@ogygia/core 0.11.5 → 0.12.1

package/dist/runtime/router-nav.js

@@ -389,6 +389,18 @@ function preflight(doc, dest) {
 	stamp_region_keys(doc.body);
 	page_seed_of(doc);
 }
+/**
+* Which client build a document belongs to: its runtime script's file and its location map's
+* (server/document-tail.ts `runtime_bootstrap_tags`) — both content-hashed, so a deploy that changed
+* any island, Svelte or the runtime names another. By file name: a `src` written relative to its
+* page reads the same from any address. Null: the document names no runtime (no island on it).
+*/
+function build_of(d) {
+	const s = d.querySelector("script[data-ogygia-runtime]");
+	if (!s) return null;
+	const file = (v) => v ? v.slice(v.lastIndexOf("/") + 1) : "";
+	return file(s.getAttribute("src")) + " " + file(s.getAttribute("data-og-locations"));
+}
 async function navigate(r, url, from, { push = true, pop_scroll = null, type = "link", replace = false } = {}) {
 	if (!r.run_before(from, url, type)) {
 		if (r.nav_target === url.href) r.nav_target = null;
@@ -460,6 +472,9 @@ async function navigate(r, url, from, { push = true, pop_scroll = null, type = "
 	if (KitBoot.document_has(doc)) return hand_off();
 	const marker = doc.querySelector("meta[name=\"ogygia-router\"]");
 	if (!marker) return hand_off();
+	const next_build = build_of(doc);
+	const this_build = next_build === null ? null : build_of(document);
+	if (this_build !== null && next_build !== this_build) return hand_off();
 	if (doc.querySelector("meta[name=\"ogygia-first-load\"]")) return hand_off();
 	globalThis.__og_restore?.(doc);
 	if (dest !== url) replace_state({

package/dist/runtime/router.js

@@ -2,6 +2,7 @@ import { kit_hydrates_page } from "./kit-boot.js";
 import { slots } from "./slots.js";
 import { publish_nav } from "./nav-handle.js";
 import { nearest_attr } from "./nearest-attr.js";
+import { record_server_body } from "./ownership.js";
 // src/runtime/router.ts
 /**
 * Minimal SPA router for ogygia (Astro's ClientRouter equivalent).
@@ -300,6 +301,8 @@ var SpaRouter = class {
 		this.#started = true;
 		this.doc_key = document_key(new URL(location.href));
 		this.current_url = new URL(location.href);
+		const body = document.body;
+		if (body) record_server_body(body, body, Array.from(body.childNodes));
 		document.addEventListener("click", (event) => {
 			const anchor = anchor_of(event);
 			const url = this.#should_intercept(event, anchor);

package/dist/runtime/slots.d.ts

@@ -9,7 +9,7 @@ import { regions_in_shadow } from "./connected.js";
 import { yield_task } from "./schedule.js";
 import { beacon_nav } from "./beacon.js";
 import { load_slot } from "./load-scheduler.js";
-import { is_self_owned, walk_enters } from "./ownership.js";
+import { is_self_owned, record_server_body, server_body_attributes, server_body_child, walk_enters } from "./ownership.js";
 import { document_key, jump_to_hash, push_state, replace_state } from "./router.js";
 import { resolve_address } from "./interaction.js";
 import { sync_attributes } from "./morph.js";
@@ -53,9 +53,11 @@ export type FormOps = {
 /** Wake a cold island when interaction lands inside it; returns a disarm fn. */
 export type ArmFn = (el: HTMLElement, fire: () => void) => void | (() => void);
 /** `target: 'walk'` = the hydration repair (the server sequence Svelte's walk binds); default = a live
- *  morph toward a new answer. Same ownership rules either way (runtime/ownership.ts). */
+ *  morph toward a new answer. Same ownership rules either way (runtime/ownership.ts). `stays`: a
+ *  child of `parent` the morph steps over (the page's own, beside the render's). */
 export type MorphFn = (parent: Element, nodes: ArrayLike<Node>, options?: {
   target?: "live" | "walk";
+  stays?: (node: Node) => boolean;
 }) => void;
 export type WireOps = {
   /** THE hub key (`OgygiaRef`) — every transportable kind crosses under it. */
@@ -149,6 +151,10 @@ export type BootLink = {
   /** DOM ownership (./ownership.ts): which children Svelte's walk enters, and self-owned elements */
   walk_enters: typeof walk_enters;
   is_self_owned: typeof is_self_owned;
+  /** `<body>`'s two owners (./ownership.ts): the router's record of what the server sent it */
+  record_server_body: typeof record_server_body;
+  server_body_attributes: typeof server_body_attributes;
+  server_body_child: typeof server_body_child;
 };
 export type RouterLink = {
   document_key: typeof document_key;

