@ogygia/core 0.11.4 → 0.12.0

package/dist/compiler/link/runtime-entry.js

@@ -12,6 +12,11 @@ const FEATURES = {
 		deps: [],
 		detect: (m) => m.forms === true || m.forms !== false && m.router === true
 	},
+	"mpa-nav": {
+		module: "nav-handle.js",
+		deps: [],
+		detect: (m) => m.page !== false
+	},
 	router: {
 		module: "router.js",
 		deps: [],
@@ -39,12 +44,23 @@ const FEATURES = {
 		phase: "hydrate",
 		detect: (m) => m.wire === true
 	},
+	"wire-classes": {
+		module: "wire-classes.js",
+		deps: [],
+		detect: (m) => m.wire === true
+	},
 	"remote-seeds": {
 		module: "remote-seeds.js",
 		deps: [],
 		phase: "hydrate",
 		detect: (m) => m.remoteSeeds !== false
 	},
+	page: {
+		module: "seeds.js",
+		deps: [],
+		phase: "hydrate",
+		detect: (m) => m.page !== false
+	},
 	frames: {
 		module: "frames.js",
 		deps: [],
@@ -59,13 +75,16 @@ const FEATURES = {
 };
 const FEATURE_ORDER = [
 	"remote-seeds",
+	"page",
 	"wire",
+	"wire-classes",
 	"frames",
 	"lakes",
 	"morph",
 	"live",
 	"interaction",
 	"forms",
+	"mpa-nav",
 	"router",
 	"context"
 ];
@@ -129,4 +148,18 @@ function generateHydrateFeaturesSource(marks, runtimeDir, all = false) {
 		features
 	};
 }
-export { FEATURES, FEATURE_ORDER, generateHydrateFeaturesSource, generateRuntimeEntrySource, phaseFeatures, resolveFeatures };
+/**
+* Emit `virtual:ogygia/runtime-flags`: build-time constants for code that lives INSIDE the always-on
+* region element rather than in a feature module, because it works on the element's own state. The
+* bundler inlines an imported `const` and drops the branches it switches off, so the code a flag
+* guards ships exactly when the feature it serves does. Same marks as the entries; `all` (dev / no
+* marks): every flag on.
+*
+* - `FRAMES`: the `frames` feature is in the build — some region streams HTML (a deferred hole, a
+*   live region, a lake). Without the frame store a region's fetch has nowhere to land, so the
+*   element's fetch / apply / morph / renew path is dead code then.
+*/
+function generateRuntimeFlagsSource(marks, all = false) {
+	return `export const FRAMES = ${all || resolveFeatures(marks).includes("frames")};\n`;
+}
+export { FEATURES, FEATURE_ORDER, generateHydrateFeaturesSource, generateRuntimeEntrySource, generateRuntimeFlagsSource, phaseFeatures, resolveFeatures };

