@ogygia/core 0.12.2 → 0.13.0

package/dist/seed-refs.js

@@ -308,100 +308,141 @@ function path_of(at) {
 	return path;
 }
 const EMPTY_NODES = [];
-const EMPTY_INDEX = {
-	by_identity: {
-		get: () => void 0,
-		has: () => false
-	},
-	candidates: () => EMPTY_NODES,
-	hash_of: () => null,
-	size: 0,
-	touched: /* @__PURE__ */ new Set()
-};
 const index_cache = /* @__PURE__ */ new WeakMap();
 /**
-* Index the seed's `data` for referencing: every referenceable node at or above `min_bytes`, by
+* The seed's `data` indexed for referencing: every referenceable node at or above `min_bytes`, by
 * identity now and by structural hash on demand (first occurrence wins — the shortest path is not
-* guaranteed, the first in key order is, which is deterministic). Cached per `data` object: one
-* index per request, however many islands ask. It reads the one measuring walk (`analyze`) and
-* prunes: a node below `min_bytes` cannot hold a child at or above it (a child is never larger
-* than its parent), so its subtree is skipped BEFORE anything is materialised — on a CMS tree that
-* is most of the nodes.
+* guaranteed, the first in key order is, which is deterministic). It reads the one measuring walk
+* (`analyze`) and prunes: a node below `min_bytes` cannot hold a child at or above it (a child is
+* never larger than its parent), so its subtree is skipped BEFORE anything is materialised — on a
+* CMS tree that is most of the nodes. Data that is not a plain object or array indexes nothing.
 */
-function index_seed(data, min_bytes = 96) {
-	if (!is_plain(data)) return {
-		...EMPTY_INDEX,
-		touched: /* @__PURE__ */ new Set()
-	};
-	const hit = index_cache.get(data);
-	if (hit) return hit;
-	const memo = analysis(data).memo;
-	const at = /* @__PURE__ */ new WeakMap();
-	const nodes = [];
-	const seen = /* @__PURE__ */ new Set();
-	const enter = (c) => {
-		if (!is_plain(c) || seen.has(c)) return false;
-		const p = memo.get(c);
-		return p !== void 0 && bytes_of(p) >= min_bytes;
-	};
-	const visit = (v, here) => {
-		seen.add(v);
-		if (memo.get(v) & F_REF) {
-			at.set(v, here);
-			nodes.push(v);
-		}
-		if (Array.isArray(v)) for (let i = 0; i < v.length; i++) {
-			const c = v[i];
-			if (enter(c)) visit(c, {
-				parent: here,
-				key: i,
-				path: null
-			});
-		}
-		else for (const key in v) {
-			const c = v[key];
-			if (enter(c)) visit(c, {
-				parent: here,
-				key,
-				path: null
+var SeedIndex = class SeedIndex {
+	/** nodes indexed (for tests / devtools). */
+	size;
+	/**
+	* SEED SHAPING: the top-level `page.data` keys under which a props node was matched
+	* (`plan_seed_refs` records the first path segment of every reference it plans). The handle
+	* renders the tail against the FULL index, then ships every touched key — a key no island's
+	* code reads but whose node an island's props point into still ships, so a reference always
+	* has something to point at.
+	*/
+	touched = /* @__PURE__ */ new Set();
+	#memo = null;
+	#at = /* @__PURE__ */ new WeakMap();
+	#nodes = [];
+	#by_bytes = null;
+	#hash_memo = /* @__PURE__ */ new Map();
+	#by_hash = /* @__PURE__ */ new Map();
+	/** The index of `data`, cached per `data` object: one index per request, however many islands
+	*  ask. */
+	static of(data, min_bytes = 96) {