package/dist/server/document-tail.d.ts

@@ -41,9 +41,10 @@ export declare function modulepreload_tag(href: string): string;
  * module's imports after downloading and parsing it; hinted here, they download ALONGSIDE the
  * runtime instead of one round trip after it. Normal priority — the runtime cannot run without
  * them. `data-ogygia-runtime-dep` keeps them attached to the script when the handle moves it
- * (head-presence.ts `runtime_first`).
+ * (head-presence.ts `runtime_first`). `locations`: the build's location map, which the runtime reads
+ * for a load that arrives with an identity alone (runtime/entry-locations.ts).
  */
-export declare function runtime_bootstrap_tags(src: string, deps: readonly string[]): string;
+export declare function runtime_bootstrap_tags(src: string, deps: readonly string[], locations?: string | null): string;
 /**
  * The island graph (island-graph.ts) as one inert JSON script: entry → the chunks its code needs.
  * The runtime turns an entry's list into modulepreload links when that island wakes. Empty map →

package/dist/server/document-tail.js

@@ -33,10 +33,11 @@ function modulepreload_tag(href) {
 * module's imports after downloading and parsing it; hinted here, they download ALONGSIDE the
 * runtime instead of one round trip after it. Normal priority — the runtime cannot run without
 * them. `data-ogygia-runtime-dep` keeps them attached to the script when the handle moves it
-* (head-presence.ts `runtime_first`).
+* (head-presence.ts `runtime_first`). `locations`: the build's location map, which the runtime reads
+* for a load that arrives with an identity alone (runtime/entry-locations.ts).
 */
-function runtime_bootstrap_tags(src, deps) {
-	let html = "<script type=\"module\" data-ogygia-runtime src=\"" + src + "\"><\/script>";
+function runtime_bootstrap_tags(src, deps, locations = null) {
+	let html = "<script type=\"module\" data-ogygia-runtime" + (locations ? " data-og-locations=\"" + locations + "\"" : "") + " src=\"" + src + "\"><\/script>";
 	for (const dep of deps) html += "<link rel=\"modulepreload\" href=\"" + dep + "\" data-ogygia-runtime-dep>";
 	return html;
 }

package/dist/server/entry-location.js

@@ -1,17 +1,19 @@
 import { runtime_bootstrap_tags } from "./document-tail.js";
 import runtime_url from "virtual:ogygia/runtime-url";
-import { entryLocation, islandDeps } from "virtual:ogygia/island-deps";
+import { entryLocation, islandDeps, locationMap } from "virtual:ogygia/island-deps";
 // src/server/entry-location.ts
 /**
 * ENTRY IDENTITY → LOCATION, on the server. A hydrate island's entry and the runtime each have an
-* IDENTITY — the stable URL the compiler bakes (`/<appDir>/immutable/og-region.<iid>.js`, the
+* IDENTITY — the stable URL the compiler bakes (`/<appDir>/ogygia/og-region.<iid>.js`, the
 * runtime's stable name) and every map keys by — and a LOCATION: the content-hashed file the build
-* emitted, the one a browser loads. A stable name served `immutable` would be kept for a year after
-* its content changed; a hashed name cannot go stale. The server bundle is built before the client
-* bundle, so the location is looked up at render time through the build handoff (`entryLocation`).
+* emitted under `immutable/`, the one a browser loads. A hashed name cannot go stale; the stable name
+* lives outside `immutable/` (compiler/region/transform.ts `STABLE_NAME_DIR`), so a host revalidates
+* it. The server bundle is built before the client bundle, so the location is looked up at render
+* time through the build handoff (`entryLocation`).
 *
-* No location (the dev server, a handoff from before hashing, an island from another app): the
-* identity itself is served — in a build, the stable-name shim that re-exports the current file.
+* In dev the identity is the location (the dev server serves the module at it). No location in a
+* build (a handoff from before hashing, an island from another app): a region writes no `src`, and the
+* browser finds the current file through the build's location maps (compiler/link/location-map.ts).
 */
 /** The file an entry is loaded from: its content-hashed location, else the identity itself. */
 function entry_src(identity) {
@@ -24,6 +26,7 @@ function entry_src(identity) {
 */
 function runtime_bootstrap(resolve = (url) => url) {
 	if (!runtime_url) return "";
-	return runtime_bootstrap_tags(resolve(entry_src(runtime_url)), islandDeps(runtime_url).map(resolve));
+	const map = locationMap();
+	return runtime_bootstrap_tags(resolve(entry_src(runtime_url)), islandDeps(runtime_url).map(resolve), map ? resolve(map) : null);
 }
 export { entry_src, runtime_bootstrap };

