@ogygia/core 0.11.5 → 0.12.1

package/dist/hooks.js

@@ -1,5 +1,5 @@
 import { REGION_BRAND } from "./region-brand.js";
-import { signing_key } from "./server/signing-key.js";
+import { configure_signing_secret, signing_key } from "./server/signing-key.js";
 import { mpaSpeculationRules } from "./compiler/link/speculation.js";
 import { set_page_route_config } from "./plugin/routes.js";
 import { kit_page_facts_tail, kit_page_ready, kit_render_context, set_kit_event_reader, set_kit_page_reader, set_render_page_port } from "./server/kit-context.js";
@@ -9,7 +9,7 @@ import { absolutize_hole_html } from "./server/hole-urls.js";
 import { is_keep_fallback } from "./keep-fallback.js";
 import { set_source_recorder } from "./source.js";
 import { kit_asset } from "./kit-paths.js";
-import { region_mac_message, sign, verify } from "./server/hmac.js";
+import { region_mac_message, secret_has_min_entropy, sign, verify } from "./server/hmac.js";
 import { expiry_refusal, note_cache_control } from "./server/shared-cache.js";
 import { app_lifetime } from "./server/region-endpoint.js";
 import { cached_render, render_cache_key } from "./server/render-cache.js";
@@ -435,6 +435,8 @@ var OgygiaHandle = class {
 		this.#transform = options.transform;
 		configure_islands_endpoint(options.endpoint);
 		this.#endpoint = islands_endpoint();
+		if (options.secret?.trim() && !import.meta.env.DEV && !secret_has_min_entropy(options.secret)) throw new Error(`[ogygia] handle({ secret }) is too short for production (need ≥16 UTF-8 bytes).`);
+		configure_signing_secret(options.secret);
 		this.#speculation_rules = enabled ? "" : mpaSpeculationRules(this.#endpoint);
 		this.render_rate = new RateLimiter({
 			max: rateLimit.max,

package/dist/insights/page-insights.js

@@ -1267,8 +1267,8 @@ function analyze_page(page, regions, failures = [], now = Infinity, cpu = null)
 		const woke = gone.filter((f) => f.recovered);
 		const dead = gone.filter((f) => !f.recovered);
 		const parts = [];
-		if (woke.length) parts.push(`${list(woke.map(name))} woke on the current build's code through ${woke.length === 1 ? "its" : "their"} stable name${woke.length === 1 ? "" : "s"}: the page's HTML and ${woke.length === 1 ? "that island" : "those islands"} now come from different builds`);
-		if (dead.length) parts.push(`${list(dead.map(name))} stayed asleep: ${dead.length === 1 ? "its" : "their"} stable name failed too`);
+		if (woke.length) parts.push(`${list(woke.map(name))} woke on the current build's code, found in its \`_app/ogygia.json\`: the page's HTML and ${woke.length === 1 ? "that island" : "those islands"} now come from different builds`);
+		if (dead.length) parts.push(`${list(dead.map(name))} stayed asleep: the current build's file failed too, or \`_app/ogygia.json\` did not name ${dead.length === 1 ? "it" : "them"}`);
 		findings.push({
 			code: "island-file-gone",
 			severity: dead.length ? "error" : "warn",

package/dist/runtime/beacon.js

@@ -108,7 +108,7 @@ function tag_attrs(tag) {
 	}
 	return out;
 }
-/** The tag's name, lowercase (`<qds-button …>` → `qds-button`). */
+/** The tag's name, lowercase (`<ds-button …>` → `ds-button`). */
 function tag_name(tag) {
 	let i = 1;
 	while (i < tag.length && tag[i] !== " " && tag[i] !== ">" && tag[i] !== "/" && tag[i] !== "\n") i++;

package/dist/runtime/boot-link.js

@@ -9,7 +9,7 @@ import { runtime_session } from "./session.js";
 import { regions_in_shadow } from "./connected.js";
 import { yield_task } from "./schedule.js";
 import { beacon_nav } from "./beacon.js";
-import { is_self_owned, walk_enters } from "./ownership.js";
+import { is_self_owned, record_server_body, server_body_attributes, server_body_child, walk_enters } from "./ownership.js";
 import { load_slot } from "./load-scheduler.js";
 // src/runtime/boot-link.ts
 /**
@@ -38,6 +38,9 @@ function link_boot() {
 		beacon_nav: BEACON ? beacon_nav : no_beacon_nav,
 		walk_enters,
 		is_self_owned,
+		record_server_body,
+		server_body_attributes,
+		server_body_child,
 		load_slot
 	};
 }