+		if (!is_plain(data)) return new SeedIndex(data, min_bytes);
+		let index = index_cache.get(data);
+		if (!index) index_cache.set(data, index = new SeedIndex(data, min_bytes));
+		return index;
+	}
+	constructor(data, min_bytes) {
+		if (is_plain(data)) {
+			const memo = this.#memo = analysis(data).memo;
+			const at = this.#at;
+			const nodes = this.#nodes;
+			const seen = /* @__PURE__ */ new Set();
+			const enter = (c) => {
+				if (!is_plain(c) || seen.has(c)) return false;
+				const p = memo.get(c);
+				return p !== void 0 && bytes_of(p) >= min_bytes;
+			};
+			const visit = (v, here) => {
+				seen.add(v);
+				if (memo.get(v) & F_REF) {
+					at.set(v, here);
+					nodes.push(v);
+				}
+				if (Array.isArray(v)) for (let i = 0; i < v.length; i++) {
+					const c = v[i];
+					if (enter(c)) visit(c, {
+						parent: here,
+						key: i,
+						path: null
+					});
+				}
+				else for (const key in v) {
+					const c = v[key];
+					if (enter(c)) visit(c, {
+						parent: here,
+						key,
+						path: null
+					});
+				}
+			};
+			if (enter(data)) visit(data, {
+				parent: null,
+				key: "",
+				path: []
 			});
 		}
-	};
-	if (enter(data)) visit(data, {
-		parent: null,
-		key: "",
-		path: []
-	});
-	let by_bytes = null;
-	const buckets = () => {
-		if (by_bytes === null) {
-			by_bytes = /* @__PURE__ */ new Map();
-			for (const n of nodes) {
-				const b = bytes_of(memo.get(n));
+		this.size = this.#nodes.length;
+	}
+	/** node → its path from `page.data` (identity matches: the app passed the seed's own object).
+	*  The path is materialised on the first ask — an indexed node that no island references
+	*  never allocates one. */
+	path(node) {
+		const here = this.#at.get(node);
+		return here === void 0 ? void 0 : path_of(here);
+	}
+	/** Whether `node` is an indexed seed node (by identity). */
+	has(node) {
+		return this.#at.has(node);
+	}
+	/**
+	* The seed nodes with exactly this byte estimate — the only ones a props node of that size can
+	* be a clone of. Structure matching hashes just those few candidates (memoised per seed node)
+	* instead of the whole seed, so an app that passes the seed's own objects never hashes a seed
+	* node at all, and a cloning app hashes only what it has to. The buckets are built on the first
+	* ask — a page whose islands only pass seed objects by identity never builds them.
+	*/
+	candidates(bytes) {
+		if (this.#by_bytes === null) {
+			const by_bytes = this.#by_bytes = /* @__PURE__ */ new Map();
+			for (const n of this.#nodes) {
+				const b = bytes_of(this.#memo.get(n));
 				const bucket = by_bytes.get(b);
 				if (bucket) bucket.push(n);
 				else by_bytes.set(b, [n]);
 			}
 		}
-		return by_bytes;
-	};
-	const hash_memo = /* @__PURE__ */ new Map();
-	const index = {
-		by_identity: {
-			get: (node) => {
-				const here = at.get(node);
-				return here === void 0 ? void 0 : path_of(here);
-			},
-			has: (node) => at.has(node)
-		},
-		candidates: (b) => buckets().get(b) ?? EMPTY_NODES,
-		hash_of: (node) => hash_subtree(node, hash_memo, /* @__PURE__ */ new Set())?.hash ?? null,
-		size: nodes.length,
-		touched: /* @__PURE__ */ new Set()
-	};
-	index_cache.set(data, index);
-	return index;
-}
+		return this.#by_bytes.get(bytes) ?? EMPTY_NODES;
+	}
+	/**