package/dist/server/props-wire.js

@@ -153,8 +153,8 @@ function plan_props_wire(value, entry) {
 		culprit: () => culprit === void 0 ? culprit = json_culprit(value) : culprit
 	};
 }
-const LIVE_ENTRY_MARK = "/immutable/og-region.";
-const LIVE_ENTRY_RE = /^\/[^"\s]+\/immutable\/og-region\.[0-9a-f]+\.js$/;
+const LIVE_ENTRY_MARK = "/ogygia/og-region.";
+const LIVE_ENTRY_RE = /^\/[^"\s]+\/ogygia\/og-region\.[0-9a-f]+\.js$/;
 function live_entries_in(text) {
 	const out = [];
 	let at = text.indexOf(LIVE_ENTRY_MARK);

package/dist/server/signing-key.d.ts

@@ -1,11 +1,19 @@
 export interface SigningKey {
   secret: string;
-  /** env-provided: survives redeploys and is shared by every deployment that sets the same value */
+  /** the app's or the env's: survives redeploys and is shared by every deployment that sets the same value */
   stable: boolean;
   /** 8-char key fingerprint (`&k=` on capabilities, `x-ogygia-key` on refusals) */
   fp: string;
+  /** where the secret came from: `handle({ secret })`, `OGYGIA_SECRET`, or this build's random key */
+  source: "option" | "env" | "build";
 }
 export declare function signing_key(): SigningKey;
+/**
+ * Record the app's `handle({ secret })`. A blank one counts as none (an app can pass a value that may
+ * be unset). Once a key is decided it never changes in the process: capabilities minted under the
+ * first would stop verifying, so a different secret arriving later is an error (thrown in dev).
+ */
+export declare function configure_signing_secret(secret: string | undefined): void;
 export declare function key_fingerprint(secret: string): string;
-/** Tests: forget the decided key. */
+/** Tests: forget the decided key and the app's secret. */
 export declare function reset_signing_key(): void;

