@ogygia/core 0.12.3 → 0.13.0

package/dist/hooks.js

@@ -13,32 +13,37 @@ import { region_mac_message, secret_has_min_entropy, sign, verify } from "./serv
 import { expiry_refusal, note_cache_control } from "./server/shared-cache.js";
 import { app_lifetime } from "./server/region-endpoint.js";
 import { cached_render, render_cache_key } from "./server/render-cache.js";
+import { render as render$1 } from "./policies.js";
+import { install_server_rules } from "./server/rules.js";
 import { B64Url } from "./server/payload.js";
 import { REF_WIRE_KEY, ref_reviver } from "./ref.js";
 import { current_facts, facts_of, mark_per_visitor, set_current_request } from "./plugin/facts.js";
-import { around, request_contexts, start_plugins } from "./plugin/server.js";
+import { around, end_request, request_contexts, start_app_plugins } from "./plugin/server.js";
+import { end_request_scope, own_response, request_scope } from "./plugin/request-scope.js";
 import { register_wire_kind } from "./live-transport.js";
 import { register_derived_kind, register_store_kind } from "./store-transport.js";
 import { register_snippet_kind } from "./region-snippet.js";
 import { register_fn_kind } from "./fn-transport.js";
 import { configure_islands_endpoint, is_region_id, is_region_ttl, islands_endpoint } from "./server/endpoint.js";
-import { build_parcel, done_parcel } from "./server/stream-regions.js";
+import { batch_stream } from "./server/stream-regions.js";
 import { dedupe_head_links, page_declares_dev_hmr_script, page_declares_router_meta, page_declares_runtime_script, page_declares_speculation_rules, runtime_first } from "./server/head-presence.js";
 import { assemble, locate } from "./server/document-assembly.js";
-import { error_route_is_csr_true, route_is_csr_true } from "./context.js";
+import { error_route_is_csr_true, route_is_csr_true, take_early_holes } from "./context.js";
+import { early_holes_head } from "./early-holes-head.js";
+import { add_early_holes_csp, with_early_holes_meta_csp } from "./server/early-holes-csp.js";
 import { merge_seed_ask, shape_page_data } from "./server/seed-shape.js";
 import { html_has_kit_bootstrap } from "./runtime/kit-boot.js";
 import { STAND_IN_CSS, check_script, mark, settle } from "./server/reversible.js";
 import { hole_head } from "./server/hole-graph.js";
 import { restore, restore_adopt } from "./runtime/restore.js";
 import { RateLimiter } from "./server/rate-limit.js";
-import { KEEP_FALLBACK_HTML } from "./keep-fallback-marker.js";
 import { PageSeed } from "./server/page-seed.js";
-import { analyze, index_seed, json_culprit, set_measure_memo_reader } from "./seed-refs.js";
+import { SeedIndex, analyze, json_culprit, set_measure_memo_reader } from "./seed-refs.js";
 import { WIRE_FORMAT_ATTR, WIRE_FORMAT_JSON } from "./server/props-wire.js";
-import { page_seed_reducers, resolve_script, settle_deferred, stage_deferred } from "./server/page-stream.js";
-import { PAGE_DEFER_BOOTSTRAP, PAGE_DEFER_GLOBAL } from "./page-defer.js";
-import { ConcurrencyGate } from "./runtime/concurrency.js";
+import { KEEP_FALLBACK_HTML } from "./keep-fallback-marker.js";
+import { page_seed_reducers, settle_deferred, stage_deferred, stream_page_deferred } from "./server/page-stream.js";
+import { PAGE_DEFER_BOOTSTRAP } from "./page-defer.js";
+import { ConcurrencyGate, is_run_timeout } from "./runtime/concurrency.js";
 import { serialize_provided_context } from "./context-bridge.js";
 import { escape_script_text } from "./escape.js";
 import { hole_copy_key } from "./runtime/hash.js";
@@ -55,6 +60,9 @@ import { drop_dead_kit_resolves } from "./server/dead-kit-resolves.js";
 import "./events/schema.js";
 import { DEVTOOLS_COOKIE, SWITCH_COOKIE_OPTIONS, switch_in_url } from "./insights/switch.js";
 import { mark_personal } from "./server/personal-response.js";
+import { OgygiaError, warn } from "./messages/server.js";
+import { ERRORS, WARNINGS } from "./messages/core.js";
+import { define_messages, dev_or_prerender } from "./messages/define.js";
 import { ogygiaTransport } from "./transport.js";
 import { document } from "./document.js";
 import { liftRegions, restoreRegions, scanRegions } from "./server/split-regions.js";
@@ -95,6 +103,8 @@ import { plugins } from "virtual:ogygia/server-plugins";
 *
 * @packageDocumentation
 */
+globalThis[Symbol.for("ogygia.prerendering")] = building;
+globalThis[Symbol.for("ogygia.messages")] ??= define_messages(import.meta.env?.DEV || import.meta.env?.SSR ? ERRORS : null, import.meta.env?.DEV || import.meta.env?.SSR ? WARNINGS : null, dev_or_prerender);
 /** Is devtools on for this request's browser (a devtools BUILD): the URL's `?og-devtools=on|off`
 *  wins and is written to the response's cookie, else the cookie (insights/switch.ts). */
 function devtools_switch(event) {
@@ -109,6 +119,7 @@ function devtools_switch(event) {
 const MAX_REGION_BODY = 2e6;
