's — EXCEPT
+*  what Kit never sees: a deferred region (its HTML is fetched after load) and anything inside an
+*  opaque region (a lake, a hole's answer, a baked region's first HTML). Those are ours. */
+function ours_on_kit_document(el) {
+	return is_deferred(el) || inside_opaque(el);
+}
+/** `{#if}` remount policy for `wake="none"` regions. Default `cache`. */
+function region_remount(el) {
+	const r = el.getAttribute("remount");
+	if (r === "empty" || r === "swr") return r;
+	return "cache";
+}
+/** Client lake-cache TTL in ms from `max-age`. `0` = no expiry. */
+function region_max_age_ms(el) {
+	const raw = el.getAttribute("max-age");
+	if (raw == null || raw === "") return 0;
+	const n = Number(raw);
+	return Number.isFinite(n) && n > 0 ? n : 0;
+}
+/**
+* Past-maxAge behavior. Defaults: `cache` → `empty`, `swr` → `fetch`.
+* `fetch` is only meaningful with `remount="swr"` (endpoint present).
+*/
+function region_on_expire(el) {
+	const raw = el.getAttribute("on-expire");
+	if (raw === "empty" || raw === "fetch") return raw;
+	return region_remount(el) === "swr" ? "fetch" : "empty";
+}
+/**
+* True when a frozen region has only Svelte placeholder anchors (comments / whitespace).
+* Used by remount: a text-only lake is still "filled" — `querySelector('*')` would miss it and
+* double-append the cache on reconnect (REMOUNT-VACANT).
+*/
+function region_is_vacant(el) {
+	for (const n of el.childNodes) {
+		if (n.nodeType === 1) return false;
+		if (n.nodeType === 3 && (n.textContent?.trim() ?? "") !== "") return false;
+	}
+	return true;
+}
+/** True when this document was SERVED FROM a page store (a plugin stamps the hit/join copies with
+*  `STORED_DOCUMENT_META`). A stored copy is a cached render by definition — swr lakes read this to
+*  revalidate on FIRST mount, not only on remounts. */
+function document_is_stored() {
+	return typeof document !== "undefined" && !!document.querySelector("meta[name=\"ogygia-stored\"]");
+}
+/**
+* True when the browser's HTML parser tore this placed island's SSR content OUT of the region —
+* the invalid-nesting hoist.
+*
+* A block-rendering island authored INLINE inside a `<p>` (e.g. a `<Counter/>` sitting in a markdown
+* sentence, where the component renders `<div>…</div>`) is invalid HTML: a `<div>` start tag while a
+* `<p>` is in button scope makes the parser CLOSE the paragraph, popping this `<ogygia-region>` with
+* it — the region is left holding only its opening Svelte hydration anchors (`<!--[-->`), while the
+* rendered nodes (and the closing anchors) become siblings of the paragraph. Hydrating that empty
+* region then fresh-mounts a SECOND copy, and the hoisted server copy lingers as an orphan → the
+* page shows the island twice.
+*
+* Detected as an UNBALANCED hydration envelope: strictly more `[` open anchors than `]` close anchors
+* among the region's descendants. A validly-nested region (inline content, or block content in block
+* context) always balances; a region that renders nothing balances (0 == 0); a not-yet-swapped
+* deferred/live region carries no anchors at all (0 == 0). So this never false-positives on a
+* correctly-parsed region — only the parser-truncated envelope reads open > close.
+*/
+function region_ssr_truncated(el) {
+	let open = 0;
+	let close = 0;
+	const scan = (parent) => {
+		for (const n of parent.childNodes) if (n.nodeType === 8) {
+			const d = (n.textContent ?? "").trim();
+			if (d[0] === "[") open++;
+			else if (d[0] === "]") close++;
+		} else if (n.nodeType === 1) scan(n);
+	};
+	scan(el);
+	return open > close;
+}
+/**
+* Schedule string for the shared scheduler.
+* Deferred regions use `when`; waking regions use `wake`; default `load`.
+*/
+function region_schedule(el) {
+	if (is_deferred(el)) return el.getAttribute("when") || "load";
+	const h = el.getAttribute("wake");
+	if (h && h !== "none") return h;
+	return "load";
+}
+/**
+* Wake schedule from `wake`, or `null` when this region does not run JS
+* (`wake` absent / `'none'`). Used after a deferred HTML swap for phase 2.
+*/
+function region_hydrate_schedule(el) {
+	const h = el.getAttribute("wake");
+	if (h == null || h === "none") return null;
+	return h;
+}
+/**
+* Phase-2 (post-swap) hydrate schedule for a deferred client island.
+*
+* - Matching schedules (`load`/`load`, `idle`/`idle`, `visible`/`visible`, same media) → `'load'`
+*   (hydrate immediately; do not re-arm the same idle / IO / MQ).
+* - `hydrate: 'load'` after any defer → `'load'` (ASAP after swap).
+* - Otherwise arm hydrate’s own schedule only.
+*/
+function phase2_hydrate_schedule(defer_when, hydrate) {
+	if (hydrate === "load" || hydrate === defer_when) return "load";
+	return hydrate;
+}
+export { FROZEN_SELECTOR, OPAQUE_SELECTOR, document_is_stored, inside_opaque, is_awake, is_deferred, is_frozen, ours_on_kit_document, phase2_hydrate_schedule, region_hydrate_schedule, region_is_vacant, region_max_age_ms, region_on_expire, region_remount, region_schedule, region_ssr_truncated };