+	* The first seed node of exactly this byte estimate whose structural hash is `hash` (bucket
+	* order, as `candidates(bytes).find(...)` gives it), in one map lookup. The bucket is hashed in
+	* order only as far as an ask needs, each hash keeping its first node, so the many same-sized
+	* records of a list cost one hash each however many props nodes ask.
+	*/
+	match(bytes, hash) {
+		const bucket = this.candidates(bytes);
+		if (bucket.length === 0) return void 0;
+		let at = this.#by_hash.get(bytes);
+		if (at === void 0) this.#by_hash.set(bytes, at = {
+			hashed: 0,
+			first: /* @__PURE__ */ new Map()
+		});
+		const hit = at.first.get(hash);
+		if (hit !== void 0) return hit;
+		while (at.hashed < bucket.length) {
+			const node = bucket[at.hashed++];
+			const h = this.hash_of(node);
+			if (h === null || at.first.has(h)) continue;
+			at.first.set(h, node);
+			if (h === hash) return node;
+		}
+	}
+	/** Structural hash of an indexed seed node, memoised for the request. */
+	hash_of(node) {
+		return this.#memo === null ? null : hash_subtree(node, this.#hash_memo, /* @__PURE__ */ new Set())?.hash ?? null;
+	}
+};
 /**
 * Plan one island's references: walk the props once, top-down, largest matching ancestor first —
 * identity first (a pointer lookup per node, no hashing), then structure (hash + exact comparison,
@@ -410,6 +451,7 @@ function index_seed(data, min_bytes = 96) {
 * ride inside the reference), and neither is anything under a node below `min_bytes` (no child
 * of it can be referenced). The props' own measures come from the request memo, so the plan adds
 * no walk of its own beyond the pointer lookups.
+* @heisenbench linear in props
 */
 function plan_seed_refs(index, props, min_bytes = 96) {
 	const matched = /* @__PURE__ */ new WeakMap();
@@ -428,18 +470,15 @@ function plan_seed_refs(index, props, min_bytes = 96) {
 		const visit = (v) => {
 			if (!is_plain(v) || seen.has(v)) return;
 			seen.add(v);
-			const by_id = index.by_identity.get(v);
+			const by_id = index.path(v);
 			if (by_id) return hit(v, by_id);
 			const p = memo.get(v) ?? measure(v, memo);
 			const bytes = bytes_of(p);
 			if (bytes < min_bytes) return;
-			if (p & F_REF) {
-				const cands = index.candidates(bytes);
-				if (cands.length) {
-					const h = hash_subtree(v, hashed, /* @__PURE__ */ new Set())?.hash ?? null;
-					const cand = h ? cands.find((c) => index.hash_of(c) === h) : void 0;
-					if (cand && deep_equal_plain(cand, v)) return hit(v, index.by_identity.get(cand));
-				}
+			if (p & F_REF && index.candidates(bytes).length) {
+				const h = hash_subtree(v, hashed, /* @__PURE__ */ new Set())?.hash ?? null;
+				const cand = h ? index.match(bytes, h) : void 0;
+				if (cand && deep_equal_plain(cand, v)) return hit(v, index.path(cand));
 			}
 			if (Array.isArray(v)) for (const item of v) visit(item);
 			else for (const key in v) visit(v[key]);
@@ -452,4 +491,4 @@ function plan_seed_refs(index, props, min_bytes = 96) {
 		keys
 	};
 }
-export { SEED_REF_KEY, analyze, deep_equal_plain, index_seed, json_culprit, plan_seed_refs, resolve_seed_ref, seed_ref_reviver, set_measure_memo_reader };
+export { SEED_REF_KEY, SeedIndex, analyze, deep_equal_plain, json_culprit, plan_seed_refs, resolve_seed_ref, seed_ref_reviver, set_measure_memo_reader };