 const DEVTOOLS = typeof __OGYGIA_DEVTOOLS__ !== "undefined" ? __OGYGIA_DEVTOOLS__ : false;
 const DEVTOOLS_LAZY = typeof __OGYGIA_DEVTOOLS_LAZY__ !== "undefined" ? __OGYGIA_DEVTOOLS_LAZY__ : false;
+if (import.meta.env?.DEV || (typeof __OGYGIA_RULES__ !== "undefined" ? __OGYGIA_RULES__ : false)) install_server_rules();
 /** High-res clock for server-realm devtools timestamps. */
 const dt_now = () => typeof performance !== "undefined" && performance.now ? performance.now() : Date.now();
 const bags = /* @__PURE__ */ new WeakMap();
@@ -220,7 +231,7 @@ set_source_recorder((tag) => {
 	current_facts()?.sources?.push(tag);
 });
 set_page_route_config(route_config);
-const plugins$1 = start_plugins(plugins, {
+const plugins$1 = start_app_plugins(plugins, {
 	sign: (message) => sign(signing_key().secret, message),
 	verify: (message, signature) => verify(signing_key().secret, message, signature),
 	lifetime: app_lifetime,
@@ -242,10 +253,13 @@ if (DEVTOOLS) set_server_devtools_recorder((input) => dt_record(bag_of(), input)
 /** Cap on a batch POST body before `request.json()` buffers it. 32 endpoints × ~8.5kB (props cap
 *  8192 + URL overhead) ≈ 270kB; 512kB leaves margin. Rejected up front via `content-length`. */
 const MAX_BATCH_BODY = 524288;
-/** Abort waiting on slow region SSR (work may continue — see INVARIANTS · RENDER-TIMEOUT). */
-const RENDER_TIMEOUT_MS = 1e4;
+/** Abort waiting on slow region SSR (work may continue — see INVARIANTS · RENDER-TIMEOUT): the
+*  `render` policy's deadline (./policies.ts). */
+const RENDER_TIMEOUT_MS = render$1.deadline;
 /** Process-local cap on concurrent region SSR (M1 CPU amp under valid MAC). */
 const render_gate = new ConcurrencyGate(4);
+/** The abandoned renders already told (one render's timeout reaches every call that joined it). */
+const told_abandoned = /* @__PURE__ */ new WeakSet();
 /** The per-plugin contexts of an app with no plugins (shared: never written to). */
 const NO_CTXS = [];
 /**
@@ -385,31 +399,6 @@ function seed_codecs(transport) {
 	}
 	return hit;
 }
-/** `</body>` as bytes (ASCII: the same in every UTF-8 document). */
-const BODY_CLOSE_BYTES = [
-	60,
-	47,
-	98,
-	111,
-	100,
-	121,
-	62
-];
-/** Does `</body>` end in `chunk` — searched backwards from its end, where it sits — or straddle the
-*  boundary with the previous chunk's last bytes (`carry`, at most 6)? No decode. */
-function has_body_close(carry, chunk) {
-	const at_bytes = (buf, i) => {
-		for (let k = 0; k < 7; k++) if (buf[i + k] !== BODY_CLOSE_BYTES[k]) return false;
-		return true;
-	};
-	for (let i = chunk.lastIndexOf(60); i !== -1; i = i === 0 ? -1 : chunk.lastIndexOf(60, i - 1)) if (at_bytes(chunk, i)) return true;
-	if (!carry.length) return false;
-	const seam = new Uint8Array(carry.length + Math.min(6, chunk.length));
-	seam.set(carry);
-	seam.set(chunk.subarray(0, seam.length - carry.length), carry.length);
-	for (let i = 0; i + 7 <= seam.length; i++) if (at_bytes(seam, i)) return true;
-	return false;
-}
 function csr_page_of(html, body_end, event, bag) {
 	return event?.route?.id != null ? bag?.page?.error != null ? error_route_is_csr_true(event.route.id) : route_is_csr_true(event.route.id) : body_end !== -1 && html_has_kit_bootstrap(html, body_end);
 }
@@ -424,6 +413,21 @@ function page_ctx_script(bag) {
 /** The restorer, inline (runtime/restore.ts — self-contained, so its source runs as is): restores the
 *  document now, and stays as `__og_restore` / `__og_restore_adopt` for hole answers and router swaps. */
 const RESTORER_SCRIPT = `<script data-og-restore>(function(){var r=${restore.toString()};window.__og_restore=r;window.__og_restore_adopt=${restore_adopt.toString()};r(document)})()<\/script>`;
+/** `inner` with the request's owner around it: made before `inner` runs, ended with its response
+*  (or at once when it throws). */
+function owned(inner) {
+	return async (input) => {
+		const owner = request_scope(input.event.request);
+		let response;
+		try {
+			response = await inner(input);
+		} catch (error) {
+			end_request_scope(owner);
+			throw error;
+		}
+		return own_response(owner, response, input.event.request);
+	};
+}
 var OgygiaHandle = class {
 	#endpoint;
 	#speculation_rules;
@@ -435,7 +439,7 @@ var OgygiaHandle = class {
 		this.#transform = options.transform;
 		configure_islands_endpoint(options.endpoint);
 		this.#endpoint = islands_endpoint();
-		if (options.secret?.trim() && !import.meta.env.DEV && !secret_has_min_entropy(options.secret)) throw new Error(`[ogygia] handle({ secret }) is too short for production (need ≥16 UTF-8 bytes).`);
+		if (options.secret?.trim() && !import.meta.env.DEV && !secret_has_min_entropy(options.secret)) throw new OgygiaError("handle_secret_too_short", { min: 16 });
 		configure_signing_secret(options.secret);
 		this.#speculation_rules = enabled ? "" : mpaSpeculationRules(this.#endpoint);