package/dist/runtime/region-endpoint-url.d.ts

@@ -0,0 +1,76 @@
+import { LoadClass } from "./load-scheduler.js";
+/** Hoisted (hot paths — connectedCallback/hydrate run per region); shared with core's
+ *  foreign-origin checks. */
+export declare const ABSOLUTE_URL_SCHEME: RegExp;
+/**
+ * Defense-in-depth: only fetch region HTML from same-origin capability URLs.
+ * Mint always emits a path-only URL (`resolve(DEFAULT_ISLANDS_ENDPOINT)?…`). Absolute /
+ * protocol-relative endpoints would require prior HTML injection — still reject them so the
+ * runtime is not an XSS amplifier. See INVARIANTS.md · HOLE-TRUST.
+ */
+/** True when `endpoint` resolves to same-origin http(s). */
+export declare function is_allowed_region_endpoint(endpoint: string, page_origin?: string): boolean;
+/**
+ * Has this hole's capability (probably) EXPIRED — worth one retry with `&renew=1` after a 403? Its
+ * document outlived it in a cache (server/shared-cache.ts). Read from the signed `exp` in the URL,
+ * with {@link CLOCK_SKEW_SEC} of slack for a slow clock; a URL that has not expired never renews
+ * (the server refuses it), so a wrong guess costs one refused request.
+ */
+export declare function capability_expired(endpoint: string, now_ms?: number, page_origin?: string): boolean;
+/** The renewal request for an expired capability `endpoint` (the handle re-signs it, anonymous
+ *  holes only, and answers the fresh capability in `x-ogygia-capability`). */
+export declare function renewal_url(endpoint: string): string;
+/**
+ * Is this hole answer a WHOLE DOCUMENT rather than the region's fragment? ogygia's handle answers a
+ * region request in place — a fragment, a 204, an error status — never with a page. A page here
+ * means a handle in front of `ogygia.handle()` took the request instead (an auth wall, a locale
+ * bounce, a 404 handler) and the browser followed it: a customer's signed-in visitors had every
+ * hole of the header filled with the account area's page — its scripts, its skeletons, a second
+ * header. Refused, the fallback stands; the redirect twin is {@link is_redirected_answer}.
+ */
+export declare function is_document_answer(text: string): boolean;
+/** A region request that was redirected (same origin — cross-origin is refused earlier) did not
+ *  reach the endpoint it named: whatever answered is not the region. */
+export declare function is_redirected_answer(res: Response): boolean;
+/**
+ * Why a hole's answer was refused:
+ * - `redirected` / `document`: something in front of ogygia's handle answered instead;
+ * - `forbidden`: the handle refused the capability (a 403, `deny` says why — `foreign-key` when the
+ *   page and the islands endpoint came from different deployments).
+ */
+export type RegionRefusal = "redirected" | "document" | "forbidden";
+/** The error a refused answer throws: the fetch loop does not retry it (the answer is
+ *  deterministic — a redirect rule, a refused capability, not a flaky network) and DEV names the
+ *  culprit. */
+export declare class RegionAnswerRefused extends Error {
+  override name: string;
+  readonly reason: RegionRefusal;
+  readonly final_url: string;
+  /** `forbidden`: the server's `x-ogygia-deny`, with its key fingerprint and the capability's */
+  readonly deny?: string;
+  constructor(reason: RegionRefusal, final_url: string, deny?: string);
+}
+/** The reason a 403 without `x-ogygia-deny` gets: ogygia's handle never answered it. */
+export declare const NOT_OGYGIA_403 = "not ogygia: a proxy, CDN or firewall in front answered (a 403 without x-ogygia-deny)";
+/**
+ * A 403 from the islands endpoint, as one line: its `x-ogygia-deny` reason, and for `foreign-key`
+ * the two keys (the capability's `&k=`, the answering server's `x-ogygia-key`). A 403 with no reason
+ * came from something in front of the handle (a bot wall), or from a server before reasons.
+ */
+export declare function deny_of(res: Response, endpoint: string): string;
+/** After fetch: reject opaque redirects that left the page origin. */
+export declare function is_same_origin_response(res: Response, page_origin?: string): boolean;
+/**
+ * Normalize a hydrate `entry` for `import()`.
+ *
+ * Root-absolute paths (`/@id/…`, `/_app/…`) and absolute URLs import as-is. Relative specs
+ * (`./_app/…`, `../_app/…`) must resolve against the **document** URL — `import()` would
+ * otherwise resolve them against the runtime module (`/_app/immutable/og-runtime.*`)
+ * and produce `/_app/_app/…` 404s on nested routes.
+ */
+export declare function island_module_url(entry: string, base?: string): string;
+/** Fire-and-forget `import()` of an island's module, deduped by resolved URL. */
+export declare function warm_island_module(entry: string, base?: string, cls?: LoadClass): void;
+/** Has this island module already been warmed (or imported through the warmer)? `entry` resolves
+ *  the way `warm_island_module` resolves it; `base` for an href read off a foreign document. */
+export declare function is_warmed_module(entry: string, base?: string): boolean;