package/dist/runtime/core.js

@@ -4,7 +4,7 @@ import { init_shadow_registries, parse_region_html, restore_adopt_sheets, restor
 import { mark_region_changed, region_changed, unwatch_region, watch_region } from "./drift-watch.js";
 import { runtime_session } from "./session.js";
 import { RegionAnswerRefused, capability_expired, deny_of, is_allowed_region_endpoint, is_document_answer, is_redirected_answer, is_same_origin_response, island_module_url, renewal_url } from "./region-endpoint-url.js";
-import { import_entry, island_entry_of, on_entry_fallback, pin_region_urls } from "./entry-locations.js";
+import { import_entry, island_entry_of, on_entry_fallback, pin_build_map, pin_region_urls } from "./entry-locations.js";
 import { is_awake, is_deferred, is_frozen, ours_on_kit_document, phase2_hydrate_schedule, region_hydrate_schedule, region_schedule } from "./region-attrs.js";
 import { slots } from "./slots.js";
 import { KEEP_FALLBACK_HTML } from "../keep-fallback-marker.js";
@@ -94,7 +94,7 @@ const ON_DEMAND_EVENTS = [
 const ON_DEMAND_SELECTOR = "ogygia-region[render=\"defer\"][when=\"interaction\"]";
 /**
 * ON-DEMAND holes, delegated: ONE set of capture listeners on the document for every armed hole
-* (five listeners per hole used to be five hundred on a page of mega-menus). Intent lands anywhere
+* (five listeners per hole used to be five hundred on a page of nav-menus). Intent lands anywhere
 * inside a hole; the nearest ARMED hole above the target fires once and is forgotten.
 */
 const on_demand_armed = /* @__PURE__ */ new Map();
@@ -1128,6 +1128,7 @@ function boot(installers = [], client_plugins = []) {
 	runtime_session.adopt_document_head();
 	link_boot();
 	for (const install of installers) install();
+	pin_build_map();
 	on_entry_fallback((report) => {
 		if (DEVTOOLS) emit({
 			domain: "runtime",

package/dist/runtime/entry-locations.d.ts

@@ -11,6 +11,13 @@ export declare function on_entry_fallback(reporter: (report: EntryFallbackReport
 export declare function note_entry_location(entry: string | null | undefined, src: string | null | undefined, base?: string): void;
 /** The known location of an entry, or undefined. */
 export declare function entry_location(entry: string, base?: string): string | undefined;
+/**
+ * Pin the build map's address to the page that wrote it, as `pin_region_urls` pins a region's: with
+ * Kit's default `paths.relative` it is written relative to that page, and it is read lazily — after a
+ * client navigation to another depth, resolved against the new address, it named a file that is not
+ * there. The runtime calls this at boot, before any navigation.
+ */
+export declare function pin_build_map(): void;
 /**
  * PIN A REGION'S URLS TO THE PAGE THAT WROTE THEM. With Kit's default `paths.relative`, the server
  * writes `entry` / `src` / `endpoint` relative to the page it rendered (`../../_app/immutable/…`,
@@ -26,8 +33,8 @@ export declare function pin_region_urls(el: Element, base?: string): void;
 /** An island element's identity, its location noted on the way (the one read every loader uses). */
 export declare function island_entry_of(el: Element): string | null;
 /**
- * Import an entry: its location when known, else `url` (what the caller resolved for the identity);
- * the location failing, once, the identity fetched fresh — so an island on a page that outlived its
- * build still wakes, on the current code. No location known → the error stands.
+ * Import an entry: its location when known (else this build's map names it, once read); failing that,
+ * or with none anywhere, the CURRENT build's location — so an island on a page that outlived its build
+ * still wakes, on the current code. `url`: what the caller resolved for the identity.
  */
 export declare function import_entry<T>(entry: string, url?: string): Promise<T>;