package/dist/compiler/link/server-manifest.js

@@ -1,4 +1,5 @@
 import { V_SERVER_ISLANDS } from "../ids.js";
+import { dedent } from "../dedent.js";
 // src/compiler/link/server-manifest.ts
 /** The SERVER-island ids the manifest carries right now (deferred / server-picked regions). */
 function server_island_ids(program) {
@@ -7,7 +8,14 @@ function server_island_ids(program) {
 	return ids;
 }
 function server_manifest_module(ssr, program, is_dev, devUrlFor, publicUrlFor) {
-	if (!ssr) return `export const load_islands = () => Promise.resolve({ islands: {} });\nexport const island_url = {};\nexport const island_name = {};\nexport const island_render = {};\nexport const render_island = {};\nexport const island_reads_page_data = null;`;
+	if (!ssr) return dedent`
+			export const load_islands = () => Promise.resolve({ islands: {} });
+			export const island_url = {};
+			export const island_name = {};
+			export const island_render = {};
+			export const render_island = {};
+			export const island_reads_page_data = null;
+		`;
 	const urls = [];
 	const names = [];
 	const renders = [];
@@ -17,25 +25,53 @@ function server_manifest_module(ssr, program, is_dev, devUrlFor, publicUrlFor) {
 		const reg = program.registry.get(virtualPath);
 		if (!reg?.server) continue;
 		if (reg.renderId) {
-			renders.push(`  ${JSON.stringify(iid)}: ${JSON.stringify(reg.renderId)}`);
+			renders.push(`${JSON.stringify(iid)}: ${JSON.stringify(reg.renderId)}`);
 			const seen = by_render.get(reg.renderId);
 			if (seen === void 0 || iid < seen) by_render.set(reg.renderId, iid);
 		}
 		const file = reg.componentPath ?? "";
 		const base = file.slice(file.lastIndexOf("/") + 1);
-		if (base.endsWith(".svelte")) names.push(`  ${JSON.stringify(iid)}: ${JSON.stringify(base.slice(0, -7))}`);
-		urls.push(`  ${JSON.stringify(iid)}: ${JSON.stringify(is_dev ? devUrlFor(virtualPath) : publicUrlFor(iid))}`);
+		if (base.endsWith(".svelte")) names.push(`${JSON.stringify(iid)}: ${JSON.stringify(base.slice(0, -7))}`);
+		urls.push(`${JSON.stringify(iid)}: ${JSON.stringify(is_dev ? devUrlFor(virtualPath) : publicUrlFor(iid))}`);
 	}
-	return `export const load_islands = () => import(${JSON.stringify(V_SERVER_ISLANDS)});\nexport const island_url = {\n${urls.join(",\n")}\n};\nexport const island_name = {\n${names.join(",\n")}\n};\nexport const island_render = {\n${renders.join(",\n")}\n};\nexport const render_island = {\n${[...by_render].map(([r, iid]) => `  ${JSON.stringify(r)}: ${JSON.stringify(iid)}`).join(",\n")}\n};\nexport const island_reads_page_data = ${is_dev ? "null" : PAGE_DATA_READS_PLACEHOLDER};`;
+	const entries = [...by_render].map(([r, iid]) => `${JSON.stringify(r)}: ${JSON.stringify(iid)}`);
+	return dedent`
+		export const load_islands = () => import(${JSON.stringify(V_SERVER_ISLANDS)});
+
+		export const island_url = {
+			${urls.join(",\n	")}
+		};
+
+		export const island_name = {
+			${names.join(",\n	")}
+		};
+
+		export const island_render = {
+			${renders.join(",\n	")}
+		};
+
+		export const render_island = {
+			${entries.join(",\n	")}
+		};
+
+		// id → does the hole's SERVER tree read \`page.data\` (the page lookup a hole needs: server/
+		// render-page.ts). Known only once every module is transformed: a build patches the
+		// placeholder in renderChunk (driver \`patch_page_data_reads\`); dev leaves \`null\` (unknown → look up).
+		export const island_reads_page_data = ${is_dev ? "null" : PAGE_DATA_READS_PLACEHOLDER};
+	`;
 }
 /** `virtual:ogygia/server-islands`: each SERVER island's loader, `id → () => import(entry)` (empty on
 *  the client). Imported only by the manifest's `load_islands()` — never statically. */
 function server_islands_module(ssr, program) {
 	const entries = [];
 	if (ssr) {
-		for (const [iid, virtualPath] of program.by_id) if (program.registry.get(virtualPath)?.server) entries.push(`  ${JSON.stringify(iid)}: () => import(${JSON.stringify(virtualPath)})`);
+		for (const [iid, virtualPath] of program.by_id) if (program.registry.get(virtualPath)?.server) entries.push(`${JSON.stringify(iid)}: () => import(${JSON.stringify(virtualPath)})`);
 	}
-	return `export const islands = {\n${entries.join(",\n")}\n};\n`;
+	return dedent`
+		export const islands = {
+			${entries.join(",\n	")}
+		};
+	`;
 }
 /** The token the build replaces with its answer (driver `patch_page_data_reads`), inside a string
 *  literal the bundler cannot fold: a plain `null` placeholder was inlined into every reader as the