package/dist/server/document-tail.d.ts

@@ -43,6 +43,12 @@ export declare function modulepreload_tag(href: string): string;
  * them. `data-ogygia-runtime-dep` keeps them attached to the script when the handle moves it
  * (head-presence.ts `runtime_first`). `locations`: the build's location map, which the runtime reads
  * for a load that arrives with an identity alone (runtime/entry-locations.ts).
+ *
+ * The runtime cannot say that it failed to load: when its file or one of its static imports fails to
+ * download, none of it runs, every island stays server markup, and nothing of ogygia's was logged
+ * (#262). The script element's own `error` event fires then (a module graph that failed to fetch),
+ * so the tag says it: the code's link, the way a production build prints every message. (A strict
+ * CSP without inline handlers blocks it, and the browser's own error stands, as before.)
  */
 export declare function runtime_bootstrap_tags(src: string, deps: readonly string[], locations?: string | null): string;
 /**

package/dist/server/document-tail.js

@@ -35,9 +35,15 @@ function modulepreload_tag(href) {
 * them. `data-ogygia-runtime-dep` keeps them attached to the script when the handle moves it
 * (head-presence.ts `runtime_first`). `locations`: the build's location map, which the runtime reads
 * for a load that arrives with an identity alone (runtime/entry-locations.ts).
+*
+* The runtime cannot say that it failed to load: when its file or one of its static imports fails to
+* download, none of it runs, every island stays server markup, and nothing of ogygia's was logged
+* (#262). The script element's own `error` event fires then (a module graph that failed to fetch),
+* so the tag says it: the code's link, the way a production build prints every message. (A strict
+* CSP without inline handlers blocks it, and the browser's own error stands, as before.)
 */
 function runtime_bootstrap_tags(src, deps, locations = null) {
-	let html = "<script type=\"module\" data-ogygia-runtime" + (locations ? " data-og-locations=\"" + locations + "\"" : "") + " src=\"" + src + "\"><\/script>";
+	let html = "<script type=\"module\" data-ogygia-runtime" + (locations ? " data-og-locations=\"" + locations + "\"" : "") + " src=\"" + src + "\" onerror=\"console.error('[ogygia] https://ogygiajs.dev/e/runtime_load_failed')\"><\/script>";
 	for (const dep of deps) html += "<link rel=\"modulepreload\" href=\"" + dep + "\" data-ogygia-runtime-dep>";
 	return html;
 }

package/dist/server/early-holes-csp.d.ts

@@ -0,0 +1,14 @@
+/** The text between a tag's `<script…>` and `<\/script>`: what a CSP hash covers. */
+export declare function script_text(tag: string): string;
+/** The script's hash source, as a policy lists it: of the exact text the head carries, once. */
+export declare const EARLY_HOLES_SOURCE: string;
+/**
+ * A `Content-Security-Policy` (or `-Report-Only`) header value with the early start's hash where its
+ * script would be blocked. A header can carry several policies, comma-separated: each is checked.
+ */
+export declare function with_early_holes_csp(header: string): string;
+/** A head's `<meta http-equiv="content-security-policy">` policies, each with the hash where its
+ *  script would be blocked. A head with none comes back as itself. */
+export declare function with_early_holes_meta_csp(head: string): string;
+/** A response's CSP headers (enforced and report-only), each with the hash where it is needed. */
+export declare function add_early_holes_csp(headers: Headers): void;