package/dist/runtime/region-endpoint-url.js

@@ -0,0 +1,169 @@
+import { preload_island_graph } from "./island-graph-preload.js";
+import { fetch_priority_of, load_slot } from "./load-scheduler.js";
+import { entry_location } from "./entry-locations.js";
+// src/runtime/region-endpoint-url.ts
+/** Hoisted (hot paths — connectedCallback/hydrate run per region); shared with core's
+*  foreign-origin checks. */
+const ABSOLUTE_URL_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+/**
+* Defense-in-depth: only fetch region HTML from same-origin capability URLs.
+* Mint always emits a path-only URL (`resolve(DEFAULT_ISLANDS_ENDPOINT)?…`). Absolute /
+* protocol-relative endpoints would require prior HTML injection — still reject them so the
+* runtime is not an XSS amplifier. See INVARIANTS.md · HOLE-TRUST.
+*/
+/** True when `endpoint` resolves to same-origin http(s). */
+function is_allowed_region_endpoint(endpoint, page_origin = location.origin) {
+	if (typeof endpoint !== "string" || endpoint.length === 0) return false;
+	try {
+		const url = new URL(endpoint, page_origin);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+		if (url.origin !== page_origin) return false;
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** How far this browser's clock may run behind the server's and still see an expiry. */
+const CLOCK_SKEW_SEC = 300;
+/**
+* Has this hole's capability (probably) EXPIRED — worth one retry with `&renew=1` after a 403? Its
+* document outlived it in a cache (server/shared-cache.ts). Read from the signed `exp` in the URL,
+* with {@link CLOCK_SKEW_SEC} of slack for a slow clock; a URL that has not expired never renews
+* (the server refuses it), so a wrong guess costs one refused request.
+*/
+function capability_expired(endpoint, now_ms = Date.now(), page_origin = location.origin) {
+	try {
+		const exp = Number(new URL(endpoint, page_origin).searchParams.get("exp"));
+		return Number.isFinite(exp) && exp > 0 && exp <= now_ms / 1e3 + CLOCK_SKEW_SEC;
+	} catch {
+		return false;
+	}
+}
+/** The renewal request for an expired capability `endpoint` (the handle re-signs it, anonymous
+*  holes only, and answers the fresh capability in `x-ogygia-capability`). */
+function renewal_url(endpoint) {
+	return endpoint + (endpoint.includes("?") ? "&" : "?") + "renew=1";
+}
+/** A whole HTML document starts with a doctype or `<html>`; a region answer never does. */
+const DOCUMENT_START_RE = /^\s*(?:<!doctype\b|<html\b)/i;
+/**
+* Is this hole answer a WHOLE DOCUMENT rather than the region's fragment? ogygia's handle answers a
+* region request in place — a fragment, a 204, an error status — never with a page. A page here
+* means a handle in front of `ogygia.handle()` took the request instead (an auth wall, a locale
+* bounce, a 404 handler) and the browser followed it: a customer's signed-in visitors had every
+* hole of the header filled with the account area's page — its scripts, its skeletons, a second
+* header. Refused, the fallback stands; the redirect twin is {@link is_redirected_answer}.
+*/
+function is_document_answer(text) {
+	return DOCUMENT_START_RE.test(text.slice(0, 256));
+}
+/** A region request that was redirected (same origin — cross-origin is refused earlier) did not
+*  reach the endpoint it named: whatever answered is not the region. */
+function is_redirected_answer(res) {
+	return res.redirected === true;
+}
+/** The error a refused answer throws: the fetch loop does not retry it (the answer is
+*  deterministic — a redirect rule, a refused capability, not a flaky network) and DEV names the
+*  culprit. */
+var RegionAnswerRefused = class extends Error {
+	name = "RegionAnswerRefused";
+	reason;
+	final_url;
+	/** `forbidden`: the server's `x-ogygia-deny`, with its key fingerprint and the capability's */
+	deny;
+	constructor(reason, final_url, deny) {
+		super(`region answer refused: ${reason}${deny ? ` (${deny})` : ""} (${final_url})`);