package/dist/runtime/entry-locations.js

@@ -6,9 +6,9 @@
 * fingerprint, the devtools' names). The file to import is its LOCATION — content-hashed, so an
 * `immutable` cache never serves a stale one. The server writes it beside the identity: the region
 * element's `src`, and the island graph's `s` map for an entry no element carries (a portable
-* snippet's). Every loader resolves through `island_module_url` (region-endpoint-url.ts), which asks
-* here first: the location once one is known, else the identity (the dev server, or a page from
-* before hashing — whose stable name is a shim that reaches the current build).
+* snippet's), and the build's location maps for the rest (`import_entry`). Every loader resolves
+* through `island_module_url` (region-endpoint-url.ts), which asks here first: the location once one
+* is known, else the identity (on the dev server, the module itself; in a build, a name, no file).
 */
 /** absolute identity → absolute location */
 const locations = /* @__PURE__ */ new Map();
@@ -43,6 +43,48 @@ function note_entry_location(entry, src, base) {
 function entry_location(entry, base) {
 	return locations.size ? locations.get(absolute(entry, base)) : void 0;
 }
+/**
+* THIS BUILD'S LOCATION MAP (compiler/link/location-map.ts, the content-hashed one): every island entry's
+* location by identity, for a load that arrives with an identity alone — a region the browser
+* rendered, a held region from the wire, a snippet whose host carried no graph. The runtime's script
+* names it (`data-og-locations`); it is read once, on the first such load. Content-hashed, so no
+* cache serves it stale. It only fills gaps: a location a page wrote (a later build's, after a
+* navigation) always wins over the map of the build the runtime came from. No map, or it failed
+* (the dev server, a page that outlived its build): the identity is loaded, as before. A failed read
+* is not kept: the next identity-only load asks again (a blip must not cost the page every later one).
+*/
+const BUILD_MAP_ATTR = "data-og-locations";
+let build_map = null;
+/**
+* Pin the build map's address to the page that wrote it, as `pin_region_urls` pins a region's: with
+* Kit's default `paths.relative` it is written relative to that page, and it is read lazily — after a
+* client navigation to another depth, resolved against the new address, it named a file that is not
+* there. The runtime calls this at boot, before any navigation.
+*/
+function pin_build_map() {
+	if (typeof document === "undefined") return;
+	const script = document.querySelector(`script[${BUILD_MAP_ATTR}]`);
+	const href = script?.getAttribute(BUILD_MAP_ATTR);
+	if (script && href) script.setAttribute(BUILD_MAP_ATTR, absolute(href));
+}
+function read_build_map() {
+	if (build_map) return build_map;
+	if (typeof document === "undefined") return null;
+	const href = document.querySelector(`script[${BUILD_MAP_ATTR}]`)?.getAttribute(BUILD_MAP_ATTR);
+	if (!href) return null;
+	const url = absolute(href);
+	const read = fetch(url).then((res) => res.ok ? res.json() : null).catch(() => null).then((map) => {
+		if (!map) {
+			if (build_map === read) build_map = null;
+			return;
+		}
+		for (const stable in map) {
+			const identity = absolute(stable, url);
+			if (!locations.has(identity)) locations.set(identity, absolute(map[stable], url));
+		}
+	});
+	return build_map = read;
+}
 /** The region attributes that hold a URL: its identity, its location, its hole's endpoint. */
 const REGION_URL_ATTRS = [
 	"entry",
@@ -80,32 +122,101 @@ function island_entry_of(el) {
 	return entry;
 }
 /**
-* The identity itself, past every cache: what a load falls back to when its location failed (a page
-* a cache kept outlived the build that made it, and that build's files are gone). The stable name
-* is a shim of the CURRENT build's file; the query makes the browser fetch it fresh rather than the
-* copy an `immutable` cache may hold. Null when no location was known (nothing to fall back to).
+* THE CURRENT BUILD'S MAP (compiler/link/location-map.ts): the one file at a fixed name, in the app
+* dir of the identities it maps (`<appDir>/ogygia.json`), so any app's is found from an identity alone.
+* A page that outlived its build reads it when its own files are gone (or it never named a map) and
+* wakes on the current code. Revalidated (a host serves it as any changing file; `no-cache` past one
+* that kept it anyway), read once per document per app. Only an ogygia identity has one: the dev
+* server's module URLs never ask.
 */
-function fresh_identity_url(entry, base) {
-	if (!entry_location(entry, base)) return null;
-	const identity = absolute(entry, base);