package/dist/compiler/link/transport.js

@@ -1,4 +1,5 @@
 import { OWN_SPECIFIER_SOURCE } from "../../own-package.js";
+import { dedent } from "../dedent.js";
 // src/compiler/link/transport.ts
 /**
 * `virtual:ogygia/transport` emitter — re-exports the app's universal `transport` hook (or an empty
@@ -6,10 +7,29 @@ import { OWN_SPECIFIER_SOURCE } from "../../own-package.js";
 * Pure over the resolved absolute path to the app's universal hooks module (or null).
 */
 function transport_module(universal_hooks, kit_codec = null) {
-	if (!universal_hooks) return `export const transport = {};\nexport const encoders = {};\nexport const decoders = {};`;
-	const src = `import * as hooks from ${JSON.stringify(universal_hooks)};\nexport const transport = hooks.transport || {};\nconst codecs = Object.entries(transport);\nexport const encoders = Object.fromEntries(codecs.map(([k, v]) => [k, v.encode]));\nexport const decoders = Object.fromEntries(codecs.map(([k, v]) => [k, v.decode]));`;
+	if (!universal_hooks) return dedent`
+			export const transport = {};
+			export const encoders = {};
+			export const decoders = {};
+		`;
+	const src = dedent`
+		import * as hooks from ${JSON.stringify(universal_hooks)};
+
+		export const transport = hooks.transport || {};
+		const codecs = Object.entries(transport);
+		export const encoders = Object.fromEntries(codecs.map(([k, v]) => [k, v.encode]));
+		export const decoders = Object.fromEntries(codecs.map(([k, v]) => [k, v.decode]));
+	`;
 	if (!kit_codec) return src;
-	return `import { init_transport } from ${JSON.stringify(kit_codec)};\n${src}\ninit_transport(transport);`;
+	return dedent`
+		import { init_transport } from ${JSON.stringify(kit_codec)};
+		${src}
+
+		// Kit 3 (client leg): Kit's own codec module is a reader too — its remote argument encoding
+		// reads it, and only Kit's client boot fills it otherwise (never on a csr=false page). Kit's
+		// boot later fills it again with the same transport.
+		init_transport(transport);
+	`;
 }
 /**
 * `virtual:ogygia/kit-transport` emitter — the value behind the barrel's `ogygia.transport` (the Kit
@@ -22,8 +42,10 @@ function transport_module(universal_hooks, kit_codec = null) {
 * `transport_spec` is the resolvable path to ogygia's own `transport.js` (dist).
 */
 function kit_transport_module(app_crosses_wire, transport_spec) {
-	if (!app_crosses_wire) return `export const transport = {};\n`;
-	return `export { ogygiaTransport as transport } from ${JSON.stringify(transport_spec)};\n`;
+	if (!app_crosses_wire) return `export const transport = {};`;
+	return dedent`
+		export { ogygiaTransport as transport } from ${JSON.stringify(transport_spec)};
+	`;
 }
 const OGYGIA_WIRE_NAMED = new RegExp(`import\\s+(?:type\\s+)?\\{([\\s\\S]*?)\\}\\s*from\\s*['"]${OWN_SPECIFIER_SOURCE}['"]`, "g");
 const WIRE_API = /\b(?:region|Region|site)\b/;
@@ -58,10 +80,20 @@ function transportables_module(modules, ssr, rel, crosses_wire = false) {
 	if (ssr) {
 		const imports = [];
 		for (const abs of modules) imports.push(`import ${JSON.stringify(abs)};`);
-		return imports.join("\n") + "\nexport const wire_loaders = {};\nexport const wire_all = false;\n";
+		return dedent`
+			${imports.join("\n")}
+
+			export const wire_loaders = {};
+			export const wire_all = false;
+		`;
 	}
 	const entries = [];
 	for (const abs of modules) entries.push(`${JSON.stringify(rel(abs))}: () => import(${JSON.stringify(abs)})`);
-	return `export const wire_loaders = {${entries.join(", ")}};\nexport const wire_all = ${crosses_wire && entries.length > 0};\n`;
+	return dedent`
+		export const wire_loaders = {
+			${entries.join(",\n	")}
+		};
+		export const wire_all = ${crosses_wire && entries.length > 0};
+	`;
 }
 export { kit_transport_module, source_crosses_wire, transport_module, transportables_module };

package/dist/compiler/macros/source.js

@@ -6,12 +6,12 @@ import { og_member } from "./wire.js";
 * `import.meta.og.source(fn)` — declared data sources, as a compile construct (the postrender
 * reverse index; internal/notes/freeze.md §L2):
 *
-*   export const loadBuilderContent = import.meta.og.source(async (event, category) => { … });
+*   export const loadCmsContent = import.meta.og.source(async (event, category) => { … });
 *
 * The macro stamps the id from THIS definition's `file#export` (root-relative; the ogygia.files
 * identity rail applies to package paths upstream) and rewrites to
 * `__og_source('<id>', fn, opts?)` with the runtime-wrapper import injected. Loads stay
-* untouched plain TS forever; `postrender.invalidate(loadBuilderContent, [args])` reads the stamp
+* untouched plain TS forever; `postrender.invalidate(loadCmsContent, [args])` reads the stamp
 * off the function — no strings anywhere.
 *
 * STRICT BY CONSTRUCTION — legal in exactly ONE position:

package/dist/compiler/program.d.ts

@@ -120,6 +120,10 @@ export declare class Program {
    *  Set during the prescan walk; with `runtime_marks.wire` it decides whether `ogygia.transport`
    *  (the generated `virtual:ogygia/kit-transport`) carries the codec cluster or is an empty map. */
   crosses_wire: boolean;
+  /** Island code can reach Kit's page world (`$app/state` and kin, or something the island-closure
+   *  walk could not follow — driver.ts `mark_island_closure`). Folded into `runtime_marks.page` at
+   *  the end of the prescan, with the other ways islands the walk never saw reach the runtime. */
+  island_reads_page: boolean;
   /** Build-time capability marks for the sticky runtime entry. Incomplete → kitchen-sink. */
   readonly runtime_marks: RuntimeMarks;
   /** The resolved feature set folded into the runtime chunk name (busts the immutable URL when the

package/dist/compiler/program.js

@@ -72,6 +72,10 @@ var Program = class {
 	*  Set during the prescan walk; with `runtime_marks.wire` it decides whether `ogygia.transport`
 	*  (the generated `virtual:ogygia/kit-transport`) carries the codec cluster or is an empty map. */
 	crosses_wire = false;
+	/** Island code can reach Kit's page world (`$app/state` and kin, or something the island-closure
+	*  walk could not follow — driver.ts `mark_island_closure`). Folded into `runtime_marks.page` at
+	*  the end of the prescan, with the other ways islands the walk never saw reach the runtime. */
+	island_reads_page = false;
 	/** Build-time capability marks for the sticky runtime entry. Incomplete → kitchen-sink. */
 	runtime_marks;
 	/** The resolved feature set folded into the runtime chunk name (busts the immutable URL when the
@@ -84,7 +88,7 @@ var Program = class {
 			complete: false,
 			forms: init.forms,
 			wire: false,
-			remoteSeeds: true,
+			remoteSeeds: false,
 			hydrate: [],
 			defer: [],
 			persistKeys: [],

package/dist/compiler/region/transform.d.ts

@@ -110,12 +110,21 @@ export declare function import_keys_hint(import_keys: ImportKeys): RegExp;
  * Paths are always posix so SSR/client builds agree across OS path separators. */
 export declare function islandId(relHostPath: string, index: string | number, salt?: string): string;
 /**
- * Deterministic client chunk path for a hydrate island (mirrors `og-runtime.<hash>.js`).
- * SSR bakes this into `<ogygia-region entry>` so the sticky runtime can `import(entry)` with no
- * app-wide regions map — Kit builds server before client, so content-hashed Vite names can't hand off.
+ * The directory, under the app dir, of the STABLE names (an island's identity, the runtime's): not
+ * `immutable/`. A host serves `immutable/` for a year by name (every adapter, every CDN rule written
+ * for it), and a stable name keeps its name while its content follows each build: a year-old copy
+ * would load another build's code. Here a host's ordinary rule revalidates them. The content-hashed
+ * files they point at stay in `immutable/`.
+ */
+export declare const STABLE_NAME_DIR = "ogygia";
+/**
+ * Deterministic client path of a hydrate island's stable name (mirrors the runtime's). SSR bakes it
+ * into `<ogygia-region entry>` as the island's identity — a name, not a file: the content-hashed
+ * entry is found through the handoff (the server) and the location maps (the browser,
+ * link/location-map.ts), since Kit builds server before client.
  */
 export declare function islandChunkFileName(iid: string, appDir?: string): string;
-/** App-internal URL for {@link islandChunkFileName}: `/<appDir>/immutable/…` (leading slash, appDir,
+/** App-internal URL for {@link islandChunkFileName}: `/<appDir>/ogygia/…` (leading slash, appDir,
  *  NO base). It is what SSR bakes onto `<ogygia-region entry>`; `Region.svelte` runs it through Kit's
  *  `asset()` at render time, which is the sole authority on `base` / the assets CDN / relative paths —
  *  so a base is never baked here (that would double-apply it). NOT the on-disk output filename. */