+		this.reason = reason;
+		this.final_url = final_url;
+		this.deny = deny;
+	}
+};
+/** The reason a 403 without `x-ogygia-deny` gets: ogygia's handle never answered it. */
+const NOT_OGYGIA_403 = "not ogygia: a proxy, CDN or firewall in front answered (a 403 without x-ogygia-deny)";
+/**
+* A 403 from the islands endpoint, as one line: its `x-ogygia-deny` reason, and for `foreign-key`
+* the two keys (the capability's `&k=`, the answering server's `x-ogygia-key`). A 403 with no reason
+* came from something in front of the handle (a bot wall), or from a server before reasons.
+*/
+function deny_of(res, endpoint) {
+	const why = res.headers.get("x-ogygia-deny");
+	if (why === null) return NOT_OGYGIA_403;
+	if (why !== "foreign-key") return why;
+	let minted = "";
+	try {
+		minted = new URL(endpoint, location.href).searchParams.get("k") ?? "";
+	} catch {}
+	return `foreign-key: signed by ${minted || "?"}, answered by ${res.headers.get("x-ogygia-key") ?? "?"}`;
+}
+/** After fetch: reject opaque redirects that left the page origin. */
+function is_same_origin_response(res, page_origin = location.origin) {
+	if (!res.url) return true;
+	try {
+		return new URL(res.url).origin === page_origin;
+	} catch {
+		return false;
+	}
+}
+/**
+* Normalize a hydrate `entry` for `import()`.
+*
+* Root-absolute paths (`/@id/…`, `/_app/…`) and absolute URLs import as-is. Relative specs
+* (`./_app/…`, `../_app/…`) must resolve against the **document** URL — `import()` would
+* otherwise resolve them against the runtime module (`/_app/immutable/og-runtime.*`)
+* and produce `/_app/_app/…` 404s on nested routes.
+*/
+function island_module_url(entry, base) {
+	if (!entry) return entry;
+	const located = entry_location(entry, base);
+	if (located) return located;
+	if (entry.startsWith("/") || ABSOLUTE_URL_SCHEME.test(entry)) return entry;
+	const b = base ?? location.href;
+	const key = b + "\n" + entry;
+	const hit = module_urls.get(key);
+	if (hit !== void 0) return hit;
+	const resolved = new URL(entry, b);
+	const out = resolved.pathname + resolved.search + resolved.hash;
+	if (module_urls.size > 4e3) module_urls.clear();
+	module_urls.set(key, out);
+	return out;
+}
+/** A relative entry resolved against its document, by base + entry (asked on every wake and warm). */
+const module_urls = /* @__PURE__ */ new Map();
+const warmed_modules = /* @__PURE__ */ new Set();
+/** The warmer's key: the resolved module as an absolute URL (a location arrives absolute, an href
+*  off a page root-relative — the same file must be one key). */
+function warm_key(url) {
+	try {
+		return new URL(url, location.href).href;
+	} catch {
+		return url;
+	}
+}
+/** Fire-and-forget `import()` of an island's module, deduped by resolved URL. */
+function warm_island_module(entry, base, cls = "speculative") {
+	const url = island_module_url(entry, base);
+	if (!url) return;
+	const key = warm_key(url);
+	if (warmed_modules.has(key)) return;
+	warmed_modules.add(key);
+	load_slot({
+		kind: "code",
+		cls,
+		label: entry
+	}).ready.then((release) => {
+		preload_island_graph(entry, base, fetch_priority_of(cls));
+		import(
+			/* @vite-ignore */
+			url
+).catch(() => {
+			warmed_modules.delete(key);
+		}).finally(release);
+	});
+}
+/** Has this island module already been warmed (or imported through the warmer)? `entry` resolves
+*  the way `warm_island_module` resolves it; `base` for an href read off a foreign document. */
+function is_warmed_module(entry, base) {
+	const url = island_module_url(entry, base);
+	return !!url && warmed_modules.has(warm_key(url));
+}
+export { ABSOLUTE_URL_SCHEME, NOT_OGYGIA_403, RegionAnswerRefused, capability_expired, deny_of, is_allowed_region_endpoint, is_document_answer, is_redirected_answer, is_same_origin_response, is_warmed_module, island_module_url, renewal_url, warm_island_module };