-	return identity + (identity.includes("?") ? "&" : "?") + "og-fresh=" + Date.now().toString(36);
+const current_maps = /* @__PURE__ */ new Map();
+/** A build's island identity (`…/<appDir>/ogygia/og-region.<id>.js`): a name, no file. */
+function is_build_identity(entry) {
+	return absolute(entry).includes("/ogygia/og-region.");
 }
+/** The current map's file for an identity (`<appDir>/ogygia.json`), or null: not a build's identity. */
+function current_map_file(identity) {
+	const dir = identity.lastIndexOf("/ogygia/og-region.");
+	return dir === -1 ? null : identity.slice(0, dir) + "/ogygia.json";
+}
+/** The current build's location for `entry`: null when its map has none, undefined when the map
+*  could not be read (that read is not kept: the next ask reads again). */
+async function current_location(entry) {
+	const identity = absolute(entry);
+	const file = current_map_file(identity);
+	if (!file) return null;
+	let map = current_maps.get(file);
+	if (!map) {
+		map = fetch(file, { cache: "no-cache" }).then((res) => res.ok ? res.json() : null).catch(() => null);
+		current_maps.set(file, map);
+	}
+	const pairs = await map;
+	if (!pairs) {
+		forget_current_map(file, map);
+		return;
+	}
+	for (const name in pairs) if (absolute(name, file) === identity) return absolute(pairs[name], file);
+	return null;
+}
+function forget_current_map(file, map = current_maps.get(file)) {
+	if (current_maps.get(file) === map) current_maps.delete(file);
+}
+/** The host says this file is not there (it does not say so of a file that failed another way). */
+function is_gone(url) {
+	return fetch(url, {
+		method: "HEAD",
+		cache: "no-store"
+	}).then((res) => res.status === 404 || res.status === 410, () => false);
+}
+/** How long a recovery waits before each ask of the current map: a rollover settles in seconds. */
+const RECOVERY_WAITS = [
+	0,
+	1e3,
+	3e3,
+	9e3
+];
 /**
-* Import an entry: its location when known, else `url` (what the caller resolved for the identity);
-* the location failing, once, the identity fetched fresh — so an island on a page that outlived its
-* build still wakes, on the current code. No location known → the error stands.
+* The current build's file for a build's identity whose file just failed to load. A deploy's rollover
+* is exactly when this is asked, so an answer that cannot be the current one is asked again while it
+* settles: a map that could not be read (a 404, a 5xx), and a map that names the very file that just
+* failed when the host says that file is gone — an edge still answering with the old build's map. A
+* file that failed some other way (the network, a broken module) is not asked about again.
+*/
+async function recover_location(entry, failed) {
+	let current;
+	for (const wait of RECOVERY_WAITS) {
+		if (wait) await new Promise((resolve) => setTimeout(resolve, wait));
+		current = await current_location(entry);
+		if (current === void 0) continue;
+		if (current !== failed || !await is_gone(failed)) break;
+		forget_current_map(current_map_file(absolute(entry)));
+	}
+	return current ?? null;
+}
+/**
+* Import an entry: its location when known (else this build's map names it, once read); failing that,
+* or with none anywhere, the CURRENT build's location — so an island on a page that outlived its build
+* still wakes, on the current code. `url`: what the caller resolved for the identity.
 */
 function import_entry(entry, url = entry_location(entry) ?? entry) {
-	const loaded = import(
+	if (entry_location(entry)) return load_entry(entry, url);
+	return (read_build_map() ?? Promise.resolve()).then(async () => {
+		const located = entry_location(entry);
+		if (located) return load_entry(entry, located);
+		return load_entry(entry, await current_location(entry) || url);
+	});
+}
+function load_entry(entry, url) {
+	return import(
 		/* @vite-ignore */
 		url
-);
-	const fresh = fresh_identity_url(entry);
-	if (!fresh) return loaded;
-	return loaded.catch(() => {
+).catch(async (error) => {
+		const failed = absolute(url);
+		const current = is_build_identity(entry) ? await recover_location(entry, failed) : absolute(entry);
+		if (!current || current === failed) throw error;
 		const retry = import(
 			/* @vite-ignore */
-			fresh
+			current
 );
 		const report = (recovered) => fallback_reporter?.({
 			entry,
@@ -116,4 +227,4 @@ function import_entry(entry, url = entry_location(entry) ?? entry) {
 		return retry;
 	});
 }
-export { entry_location, import_entry, island_entry_of, note_entry_location, on_entry_fallback, pin_region_urls };
+export { entry_location, import_entry, island_entry_of, note_entry_location, on_entry_fallback, pin_build_map, pin_region_urls };