package/dist/server/signing-key.js

@@ -5,7 +5,12 @@ import { building } from "$app/env";
 /**
 * THE region signing key, decided once at first use (the first mint or verify), not at module eval:
 * a host that fills `process.env` after the server's modules load (an adapter loading a `.env` late)
-* still counts. The runtime's `OGYGIA_SECRET` wins; else this build's random key.
+* still counts. The app's `handle({ secret })` wins, then the runtime's `OGYGIA_SECRET`, else this
+* build's random key.
+*
+* Process-wide on `globalThis`, not module state (like the islands endpoint, server/endpoint.ts):
+* one server can load this file as two copies (pnpm gives a package one folder per set of peer
+* versions), and a copy that never saw the handle's secret would mint with the build's key.
 *
 * A capability carries its minter's key FINGERPRINT (`&k=`): an HMAC of a constant under the key —
 * the same on every instance sharing the key, and it reveals nothing of the key. A deployment that
@@ -13,18 +18,47 @@ import { building } from "$app/env";
 * instead of an opaque 403: the page and its islands endpoint came from different deployments (a CDN
 * routing them to two backends, HTML cached across a key change).
 */
-let key;
+const SLOT = Symbol.for("ogygia.signing-key");
+const SOURCE_NAME = {
+	option: "handle({ secret })",
+	env: "OGYGIA_SECRET",
+	build: "this build's random key"
+};
+function slot() {
+	const g = globalThis;
+	return g[SLOT] ??= {};
+}
 function signing_key() {
-	if (key) return key;
+	const s = slot();
+	if (s.key) return s.key;
 	const from_env = typeof process !== "undefined" && process.env?.OGYGIA_SECRET || "";
-	const secret = from_env || buildKey;
-	key = {
+	const [secret, source] = s.option ? [s.option, "option"] : from_env ? [from_env, "env"] : [buildKey, "build"];
+	s.key = {
 		secret,
-		stable: from_env !== "",
-		fp: key_fingerprint(secret)
+		stable: source !== "build",
+		fp: key_fingerprint(secret),
+		source
 	};
-	if (!key.stable && !import.meta.env.DEV) warn_build_key();
-	return key;
+	if (!s.key.stable && !import.meta.env.DEV) warn_build_key();
+	return s.key;
+}
+/**
+* Record the app's `handle({ secret })`. A blank one counts as none (an app can pass a value that may
+* be unset). Once a key is decided it never changes in the process: capabilities minted under the
+* first would stop verifying, so a different secret arriving later is an error (thrown in dev).
+*/
+function configure_signing_secret(secret) {
+	if (!secret?.trim()) return;
+	const s = slot();
+	const decided = s.key?.secret ?? s.option;
+	if (decided === void 0 || decided === secret) {
+		s.option = secret;
+		return;
+	}
+	const from = s.key ? `${SOURCE_NAME[s.key.source]}, decided by an earlier mint or verify` : "another handle({ secret })";
+	const message = `[ogygia] handle({ secret }) names key ${key_fingerprint(secret)}, but this server already signs with key ${key_fingerprint(decided)} (from ${from}). The first key stays: pass one secret, before anything renders.`;
+	if (import.meta.env.DEV) throw new Error(message);
+	console.error(message);
 }
 function key_fingerprint(secret) {
 	return sign(secret, "ogygia:key-fp").slice(0, 8);
@@ -36,12 +70,12 @@ function warn_build_key() {
 	const K = Symbol.for("ogygia.build-key-warned");
 	if (g[K]) return;
 	g[K] = true;
-	if (building) console.warn("[ogygia] prerendered page mints region capabilities signed with a per-build random key — they stop verifying after your next deploy while the static HTML lives on. Set a stable OGYGIA_SECRET env var so prerendered holes survive redeploys.");
-	else if (buildHadSecret) console.error("[ogygia] OGYGIA_SECRET was set when this app was built but is not set where it runs: region capabilities are signed with this build's random key, so every hole minted by another deployment (another backend behind the same CDN, the previous deploy) is refused (403, x-ogygia-deny: foreign-key). Set OGYGIA_SECRET in the server's runtime environment.");
-	else console.warn("[ogygia] OGYGIA_SECRET is not set: region capabilities are signed with this build's random key, so a page cached across a deploy, or served by another deployment than its islands endpoint, gets its holes refused (403, x-ogygia-deny: foreign-key). Set a stable OGYGIA_SECRET.");
+	if (building) console.warn("[ogygia] prerendered page mints region capabilities signed with a per-build random key — they stop verifying after your next deploy while the static HTML lives on. Set a stable OGYGIA_SECRET env var (or pass it to handle({ secret })) so prerendered holes survive redeploys.");
+	else if (buildHadSecret) console.error("[ogygia] OGYGIA_SECRET was set when this app was built but is not set where it runs: region capabilities are signed with this build's random key, so every hole minted by another deployment (another backend behind the same CDN, the previous deploy) is refused (403, x-ogygia-deny: foreign-key). Set OGYGIA_SECRET in the server's runtime environment, or pass it to handle({ secret }) (e.g. from $env/static/private).");
+	else console.warn("[ogygia] OGYGIA_SECRET is not set: region capabilities are signed with this build's random key, so a page cached across a deploy, or served by another deployment than its islands endpoint, gets its holes refused (403, x-ogygia-deny: foreign-key). Set a stable OGYGIA_SECRET, or pass one to handle({ secret }).");
 }
-/** Tests: forget the decided key. */
+/** Tests: forget the decided key and the app's secret. */
 function reset_signing_key() {
-	key = void 0;
+	delete globalThis[SLOT];
 }
-export { key_fingerprint, reset_signing_key, signing_key };
+export { configure_signing_secret, key_fingerprint, reset_signing_key, signing_key };

package/dist/vite/index.js

@@ -701,10 +701,10 @@ function ogygia(options = {}) {
 			},
 			generateBundle() {
 				if (!is_build || server_leg_of(this)) return;
-				for (const shim of compiler.entry_shims((ref) => this.getFileName(ref))) this.emitFile({
+				for (const file of compiler.location_maps((ref) => this.getFileName(ref))) this.emitFile({
 					type: "asset",
-					fileName: shim.fileName,
-					source: shim.source
+					fileName: file.fileName,
+					source: file.source
 				});
 			},
 			closeBundle: {
@@ -805,7 +805,8 @@ function ogygia(options = {}) {
 					content_css,
 					css_inline,
 					fn_manifest: Object.fromEntries(compiler.dollar_hoists),
-					entries: entries.locations
+					entries: entries.locations,
+					locations: compiler.location_map_url
 				});
 				emit_island_deps_handoff(root, json, kit_dirs(root).out_dir);
 			}