 		this.render_rate = new RateLimiter({
@@ -448,7 +452,7 @@ var OgygiaHandle = class {
 			windowMs: rateLimit.windowMs
 		});
 	}
-	handle = around(plugins$1, (input) => this.#core(input));
+	handle = owned(around(plugins$1, (input) => this.#core(input)));
 	#core = async ({ event, resolve }) => {
 		const path = decode_pathname(event.url.pathname);
 		if (path === null) return new Response("Bad Request", { status: 400 });
@@ -462,9 +466,7 @@ var OgygiaHandle = class {
 			}
 			return await this.#route(event, resolve, path, ctxs, facts);
 		} finally {
-			for (let i = 0; i < plugins$1.length; i++) try {
-				plugins$1[i].def.done?.(ctxs[i]);
-			} catch {}
+			end_request(plugins$1, ctxs, event.platform);
 		}
 	};
 	/** One signed hole rendered in place with THIS request's event (a plugin's `ctx.renderHole`:
@@ -525,6 +527,9 @@ var OgygiaHandle = class {
 			};
 			const response = await resolve(event, { transformPageChunk: async ({ html }) => this.inject_client_seeds(this.#transform ? await this.#transform_document(html, event, bag) : html, store?.state, event, bag) });
 			if (devtools_personal) mark_personal(response);
+			if (bag.early_holes?.length) try {
+				add_early_holes_csp(response.headers);
+			} catch {}
 			if (this.#transform && (response.headers.get("content-type") ?? "").includes("text/html")) try {
 				response.headers.append("vary", "x-ogygia-spa");
 			} catch {}
@@ -536,7 +541,7 @@ var OgygiaHandle = class {
 			let out = response;
 			for (let i = 0; i < ctxs.length; i++) out = await plugins$1[i].def.response?.(ctxs[i], out) ?? out;
 			if (out !== response) return out;
-			if (bag.deferred && bag.deferred.length) return this.stream_page_deferred(response, bag.deferred, bag.defer_next_id, bag.seed_reducers ?? void 0);
+			if (bag.deferred && bag.deferred.length) return stream_page_deferred(request_scope(event.request), response, bag.deferred, bag.defer_next_id, bag.seed_reducers ?? void 0);
 			if (!bag.kit_client && !response.headers.has("content-length") && (response.headers.get("content-type") ?? "").includes("text/html")) return drop_dead_kit_resolves(response);
 			return response;
 		}
@@ -566,17 +571,7 @@ var OgygiaHandle = class {
 		}
 		if (!Array.isArray(parsed) || parsed.length === 0) return region_response("Bad Request", { status: 400 });
 		const calls = parsed.filter((e) => typeof e === "string").slice(0, MAX_BATCH);
-		const render = (endpoint) => this.#render_capability(endpoint, event, true);
-		const encoder = new TextEncoder();
-		return region_response(new ReadableStream({ async start(controller) {
-			await Promise.all(calls.map(async (endpoint) => {
-				const out = await render(endpoint).catch(() => null);
-				const parcel = out ? build_parcel(out.slot, out.html) : null;
-				if (parcel) controller.enqueue(encoder.encode(parcel));
-			}));
-			controller.enqueue(encoder.encode(done_parcel()));
-			controller.close();
-		} }), {
+		return region_response(batch_stream(calls, (endpoint, signal) => this.#render_capability(endpoint, event, true, signal), request_scope(event.request)), {
 			status: 200,
 			headers: {
 				"content-type": "text/html; charset=utf-8",
@@ -633,23 +628,27 @@ var OgygiaHandle = class {
 		const t_start = performance.now();
 		const spans = locate(html);
 		const head = spans.head_end === -1 ? null : html.slice(0, spans.head_end);
+		const early = head === null || !event ? [] : take_early_holes(event.request);
+		if (early.length && bag) bag.early_holes = early;
+		const early_head = early_holes_head(early);
+		const with_early_csp = (h) => early.length ? with_early_holes_meta_csp(h) : h;
 		const csr_page = csr_page_of(html, spans.body_end, event, bag);
 		if (csr_page && bag) bag.kit_client = true;
 		if (csr_page) {
 			let head_inject = "";
 			if (head !== null) {
-				head_inject = CSR_META;
+				head_inject = CSR_META + early_head;
 				if (devtools_boot_url && !head.includes("data-ogygia-devtools-boot")) head_inject += `<script type="module" data-ogygia-devtools-boot src="${devtools_boot_url}"><\/script>`;
 				if (bag) bag.kit_with_runtime = page_declares_runtime_script(head);
 			}
 			if (head !== null && bag?.transform_head) head_inject = bag.transform_head + head_inject;
 			const tail = spans.body_end !== -1 && bag ? (bag.transform_body ?? "") + bag.tail.render(null) + (bag.kit_with_runtime ? page_ctx_script(bag) : "") : "";
 			if (head === null && !tail) return html;
-			const ordered = head === null ? null : runtime_first(head, null);
+			const ordered = head === null ? null : with_early_csp(runtime_first(head, null));
 			return assemble(html, spans, ordered === head ? null : ordered, head_inject, tail);
 		}
 		let head_out = null;
-		let head_inject = head !== null ? CSR_FALSE_META : "";
+		let head_inject = head !== null ? CSR_FALSE_META + early_head : "";
 		if (head !== null) {