package/dist/runtime/morph.d.ts

@@ -35,6 +35,13 @@ export declare function morph_children(parent: Element, new_nodes: ArrayLike<Nod
  */
 export interface MorphOptions {
   target?: "live" | "walk";
+  /**
+   * A child of the ROOT that is not the render's (the router's body reconcile: a node a script put
+   * in `<body>`, such as a portal's mount anchor; ownership.ts `server_body_child`). The morph steps
+   * over it: never matched, never moved, never removed. The render's children around it reconcile
+   * as usual. Root level only; below the root the ownership rules decide.
+   */
+  stays?: (node: Node) => boolean;
 }
 /** Add + update + remove attributes so `from` matches `to` exactly. Boolean attrs are attr presence.
  *  `keep_extra` (a self-owned element, {@link is_self_owned}): add + update only — an attribute the

package/dist/runtime/morph.js

@@ -95,7 +95,7 @@ function morph_children(parent, new_nodes, options) {
 		const owner = owner_of(parent);
 		if (owner !== "walk" && owner !== "region") return;
 	}
-	reconcile(parent, new_nodes, build_id_sets(parent, new_nodes), walk);
+	reconcile(parent, new_nodes, build_id_sets(parent, new_nodes), walk, options?.stays);
 	clear_aria_hidden_over_focus(parent);
 }
 /**
@@ -191,18 +191,24 @@ function reserved_for_later(sets, new_inner, cursor, idx) {
 * ({@link reconcile_by_identity}). Toward Svelte's walk, positions are always the render's (the walk
 * binds by position).
 */
-function reconcile(parent, new_nodes, sets, walk) {
+function reconcile(parent, new_nodes, sets, walk, stays) {
 	if (!walk && order_owner(parent) === "element") reconcile_by_identity(parent, new_nodes, sets);
-	else reconcile_children(parent, new_nodes, sets, walk);
+	else reconcile_children(parent, new_nodes, sets, walk, stays);
 }
 /**
 * The render's sequence, by position.
 * @param walk the {@link MorphOptions.target} is Svelte's walk (the repair), threaded unchanged down
 * the recursion — a subtree the walk never enters is skipped.
+* @param stays the root's children that are not the render's ({@link MorphOptions.stays}): the
+* cursor steps over them, so they are never matched, moved or removed. Not threaded down.
 */
-function reconcile_children(parent, new_nodes, sets, walk = false) {
+function reconcile_children(parent, new_nodes, sets, walk = false, stays) {
 	const count = new_nodes.length;
-	let cursor = parent.firstChild;
+	const step = (n) => {
+		if (stays) while (n && stays(n)) n = n.nextSibling;
+		return n;
+	};
+	let cursor = step(parent.firstChild);
 	let idx = 0;
 	while (idx < count && cursor) {
 		const next = new_nodes[idx];
@@ -213,11 +219,11 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 			if (!same_node(cursor, next)) break;
 			if (sets !== null && !id_sets_agree(sets, cursor, next)) break;
 			const here = cursor;
-			cursor = cursor.nextSibling;
+			cursor = step(cursor.nextSibling);
 			morph_same(here, next, sets, walk);
 		} else {
 			const here = cursor;
-			cursor = cursor.nextSibling;
+			cursor = step(cursor.nextSibling);
 			morph_node(here, next, sets, walk);
 		}
 		idx++;
@@ -225,7 +231,7 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 	if (idx >= count) {
 		while (cursor) {
 			const gone = cursor;
-			cursor = cursor.nextSibling;
+			cursor = step(cursor.nextSibling);
 			parent.removeChild(gone);
 		}
 		return;
@@ -236,7 +242,7 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 	}
 	let old_keys = null;
 	let old_inner = null;
-	for (let n = cursor; n; n = n.nextSibling) {
+	for (let n = cursor; n; n = step(n.nextSibling)) {
 		const k = key_of(n);
 		if (k !== null) (old_keys ??= /* @__PURE__ */ new Map()).set(k, n);
 		else if (sets !== null && n.nodeType === ELEMENT) {
@@ -260,7 +266,7 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 		const next = new_nodes[idx];
 		if (cursor && key_of(next) === null && same_node(cursor, next)) {
 			const here = cursor;
-			cursor = cursor.nextSibling;
+			cursor = step(cursor.nextSibling);
 			morph_same(here, next, sets, walk);
 		} else parent.insertBefore(clone(next), cursor);
 	}
@@ -271,7 +277,7 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 			const matched = old_keys?.get(next_key);
 			if (matched !== void 0) {
 				old_keys.delete(next_key);
-				if (matched === cursor) cursor = cursor.nextSibling;
+				if (matched === cursor) cursor = step(cursor.nextSibling);
 				else parent.insertBefore(matched, cursor);
 				morph_node(matched, next, sets, walk);
 				continue;
@@ -281,7 +287,7 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 			const holder = wanted === void 0 ? null : find_holder(old_inner, wanted, next);
 			if (holder !== null) {
 				release_holder(old_inner, sets, holder);
-				if (holder === cursor) cursor = cursor.nextSibling;
+				if (holder === cursor) cursor = step(cursor.nextSibling);
 				else parent.insertBefore(holder, cursor);
 				morph_same(holder, next, sets, walk);
 				continue;
@@ -291,11 +297,11 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 		while (cursor) {
 			cur_key = key_of(cursor);
 			if (cur_key === null || old_keys === null || !old_keys.has(cur_key)) break;
-			cursor = cursor.nextSibling;
+			cursor = step(cursor.nextSibling);
 		}
 		if (cursor && next_key === null && cur_key === null && same_node(cursor, next) && (old_inner === null || !reserved_for_later(sets, new_inner, cursor, idx))) {
 			const here = cursor;
-			cursor = cursor.nextSibling;
+			cursor = step(cursor.nextSibling);
 			if (old_inner !== null) release_holder(old_inner, sets, here);
 			morph_same(here, next, sets, walk);
 			continue;
@@ -304,7 +310,7 @@ function reconcile_children(parent, new_nodes, sets, walk = false) {
 	}
 	while (cursor) {
 		const gone = cursor;
-		cursor = cursor.nextSibling;
+		cursor = step(cursor.nextSibling);
 		parent.removeChild(gone);
 	}
 	if (old_keys) {