package/dist/compiler/region/transform.js

@@ -200,14 +200,23 @@ function islandId(relHostPath, index, salt = "") {
 	return createHash("md5").update(msg).digest("hex").slice(0, 12);
 }
 /**
-* Deterministic client chunk path for a hydrate island (mirrors `og-runtime.<hash>.js`).
-* SSR bakes this into `<ogygia-region entry>` so the sticky runtime can `import(entry)` with no
-* app-wide regions map — Kit builds server before client, so content-hashed Vite names can't hand off.
+* The directory, under the app dir, of the STABLE names (an island's identity, the runtime's): not
+* `immutable/`. A host serves `immutable/` for a year by name (every adapter, every CDN rule written
+* for it), and a stable name keeps its name while its content follows each build: a year-old copy
+* would load another build's code. Here a host's ordinary rule revalidates them. The content-hashed
+* files they point at stay in `immutable/`.
+*/
+const STABLE_NAME_DIR = "ogygia";
+/**
+* Deterministic client path of a hydrate island's stable name (mirrors the runtime's). SSR bakes it
+* into `<ogygia-region entry>` as the island's identity — a name, not a file: the content-hashed
+* entry is found through the handoff (the server) and the location maps (the browser,
+* link/location-map.ts), since Kit builds server before client.
 */
 function islandChunkFileName(iid, appDir = "_app") {
-	return `${appDir}/immutable/og-region.${iid}.js`;
+	return `${appDir}/${STABLE_NAME_DIR}/og-region.${iid}.js`;
 }
-/** App-internal URL for {@link islandChunkFileName}: `/<appDir>/immutable/…` (leading slash, appDir,
+/** App-internal URL for {@link islandChunkFileName}: `/<appDir>/ogygia/…` (leading slash, appDir,
 *  NO base). It is what SSR bakes onto `<ogygia-region entry>`; `Region.svelte` runs it through Kit's
 *  `asset()` at render time, which is the sole authority on `base` / the assets CDN / relative paths —
 *  so a base is never baked here (that would double-apply it). NOT the on-disk output filename. */
@@ -1930,4 +1939,4 @@ var TsRegionCompilation = class {
 		};
 	}
 };
-export { CLIENT_BINDING_STUB, DEFAULT_IMPORT_KEYS, ISLAND_DIR, asRegionLocals, foucCssVirtualId, import_keys_hint, is_island_path, islandChunkFileName, islandId, islandPublicUrl, normalize_hydrate_value, normalize_import_keys, normalize_region_value, regionBindingVirtualId, regionId, regionIdentity, strategyKey, transformHost, transformTsRegions, wrapperVirtualId };
+export { CLIENT_BINDING_STUB, DEFAULT_IMPORT_KEYS, ISLAND_DIR, STABLE_NAME_DIR, asRegionLocals, foucCssVirtualId, import_keys_hint, is_island_path, islandChunkFileName, islandId, islandPublicUrl, normalize_hydrate_value, normalize_import_keys, normalize_region_value, regionBindingVirtualId, regionId, regionIdentity, strategyKey, transformHost, transformTsRegions, wrapperVirtualId };

package/dist/context.d.ts

@@ -1,14 +1,4 @@
-/**
- * Mark the current subtree's hydration state. `true` = inside a hydrated island (nested islands
- * degrade). `false` = a LAKE resets its subtree to "dead", so an island inside the lake self-
- * hydrates again (the nearest-boundary rule — DESIGN.md).
- */
-export declare function setNested(value?: boolean): void;
-/**
- * True when an ancestor island wrapper already marked the subtree. `getContext` returns `undefined`
- * when no ancestor set it (a top-level island) — that absence is exactly "not nested".
- */
-export declare function isNested(): boolean;
+import { isNested, setNested } from "./nested.js";
 /** Mark the current subtree as opaque to Kit — a lake's inside (LakeBoundary). */
 export declare function setInLake(): void;
 /** True when the subtree is opaque to Kit (a lake's inside, or a held region's render). */
@@ -69,4 +59,5 @@ export declare function claim_region_css(hrefs: string[]): string[];
  * injects the same script into `<head>` (presence-checked) on pages that have no island to emit it.
  * Client / no-request → false (SSR already emitted).
  */
-export declare function claimRuntimeEmit(): boolean;
+export declare function claimRuntimeEmit(): boolean;
+export { isNested, setNested };

package/dist/context.js

@@ -1,25 +1,10 @@
 import { kit_hydrates_page } from "./runtime/kit-boot.js";
+import { isNested, setNested } from "./nested.js";
 import { getContext, setContext } from "svelte";
 import { BROWSER } from "esm-env";
 import { getRequestEvent } from "virtual:ogygia/request-event";
 import { csr_true_routes, error_csr_true_routes, root_layout_csr_true } from "virtual:ogygia/route-csr";
 // src/context.ts
-const NESTED_KEY = Symbol.for("ogygia.nested-island");
-/**
-* Mark the current subtree's hydration state. `true` = inside a hydrated island (nested islands
-* degrade). `false` = a LAKE resets its subtree to "dead", so an island inside the lake self-
-* hydrates again (the nearest-boundary rule — DESIGN.md).
-*/
-function setNested(value = true) {
-	setContext(NESTED_KEY, value);
-}
-/**
-* True when an ancestor island wrapper already marked the subtree. `getContext` returns `undefined`
-* when no ancestor set it (a top-level island) — that absence is exactly "not nested".
-*/
-function isNested() {
-	return getContext(NESTED_KEY) === true;
-}
 const LAKE_KEY = Symbol.for("ogygia.lake-subtree");
 /** Mark the current subtree as opaque to Kit — a lake's inside (LakeBoundary). */
 function setInLake() {