 			const deduped = dedupe_head_links(head);
 			if (deduped !== head) head_out = deduped;
@@ -657,7 +656,7 @@ var OgygiaHandle = class {
 			if (!enabled && !page_declares_speculation_rules(probe)) head_inject += `<script type="speculationrules" data-ogygia-speculate>${this.#speculation_rules}<\/script>`;
 			if (enabled && !page_declares_router_meta(probe)) head_inject += `<meta name="ogygia-router" content="${viewTransitions ? "vt" : "plain"}">`;
 			const runtime_tag = enabled && runtime_url && !page_declares_runtime_script(probe) ? runtime_bootstrap(kit_asset) : null;
-			const ordered = runtime_first(probe, runtime_tag);
+			const ordered = with_early_csp(runtime_first(probe, runtime_tag));
 			if (ordered !== probe) head_out = ordered;
 			if (dev_hmr_url && !page_declares_dev_hmr_script(probe)) {
 				head_inject += `<script type="module" data-ogygia-dev-hmr src="${kit_asset(dev_hmr_url)}"><\/script>`;
@@ -676,9 +675,9 @@ var OgygiaHandle = class {
 		const page_snap = bag.page;
 		const seed_wanted = bag.seed_wanted;
 		const detail = request_stats_detailed();
-		const tail_html = bag.tail.render(seed_wanted ? index_seed(page_snap.data) : null, detail);
+		const tail_html = bag.tail.render(seed_wanted ? SeedIndex.of(page_snap.data) : null, detail);
 		let seed_keys = bag.seed_keys;
-		if (seed_wanted && seed_keys !== "all" && seed_keys !== null) for (const k of index_seed(page_snap.data).touched) seed_keys.add(k);
+		if (seed_wanted && seed_keys !== "all" && seed_keys !== null) for (const k of SeedIndex.of(page_snap.data).touched) seed_keys.add(k);
 		const shaped_data = shape_page_data(page_snap.data, seed_keys);
 		let seed_data = shaped_data;
 		let seed_form = page_snap.form;
@@ -822,88 +821,6 @@ var OgygiaHandle = class {
 		if (DEVTOOLS && dt_buf && dt_buf.events.length) scripts.push(emit_ogygia_script("devtools", escape_script_text(JSON.stringify(dt_buf.events))));
 	}
 	/**
-	* Stream the captured `$page.data` promises into islands (csr=false, real browser load). The
-	* document — carrying the pending seed + resolve-global bootstrap — is already built by `resolve`;
-	* here we (1) forward it, (2) DRAIN Kit's own dead csr=false resolve tail so its
-	* `__sveltekit_<hash> is not defined` never reaches the browser, and (3) emit one
-	* `<script>__ogygia_page_resolve(id, ok, value)<\/script>` per promise AS IT SETTLES — completion
-	* order, non-blocking. Each island's `{#await page.data.x}` flips pending → resolved live.
-	*/
-	stream_page_deferred(response, deferred, initial_next_id, reducers) {
-		const source = response.body;
-		if (!source) return response;
-		const reader = source.getReader();
-		const encoder = new TextEncoder();
-		const stream = new ReadableStream({
-			async start(controller) {
-				let carry = /* @__PURE__ */ new Uint8Array(0);
-				try {
-					for (;;) {
-						const { value, done } = await reader.read();
-						if (done) break;
-						controller.enqueue(value);
-						if (has_body_close(carry, value)) break;
-						carry = value.length >= 6 ? value.subarray(value.length - 6) : value;
-					}
-				} catch {}
-				(async () => {
-					try {
-						for (;;) {
-							const { done } = await reader.read();
-							if (done) break;
-						}
-					} catch {}
-				})();
-				let pending = deferred.length;
-				let next_id = initial_next_id;
-				let closed = false;
-				const maybe_close = () => {
-					if (pending === 0 && !closed) {
-						closed = true;
-						try {
-							controller.close();
-						} catch {}
-					}
-				};
-				const push = (id, ok, value) => {
-					try {
-						controller.enqueue(encoder.encode(resolve_script(PAGE_DEFER_GLOBAL, id, {
-							ok,
-							value
-						}, reducers)));
-					} catch {}
-				};
-				const stream_one = (id, promise) => {
-					Promise.resolve(promise).then((value) => {
-						const { staged, deferred: nested, next_id: after } = stage_deferred(value, next_id);
-						next_id = after;
-						push(id, true, staged);
-						pending += nested.length;
-						for (const n of nested) stream_one(n.id, n.promise);
-						pending -= 1;
-						maybe_close();
-					}, (error) => {
-						push(id, false, error);
-						pending -= 1;
-						maybe_close();
-					});
-				};
-				for (const { id, promise } of deferred) stream_one(id, promise);
-				maybe_close();
-			},
-			cancel() {
-				reader.cancel().catch(() => {});
-			}
-		});
-		const headers = new Headers(response.headers);
-		headers.delete("content-length");
-		return new Response(stream, {
-			status: response.status,
-			statusText: response.statusText,
-			headers
-		});
-	}
-	/**
 	* True when a remote's resolved value (deep) contains a region carrying baked SSR HTML — a
 	* page-sized render, not seed data (see the skip in {@link build_remote_seed_script}). Depth-capped:
 	* a region ticket sits shallow in any sane payload (a DocView's `entry.body` is 2 levels deep).