package/dist/runtime/ownership.d.ts

@@ -98,4 +98,13 @@ export declare function mark_render_made(node: Node): void;
  * produces at this level (`render_tags`) is render output — a runtime does not make the render's
  * elements. Anything else is the element's own: never matched, never removed.
  */
-export declare function render_made(node: Node, render_tags: ReadonlySet<string>): boolean;
+export declare function render_made(node: Node, render_tags: ReadonlySet<string>): boolean;
+/** Record what the server sent `root` (`<body>`): the attribute names on `sent` (the root as the
+ *  server rendered it), and `children` (the live root's nodes that are the server's) as render output. */
+export declare function record_server_body(root: Element, sent: Element, children: Iterable<Node>): void;
+/** The attribute names the server last sent `root`, or null for a root with no record yet (all of
+ *  it is then taken to be the server's). */
+export declare function server_body_attributes(root: Element): ReadonlySet<string> | null;
+/** Is `node`, a child of `<body>`, the server's? Recorded, or an `<ogygia-region>`. Anything else
+ *  the page's scripts put there: a navigation neither matches nor removes it. */
+export declare function server_body_child(node: Node): boolean;

package/dist/runtime/ownership.js

@@ -112,4 +112,22 @@ function render_made(node, render_tags) {
 	const name = node.localName;
 	return name === REGION || render_tags.has(name);
 }
-export { BAKED_ATTR, HTML_PARENT_ATTR, OPAQUE_ATTR, REGION_RENDER_ATTRS, attributes_writer, is_declared_foreign, is_region_owned, is_self_owned, is_upgraded_ce, mark_render_made, order_owner, owner_of, render_made, slots_light_dom, walk_enters };
+const NO_TAGS = /* @__PURE__ */ new Set();
+const server_attrs = /* @__PURE__ */ new WeakMap();
+/** Record what the server sent `root` (`<body>`): the attribute names on `sent` (the root as the
+*  server rendered it), and `children` (the live root's nodes that are the server's) as render output. */
+function record_server_body(root, sent, children) {
+	server_attrs.set(root, new Set(Array.from(sent.attributes, (a) => a.name)));
+	for (const n of children) mark_render_made(n);
+}
+/** The attribute names the server last sent `root`, or null for a root with no record yet (all of
+*  it is then taken to be the server's). */
+function server_body_attributes(root) {
+	return server_attrs.get(root) ?? null;
+}
+/** Is `node`, a child of `<body>`, the server's? Recorded, or an `<ogygia-region>`. Anything else
+*  the page's scripts put there: a navigation neither matches nor removes it. */
+function server_body_child(node) {
+	return render_made(node, NO_TAGS);
+}
+export { BAKED_ATTR, HTML_PARENT_ATTR, OPAQUE_ATTR, REGION_RENDER_ATTRS, attributes_writer, is_declared_foreign, is_region_owned, is_self_owned, is_upgraded_ce, mark_render_made, order_owner, owner_of, record_server_body, render_made, server_body_attributes, server_body_child, slots_light_dom, walk_enters };