package/dist/hooks.d.ts

@@ -17,6 +17,22 @@ export interface OgygiaHandleOptions {
    * (`/_app/…`): Kit answers those itself, before any handle runs.
    */
   endpoint?: string;
+  /**
+   * The secret that signs region capabilities (hole and live-region URLs). Takes precedence over
+   * the `OGYGIA_SECRET` environment variable, for a host whose server process never sees its
+   * runtime env. Pass a build-time private env value:
+   *
+   * ```ts
+   * import { OGYGIA_SECRET } from '$env/static/private';
+   * export const handle = ogygia.handle({ secret: OGYGIA_SECRET });
+   * ```
+   *
+   * An empty or blank value counts as not given (`OGYGIA_SECRET`, then a per-build random key, sign
+   * instead). It signs exactly as the same value in `OGYGIA_SECRET` does, so pages from either
+   * verify on the other. In production it needs ≥16 UTF-8 bytes. Every deployment that serves your
+   * pages or your islands endpoint needs the same secret.
+   */
+  secret?: string;
   /**
    * Post-process the HTML ogygia sends — every document (the chunk carrying `</head>`; a streamed
    * tail passes untouched) and every region answer (a hole, a lake remount) — e.g. a web-component

package/dist/hooks.js

@@ -1,5 +1,5 @@
 import { REGION_BRAND } from "./region-brand.js";
-import { signing_key } from "./server/signing-key.js";
+import { configure_signing_secret, signing_key } from "./server/signing-key.js";
 import { mpaSpeculationRules } from "./compiler/link/speculation.js";
 import { set_page_route_config } from "./plugin/routes.js";
 import { kit_page_facts_tail, kit_page_ready, kit_render_context, set_kit_event_reader, set_kit_page_reader, set_render_page_port } from "./server/kit-context.js";
@@ -9,7 +9,7 @@ import { absolutize_hole_html } from "./server/hole-urls.js";
 import { is_keep_fallback } from "./keep-fallback.js";
 import { set_source_recorder } from "./source.js";
 import { kit_asset } from "./kit-paths.js";
-import { region_mac_message, sign, verify } from "./server/hmac.js";
+import { region_mac_message, secret_has_min_entropy, sign, verify } from "./server/hmac.js";
 import { expiry_refusal, note_cache_control } from "./server/shared-cache.js";
 import { app_lifetime } from "./server/region-endpoint.js";
 import { cached_render, render_cache_key } from "./server/render-cache.js";
@@ -435,6 +435,8 @@ var OgygiaHandle = class {
 		this.#transform = options.transform;
 		configure_islands_endpoint(options.endpoint);
 		this.#endpoint = islands_endpoint();
+		if (options.secret?.trim() && !import.meta.env.DEV && !secret_has_min_entropy(options.secret)) throw new Error(`[ogygia] handle({ secret }) is too short for production (need ≥16 UTF-8 bytes).`);
+		configure_signing_secret(options.secret);
 		this.#speculation_rules = enabled ? "" : mpaSpeculationRules(this.#endpoint);
 		this.render_rate = new RateLimiter({
 			max: rateLimit.max,

package/dist/insights/page-insights.js

@@ -1267,8 +1267,8 @@ function analyze_page(page, regions, failures = [], now = Infinity, cpu = null)
 		const woke = gone.filter((f) => f.recovered);
 		const dead = gone.filter((f) => !f.recovered);
 		const parts = [];
-		if (woke.length) parts.push(`${list(woke.map(name))} woke on the current build's code through ${woke.length === 1 ? "its" : "their"} stable name${woke.length === 1 ? "" : "s"}: the page's HTML and ${woke.length === 1 ? "that island" : "those islands"} now come from different builds`);
-		if (dead.length) parts.push(`${list(dead.map(name))} stayed asleep: ${dead.length === 1 ? "its" : "their"} stable name failed too`);
+		if (woke.length) parts.push(`${list(woke.map(name))} woke on the current build's code, found in its \`_app/ogygia.json\`: the page's HTML and ${woke.length === 1 ? "that island" : "those islands"} now come from different builds`);
+		if (dead.length) parts.push(`${list(dead.map(name))} stayed asleep: the current build's file failed too, or \`_app/ogygia.json\` did not name ${dead.length === 1 ? "it" : "them"}`);
 		findings.push({
 			code: "island-file-gone",
 			severity: dead.length ? "error" : "warn",