@@ -934,23 +851,25 @@ var OgygiaHandle = class {
 	* if the render threw or timed out. Shared by the endpoint ({@link render_region}) and the
 	* batch path ({@link #render_capability}).
 	*/
-	async #render_component(load, props, cache, report, timing, base, reads_page_data = false) {
+	async #render_component(load, props, cache, report, timing, base, reads_page_data = false, signal) {
 		const render_body = async () => {
 			const mod = await load();
-			const rendered = render(mod.default, {
+			const out = await render(mod.default, {
 				props,
 				context: kit_render_context()
 			});
-			return await Promise.race([Promise.resolve(rendered).then((out) => {
-				const body = out.body;
-				if (body === "<!--ogygia:keep-fallback-->") return body;
-				return hole_head(out.head, base) + body + kit_page_facts_tail();
-			}), new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("region render timeout")), RENDER_TIMEOUT_MS))]);
+			const body = out.body;
+			if (body === "<!--ogygia:keep-fallback-->") return body;
+			return hole_head(out.head, base) + body + kit_page_facts_tail();
 		};
 		try {
-			return await cached_render(async () => {
+			return await cached_render(async (render_signal) => {
+				const gated = {
+					deadline_ms: RENDER_TIMEOUT_MS,
+					signal: render_signal
+				};
 				await kit_page_ready(reads_page_data);
-				if (!timing) return render_gate.run(render_body);
+				if (!timing) return render_gate.run(render_body, gated);
 				const asked = performance.now();
 				return render_gate.run(async () => {
 					const entered = performance.now();
@@ -960,19 +879,23 @@ var OgygiaHandle = class {
 					} finally {
 						timing.render_ms = performance.now() - entered;
 					}
-				});
-			}, cache, Date.now(), report);
+				}, gated);
+			}, cache, report, signal);
 		} catch (e) {
 			if (is_keep_fallback(e)) return KEEP_FALLBACK_HTML;
-			if (import.meta.env.DEV) console.warn("[ogygia] region render failed:", e);
+			if (signal?.aborted) return null;
+			if (is_run_timeout(e) && render_gate.abandoned === 1 && !told_abandoned.has(e)) {
+				told_abandoned.add(e);
+				warn("region_render_abandoned", { ms: RENDER_TIMEOUT_MS });
+			}
+			if (import.meta.env.DEV) warn("region_render_failed", e);
 			return null;
 		}
 	}
 	/** A cached hole's memo key: the call and the visitor's session, and — when its tree reads
 	*  `page.data` — the page it renders for (one page's facts never answer another page's hole). */
 	#hole_cache_key(id, payload, event, reads_page_data) {
-		const session = this.#region_session(event);
-		return render_cache_key(id, payload, reads_page_data ? session + "\n" + page_url_of(event).href : session);
+		return render_cache_key(id, payload, this.#region_session(event), reads_page_data ? page_url_of(event).href : null);
 	}
 	/** The session cookie value sealed into a region capability (empty when no `sessionCookie` is
 	*  configured) — the same read the MAC verify uses, and the per-user part of the render-cache key. */
@@ -1031,7 +954,7 @@ var OgygiaHandle = class {
 			register_derived_kind();
 			props = devalue.parse(B64Url.decode(payload), { [REF_WIRE_KEY]: ref_reviver(false) });
 		} catch (e) {
-			if (import.meta.env.DEV) console.warn("[ogygia] region endpoint 403: island module load / props decode failed", e);
+			if (import.meta.env.DEV) warn("endpoint_props_decode_failed", e);
 			return null;
 		}
 		if (props === null || typeof props !== "object" || Array.isArray(props)) return null;
@@ -1043,9 +966,9 @@ var OgygiaHandle = class {
 	* bad/expired MAC, unknown id, non-serializable props, render error, oversize — resolves to
 	* `null` so the hole silently falls back to a client fetch. Never throws.