package/dist/server/early-holes-csp.js

@@ -0,0 +1,73 @@
+import { EARLY_HOLES_TAG } from "../early-holes-head.js";
+import { createHash } from "node:crypto";
+// src/server/early-holes-csp.ts
+/**
+* THE EARLY START'S SCRIPT UNDER A CONTENT SECURITY POLICY (../early-holes.ts). Its bytes never
+* change, so its `'sha256-…'` source is computed once, here. A policy that would block an inline
+* script gets that one source added to the directive that rules script elements:
+* `script-src-elem`, else `script-src`, else `default-src`. Nothing else in the policy changes:
+*
+*   - no such directive: inline scripts are not restricted, nothing to add;
+*   - `'none'`: no script runs, ours neither;
+*   - `'unsafe-inline'` with no nonce or hash: inline scripts run already, and adding a hash would
+*     switch `'unsafe-inline'` off for every other one;
+*   - a nonce or `'strict-dynamic'` policy: a hash is a valid source beside both.
+*
+* Server-only (node:crypto).
+*/
+/** The text between a tag's `<script…>` and `<\/script>`: what a CSP hash covers. */
+function script_text(tag) {
+	return tag.slice(tag.indexOf(">") + 1, tag.lastIndexOf("<\/script>"));
+}
+/** The script's hash source, as a policy lists it: of the exact text the head carries, once. */
+const EARLY_HOLES_SOURCE = `'sha256-${createHash("sha256").update(script_text(EARLY_HOLES_TAG), "utf8").digest("base64")}'`;
+/** The directives that rule an inline `<script>`, the most specific first. */
+const SCRIPT_DIRECTIVES = [
+	"script-src-elem",
+	"script-src",
+	"default-src"
+];
+const NONCE_OR_HASH_RE = /^'(?:nonce|sha256|sha384|sha512)-/i;
+const WHITESPACE_RE = /\s+/;
+/** One serialized policy (`directive sources; …`) with the hash where an inline script needs it. */
+function with_hash(policy) {
+	const parts = policy.split(";");
+	const names = parts.map((p) => p.trim().split(WHITESPACE_RE)[0]?.toLowerCase() ?? "");
+	for (const directive of SCRIPT_DIRECTIVES) {
+		const at = names.indexOf(directive);
+		if (at === -1) continue;
+		const sources = parts[at].trim().split(WHITESPACE_RE).slice(1);
+		const lower = sources.map((s) => s.toLowerCase());
+		if (sources.includes(EARLY_HOLES_SOURCE)) return policy;
+		if (lower.length === 1 && lower[0] === "'none'") return policy;
+		if (lower.includes("'unsafe-inline'") && !sources.some((s) => NONCE_OR_HASH_RE.test(s))) return policy;
+		parts[at] = parts[at].replace(/\s*$/, "") + " " + EARLY_HOLES_SOURCE;
+		return parts.join(";");
+	}
+	return policy;
+}
+/**
+* A `Content-Security-Policy` (or `-Report-Only`) header value with the early start's hash where its
+* script would be blocked. A header can carry several policies, comma-separated: each is checked.
+*/
+function with_early_holes_csp(header) {
+	if (!header) return header;
+	return header.split(",").map(with_hash).join(",");
+}
+const META_CSP_G = /(<meta\b[^>]*\bhttp-equiv\s*=\s*["']?content-security-policy["']?[^>]*\bcontent\s*=\s*")([^"]*)(")/gi;
+/** A head's `<meta http-equiv="content-security-policy">` policies, each with the hash where its
+*  script would be blocked. A head with none comes back as itself. */
+function with_early_holes_meta_csp(head) {
+	return head.replace(META_CSP_G, (_m, open, policy, close) => open + with_early_holes_csp(policy) + close);
+}
+const CSP_HEADERS = ["content-security-policy", "content-security-policy-report-only"];
+/** A response's CSP headers (enforced and report-only), each with the hash where it is needed. */
+function add_early_holes_csp(headers) {
+	for (const name of CSP_HEADERS) {
+		const value = headers.get(name);
+		if (!value) continue;
+		const next = with_early_holes_csp(value);
+		if (next !== value) headers.set(name, next);
+	}
+}
+export { EARLY_HOLES_SOURCE, add_early_holes_csp, script_text, with_early_holes_csp, with_early_holes_meta_csp };

package/dist/server/page-facts.d.ts

@@ -1,3 +1,4 @@
+import { Scope } from "@ogygia/machine";
 /** Marks ogygia's own lookup: the handle answers it without setting up a page render. */
 export declare const PAGE_FACTS_HEADER = "x-ogygia-page-facts";
 /** The route id and params Kit matched for the looked-up page (the data alone carries neither). */
@@ -18,8 +19,10 @@ export declare function data_url_of(page: URL): string;
 /**
  * The page's facts, or a reason they are not available (a redirect, an error, a load that threw,
  * not a Kit data answer). `decoders`: the app's `transport` decoders, as Kit's client uses them.
+ * `owner`: the request the look-up is for. When it ends, the answer's reader stops (a streamed
+ * promise still pending then stays pending).
  */
-export declare function look_up_page(page: URL, fetch: Fetch, decoders: Decoders): Promise<PageFacts | {
+export declare function look_up_page(page: URL, fetch: Fetch, decoders: Decoders, owner?: Scope): Promise<PageFacts | {
   miss: string;
 }>;
 export {};