package/dist/internal.d.ts

@@ -1,6 +1,7 @@
 import { og_entry_hydrate, og_entry_unmount } from "./entry-hydrate.js";
-import { documentIsCsrTrue, isNested, setNested } from "./context.js";
+import { documentIsCsrTrue } from "./context.js";
 import { __register_transportable } from "./live-transport.js";
+import { isNested, setNested } from "./nested.js";
 import { __og_$, __register_fn } from "./fn-transport.js";
 import { __og_store, __register_store_factory, mark_store } from "./store-transport.js";
 import { __og_boundary, configure_boundary } from "./boundary.js";

package/dist/internal.js

@@ -1,9 +1,10 @@
 import { og_entry_hydrate, og_entry_unmount } from "./entry-hydrate.js";
-import { documentIsCsrTrue, isNested, setNested } from "./context.js";
+import { documentIsCsrTrue } from "./context.js";
 import { __register_transportable } from "./live-transport.js";
 import { __og_$, __register_fn } from "./fn-transport.js";
 import { __og_store, __register_store_factory, mark_store } from "./store-transport.js";
 import { __og_boundary, configure_boundary } from "./boundary.js";
+import { isNested, setNested } from "./nested.js";
 import { __og_source } from "./source.js";
 import { __tag_context } from "./context-bridge.js";
 import { og_portable } from "./region-snippet.js";

package/dist/nested.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Mark the current subtree's hydration state. `true` = inside a hydrated island (nested islands
+ * degrade). `false` = a LAKE resets its subtree to "dead", so an island inside the lake self-
+ * hydrates again (the nearest-boundary rule — DESIGN.md).
+ */
+export declare function setNested(value?: boolean): void;
+/**
+ * True when an ancestor island wrapper already marked the subtree. `getContext` returns `undefined`
+ * when no ancestor set it (a top-level island) — that absence is exactly "not nested".
+ */
+export declare function isNested(): boolean;

package/dist/nested.js

@@ -0,0 +1,19 @@
+import { getContext, setContext } from "svelte";
+// src/nested.ts
+const NESTED_KEY = Symbol.for("ogygia.nested-island");
+/**
+* Mark the current subtree's hydration state. `true` = inside a hydrated island (nested islands
+* degrade). `false` = a LAKE resets its subtree to "dead", so an island inside the lake self-
+* hydrates again (the nearest-boundary rule — DESIGN.md).
+*/
+function setNested(value = true) {
+	setContext(NESTED_KEY, value);
+}
+/**
+* True when an ancestor island wrapper already marked the subtree. `getContext` returns `undefined`
+* when no ancestor set it (a top-level island) — that absence is exactly "not nested".
+*/
+function isNested() {
+	return getContext(NESTED_KEY) === true;
+}
+export { isNested, setNested };

package/dist/ref-sink.d.ts

@@ -0,0 +1,15 @@
+/**
+ * RESOLVE SINK (reconciler R3) — a hook the runtime installs during an island's hydration to learn
+ * which page-scoped ids that island resolves, WITHOUT the hub knowing anything about the DOM.
+ * `resolve()` (ref.ts) calls the current sink with each id it freshly remembers in the page scope;
+ * the runtime's sink attributes it to the island currently hydrating (region → id-set), so a
+ * reconcile nav can dispose exactly the ids owned by REMOVED regions. Null when no island is
+ * hydrating.
+ *
+ * A leaf of its own (ref.ts re-exports the setter): the hydrate core installs the sink around every
+ * island, wired values or not, and shares modules with Kit's client graph, which uses the rest of
+ * the hub. A shared module ships whole, so reaching the sink through ref.ts sent every island page
+ * the hub's registry and minting.
+ */
+export declare let resolve_sink: ((id: string) => void) | null;
+export declare function set_resolve_sink(fn: ((id: string) => void) | null): void;

package/dist/ref-sink.js

@@ -0,0 +1,19 @@
+// src/ref-sink.ts
+/**
+* RESOLVE SINK (reconciler R3) — a hook the runtime installs during an island's hydration to learn
+* which page-scoped ids that island resolves, WITHOUT the hub knowing anything about the DOM.
+* `resolve()` (ref.ts) calls the current sink with each id it freshly remembers in the page scope;
+* the runtime's sink attributes it to the island currently hydrating (region → id-set), so a
+* reconcile nav can dispose exactly the ids owned by REMOVED regions. Null when no island is
+* hydrating.
+*
+* A leaf of its own (ref.ts re-exports the setter): the hydrate core installs the sink around every
+* island, wired values or not, and shares modules with Kit's client graph, which uses the rest of
+* the hub. A shared module ships whole, so reaching the sink through ref.ts sent every island page
+* the hub's registry and minting.
+*/
+let resolve_sink = null;
+function set_resolve_sink(fn) {
+	resolve_sink = fn;
+}
+export { resolve_sink, set_resolve_sink };