 	*/
-	async #render_capability(endpoint, event, batch = false) {
+	async #render_capability(endpoint, event, batch = false, signal) {
 		const q = endpoint.indexOf("?");
-		if (q === -1) return null;
+		if (q === -1 || signal?.aborted) return null;
 		const cap = capability_of(new URLSearchParams(endpoint.slice(q + 1)));
 		const { id, payload, sig } = cap;
 		if (this.#capability_precheck(cap)) return null;
@@ -1066,7 +989,7 @@ var OgygiaHandle = class {
 		const t0 = stats ? performance.now() : 0;
 		const timing = {};
 		let outcome = "none";
-		const body = await this.#render_component(load, props, cache, stats ? (o) => outcome = o : void 0, stats ? timing : void 0, event.url, reads_page_data);
+		const body = await this.#render_component(load, props, cache, stats ? (o) => outcome = o : void 0, stats ? timing : void 0, event.url, reads_page_data, signal);
 		if (stats) record_batch_hole_stats(event.request, {
 			kind: "hole",
 			id,
@@ -1078,7 +1001,7 @@ var OgygiaHandle = class {
 			ms: performance.now() - t0,
 			status: body === null ? 500 : 200
 		});
-		if (body === null || body.length > MAX_REGION_BODY) return null;
+		if (body === null || body.length > MAX_REGION_BODY || signal?.aborted) return null;
 		if (body === "<!--ogygia:keep-fallback-->") return {
 			slot: sig,
 			html: KEEP_FALLBACK_HTML
@@ -1116,7 +1039,11 @@ var OgygiaHandle = class {
 		const renewal = url.searchParams.get("renew") === "1";
 		const refused = this.#capability_precheck(cap, renewal);
 		if (refused) {
-			if (import.meta.env.DEV && refused === "foreign-key") console.warn(`[ogygia] region endpoint 403: id "${id}" was signed by key ${cap.k}, this server signs with ${signing_key().fp}`);
+			if (import.meta.env.DEV && refused === "foreign-key") warn("endpoint_foreign_key", {
+				id,
+				key: String(cap.k),
+				own: signing_key().fp
+			});
 			return region_denied(refused);
 		}
 		if (this.probe_rate.limited(ip)) return region_response("Too Many Requests", { status: 429 });
@@ -1126,7 +1053,7 @@ var OgygiaHandle = class {
 			cap = fresh;
 			renewed = `${url.pathname}?id=${encodeURIComponent(id)}${cap.render ? `&r=${cap.render}` : ""}&props=${payload}&exp=${cap.exp}${ttl_raw ? `&ttl=${ttl_raw}` : ""}&sig=${cap.sig}&k=${cap.k}`;
 		} else if (!this.#verify_region_mac(cap, event)) {
-			if (import.meta.env.DEV) console.warn(`[ogygia] region endpoint 403: bad signature for id "${id}"`);
+			if (import.meta.env.DEV) warn("endpoint_bad_signature", { id });
 			return region_denied("sig");
 		}
 		const cache_control = ttl_raw && !renewed ? `private, max-age=${Number(ttl_raw)}` : "no-store";
@@ -1135,7 +1062,11 @@ var OgygiaHandle = class {
 		if (this.render_rate.limited(ip)) return region_response("Too Many Requests", { status: 429 });
 		const target = capability_target(cap);
 		if (target === null) {
-			if (import.meta.env.DEV) console.warn(`[ogygia] region endpoint 403: id "${id}"${cap.render ? ` (component ${cap.render})` : ""} is not in the server manifest (${Object.keys(island_url).length} known)`);
+			if (import.meta.env.DEV) warn("endpoint_unknown_id", {
+				id,
+				component: cap.render || void 0,
+				known: Object.keys(island_url).length
+			});
 			return region_denied("unknown-id");
 		}
 		const load = (await load_islands()).islands[target];

package/dist/insights/page-assets.js

@@ -1,4 +1,5 @@
 import { find_unscoped } from "../unscoped-css.js";
+import { scope } from "@ogygia/machine";
 // src/insights/page-assets.ts
 /**
 * THE PAGE'S WEIGHT — every file the rendered document makes the browser fetch at start, found in
@@ -315,7 +316,7 @@ async function weigh_assets(opts) {
 			if (w === void 0) {
 				const got = await weigh_one(r, opts, deadline, origin);
 				if ("miss" in got) {
-					if (got.miss.startsWith("status ")) opts.cache.set(r.url, null);
+					if (got.gone) opts.cache.set(r.url, null);
 					miss(r.url, got.miss);
 					continue;
 				}
@@ -564,13 +565,20 @@ function byte_length(s) {
 	}
 	return n;
 }
+/** A status that says the file is not there for good: a client error, but not a timeout or a
+*  rate limit (408, 429), which say "not now", as a 5xx does. */
+const gone_for_good = (status) => status >= 400 && status < 500 && status !== 408 && status !== 429;
 async function weigh_one(r, opts, deadline, origin) {
 	const left = deadline - Date.now();
 	if (left < 100) return { miss: "budget" };
 	try {
-		const res = await Promise.race([opts.fetch_url(r.url.startsWith(origin) ? r.url.slice(origin.length) || "/" : r.url), new Promise((ok) => setTimeout(() => ok(null), left))]);
+		const wait = scope();
+		const res = await Promise.race([opts.fetch_url(r.url.startsWith(origin) ? r.url.slice(origin.length) || "/" : r.url), new Promise((ok) => wait.timeout(() => ok(null), left))]).finally(() => wait.close());
 		if (!res) return { miss: "timeout" };
-		if (!res.ok) return { miss: `status ${res.status}` };
+		if (!res.ok) return gone_for_good(res.status) ? {
+			miss: `status ${res.status}`,
+			gone: true
+		} : { miss: `status ${res.status}` };
 		const enc = res.headers.get("content-encoding");