package/dist/runtime/region-ids.d.ts

@@ -0,0 +1,8 @@
+/** Record that `region`'s island resolved page id `id` (called via the resolve-sink). */
+export declare function record_region_id(region: Element, id: string): void;
+/** The page ids a region's island owns, or undefined. */
+export declare function region_owned_ids(region: Element): Set<string> | undefined;
+/** Run `fn` with the hub's resolve-sink funneling every page id it resolves to `region`'s owned
+ *  set, then restore the previous sink (finally, so a throw can't strand it). Wrap an island's
+ *  SYNC prop/context decode so the reconciler learns which ids that island owns. */
+export declare function capture_region_ids<T>(region: Element, fn: () => T): T;

package/dist/runtime/region-ids.js

@@ -0,0 +1,33 @@
+import { set_resolve_sink } from "../ref.js";
+// src/runtime/region-ids.ts
+/**
+* R3 OWNERSHIP: which page-scoped hub ids each region's island resolved during hydration. The
+* hydrate core installs a resolve-sink (ref.set_resolve_sink) around each island's sync prop +
+* context decode that funnels ids here, keyed by the region element; the reconciler (a navigation)
+* disposes exactly the ids of REMOVED regions. WeakMap → a removed element's set is GC'd with it.
+* Its own module so the boot-time reconciler and the lazily loaded hydrate core share one map
+* without either importing the other.
+*/
+const owned_ids = /* @__PURE__ */ new WeakMap();
+/** Record that `region`'s island resolved page id `id` (called via the resolve-sink). */
+function record_region_id(region, id) {
+	let set = owned_ids.get(region);
+	if (set === void 0) owned_ids.set(region, set = /* @__PURE__ */ new Set());
+	set.add(id);
+}
+/** The page ids a region's island owns, or undefined. */
+function region_owned_ids(region) {
+	return owned_ids.get(region);
+}
+/** Run `fn` with the hub's resolve-sink funneling every page id it resolves to `region`'s owned
+*  set, then restore the previous sink (finally, so a throw can't strand it). Wrap an island's
+*  SYNC prop/context decode so the reconciler learns which ids that island owns. */
+function capture_region_ids(region, fn) {
+	set_resolve_sink((id) => record_region_id(region, id));
+	try {
+		return fn();
+	} finally {
+		set_resolve_sink(null);
+	}
+}
+export { capture_region_ids, record_region_id, region_owned_ids };

package/dist/runtime/remote-seeds.d.ts

@@ -0,0 +1,2 @@
+/** Feature entry: fill the `remoteSeeds` slot. */
+export declare function install(): void;

package/dist/runtime/remote-seeds.js

@@ -0,0 +1,21 @@
+import { slots } from "./slots.js";
+import { seed_query_responses } from "../shims/kit-remote/client-stub.js";
+import { clear_remote_instances, clear_remote_seeds } from "../shims/kit-remote/remote-cache.js";
+// src/runtime/remote-seeds.ts
+/**
+* Remote-seeds feature: seed the reused Kit client query cache from the server's
+* `application/ogygia-remote` side-channel (zero-flash hydration), and clear it across SPA swaps.
+*
+* A HYDRATE-phase feature (link/runtime-entry.ts): installed by the hydrate core, never the boot —
+* only `seeds.ts` (hydrate core) reads the slot, and the decoder imports the APP's transport codecs
+* (its own `src/hooks.ts`), which reach Svelte.
+*/
+/** Feature entry: fill the `remoteSeeds` slot. */
+function install() {
+	slots.remoteSeeds = {
+		seed_query_responses,
+		clear_remote_seeds,
+		clear_remote_instances
+	};
+}
+export { install };