package/dist/ref.d.ts

@@ -1,3 +1,4 @@
+import { set_resolve_sink } from "./ref-sink.js";
 import { batch, notify, watch, watcher_count } from "./ref-watch.js";
 /**
  * THE HUB — ogygia's identity layer. One primitive carries everything that crosses an
@@ -78,7 +79,6 @@ export declare function register_kind(kind: RefKind): void;
  * silently mis-read as one). Same instance → same id, always.
  */
 export declare function mint(value: unknown, only?: ReadonlySet<string>): Ref | undefined;
-export declare function set_resolve_sink(fn: ((id: string) => void) | null): void;
 /**
  * DISPOSE a whole scope (hub v2, phase D) — tear down every instance in its bucket via the
  * instance's `kind.dispose`, run any registered scope-disposers (side-effect cleanups like the
@@ -121,4 +121,4 @@ export declare const REF_WIRE_KEY = "OgygiaRef";
 export declare function ref_reducer(only?: ReadonlySet<string>): (value: unknown) => Ref | undefined;
 /** Devalue reviver for a seam. Browser passes `remember: true`; the server must pass `false`. */
 export declare function ref_reviver(remember: boolean): (ref: Ref) => unknown;
-export { batch, notify, watch, watcher_count };
+export { batch, notify, set_resolve_sink, watch, watcher_count };

package/dist/ref.js

@@ -1,5 +1,6 @@
 import { emit } from "./events/bus.js";
 import { batch, notify, watch, watcher_count, watchers } from "./ref-watch.js";
+import { resolve_sink, set_resolve_sink } from "./ref-sink.js";
 // src/ref.ts
 const DEVTOOLS = typeof __OGYGIA_DEVTOOLS__ !== "undefined" ? __OGYGIA_DEVTOOLS__ : false;
 const REGISTRY_KEY = Symbol.for("ogygia.hub");
@@ -62,17 +63,6 @@ function mint(value, only) {
 		return ref;
 	}
 }
-/**
-* RESOLVE SINK (reconciler R3) — a hook the runtime installs during an island's hydration to learn
-* which page-scoped ids that island resolves, WITHOUT the hub knowing anything about the DOM.
-* `resolve()` calls the current sink with each id it freshly remembers in the page scope; the
-* runtime's sink attributes it to the island currently hydrating (region → id-set), so a reconcile
-* nav can dispose exactly the ids owned by REMOVED regions. Null when no island is hydrating.
-*/
-let resolve_sink = null;
-function set_resolve_sink(fn) {
-	resolve_sink = fn;
-}
 /** The live bucket for a scope (never 'request' — that scope is never stored). */
 function bucket(reg, scope) {
 	let b = reg.instances.get(scope);

package/dist/runtime/beacon.js

@@ -108,7 +108,7 @@ function tag_attrs(tag) {
 	}
 	return out;
 }
-/** The tag's name, lowercase (`<qds-button …>` → `qds-button`). */
+/** The tag's name, lowercase (`<ds-button …>` → `ds-button`). */
 function tag_name(tag) {
 	let i = 1;
 	while (i < tag.length && tag[i] !== " " && tag[i] !== ">" && tag[i] !== "/" && tag[i] !== "\n") i++;

package/dist/runtime/boot-link.js

@@ -9,7 +9,7 @@ import { runtime_session } from "./session.js";
 import { regions_in_shadow } from "./connected.js";
 import { yield_task } from "./schedule.js";
 import { beacon_nav } from "./beacon.js";
-import { is_self_owned, walk_enters } from "./ownership.js";
+import { is_self_owned, record_server_body, server_body_attributes, server_body_child, walk_enters } from "./ownership.js";
 import { load_slot } from "./load-scheduler.js";
 // src/runtime/boot-link.ts
 /**
@@ -38,6 +38,9 @@ function link_boot() {
 		beacon_nav: BEACON ? beacon_nav : no_beacon_nav,
 		walk_enters,
 		is_self_owned,
+		record_server_body,
+		server_body_attributes,
+		server_body_child,
 		load_slot
 	};
 }