 		const len = Number(res.headers.get("content-length"));
 		const buf = new Uint8Array(await res.arrayBuffer());

package/dist/insights/page-insights.d.ts

@@ -425,8 +425,6 @@ export interface PreloadMiss {
   crossorigin: string | null;
   /** the answer's `Vary` header, when the devtools read it (a font downloaded again) */
   vary?: string;
-  /** a hole the runtime asked for: the preload is ogygia's own (on any endpoint path) */
-  hole?: true;
 }
 export interface HoleWait {
   name: string;

package/dist/insights/page-insights.js

@@ -1197,21 +1197,20 @@ function analyze_page(page, regions, failures = [], now = Infinity, cpu = null)
 		};
 		const kb = (n) => n >= 1024 ? `${(n / 1024).toFixed(1)} KB` : `${n} B`;
 		const safari = !!page.browser?.startsWith("Safari");
-		const ours = (m) => m.type === "fetch" && m.crossorigin === "anonymous" && m.hole === true;
 		const safari_fetch = (m) => safari && m.type === "fetch" && m.crossorigin !== null;
 		const varies = (m) => !!m.vary && m.vary.toLowerCase().split(",").some((v) => v.trim() === "origin" || v.trim() === "*");
 		const safari_font = (m) => safari && m.type === "font" && m.crossorigin !== null && varies(m);
-		const why = (m) => safari_font(m) ? `its answer says \`Vary: ${m.vary}\`: ${page.browser} does not reuse a font preload that varies by Origin once the @font-face asking for it comes from a stylesheet added after the page parsed${page.dev ? " (on a dev server both are common: it answers every file with Vary: Origin and adds the page's CSS by script)" : ""}` : ours(m) ? `ogygia's own hole preload and its runtime's fetch match (crossorigin="anonymous", credentials same-origin)${safari ? `; ${page.browser} never hands a fetch preload to a later fetch() — whatever its crossorigin or Cache-Control — so it fetched the answer again` : ""}` : safari_fetch(m) ? `${page.browser} never hands a fetch preload to a later fetch(), whatever its crossorigin, credentials or Cache-Control: in Safari it is always a second download (Chromium uses it)` : m.type === "font" && m.crossorigin === null ? "a font always loads in CORS mode: its preload needs `crossorigin`" : m.type === "fetch" && m.crossorigin === null ? "a fetch preload needs `crossorigin` (`anonymous` for a same-origin `fetch()`, `use-credentials` for `credentials: \"include\"`)" : m.type === "fetch" || m.type === "font" ? `its \`crossorigin="${m.crossorigin}"\`${m.crossorigin ? "" : " (anonymous)"} does not match the request's credentials` : m.type === "script" ? "a module script is preloaded with `<link rel=\"modulepreload\">`, not `rel=\"preload\" as=\"script\"`" : "its `as` or `crossorigin` does not match how the page requests the file";
+		const why = (m) => safari_font(m) ? `its answer says \`Vary: ${m.vary}\`: ${page.browser} does not reuse a font preload that varies by Origin once the @font-face asking for it comes from a stylesheet added after the page parsed${page.dev ? " (on a dev server both are common: it answers every file with Vary: Origin and adds the page's CSS by script)" : ""}` : safari_fetch(m) ? `${page.browser} never hands a fetch preload to a later fetch(), whatever its crossorigin, credentials or Cache-Control: in Safari it is always a second download (Chromium uses it)` : m.type === "font" && m.crossorigin === null ? "a font always loads in CORS mode: its preload needs `crossorigin`" : m.type === "fetch" && m.crossorigin === null ? "a fetch preload needs `crossorigin` (`anonymous` for a same-origin `fetch()`, `use-credentials` for `credentials: \"include\"`)" : m.type === "fetch" || m.type === "font" ? `its \`crossorigin="${m.crossorigin}"\`${m.crossorigin ? "" : " (anonymous)"} does not match the request's credentials` : m.type === "script" ? "a module script is preloaded with `<link rel=\"modulepreload\">`, not `rel=\"preload\" as=\"script\"`" : "its `as` or `crossorigin` does not match how the page requests the file";
 		const wasted = misses.reduce((a, m) => a + m.bytes, 0);
 		findings.push({
 			code: "preload-unused",
 			severity: "warn",
 			message: `${list(misses.map((m) => `${file(m.url)} (${kb(m.bytes)})`))} ${misses.length === 1 ? "was" : "were"} preloaded, then downloaded again: the browser could not use the preload${misses.length === 1 ? "" : "s"}, and the page paid ${kb(wasted)} twice.`,
-			fix: `${[...new Set(misses.map(why))].map((w) => w[0].toUpperCase() + w.slice(1)).join(". ")}.` + (misses.every(ours) ? " Nothing in the page's markup to change: it is the hole preload ogygia writes, in a browser that never uses one." : [
-				misses.some((m) => !ours(m) && safari_fetch(m)) ? " No attribute changes a fetch preload in Safari: to start the request early there too, begin it in an inline script and hand its promise to the code that reads it — or drop the preload where Safari is most of the traffic." : "",
+			fix: `${[...new Set(misses.map(why))].map((w) => w[0].toUpperCase() + w.slice(1)).join(". ")}.` + [