package/dist/vite/kit-dirs.js

@@ -8,7 +8,7 @@ import { pathToFileURL } from "node:url";
 * `src/routes`) and `outDir` (default `.svelte-kit`). ogygia scans the routes tree (csr worlds, the
 * client-build keepalive, route options) and writes/reads its island-deps handoff under Kit's output
 * dir — every one of those must follow the app's configuration, not the defaults (an app building
-* two route trees from one source, `PES_MODE=v2 → src/routes-v2` + `.svelte-kit-v2`, had its
+* two route trees from one source, `CATALOG_MODE=v2 → src/routes-v2` + `.svelte-kit-v2`, had its
 * all-csr=false tree read as "no routes": Kit skipped the client build, the runtime chunk was never
 * emitted, every island 404'd).
 *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygia/core",
-  "version": "0.11.5",
+  "version": "0.12.1",
   "description": "The core of ogygia (SSR islands for SvelteKit): apps install `ogygia`, plugins build on this",
   "homepage": "https://ogygiajs.dev",
   "bugs": {

package/dist/compiler/link/entry-shim.d.ts

@@ -1,4 +0,0 @@
-/** An island entry's shim: every export of its hashed file (a component entry has a default). */
-export declare function island_shim_source(shim_file: string, entry_file: string): string;
-/** The runtime's shim: the hashed runtime, run (it has no exports; loading it boots). */
-export declare function runtime_shim_source(shim_file: string, runtime_file: string): string;

package/dist/compiler/link/entry-shim.js

@@ -1,29 +0,0 @@
-import { path } from "../host.js";
-// src/compiler/link/entry-shim.ts
-/**
-* THE STABLE-NAME SHIMS. An island entry and the runtime are content-hashed files; each one's old
-* stable name is ALSO written, as a shim of the hashed file, so that a page cached before content
-* hashing (whose islands import their stable names), and a load whose location failed (the runtime
-* re-fetches the stable name fresh), still reach the CURRENT build.
-*
-* A shim is written as a plain ASSET at the bundle's end, once every hashed name is final — never as
-* a bundled chunk. Its name never changes, so the bundler has nothing to hash, and a chunk would make
-* the island's module the target of two entries: the bundler would split its code behind two facades
-* and every island load would cost two requests. As an asset, the island has one entry, its location
-* IS its code, and the shim is a static re-export by relative path.
-*/
-/** The specifier from the shim's file to the hashed file (both output-relative paths). */
-function relative_specifier(from_file, to_file) {
-	const rel = path.posix.relative(path.posix.dirname(from_file), to_file);
-	return rel.startsWith(".") ? rel : "./" + rel;
-}
-/** An island entry's shim: every export of its hashed file (a component entry has a default). */
-function island_shim_source(shim_file, entry_file) {
-	const spec = JSON.stringify(relative_specifier(shim_file, entry_file));
-	return `export * from ${spec};\nexport { default } from ${spec};\n`;
-}
-/** The runtime's shim: the hashed runtime, run (it has no exports; loading it boots). */
-function runtime_shim_source(shim_file, runtime_file) {
-	return `import ${JSON.stringify(relative_specifier(shim_file, runtime_file))};\n`;
-}
-export { island_shim_source, runtime_shim_source };

package/dist/compiler/macros/dedent.js

@@ -1,36 +0,0 @@
-// src/compiler/macros/dedent.ts
-const CRLF_G = /\r\n?/g;
-const LEADING_INDENT_RE = /^[\t ]*/;
-/**
-* Strip the common leading indentation from a block of source, and trim leading/trailing blank
-* lines. Source embedded in a call (`import.meta.og.code(\`…\`, …)`) is indented to match where the
-* call sits; that indentation is an artifact of the surrounding code, not part of the snippet. This
-* normalizes it so the rendered `<pre>` shows the snippet's OWN logical indentation, flush-left.
-*
-* Blank lines (whitespace-only) don't count toward the common indent; tabs and spaces are treated by
-* their literal column contribution to the prefix (the common prefix is computed on raw characters,
-* so mixed tabs/spaces still de-indent correctly as long as the leading run is consistent — which it
-* is for machine-indented source).
-*/
-function dedent(text) {
-	const lines = text.replace(CRLF_G, "\n").split("\n");
-	while (lines.length && lines[0].trim() === "") lines.shift();
-	while (lines.length && lines[lines.length - 1].trim() === "") lines.pop();
-	if (!lines.length) return "";
-	let common = null;
-	for (const line of lines) {
-		if (line.trim() === "") continue;
-		const lead = LEADING_INDENT_RE.exec(line)[0];
-		if (common === null) common = lead;
-		else {
-			let i = 0;
-			const max = Math.min(common.length, lead.length);
-			while (i < max && common[i] === lead[i]) i++;
-			common = common.slice(0, i);
-		}
-		if (common === "") break;
-	}
-	const n = common?.length ?? 0;
-	return lines.map((line) => line.trim() === "" ? "" : line.slice(n)).join("\n");
-}
-export { dedent };