package/dist/runtime/render-blocking.d.ts

@@ -0,0 +1,2 @@
+/** `(r) => did r hold the first paint`, read once for a pass over many entries */
+export declare function paint_blocker(): (r: PerformanceResourceTiming) => boolean;

package/dist/runtime/render-blocking.js

@@ -0,0 +1,30 @@
+// src/runtime/render-blocking.ts
+/** whether this browser says per file what blocked the paint */
+function status_known() {
+	return typeof PerformanceResourceTiming !== "undefined" && "renderBlockingStatus" in PerformanceResourceTiming.prototype;
+}
+/** the URLs the head makes blocking, or null where the browser says it itself */
+function head_blockers() {
+	if (status_known() || typeof document === "undefined" || !document.head) return null;
+	const out = /* @__PURE__ */ new Set();
+	for (const el of document.head.querySelectorAll("link[href],script[src]")) {
+		const marked = (el.getAttribute("blocking") ?? "").split(" ").includes("render");
+		if (el instanceof HTMLLinkElement) {
+			if (!el.relList.contains("stylesheet") || el.disabled) continue;
+			const media = el.media.trim();
+			if (marked || !media || media === "all" || matchMedia(media).matches) out.add(el.href);
+		} else if (el instanceof HTMLScriptElement) {
+			const type = el.type.trim().toLowerCase();
+			if (marked || (!type || type === "text/javascript" || type === "application/javascript") && !el.async && !el.defer) out.add(el.src);
+		}
+	}
+	return out;
+}
+/** `(r) => did r hold the first paint`, read once for a pass over many entries */
+function paint_blocker() {
+	const head = head_blockers();
+	if (!head) return (r) => r.renderBlockingStatus === "blocking";
+	const parsed = performance.getEntriesByType("navigation")[0]?.domInteractive || Infinity;
+	return (r) => head.has(r.name) && r.startTime < parsed;
+}
+export { paint_blocker };

package/dist/runtime/restore.d.ts

@@ -0,0 +1,34 @@
+/**
+ * THE RESTORER — the browser half of reversible transforms (server/reversible.ts). An app's server
+ * transform rendered each planned custom element (`og-h`) in scoped form: its rendered tree in the
+ * host's light DOM, Svelte's children moved into `<slot>` wrappers inside it. This puts it back into
+ * the form hydration and the component's runtime both expect:
+ *
+ *   1. stand-ins (`<og-as tag="a">`: tags the HTML parser would have restructured) become their real
+ *      element, in place — a DOM operation, which no content-model rule applies to;
+ *   2. for each planned host, innermost first: an open shadow root with the host's keyed sheets, the
+ *      rendered tree moved into it (its `<slot>` wrappers become real slots), Svelte's children back
+ *      in the light DOM in their original order and exactly as Svelte rendered them (attributes reset,
+ *      trimmed or dropped text put back), the host's attributes back to Svelte's (except `og-keep`).
+ *
+ * The page stays painted the same throughout: the scoped form and the shadow form render alike, and
+ * each host is restored in one task. It must run before anything reads the markup — before an island
+ * snapshots or hydrates, before Kit starts, before a web-component runtime upgrades a host. So the
+ * handle inlines it at the end of the document's body (`restore.toString()`: this function is
+ * self-contained, no imports, no outer names), and the runtime calls it on a hole / lake answer before
+ * insertion and on an incoming page before a router swap.
+ *
+ * A host that already has a shadow root when it is reached was upgraded first — the restore came
+ * too late. It is left as served and reported (`ogygia:restore-late` on the host), never restored into
+ * a root the component's own constructor made (that tree would render twice).
+ */
+export declare function restore(root: Document | DocumentFragment | Element): number;
+/** Adopt the sheets of roots restored outside the page, now that their hosts are in it (after a hole
+ *  answer's insertion or a router swap, in the same task: no paint in between). Each root is one of
+ *  three: IN THE PAGE (adopted now); in a fragment not inserted yet (another hole's answer still
+ *  waiting for its stylesheet: kept for the call after its insertion); or in ANOTHER DOCUMENT — the
+ *  incoming page's parsed copy, where the swap left what it did not take (a morph kept the live
+ *  host): dropped. That last one counts as connected (its document is its root), and adopting a page
+ *  sheet into it throws — which stopped every root after it from getting its sheets. A fragment root
+ *  still out after 30 s never goes in (a morph took a copy of it, the hole left): dropped. */
+export declare function restore_adopt(): void;