package/dist/runtime/reconcile.d.ts

@@ -27,7 +27,9 @@ export declare function stamp_region_keys(root: ParentNode): void;
  * here, on either document.
  */
 export declare const NO_RECONCILE_SELECTOR = "[data-og-no-reconcile]";
-export declare function reconcile_body(live: Element, next: Element, morph: (parent: Element, nodes: ArrayLike<Node>) => void): void;
+export declare function reconcile_body(live: Element, next: Element, morph: (parent: Element, nodes: ArrayLike<Node>, options?: {
+  stays?: (node: Node) => boolean;
+}) => void): void;
 /**
  * outerSync body swap — the FALLBACK path (reconcile off, or a region trapped in a shadow root the
  * morph can't pierce). The old code did `document.body.replaceWith(doc.body)`, which THROWS AWAY the
@@ -35,7 +37,8 @@ export declare function reconcile_body(live: Element, next: Element, morph: (par
  * analytics, a scroll library) attached to `document.body`. htmx 4 boosts land the same way and use
  * `outerSync` for exactly this reason: keep the element, sync its attributes, replace its children.
  * So we do too — the live body node survives, only its guts change. Incoming children are moved out
- * of the parsed document (insertion adopts them across documents).
+ * of the parsed document (insertion adopts them across documents). The page's own children (a
+ * portal's anchor) stay, as in the reconcile; the server's are replaced.
  */
 export declare function swap_body(live: HTMLElement, next: HTMLElement): void;
 export { endpoint_key, fingerprint_of, fnv1a, signature_of };