package/dist/server/page-facts.js

@@ -31,8 +31,10 @@ function data_url_of(page) {
 /**
 * The page's facts, or a reason they are not available (a redirect, an error, a load that threw,
 * not a Kit data answer). `decoders`: the app's `transport` decoders, as Kit's client uses them.
+* `owner`: the request the look-up is for. When it ends, the answer's reader stops (a streamed
+* promise still pending then stays pending).
 */
-async function look_up_page(page, fetch, decoders) {
+async function look_up_page(page, fetch, decoders, owner) {
 	let res;
 	try {
 		res = await fetch(data_url_of(page), { headers: { [PAGE_FACTS_HEADER]: "1" } });
@@ -44,6 +46,7 @@ async function look_up_page(page, fetch, decoders) {
 		return { miss: `the data request answered ${res.status}` };
 	}
 	const reader = res.body.getReader();
+	owner?.defer(() => void reader.cancel().catch(() => {}));
 	const text = new TextDecoder();
 	let buf = "";
 	let nl = -1;

package/dist/server/page-seed.d.ts

@@ -20,8 +20,8 @@ export interface SeedText {
 export declare class PageSeed {
   /**
    * Public page slice for islands. url/params/route/status are always plain and MUST survive;
-   * data/form/error may carry a non-serializable leaf (function/store/class) — that ONE field is
-   * dropped, never the whole seed. Promises should already be resolved by the handle
+   * data/form/error may carry a non-serializable leaf (function/store/class) — that leaf is left
+   * out where it sits (`keep_serializable`), never its field or the whole seed. Promises should already be resolved by the handle
    * (`resolve_promises`) before this. See INVARIANTS.md · PAGE-SEED.
    *
    * `json`: the caller proved the whole slice JSON-exact (seed-refs.ts `analyze`) — then the seed