+				misses.some(safari_fetch) ? " No attribute changes a fetch preload in Safari: to start the request early there too, begin it in an inline script and hand its promise to the code that reads it — or drop the preload where Safari is most of the traffic." : "",
 				misses.some(safari_font) ? page.dev ? " For the fonts: a build drops the dev server's habits (its CSS linked, its files answered by the host), so check whether the host also answers fonts with Vary: Origin and whether a stylesheet naming them is added by script." : " For the fonts: answer them without `Vary: Origin` (a font is the same whoever asks; a CORS header alone does not need it), or name them in a stylesheet the HTML links." : "",
-				misses.some((m) => !ours(m) && !safari_fetch(m) && !safari_font(m)) ? " The preload and the request must match exactly, or the browser fetches the file again." : ""
-			].join("")),
+				misses.some((m) => !safari_fetch(m) && !safari_font(m)) ? " The preload and the request must match exactly, or the browser fetches the file again." : ""
+			].join(""),
 			fps: []
 		});
 	}
@@ -1458,18 +1457,23 @@ function lcp_rivals(visit) {
 	const below = visit?.images_eager_below;
 	const p = visit?.paints;
 	if (!visit || !below?.length || typeof p?.lcp !== "number") return null;
-	const resources = visit.resources ?? [];
-	const res = p.lcp_url ? resources.find((r) => r.url === p.lcp_url) : void 0;
+	const by_url = /* @__PURE__ */ new Map();
+	for (const r of visit.resources ?? []) if (!by_url.has(r.url)) by_url.set(r.url, r);
+	const res = p.lcp_url ? by_url.get(p.lcp_url) : void 0;
 	const from = res ? res.req_start ?? res.start : visit.nav?.res_start ?? visit.nav?.res_end ?? 0;
 	const to = res ? res.end : p.lcp;
 	let bytes = 0;
 	const files = [];
+	const named = /* @__PURE__ */ new Set();
 	for (const i of below) {
-		const r = resources.find((x) => x.url === i.url);
+		const r = by_url.get(i.url);
 		if (!r || r.start >= to || r.end <= from) continue;
 		bytes += i.bytes;
 		const f = i.url.slice(i.url.lastIndexOf("/") + 1).split("?")[0];
-		if (!files.includes(f)) files.push(f);
+		if (!named.has(f)) {
+			named.add(f);
+			files.push(f);
+		}
 	}
 	return bytes ? {
 		bytes,

package/dist/insights/session-insights.js

@@ -422,7 +422,7 @@ function analyze_session(s, names, page_url) {
 	else if (e.name === "region.hydrate.conflict") findings.push({
 		code: "hydrate-conflict",
 		severity: "warn",
-		message: `${name_of(e.fp ?? null)}: ${e.reason ?? "a web component and Svelte wanted the same nodes"}`,
+		message: `${name_of(e.fp ?? null)}: ${e.reason ?? "a web component"} changed its own children where Svelte's hydration reads, so the repair removed what it added (render it with {@html}, put it in a lake, or mark it data-ogygia-keep).`,
 		refs: e.fp ? [{
 			kind: "island",
 			fp: e.fp
@@ -444,7 +444,7 @@ function analyze_session(s, names, page_url) {
 			refs: []
 		});
 	}
-	const errors = s.events.some((e) => e.name === "region.hydrate.failed") ? s.errors.filter((e) => !e.message.startsWith("console.error: [ogygia] hydration failed")) : s.errors;
+	const errors = s.events.some((e) => e.name === "region.hydrate.failed") ? s.errors.filter((e) => !(e.message.startsWith("console.error: OgygiaError: [ogygia] hydration failed") || e.message.includes("ogygiajs.dev/e/island_hydrate_failed"))) : s.errors;
 	if (errors.length) findings.push({
 		code: "errors",
 		severity: "error",

package/dist/internal-instruments.d.ts

@@ -1,5 +1,7 @@
 import { AttrChange, BeaconPage, beacon_page, beacon_record_cpu, hole_request_times, is_headless } from "./runtime/beacon.js";
 import { props_sidecar_of } from "./runtime/sidecar.js";
+import { import_again } from "./runtime/import-again.js";
+import { download } from "./policies.js";
 import { PAGE_SEED_SELECTOR } from "./runtime/seeds.js";
 import { paint_blocker } from "./runtime/render-blocking.js";
 import { RegionRefusal } from "./runtime/region-endpoint-url.js";
@@ -10,4 +12,4 @@ import { tool_fetch, tool_made } from "./tool-fetches.js";
 import { PAGE_DEFER_GLOBAL, PAGE_DEFER_KEY, PAGE_DEFER_REGISTRY_KEY } from "./page-defer.js";
 import { ISLAND_GRAPH_ATTR, decode_island_graph } from "./island-graph.js";
 import { UnscopedStyles, find_unscoped, unscoped_finding, unscoped_marker } from "./unscoped-css.js";
-export { type AttrChange, type BeaconPage, ISLAND_GRAPH_ATTR, PAGE_DEFER_GLOBAL, PAGE_DEFER_KEY, PAGE_DEFER_REGISTRY_KEY, PAGE_SEED_SELECTOR, REGION_RENDER_CONCURRENCY, type RegionRefusal, type UnscopedStyles, beacon_page, beacon_record_cpu, charge, decode_island_graph, find_unscoped, hole_request_times, is_headless, nearest_attr, own_cost, paint_blocker, props_sidecar_of, tool_fetch, tool_made, unscoped_finding, unscoped_marker };
+export { type AttrChange, type BeaconPage, ISLAND_GRAPH_ATTR, PAGE_DEFER_GLOBAL, PAGE_DEFER_KEY, PAGE_DEFER_REGISTRY_KEY, PAGE_SEED_SELECTOR, REGION_RENDER_CONCURRENCY, type RegionRefusal, type UnscopedStyles, beacon_page, beacon_record_cpu, charge, decode_island_graph, download, find_unscoped, hole_request_times, import_again, is_headless, nearest_attr, own_cost, paint_blocker, props_sidecar_of, tool_fetch, tool_made, unscoped_finding, unscoped_marker };