package/dist/runtime/reconcile.js

@@ -1,5 +1,5 @@
 import { dispose_ids } from "../ref.js";
-import { boot_link, morph_sync_attributes } from "./slots.js";
+import { boot_link, morph_sync_attributes, slots } from "./slots.js";
 import { region_owned_ids } from "./region-ids.js";
 import { emit } from "../events/bus.js";
 import { endpoint_key, fingerprint_of, fnv1a, signature_of } from "./hash.js";
@@ -27,22 +27,48 @@ import { endpoint_key, fingerprint_of, fnv1a, signature_of } from "./hash.js";
 const DEVTOOLS = typeof __OGYGIA_DEVTOOLS__ !== "undefined" ? __OGYGIA_DEVTOOLS__ : false;
 const props_sidecar_of = (region) => boot_link().props_sidecar_of(region);
 /**
-* `<body>`'s attributes have two owners (runtime/ownership.ts): the server, page by page (a theme
-* class, a layout flag), and the scripts living on the page (a scroll lock, a consent banner's state,
-* an analytics marker). A navigation moves the server's attributes to the new page's — and removes
-* only those the PREVIOUS page's server sent that the new one doesn't. An attribute a script set is
-* not the server's to take away (before this, every navigation stripped them all). The server's set
-* starts as the body's attributes when this module loads, which the runtime does before the page's
-* own scripts (head-presence.ts puts it first).
+* `<body>` has two owners (runtime/ownership.ts): the server, page by page (a theme class, a layout
+* flag, the content), and the scripts living on the page (a scroll lock, a consent banner's state; a
+* component mounted into the body, such as a popover's portal). A navigation moves the server's part
+* to the new page's and leaves the page's part alone:
+*  - ATTRIBUTES: it removes only those the PREVIOUS page's server sent that the new one doesn't;
+*  - CHILDREN: the morph steps over a child the server never sent (a portal's mount anchor: taking
+*    it away leaves the portal inserting its content beside a detached node, so a popover in a kept
+*    island never opens again).
+* ONE record per reconciled root (ownership.ts `record_server_body`), reached through the boot
+* registry like every boot helper this lazy chunk uses: the router takes the body's when it starts,
+* before any island wakes; each reconcile renews its root's (a harness driving it on its own root
+* gets one from its first call). A root with no record yet is all the server's: every child is
+* matched, and no attribute is taken away.
 */
-const attr_names = (el) => new Set(Array.from(el.attributes, (a) => a.name));
-let server_body_attrs = typeof document !== "undefined" && document.body ? attr_names(document.body) : null;
+/** The record of what the server last sent `live`, or null while there is none. */
+function body_record(live) {
+	const link = slots.boot;
+	return link && link.server_body_attributes(live) !== null ? link : null;
+}
 function sync_body_attributes(live, next) {
 	morph_sync_attributes()(live, next, true);
-	if (server_body_attrs) {
-		for (const name of server_body_attrs) if (!next.hasAttribute(name)) live.removeAttribute(name);
+	const sent = body_record(live)?.server_body_attributes(live);
+	if (sent) {
+		for (const name of sent) if (!next.hasAttribute(name)) live.removeAttribute(name);
 	}
-	server_body_attrs = attr_names(next);
+}
+/** The live body's children that are the page's own, not the server's (none without a record). */
+function page_own_children(live) {
+	const own = /* @__PURE__ */ new Set();
+	const record = body_record(live);
+	if (record === null) return own;
+	for (let n = live.firstChild; n; n = n.nextSibling) if (!record.server_body_child(n)) own.add(n);
+	return own;
+}
+/** After a navigation the server's body is the new page's: its attributes, and every live child that
+*  is not the page's own. */
+function renew_server_body(live, next, own) {
+	const link = slots.boot;
+	if (!link) return;
+	const children = [];
+	for (let n = live.firstChild; n; n = n.nextSibling) if (!own.has(n)) children.push(n);
+	link.record_server_body(live, next, children);
 }
 /** The `<script data-ogygia-props>` seed text of a region — keyed at the end of the body or the
 *  adjacent sibling (runtime/sidecar.ts) — or '' — the same lookup the hydrator uses, read-only.
@@ -143,6 +169,7 @@ function dt_emit_reconcile(live, next) {
 function reconcile_body(live, next, morph) {
 	stamp_region_keys(live);
 	stamp_region_keys(next);
+	const own = page_own_children(live);
 	sync_body_attributes(live, next);
 	if (DEVTOOLS) dt_emit_reconcile(live, next);
 	const next_keys = /* @__PURE__ */ new Set();
@@ -158,7 +185,8 @@ function reconcile_body(live, next, morph) {
 		if (set !== void 0) for (const id of set) removed_ids.push(id);
 	}
 	absorb_kept_props(live, next);
-	morph(live, next.childNodes);
+	morph(live, next.childNodes, own.size > 0 ? { stays: (n) => own.has(n) } : void 0);
+	renew_server_body(live, next, own);
 	if (removed_ids.length > 0) dispose_ids(removed_ids);
 }
 /**
@@ -168,12 +196,20 @@ function reconcile_body(live, next, morph) {
 * analytics, a scroll library) attached to `document.body`. htmx 4 boosts land the same way and use
 * `outerSync` for exactly this reason: keep the element, sync its attributes, replace its children.
 * So we do too — the live body node survives, only its guts change. Incoming children are moved out
-* of the parsed document (insertion adopts them across documents).
+* of the parsed document (insertion adopts them across documents). The page's own children (a
+* portal's anchor) stay, as in the reconcile; the server's are replaced.
 */
 function swap_body(live, next) {
+	const own = page_own_children(live);
 	sync_body_attributes(live, next);
-	live.replaceChildren();
+	if (own.size === 0) live.replaceChildren();
+	else for (let n = live.firstChild; n;) {
+		const here = n;
+		n = n.nextSibling;
+		if (!own.has(here)) live.removeChild(here);
+	}
 	while (next.firstChild) live.appendChild(next.firstChild);
+	renew_server_body(live, next, own);
 }
 /** For each live region whose reconcile key also appears in `next`, push the incoming region's
 *  props into the live island (kept regions only — a re-mounting region gets its props on mount). */

package/dist/runtime/region-endpoint-url.js

@@ -143,6 +143,7 @@ function warm_key(url) {
 function warm_island_module(entry, base, cls = "speculative") {
 	const url = island_module_url(entry, base);
 	if (!url) return;
+	if (!entry_location(entry, base) && url.includes("/ogygia/og-region.")) return;
 	const key = warm_key(url);
 	if (warmed_modules.has(key)) return;
 	warmed_modules.add(key);