package/dist/server/page-seed.js

@@ -2,11 +2,96 @@ import { escape_script_text } from "../escape.js";
 import { stringify } from "devalue";
 // src/server/page-seed.ts
 /** Serialize a Kit `page` snapshot for a single document-level ogygia side-channel. */
+const DROP = Symbol("drop");
+/**
+* A copy of `value` without the values `stringify_fn` cannot carry (a function, a symbol, a class
+* no reducer encodes): an object's key is left out, an array's slot reads `undefined` (later
+* indexes still point at what they did), a Map or Set loses that entry. Plain objects, arrays,
+* Maps and Sets are copied (one copy per source object, so shared and cyclic references keep their
+* shape); every other value is kept or left out whole, asked of `stringify_fn` itself so the app's
+* reducers decide. The source is not touched. Only for a slice whose whole serialization threw.
+*/
+function keep_serializable(value, stringify_fn) {
+	const copies = /* @__PURE__ */ new Map();
+	const carries = (v) => {
+		try {
+			stringify_fn(v);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+	const put = (out, key, v) => {
+		if (key === "__proto__") Object.defineProperty(out, key, {
+			value: v,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+		else out[key] = v;
+	};
+	const keep = (v) => {
+		if (typeof v === "function" || typeof v === "symbol") return carries(v) ? v : DROP;
+		if (v === null || typeof v !== "object") return v;
+		if (copies.has(v)) return copies.get(v);
+		const proto = Object.getPrototypeOf(v);
+		if (Array.isArray(v) && proto === Array.prototype) {
+			const out = [];
+			out.length = v.length;
+			copies.set(v, out);
+			for (let i = 0; i < v.length; i++) {
+				if (!(i in v)) continue;
+				const c = keep(v[i]);
+				out[i] = c === DROP ? void 0 : c;
+			}
+			return out;
+		}
+		if (proto === Object.prototype || proto === null) {
+			const out = Object.create(proto);
+			copies.set(v, out);
+			for (const key of Object.keys(v)) {
+				let e;
+				try {
+					e = v[key];
+				} catch {
+					continue;
+				}
+				const c = keep(e);
+				if (c !== DROP) put(out, key, c);
+			}
+			return out;
+		}
+		if (proto === Map.prototype) {
+			const out = /* @__PURE__ */ new Map();
+			copies.set(v, out);
+			for (const [k, e] of v) {
+				const ck = keep(k);
+				const ce = keep(e);
+				if (ck !== DROP && ce !== DROP) out.set(ck, ce);
+			}
+			return out;
+		}
+		if (proto === Set.prototype) {
+			const out = /* @__PURE__ */ new Set();
+			copies.set(v, out);
+			for (const e of v) {
+				const c = keep(e);
+				if (c !== DROP) out.add(c);
+			}
+			return out;
+		}
+		const kept = carries(v) ? v : DROP;
+		copies.set(v, kept);
+		return kept;
+	};
+	const out = keep(value);
+	return out === DROP ? void 0 : out;
+}
 var PageSeed = class {
 	/**
 	* Public page slice for islands. url/params/route/status are always plain and MUST survive;
-	* data/form/error may carry a non-serializable leaf (function/store/class) — that ONE field is
-	* dropped, never the whole seed. Promises should already be resolved by the handle
+	* data/form/error may carry a non-serializable leaf (function/store/class) — that leaf is left
+	* out where it sits (`keep_serializable`), never its field or the whole seed. Promises should already be resolved by the handle
 	* (`resolve_promises`) before this. See INVARIANTS.md · PAGE-SEED.
 	*
 	* `json`: the caller proved the whole slice JSON-exact (seed-refs.ts `analyze`) — then the seed
@@ -37,16 +122,24 @@ var PageSeed = class {
 			try {
 				raw = stringify_fn(full);
 			} catch {
-				const safe = { ...base };
-				for (const key of [
-					"data",
-					"form",
-					"error"
-				]) try {
-					stringify_fn(full[key]);
-					safe[key] = full[key];
+				let kept = full;
+				try {
+					kept = keep_serializable(full, stringify_fn);
 				} catch {}
-				raw = stringify_fn(safe);
+				try {
+					raw = stringify_fn(kept);
+				} catch {
+					const safe = { ...base };
+					for (const key of [
+						"data",
+						"form",
+						"error"
+					]) try {
+						stringify_fn(kept[key]);
+						safe[key] = kept[key];
+					} catch {}
+					raw = stringify_fn(safe);
+				}
 			}
 			return {
 				text: raw,

package/dist/server/page-stream.d.ts

@@ -1,3 +1,4 @@
+import { Scope } from "@ogygia/machine";
 /** A THENABLE, not just a native Promise — Kit wraps streamed load promises, so `instanceof Promise`
  *  would miss them. Anything with a callable `.then` we can await. */
 export declare const is_thenable: (v: unknown) => v is PromiseLike<unknown>;
@@ -52,4 +53,16 @@ export declare function resolve_script(global_name: string, id: number, settled:
 }, reducers?: Record<string, (v: unknown) => unknown>): string;
 export declare function normalize_error(err: unknown): {
   message: string;
-};
+};
+/**
+ * Stream the captured `$page.data` promises into islands (csr=false, real browser load). The
+ * document — carrying the pending seed + resolve-global bootstrap — is already built by `resolve`;
+ * here we (1) forward it, (2) DRAIN Kit's own dead csr=false resolve tail so its
+ * `__sveltekit_<hash> is not defined` never reaches the browser, and (3) emit one
+ * `<script>__ogygia_page_resolve(id, ok, value)<\/script>` per promise AS IT SETTLES — completion
+ * order, non-blocking. Each island's `{#await page.data.x}` flips pending → resolved live.
+ *
+ * The stream is the request's (`request`, its owner): the visitor leaving, or the body cancelled,
+ * stops Kit's reader and drops what settles after.
+ */
+export declare function stream_page_deferred(request: Scope, response: Response, deferred: Deferred[], initial_next_id: number, reducers?: Record<string, (v: unknown) => unknown>): Response;